From keyless discovery to receipt-gated governance
Use this four-step ladder to see what each level can answer, what it cannot yet do, and the exact next move.
Keyless screen
Inspect one public spec without an account
The public preflight is a single-spec hallucination and quality pre-screen. It is a documented GET call with a url parameter.
GET https://app.coderifts.com/api/v1/public/preflight?url=https://petstore3.swagger.io/api/v3/openapi.jsonWhen cache_status is MISS_NOT_ANALYZED or MISS_SPEC_CHANGED, the response is PENDING with retry_after (seconds). Poll the same GET until cache_status is HIT.
What you can do here
Run the quality pre-screen and handle its documented pending retry state until the cache is HIT.
What you cannot yet do
It returns ALLOW/WARN only. It has no execution_action receipt gate and is not breaking-change or change-set governance.
Exact next move
Get an API key before moving to an operation-bound authorize preflight.
Get a key
Move from public inspection to authenticated preflight
Obtain an API key through the public signup page. This is a human step.
What you can do here
Obtain the key needed to use authenticated preflight paths.
What you cannot yet do
The public discovery document does not describe a signup request contract. This page does not infer one.
Exact next move
Use the authenticated authorize path for the operation you intend to govern.
Authorize preflight
Ask for an operation-bound decision
Authorize is operation-bound and may mint a receipt. Branch on execution_action: CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, or STOP.
What you can do here
Use the proceed or halt signal for an authorize response, with the decision as its explanation.
What you cannot yet do
Analyze is never permission. An execution_action by itself is not permission either; downstream gates verify receipts conjunctively.
Exact next move
Pass the issued receipt to a verifier and require the conjunctive checks before an acting path proceeds.
Verify the receipt
Use the portable verification pointers
Portable verification is supported with Ed25519. The public discovery document provides the key registry, public key, receipt format, and reference verifier.
What you can do here
Verify a receipt with the published portable-verification resources.
What you cannot yet do
Receipt possession is not permission. Verification remains conjunctive: receipt presence, current authorization, operation match, fingerprint match, and an allow-class execution_action all matter.
Exact next move
Have the merge, deploy, or runtime gate verify the receipt before it acts.