Documentation
Four things you might be here for: to check a claim, to wire the gate into something, to read the decision format, or to look up a term.
Verify a claim
Start here if you want to check something rather than read about it.
- Claim table What we assert, and the command that settles each one
- Proof boundaries What every decision does not prove
- Bot incidents What the gate did when an agent pushed a breaking change
- Format coverage the rows dated 2026-10-04
- What each path does The four paths, and what each one can and cannot say
- The guards Every automated check on this site, what it measures, when it runs, and how many planted defects it is tested against
- Portable verification Verify a receipt offline, with no account
- Platform truth table Which artifact version is current, generated
- Execution attestations What the attestation covers
- Execution proof Why a proof the caller may skip is not a gate
Format coverage
Format coverage, read 2026-10-04, CLI 8.7.0: incomplete authorize analysis is ANALYSIS_FAILED and STOP, with the gap named. Webhook direction on OpenAPI 3.1 is inverted. Callbacks and external or remote $ref fail closed the same way. 3.1 is read as written. GraphQL nullability is directional and the input crash is gone. AsyncAPI 3 send and receive are the two sides. A gRPC option block parses and an http route change breaks. MCP resources, prompts, and taskSupport stop at REQUIRE_APPROVAL because they are not diffed.
| Format | Read 2026-10-04 |
|---|---|
| OpenAPI 3.1 | An OpenAPI 3.1 webhook is diffed in the inverted direction, so authorize returns ANALYSIS_FAILED and STOP with the gap named. A changed or removed callback, or a switched or removed external or remote $ref, is the same decision. A 3.1 spec is diffed as written, the 3.0.3 conversion runs only when oasdiff did not answer, and dependentRequired is REQUIRE_APPROVAL with one breaking change. |
| GraphQL | A GraphQL input type no longer crashes the diff. Nullability follows direction: output T! to T is a break, output T to T! is not, an input or argument T to T! with no default is a break, and an input or argument T! to T is not. |
| AsyncAPI 3 | AsyncAPI 3 top-level operations are diffed. send is the response side: a removed field is a break and a new required field is not. receive is the request side: a new required field is a break and a removed field is not. |
| gRPC | A gRPC service with an option block parses. A google.api.http route that is removed or changed is a break (HTTP_BINDING_CHANGED). A new google.api.http route is not a break (HTTP_BINDING_ADDED). A removed RPC on that service is REQUIRE_APPROVAL with one breaking change. |
| MCP manifest | A removed MCP resource, a resource template, a removed prompt, a prompt argument made required, or execution.taskSupport moving from optional to required is REQUIRE_APPROVAL with zero breaking changes, pattern MCP_SURFACE_NOT_ANALYZED. Diffing those surfaces is not built. |
Wire it in
The gate runs where your agent runs. Pick the host.
- Install All entry points, one page
- MCP server The remote surface, three tools
- Agent quickstart The guarded tool table in an existing agent loop
- Agent frameworks LangGraph, and what the adapter does not see
- GitHub App GitHub Actions GitLab CI Bitbucket Pipelines
- REST API CLI VS Code Backstage
The decision
What comes back, and what it means.
- Decision spec The envelope, field by field
- How agents use this Reading a decision from inside an agent
- Remediation transaction what a BLOCK hands back, and why re-submitting the same input is still a BLOCK
- Execution grants what authority was issued, and what the grant does not prove
- Decision predicate four fields the Action copies off a verified receipt
Enforcement & policy
What turns a decision into a refusal.
- Deploy gate Gating a deploy on a signed preflight receipt
- Enforcement status What "enforced" means here, when it is not verified, and what VERIFIED means per provider — three providers, three different guarantees, in their own words
- Contract lock coderifts.lock, and the four exit codes
- Policy delivery Where policy lives, and why not in the prompt
- If you already use oasdiff The check oasdiff posts, and the receipt that runs beside it
- Repo policy files .coderifts.yml can fail a check; api-policy.yaml is a PR comment — accepted keys measured from the running parser
- MCP tool poisoning the attack a redefined tool runs, with a benign and a poisoned pair side by side
- MCP poison gate escalate-only — it can raise a verdict to REQUIRE_APPROVAL, and it never lowers a BLOCK
- Provider canary what a provider actually enforced, captured as an artefact
Reference
Format explainers, tool comparisons and background reading. Nothing here gates a change — the pages that do are above.
What we store and for how long: data retention.
During the public beta every organization gets Team features at $0 with a self-serve key, public and private repositories alike, no separate Team key to request, and each key allows 1,000 requests a month: after that, /preflight authorize returns BETA_LIMIT_REACHED while its analysis keeps working; other API routes return 429.