A — Tool-call binding
The grant binds the canonical tool-call bytes, so what-was-called equals what-was-authorized — closing prompt-injection and argument-drift. Not available.
CodeRifts · claim table · two blocks, never mixed
What is a gate today, and what is only direction
The left block is enforced today. The right block is the roadmap — planned or on request, never available. They are not one table. A roadmap row is not a proof.
The done gate is exactly grant + consume + target-state + offline-verify. Roadmap items (tool-call binding, the evidence bundle, delegation attenuation, the TRACE bridge) are listed so they cannot be read as shipping.
Enforced today
Done · enforcedFail-closed authorization-execution gate
One grant binds authorize → consume → target-state transition → offline readback. A mutating tool cannot be assembled into the agent’s table without a guard client: guardToolRegistry fails closed at construction time. Verifiable offline. No provider-witness. No TEE.
Boundary: binds names the chain the grant spans, not an attestation that the consume happened. Single-use is a property of the consuming enforcement path, not of the signed grant. The shipped guard does not attest nonce consumption; the panels that record a consume are a pinned ATOMIC_COMMIT transcript, not a live guard run. See what makes a grant single-use and what COVERED means.
Where the CodeRifts App check is configured as required for the target branch and bound to the issuing App, the check is red without this receipt. That is the product.
Offline Python, beside the clone: git clone --depth 1 https://github.com/coderifts/receipt-verifier and pip install coderifts-verifier (Python 3.10+).
This is what VERIFY.md proves on a stranger’s machine, and what the published packages enforce.
Public chain, generated from atomic-stack.json — the release manifest the app writes and this site vendors, so these four numbers have one source and cannot go stale on their own: @coderifts/prove@0.1.13 · @coderifts/conformance@0.8.11 · coderifts-sdk 3.8.2 (Python, PyPI) · coderifts 8.8.0. They were hand-typed until 2026-09-23, and on that morning three of the four were stale (prove 0.1.12, coderifts-sdk 3.8.1, coderifts 8.6.3) against a line that said it had read them on 2026-09-15. A version written by hand into a page is a claim with a date on it.
Replay: npx @coderifts/conformance@0.8.11 --assurance END_TO_END
Roadmap (planned / on-request)
None of these rows carries a proof claim on this site. Three are direction only. The evidence bundle is built and tested, but the gate that consumes it is not published — so it stays here until a stranger can run it.
F — Cross-domain evidence bundle
cr.bundle.v1 carries eight slots — receipt, execution grant, toolset declaration, commit attestation, nonce commitment, merge evidence, deploy attestation, provider evidence — as one offline-checkable file. It introduces no new digest and no new key handling: the anchor is the receipt_digest the grant already binds, so nothing already issued moves.
Proves: that the slots present in one bundle belong to one run, and that the grant binds that run’s receipt. An ABSENT slot is a statement about scope, never a pass — an all-absent bundle is refused, not green.
Does not prove: anything the individual tokens did not already prove — the bundle re-presents them, it does not add a guarantee. And it is not publicly verifiable today: the merge gate that consumes it ships in a private package, and npx @coderifts/prove does not exercise it. Verified by 45 passing tests in receipt-verifier, vendored byte-identically under a pinned VENDOR.sha256.
C — Agent-to-agent delegation attenuation
A downstream agent receives a strictly narrower grant than the caller held. Not available.
TRACE bridge
Authorized-intent equals the CodeRifts receipt-digest, so a TRACE-shaped intent can be checked against the same receipt. Intent / on request. Not available.