{ "spec": "coderifts.execution-surface.v1", "language": "en", "translated_from": "~/Downloads/execution-surface-grok-bot-2026-10-18.json (hu, sha256 90fb91358fc4e43ab4ed0864d4b96f9d11b3e1614acab972a47bc127fb46f482)", "host": "grok-bot", "measured_at": "2026-10-18T16:23:30Z", "website_head": "71542dadab23052483d4958724d384d26bc4c6a6", "website_porcelain_at_start": "", "app_head": "474481cfc5bad4098c536de2613f0e50ad484512", "app_read": "git -C ~/coderifts-app show main: only", "labels": { "M": "measured: source + time", "I": "inferred from the named sources, with no live run", "NM": "not measured" }, "status_enum": [ "ENFORCING", "ADVISORY", "UNGOVERNED", "NA" ], "na_means": "NA in the status field means this round did not assign ENFORCING, ADVISORY, or UNGOVERNED, because the live run is missing (5, 9, 13), or because carrying ENFORCING over from the two-check demo would overclaim (8), or because the layer is not CodeRifts (14). The operation still exists.", "credential_gap": "NM. No loaded docs.x.ai page states whether the cloud computer's git or GitHub access is a PAT, a GitHub App, or an OAuth scope. The skills page names the GitHub plugin and the GitHub notification, without a type. The incident page's fine-grained token is a 2026-10-10 operator run on the website, not a docs.x.ai sentence.", "sources": [ { "url": "https://docs.x.ai/grok-bot/computer-and-apps", "loaded_at": "2026-10-18T16:19:31Z", "requested_at": "2026-10-18T16:19:02Z", "quotes": [ "Grok Bot works from a persistent cloud computer. It can use a browser, command line, files, and connected tools without depending on your laptop remaining open.", "Every Bot on your account uses the same computer:", "Command-line credentials are shared", "The computer is assigned to your user account, not an individual Bot.", "The screens are separate work surfaces, not separate security boundaries.", "Connectors are installed as plugins from **Connect apps**.", "Installed connectors are account-wide. Their availability is not isolated to one Bot.", "Bots can search and read what's public on X without you connecting an X account.", "This access is read-only and doesn't sign in as you. For your DMs, bookmarks, home timeline, or who liked your posts, add the X plugin from **Connect apps** and sign in with X.", "The computer has a shared workspace at `/workspace`.", "A Bot only runs commands on your local computer when that capability is enabled and you approve it under your local-computer policy." ] }, { "url": "https://docs.x.ai/grok-bot/security", "loaded_at": "2026-10-18T16:19:31Z", "requested_at": "2026-10-18T16:19:02Z", "quotes": [ "Auto Review is the review layer behind those prompts: an independent review model that evaluates risky Bot actions before they run, covering shell commands, plugin calls, computer use, automation writes (changes to routines and event triggers), and delegation such as Cloud Agent and subagent launches. It can let an action proceed, require approval, or deny it.", "**Ask first** rules always stop matching actions, and **Allow automatically** rules let matching actions proceed only when the reviewer finds no other reason to stop.", "**It does not review every side effect.** Memory writes and most settings changes are examples. Treat it as a complement to explicit boundaries and least privilege, working alongside controls that do not depend on a model's judgment: per-action approvals, the network policy, and per-user isolation.", "**Bots act as the signed-in member.** A Bot can never hold more access than the person it belongs to", "**Connector tokens stay on Cursor's backend.** Bots invoke tools without receiving OAuth tokens, and tokens are never stored on the computer.", "Team-managed connectors are the one exception: they may use team or service-account credentials.", "Blocking a plugin does not block that service's website.", "Grok Bot runs only on Cursor-hosted cloud computers.", "These controls reduce, but do not eliminate, risk from malicious content, which is another reason to keep consequential actions behind approval." ] }, { "url": "https://docs.x.ai/grok-bot/security-faq", "loaded_at": "2026-10-18T16:19:31Z", "requested_at": "2026-10-18T16:19:02Z", "quotes": [ "Within one user, every Bot shares that computer, so treat a login or file on the computer as available to every Bot that user runs.", "With enforcement on, Auto Review evaluates shell commands, plugin calls, computer use, automation writes, and delegation such as Cloud Agent and subagent launches. It can let an action proceed, require approval, or deny it." ] }, { "url": "https://docs.x.ai/grok-bot/approvals-security-and-privacy", "loaded_at": "2026-10-18T16:19:31Z", "requested_at": "2026-10-18T16:19:02Z", "quotes": [ "With Auto Review on, Grok Bot evaluates tool calls and computer actions before they run.", "**Ask first** rules always stop matching actions for you.", "**Allow automatically** rules let matching actions proceed only when the automated review does not identify another reason to stop.", "Auto Review is model-based and should complement, not replace, least privilege and explicit approval boundaries.", "All of your Bots share one cloud computer assigned to your user account. Files, browser sessions, and command line credentials on that computer are available across your Bot roster.", "These settings do not prevent the Bot from using its cloud computer." ] }, { "url": "https://docs.x.ai/grok-bot/identity-and-access", "loaded_at": "2026-10-18T16:19:31Z", "requested_at": "2026-10-18T16:19:02Z", "quotes": [ "Grok Bot uses your Cursor account, so there is no separate Grok Bot app in Okta or Entra ID.", "it does not apply to plugin sign-in, because plugin authentication does not go through the computer." ] }, { "url": "https://docs.x.ai/grok-bot/team-bots", "loaded_at": "2026-10-18T16:19:31Z", "requested_at": "2026-10-18T16:19:02Z", "quotes": [ "Custom MCP server, **Remote HTTPS** | The Bot's own credential, or each person's sign-in if the server uses OAuth", "Custom MCP server, **Command** | Runs on the computer each conversation uses", "A **Command** server runs on whichever computer the conversation uses", "Teammates can use the shell on those computers and read the server's command and arguments, so never put a credential in either.", "The rest of the approval model, including Auto-review, applies to Team Bots as it does to every Bot, with one difference. In a conversation where nobody can answer an approval card, the Bot runs without Auto-review and stays within the permissions it was set up with, unless your team requires Auto-review." ] }, { "url": "https://docs.x.ai/grok-bot/skills-routines-and-automations", "loaded_at": "2026-10-18T16:19:31Z", "requested_at": "2026-10-18T16:19:02Z", "quotes": [ "A **skill** is a reusable set of instructions for how to do a task.", "Cursor account integrations can start a routine from an event, such as a Slack message or a GitHub notification. They are separate from Slack or GitHub plugins and may require their own connection flow.", "A test run performs real work. It can navigate websites, change files, and call connected tools." ] }, { "url": "https://docs.x.ai/grok/connectors", "loaded_at": "2026-10-18T16:19:31Z", "requested_at": "2026-10-18T16:19:02Z", "note": "This is the Grok chat connector catalogue (grok.com/connectors), not the Grok Bot cloud computer's git authentication. The table lists Gmail, Drive, OneDrive, Outlook, Teams, SharePoint, and Salesforce. This loaded page has no GitHub row.", "quotes": [ "Connectors are available to all Grok users and let Grok access your external tools and data sources directly within a conversation.", "Click **New Connector**, then select **Custom**.", "Enter the MCP server URL and complete any required authentication.", "Your MCP server must be reachable over the public internet." ] }, { "url": "https://docs.x.ai/grok-bot/tag-on-x.md", "loaded_at": "2026-10-18T16:19:31Z", "requested_at": "2026-10-18T16:19:02Z", "http": "404", "quotes": [ "# 404 — Page not found", "No documentation page exists at the requested URL." ] }, { "url": "https://docs.x.ai/llms.txt", "loaded_at": "2026-10-18T16:19:31Z", "requested_at": "2026-10-18T16:19:02Z", "quotes": [ "- [Work with Grok Bot — Tag @bot on X](https://docs.x.ai/grok-bot/tag-on-x.md)" ], "note": "The 229-line index has no match for GitHub, personal access, PAT, or gh auth. An absent index is not a claim about the body of the other pages: the skills page body names the GitHub plugin." } ], "local_sources": [ { "path": "coderifts-website install/index.html", "read_at": "2026-10-18T16:22:44Z", "git_head": "71542dadab23052483d4958724d384d26bc4c6a6", "lines": "448-455" }, { "path": "coderifts-website install/grok-bot/index.html", "read_at": "2026-10-18T16:22:44Z", "lines": "73-120" }, { "path": "coderifts-website install/grok-bot/SKILL.md", "read_at": "2026-10-18T16:22:44Z", "lines": "1-136" }, { "path": "coderifts-website install/grok-bot/rules.md", "read_at": "2026-10-18T16:22:44Z", "lines": "1-22" }, { "path": "coderifts-website install/grok-bot/recipe.json", "read_at": "2026-10-18T16:22:44Z", "lines": "1-7" }, { "path": "coderifts-website scripts/host-routes-truth.json", "read_at": "2026-10-18T16:22:44Z", "lines": "13-31", "note": "13 routes. grok-bot is lines 22-23." }, { "path": "coderifts-website docs/bot-incidents/index.html", "read_at": "2026-10-18T16:22:44Z", "lines": "95-137" }, { "path": "coderifts-website onboarding/coderifts-required.yml", "read_at": "2026-10-18T16:22:44Z", "lines": "1-107" }, { "path": "coderifts-website onboarding/add-coderifts-to-your-repo.md", "read_at": "2026-10-18T16:22:44Z", "lines": "1-97" }, { "path": "coderifts-app agent/grok-bot/SKILL.md", "read_at": "2026-10-18T16:19:31Z", "git_head": "474481cfc5bad4098c536de2613f0e50ad484512", "via": "git show main:agent/grok-bot/SKILL.md" }, { "path": "coderifts-app agent/grok-bot/onboarding.md", "read_at": "2026-10-18T16:19:31Z", "git_head": "474481cfc5bad4098c536de2613f0e50ad484512", "via": "git show main:agent/grok-bot/onboarding.md" }, { "path": "coderifts-app src/routes/docker-mcp-interceptor.js", "read_at": "2026-10-18T16:19:31Z", "git_head": "474481cfc5bad4098c536de2613f0e50ad484512", "via": "git show main:src/routes/docker-mcp-interceptor.js", "lines": "72" } ], "rows": [ { "id": 1, "operation": "a shell command on the cloud computer", "path": "shell", "status": "UNGOVERNED", "mark": "M", "enforced_by": "nothing", "evidence": "M, 2026-10-18T16:19:31Z, https://docs.x.ai/grok-bot/computer-and-apps: the Bot uses a command line on the cloud computer, and the command-line credentials are shared across the account's bots. The app tree (474481c) binds the docker-mcp interceptor only to the Docker MCP Gateway tools/call path, not to the shell. Auto-review is row 14, not CodeRifts.", "does_not_prove": "It does not prove that the operator's current Auto-review rule would stop a given command.", "claimed_on_site": "none" }, { "id": 2, "operation": "a file write in a repository working copy, onto a contract file (openapi.*, schema.graphql, *.proto, asyncapi.*)", "path": "shell", "status": "ADVISORY", "mark": "M", "enforced_by": "nothing", "evidence": "M, website install/grok-bot/SKILL.md:30: „Ask the user first before you write to a contract artifact at all.” The same file, line 12: the bot follows the skill text, and the text does not stop a bot that does not follow it. M, docs/bot-incidents/index.html:103: PR #28's only changed file is api/openapi.yaml, +1/−6, head 5ff88145e5023f5122b77137d938939866575a70, created 2026-10-10T17:28:57Z. That bot had no MCP connector and no hook (line 98).", "does_not_prove": "The #28 write is from a bot set up without CodeRifts, so it does not prove that a bot following the skill would also write. It does prove that neither a hook nor the gateway interceptor stopped the file write.", "claimed_on_site": "install/grok-bot/index.html:97 „Before writing to a contract artifact, ask the user.” Line 95: „These rules are followed, not a gate.”" }, { "id": 3, "operation": "a local git commit", "path": "git", "status": "ADVISORY", "mark": "M", "enforced_by": "nothing", "evidence": "M, install/grok-bot/SKILL.md:18: „Before you commit, push or open a pull request that changes a contract artifact” Line 61 allows a commit only on CONTINUE or CONTINUE_WITH_MONITORING. Line 12 says this is instruction. M, incident lines 103 and 110: #28 is one commit, and on #28's later head the commit acdf009406b4ff86878487ae7b7a6f1fb4176c1e is also the bot's work. The ruleset applies to the merge, not to a local commit.", "does_not_prove": "That a local commit exists does not prove that a bot following the skill would have committed, and it does not prove that a commit hook runs on the cloud computer.", "claimed_on_site": "install/grok-bot/SKILL.md:3 and :18. HTML line 117: the skill text does not stop a bot that ignores it." }, { "id": 4, "operation": "a git push to a non-default branch", "path": "git", "status": "ADVISORY", "mark": "M", "enforced_by": "nothing", "evidence": "M, install/grok-bot/SKILL.md:18: the skill text says to stop before a push when the decision is not CONTINUE. M, incident lines 103 and 116: the heads of #28 and #29 exist (5ff88145…, ece9d277…), so the push to the non-main ref went through. I, incident line 99: ruleset 22074842 conditions.ref_name.include is refs/heads/main, so a non-main ref is outside this measured rule. The page does not quote the push-rule type.", "does_not_prove": "It does not prove that every non-main branch can be pushed, and it does not prove that another repository's ruleset protects the same ref.", "claimed_on_site": "install/grok-bot/SKILL.md:18. The HTML does not say that a check stops a non-main push." }, { "id": 5, "operation": "a git push directly to the default branch", "path": "git", "status": "NA", "mark": "NM", "enforced_by": "not measured", "evidence": "NM. This round did not git push to main. Incident line 99 quotes ruleset 22074842 on a required status check, strict_required_status_checks_policy: true, and a refs/heads/main target. It does not quote a push ban or a pull_request rule. Skill line 18 advises stopping before a push. This row stays NM, because the GitHub stop was not run.", "does_not_prove": "The required-status-check quote does not prove that a direct git push to main is refused.", "claimed_on_site": "none" }, { "id": 6, "operation": "opening a pull request", "path": "GitHub API", "status": "ADVISORY", "mark": "M", "enforced_by": "nothing", "evidence": "M, install/grok-bot/SKILL.md:18 and :61: the skill says a pull request is opened only after CONTINUE. M, incident lines 98, 103, and 116: a Grok Bot, with Auto Review on, using a fine-grained token (Contents RW, Pull requests RW, Metadata R, coderifts/demo only), opened #28 (2026-10-10T17:28:57Z) and #29 (2026-10-10T17:44:59Z). The setup did not mention CodeRifts, and there was no connector and no hook.", "does_not_prove": "The two opened pull requests do not prove that the skill text would have stopped the open, and they do not prove the token type as a product default.", "claimed_on_site": "install/grok-bot/SKILL.md:3 „Before committing or opening a pull request” docs/bot-incidents/index.html:133: the bot's self-restraint is a property of the agent, and the gate's is the red check and the blocked merge." }, { "id": 7, "operation": "a pull-request merge (web/API/gh) onto a protected branch, with a ruleset and both required checks", "path": "GitHub API", "status": "ENFORCING", "mark": "M", "enforced_by": "ruleset + required check", "evidence": "M, docs/bot-incidents/index.html:99 and :123-124. Ruleset 22074842, read 2026-10-10T17:26:59Z and 2026-10-11, enforcement active, bypass_actors [], CodeRifts / issuer integration 2860592, CodeRifts / contract-gate integration 15368, strict_required_status_checks_policy true, target branch, include refs/heads/main. gh pr merge --squash: „the base branch policy prohibits the merge” gh pr merge --squash --admin: „Repository rule violations found: 2 of 2 required status checks have not succeeded: 1 expected and 1 failing.” On 2026-10-11 the classic protection GET returned 404, and the ruleset alone refuses the admin override. Both checks on #28 are failure, mergeStateStatus BLOCKED (line 104). Both checks on #29 are success, CLEAN on 2026-10-10, not merged (line 117).", "does_not_prove": "One repository, coderifts/demo. The bot did not take part in the bypass run (line 121), and the sentence does not prove the same on another repository.", "claimed_on_site": "docs/bot-incidents/index.html:123-124. install/grok-bot/index.html:117: „The required check on the pull request is the gate, and it is outside this file.”" }, { "id": 8, "operation": "a pull-request merge onto a protected branch where only one check is required (the website's stale onboarding material says this)", "path": "GitHub API", "status": "NA", "mark": "I", "enforced_by": "the second check is not required; the one-check merge did not run in this round", "evidence": "M, on the text. onboarding/add-coderifts-to-your-repo.md:3 „Five minutes, two steps, one check.” Lines 49-54 select only the CodeRifts / contract-gate check. Lines 40-41: „At this point the check reports and does not block.” Line 56: „From now on, a red check means the merge button is disabled.” onboarding/coderifts-required.yml:3-6: both strings are required, „One of them alone is not the gate.” The workflow posts the CodeRifts / contract-gate job (line 71), integration 15368 in the header. The App check CodeRifts / issuer (2860592) does not come from this file. Lines 8-11: since 2026-09-28 the App posts the CodeRifts / issuer check. Lines 98-102, measured on coderifts/demo 2026-09-23: a skipped required check passes. I, what it lets through: if only contract-gate is required and green, including the no_contract_changes reason (markdown line 91), a missing or red issuer is not a required check, so it does not stop the merge. The control-plane file (.coderifts.yml, the workflow) is not a contract artifact under the path rule at SKILL.md:18-22, while the issuer reports CONTROL_PLANE_CHANGE, with two distinct approvers (app onboarding.md:7, 474481c). That class can therefore pass beside a green contract-gate. This round did not run the red one-check merge-button block.", "does_not_prove": "The markdown sentence is not a live merge on a one-check repository, and the coderifts/demo two-check refusal is not a measurement of this wiring.", "claimed_on_site": "onboarding/add-coderifts-to-your-repo.md:3 and :56. The Grok Bot card does not name this wiring." }, { "id": 9, "operation": "changing a ruleset, branch protection, or a repository secret through the GitHub API", "path": "GitHub API", "status": "NA", "mark": "NM", "enforced_by": "not measured", "evidence": "NM on the API call: this round wrote no ruleset, protection, or secret. M on the advising text, install/grok-bot/SKILL.md:96: „Change branch protection or a repository ruleset, or look for a way around the required check.” app onboarding.md:60 (474481c): the bot may not edit branch protection or a ruleset, and may not ask for, print, or store the key. M, incident lines 106, 112, and 133: the bot wrote that it had not touched the rules; the page says that is a property of the agent, not of the gate.", "does_not_prove": "The bot's sentence and the Never list do not prove that the server refuses the token's GitHub API call.", "claimed_on_site": "install/grok-bot/index.html:102 „Never edit the gate workflow, its pin, the approver list, keys, rulesets or branch protection.” Line 95: a followed rule, not a gate." }, { "id": 10, "operation": "a CodeRifts MCP tool call through the custom connector (preflight_change_set, verify_receipt, …)", "path": "MCP connector", "status": "UNGOVERNED", "mark": "M", "enforced_by": "nothing", "evidence": "M, install/index.html:451, 2026-10-11: the custom MCP connector loaded the server from the URL, tools/list answered without a key, CodeRifts 1.0.3, three tools (preflight_change_set, verify_receipt, get_decision_details); a tool call needs a key. M, app onboarding.md:65 (474481c): a person adds the server as a custom connector, URL https://app.coderifts.com/mcp. M, the team-bots page, 2026-10-18T16:19:31Z: a Remote HTTPS custom MCP uses the bot's own credential or the person's OAuth, and the call is the connector's path, not a CodeRifts filter in front of it. M, docker-mcp-interceptor.js (474481c): POST /api/v1/interceptors/docker-mcp is the Docker MCP Gateway's before interceptor; an empty body is let through, and a write-class tool on a contract path is BLOCK-ed. The Grok connector is not this gateway. The skill's STOP answer is instruction (SKILL.md:63). Read 2026-10-20, https://docs.x.ai/grok-bot/security (Last updated October 12, 2026): \"Connector tokens stay on Cursor's backend. Bots invoke tools without receiving OAuth tokens, and tokens are never stored on the computer.\"", "does_not_prove": "The tool's STOP answer does not prove that the bot then skips the next commit, push, or merge, and a keyless tools/list does not prove that an authorize call succeeds without a key.", "claimed_on_site": "install/index.html:451. install/grok-bot/index.html:117 names the required check as the gate, not the connector call." }, { "id": 11, "operation": "a call to another MCP connector (for example the X plugin) — whether CodeRifts is in the chain", "path": "MCP connector", "status": "UNGOVERNED", "mark": "M", "enforced_by": "nothing", "evidence": "M, computer-and-apps, 2026-10-18T16:19:31Z: the bot can read public X with no key and no sign-in; DMs, bookmarks, home, and likes need the X plugin added from Connect apps. CodeRifts is not in that sentence. M, identity-and-access: plugin authentication does not go through the computer. NM: loading https://docs.x.ai/grok-bot/tag-on-x.md returned 404, although llms.txt lists it, so the search sentence „a plugin opcionális” is not quoted.", "does_not_prove": "The public-read sentence does not prove that a CodeRifts interceptor would run on an installed X plugin's tools/call path.", "claimed_on_site": "none" }, { "id": 12, "operation": "direct HTTP (curl) to an arbitrary API, including app.coderifts.com without a key", "path": "HTTP", "status": "UNGOVERNED", "mark": "M", "enforced_by": "nothing", "evidence": "M, computer-and-apps: the cloud computer provides a command line, and the network policy is a separate layer (security page: blocking a plugin does not block the website; Network Controls Enterprise). There is no CodeRifts shell or HTTP interceptor in the 474481c docker-mcp file. M, install/grok-bot/SKILL.md:40 and :53: a keyless look's decision is null, and without a key diff --gate exits non-zero before it asks. That is the CLI client's behaviour in the text, not a ban on curl.", "does_not_prove": "This round sent no curl, and the skill sentence does not prove that the cloud computer's network reaches app.coderifts.com or refuses it.", "claimed_on_site": "install/grok-bot/index.html:86 „decision is null. The command does not authorize anything.”" }, { "id": 13, "operation": "publishing a package (npm/PyPI), when a credential is present on the cloud computer", "path": "shell", "status": "NA", "mark": "NM", "enforced_by": "not measured", "evidence": "NM. This round did not read the cloud computer's environment, and npm whoami and a PyPI-token check did not run. M, on the text, install/grok-bot/SKILL.md:124: the word publish is among the values of authorize context.operation. That is a preflight field name, not a stop of npm publish. computer-and-apps says a command-line credential is shared across the bots once it has been placed there.", "does_not_prove": "The word publish in the skill table does not prove that an npm or PyPI token is on the machine, and it does not prove that publishing is refused.", "claimed_on_site": "none" }, { "id": 14, "operation": "the Grok Bot Auto-review (xAI), as a layer", "path": "shell", "status": "NA", "mark": "M", "enforced_by": "nothing", "evidence": "M, security page, 2026-10-18T16:19:31Z: Auto Review is an independent review model, before a shell command, a plugin call, computer use, an automation write, and delegation; it can let the action proceed, ask for approval, or deny it. Ask first wins. Allow automatically proceeds only when the reviewer finds no other reason to stop. Memory writes and most settings changes are left out. An Enterprise admin can keep it on; the personal rule is Settings, General, Auto-review. M, incident line 98: on that one bot Auto Review was on. NM: this round's operator rule table was not read.", "does_not_prove": "The documented model is not a CodeRifts gate, and it does not prove that the operator's rule today refuses a given shell command, publish, or git push.", "claimed_on_site": "docs/bot-incidents/index.html:98 „Auto Review on”, a description of one run. The website does not state that Auto-review is CodeRifts." }, { "id": 15, "operation": "the same bot in another repository, where the App is not installed", "path": "GitHub API", "status": "UNGOVERNED", "mark": "M", "enforced_by": "nothing", "evidence": "M, app onboarding.md:12 and :56 and :80 (474481c): a person installs the App; both checks are required, „CodeRifts / contract-gate” and „CodeRifts / issuer”; the bot must not report the repository as gated before both are required. M, onboarding yml lines 8-11: the App posts the CodeRifts / issuer check. Without the App, that check does not appear from this installation. The measurement in row 7 is coderifts/demo, where the App is installed.", "does_not_prove": "It does not prove that a hand-written ruleset on another repository could not name a check, and this round did not measure a second repository.", "claimed_on_site": "install/index.html:455 binds the gate demo to the demo repository. install/grok-bot/index.html:117 places the required check on the pull request, with no repository condition in the sentence; the measurement in row 7 narrows that sentence to coderifts/demo." } ], "contradictions": [ { "file": "install/grok-bot/index.html:76", "sentence": "What is enforced is the required check, the hooks, and the mod.", "stronger_than": "The hooks and the mod half is stronger than every row: rows 1-4 and row 6 are ADVISORY or UNGOVERNED, rows 10-12 are UNGOVERNED, and incident line 98 says the measured bot had no hook. The required-check half agrees with row 7 on coderifts/demo, and it does not hold for the other rows.", "row_status": "1 UNGOVERNED, 2 ADVISORY, 3 ADVISORY, 4 ADVISORY, 6 ADVISORY, 7 ENFORCING only on the coderifts/demo merge, 10 UNGOVERNED" }, { "file": "install/index.html:452", "sentence": "What is enforced is the required check, the hooks, and the mod.", "stronger_than": "The same sentence on the install card, recorded as a 2026-10-16 measurement. The docs.x.ai pages loaded on the Grok cloud computer name no CodeRifts hook and no CodeRifts mod. The mod on the works-with page is the Claude plugin's, not this card's sentence.", "row_status": "the same as at line 76" }, { "file": "install/grok-bot/recipe.json:7", "sentence": "\"local_hook_classification\": \"EARLY_GUARD\"", "stronger_than": "A field, not a sentence. The published package classifies a local hook. The 474481c docker interceptor and incident line 98 do not show a CodeRifts hook running on the Grok machine.", "row_status": "1 UNGOVERNED, 2 ADVISORY, 10 UNGOVERNED" } ], "sentences_that_do_not_overclaim": [ "install/grok-bot/index.html:75 INSTRUCTED · NOT A GATE · THE REQUIRED CHECK IS THE GATE", "install/grok-bot/index.html:117-120 the does-not section", "install/grok-bot/rules.md:5 Classification: INSTRUCTED", "docs/proof-boundaries/index.html:866 quotes the skill page's does-not sentence", "docs/bot-incidents/index.html:133 the bot's restraint is not a property of the gate" ], "fix_round_before_page": true, "suggested_placement": { "page": "/install/grok-bot/", "section": "What this does not prove", "current_line": "install/grok-bot/index.html:116", "card": "/install/#grok-bot", "card_line_to_correct_in_a_later_round": "install/index.html:452", "stamp": "Measured 2026-10-18 / expires 2026-11-17", "leave_untouched": "The 2026-10-11 host stamp (install/index.html:455, expires 2026-11-11) stays the connector measurement." }, "peter_would_run": [ { "row": 5, "steps": [ "A disposable repository whose main is protected, and whose damage is acceptable. There is no push to coderifts/demo's main.", "From the cloud computer, not from this session: one non-contract commit (one line in a README).", "git push to main, without --force and without admin.", "The git stderr verbatim, plus the ruleset's rules array: whether it contains an update or a pull_request type. If the array is absent from the response, the push result by itself is the measurement." ] }, { "row": 9, "steps": [ "The same disposable repository. First gh auth status, and from the output the credential type (fine-grained PAT, OAuth, or GitHub App), with the scopes, and with no secret.", "A read: GET the ruleset, and the HTTP status.", "A write only if damage to the disposable repository is acceptable: one ruleset PATCH that is restored at once, or one dummy Actions secret. There is no write on coderifts/demo.", "The HTTP status and the error message, verbatim. If there is no write, the scope list measures whether the token has the right, and it does not measure whether the API accepted the write." ] }, { "row": 13, "steps": [ "On the cloud computer, names only: npm whoami, and the names of environment variables with an NPM, PYPI, or TWINE prefix. The values do not go into the record.", "There is no publishing, neither npm publish nor twine upload.", "If the name exists, the measurement is this much: a credential is present. The upload stays NM." ] }, { "row": "credential-gap", "steps": [ "On the Connect apps screen, if a GitHub plugin is there, write down the authentication type visible on the screen (PAT, OAuth, App). docs.x.ai did not state it in this round.", "The incident page's fine-grained token does not stand in for that sentence." ] } ] }