# External measurements 2026-09-26

summary: Website-side index. Two doc bugs re-measured here. Gemini timing, the doc-smoke table, and the Claude Code stage numbers were not in a file this session could read, so they are not re-stated as results.

## Re-measured here

| Probe | Result | Source |
|---|---|---|
| `https://coderifts.com/.well-known/coderifts-keys.json` | HTTP 404, no redirect | curl 2026-09-26 |
| `https://app.coderifts.com/.well-known/coderifts-keys.json` | HTTP 200 | curl 2026-09-26 |
| PyPI `coderifts-verifier` | HTTP 404 | `https://pypi.org/pypi/coderifts-verifier/json` |
| PyPI `coderifts-sdk` | HTTP 200 | `https://pypi.org/pypi/coderifts-sdk/json` |
| `python3 receipt-verifier/verify.py` after `git clone --depth 1` | exit 0 in 0.326 s, status VERIFIED_CURRENT, on a keyless action-verdict receipt | this machine, 2026-09-26 |
| `POST /api/v1/preflight` `preflight_mode` analyze | HTTP 200, `engine_build_id` `b235243e45e6`, `may_execute` false | live app |
| `GET /api/v1/public/preflight` | HTTP 200, `engine_build_id` absent | live app |
| `tools/list` | three names: `preflight_change_set`, `verify_receipt`, `get_decision_details` | `POST https://app.coderifts.com/mcp` |
| `does_not_prove` | 7 on the vendored file and on `app.coderifts.com/.well-known/coderifts.json` | both |
| `GET /api/v1/score-mcp` | keys include `signals` and `score`; no `breaking_changes` array | live app, manifest `https://coderifts.com/mcp.json` |
| `.cursorrules` on this site | 0 occurrences | grep |
| `init --agents` file list | 9 embedded host files plus 3 MCP configs plus the workflow = 13 | `packages/cli/src/agent-host-files.embedded.js` (read only) |
| Guard outcome shape | `outcome.executed` and `outcome.verdict.action` (`STOP` when `kind` is `BLOCK`). No `verdict.executionAction` | `coderifts-agent-guard/src/types.ts` lines 300–380 |

## Named by the assigning brief, not re-run here

The brief names a Gemini cold quickstart of 3.5 minutes that found the keyring-host bug and the unpublished pip package, a doc-smoke table, and four Claude Code stages (plugin marketplace add, plugin list, agent-hooks, and the CLI rows including conformance 16/16). No file in Downloads, this repository, or the app evidence directory held those stage timings or that smoke table. They are not copied in as numbers. The install-page stamps that say `measured 2026-09-26 (external run)` attribute those runs to that hand and say this page did not re-run them.

The CC-2 IV/2 evidence file is the app side. It is not copied here. App `git log -1` on 2026-09-26 was not an IV/2 subject, and the website surface-anchor check still pinned `sha256:2d8c75c5…`.