{
  "spec": "coderifts.proof-run.v1",
  "date": "2026-11-07",
  "started_at": "2026-11-07T13:24:39.365Z",
  "claims_source": "https://coderifts.com/.well-known/proof-claims.json",
  "claims_digest": "sha256:1ec3d8dd362fdbc572cd656ef752e727211c6c292d0a3e6ab6ed03e781bd43f2",
  "page": "https://coderifts.com/verify/",
  "website_commit": "c43dfc0c6a17bd5dc6a3c4d50d4c8f91c7e445b3",
  "website_commit_reason": null,
  "app_server_info": {
    "name": "CodeRifts",
    "version": "1.0.3",
    "websiteUrl": "https://coderifts.com"
  },
  "app_health_version": "1.0",
  "app_decision_spec_version": "2.0",
  "app_test_count": 8360,
  "app_commit": null,
  "app_commit_reason": "the app exposes no commit on any public surface — /health and MCP initialize both return a version string and no SHA. surface_source_ref_commit is the coderifts/api-governance commit that pins the published tools[], not the server build.",
  "surface_source_ref_commit": "c47da26724aea96ab542f98ac85cdc5131dad0e1",
  "environment": {
    "runner": "GitHub Actions 1000008529",
    "runner_os": "Linux",
    "github_run_id": "42376753882",
    "node": "v20.20.2",
    "python": "Python 3.12.3",
    "python_reason": null,
    "curl": "curl 8.5.0 (x86_64-pc-linux-gnu) libcurl/8.5.0 OpenSSL/3.0.13 zlib/1.3 brotli/1.1.0 zstd/1.5.5 libidn2/2.3.7 libpsl/0.21.2 (+libidn2/2.3.7) libssh/0.10.6/openssl/zlib nghttp2/1.59.0 librtmp/2.3 OpenLDAP/2.6.10"
  },
  "summary": {
    "total": 11,
    "verified": 10,
    "stale": 0,
    "drift": 1,
    "undecided": 0,
    "skipped": 0,
    "error": 0
  },
  "proofs": [
    {
      "id": "signed-decision",
      "verdict": "verified",
      "detail": "4/4 field(s) as documented",
      "ms": 204,
      "exit_code": 0,
      "output_digest": "sha256:1f33f24a7bf7ec6dd67e6d2cb8456f3689bd1e6d2ed13ed270425373b9654654",
      "output_bytes": 1455
    },
    {
      "id": "valid-not-authz",
      "verdict": "verified",
      "detail": "3/3 field(s) as documented",
      "ms": 145,
      "exit_code": 0,
      "output_digest": "sha256:a8a056183685040d8e14a6808134b653e7fc90dd6b18646c18d900b83eb87f70",
      "output_bytes": 582
    },
    {
      "id": "limits-as-data",
      "verdict": "verified",
      "detail": "3/3 expected string(s) present",
      "ms": 43,
      "exit_code": 0,
      "output_digest": "sha256:3d0b8eccc5f15498d613fe1110577528483074f41ddf8f9f5296257310f1f0f0",
      "output_bytes": 6460
    },
    {
      "id": "surface-selfcheck",
      "verdict": "verified",
      "detail": "two sources agree: sha256:75515f808619c378be5d30f8e13c7731b227f393985c5e2af38f42ef5cf7cd1f",
      "ms": 168,
      "exit_code": 0,
      "output_digest": "sha256:482c38bef05afad95e6aa1a5fa7030be1e8d8ad3560ca900c9b0ab4e16602527",
      "output_bytes": 143
    },
    {
      "id": "mcp-surface-lock",
      "verdict": "drift",
      "detail": "exit 2: {\n  \"schema\": \"coderifts.tools-check.v1\",\n  \"base\": {\n    \"file\": \"/home/runner/work/website/website/docs/evidence/mcp-surface/mcp-surface.lock.json\",\n    \"tools\": 3,\n    \"from\": \"lock\"\n  },\n  \"head\": {\n    \"file\": \"/tmp/mcp-surface-head-4VRkI5/tools-list.json\",\n    \"tools\": 3\n  },\n  \"outcome\": \"BREAKS_DETECTED\",\n  \"breaking_changes\": 1,\n  \"changes\": [],\n  \"grant\": null,\n  \"exit_code\": 2\n}\n",
      "ms": 38446,
      "exit_code": 2,
      "output_digest": "sha256:6147dfbea28a3b5554861afb6c7b0f9b73c85d0eb84388b92c6b3ab50052f239",
      "output_bytes": 393
    },
    {
      "id": "unknown-method",
      "verdict": "verified",
      "detail": "2/2 field(s) as documented",
      "ms": 114,
      "exit_code": 0,
      "output_digest": "sha256:fbfa23c146f063b943e34bd80d04e4442882a30c90e4555afded2ac8db308ddd",
      "output_bytes": 94
    },
    {
      "id": "guarded-table",
      "verdict": "verified",
      "detail": "1/1 expected string(s) present",
      "ms": 1962,
      "exit_code": 0,
      "output_digest": "sha256:7d3d3a0aef146e08c1b655c3f28c0b20c339f41a127b75f318ad9c2469d48e83",
      "output_bytes": 49
    },
    {
      "id": "one-grant",
      "verdict": "verified",
      "detail": "1/1 expected string(s) present",
      "ms": 660,
      "exit_code": 0,
      "output_digest": "sha256:864bb928a5a0c2286c05362b0ac1abc6eb39ffa230957710a85ba2339a67a114",
      "output_bytes": 48
    },
    {
      "id": "decision-branches",
      "verdict": "verified",
      "detail": "2/2 expected string(s) present",
      "ms": 620,
      "exit_code": 0,
      "output_digest": "sha256:d39c630138daf7606477d86a55e3abbf098ebbbcd1a7a1e640f75a513482148f",
      "output_bytes": 614
    },
    {
      "id": "reproduce-evidence",
      "verdict": "verified",
      "detail": "1/1 expected string(s) present",
      "ms": 773,
      "exit_code": 0,
      "output_digest": "sha256:9699e53b16c76da1ef825430adf2f1b329fac6775a006af7f4473998cb145b64",
      "output_bytes": 224
    },
    {
      "id": "analysis-is-not-permission",
      "verdict": "verified",
      "detail": "5/5 field(s) as documented",
      "ms": 323,
      "exit_code": 0,
      "output_digest": "sha256:7258ed86e02b652705f9c5191bc17cca2f80917de5e899942df558951359fe83",
      "output_bytes": 12272
    }
  ],
  "does_not_prove": [
    "That a reader ran these commands, or that they would get this on their machine. It records that THIS runner did, from THIS environment, on this date.",
    "That a verified proof is a correct claim. It is agreement between a live surface and a published expectation — both of which we wrote.",
    "Anything about a proof marked skipped. A rate limit or a DNS failure is not evidence in either direction, which is why skipped never moves a badge."
  ]
}