Vendored from the CodeRifts app repository (docs/policy-delivery.md) and drift-gated: an app-side test fails if this page and the source diverge. The character and paragraph counts below are verified against the published @coderifts/sdk, which is what an adopter actually installs.
Policy delivery — which artifact, for which adopter
The policy text is load-bearing, and that is measured: in our cross-host A/B, gpt-5.2 offered to deploy under a merge-scoped receipt when it saw only the MCP tool descriptions, while claude-sonnet-5 refused unprompted. The protocol text in the prompt is what closed that gap. So "which artifact does this adopter paste?" is a product question, not a formatting one.
One source, several carriers
src/agent-host-rule.js getCanonicalRuleText() is the single source. Everything below is generated or vendored from it and drift-gated — no carrier restates the rule in its own words.
| adopter path | artifact | how it is kept true |
|---|---|---|
| Claude Code project | CLAUDE.md | generated, --check drift gate |
| Codex / AGENTS.md hosts | AGENTS.md | generated, --check drift gate |
| Cursor | .cursor/rules/coderifts.mdc | generated, --check drift gate |
| GitHub Copilot | .github/copilot-instructions.md | generated, --check drift gate |
| LangGraph | coderifts-langgraph-policy.js | generated, --check drift gate |
| OpenAI Agents SDK | openai-agent-instructions.md | generated, --check drift gate |
@coderifts/sdk or the raw MCP endpoint | CODERIFTS_POLICY (exported constant) | vendored from the same canonical text, byte-equal, gated by test/policy-vendored-sync.test.js |
If you use the SDK or call the MCP endpoint directly
Do not paste a host file. AGENTS.md, CLAUDE.md and the rest are files for a specific host to read from a specific path; their wrappers say so. Import the constant instead:
import { CODERIFTS_POLICY, withPolicy } from '@coderifts/sdk';
// either: put the text in your system prompt yourself
const system = `${CODERIFTS_POLICY}\n\n${yourOwnSystemPrompt}`;
// or: the one-liner, which also warns once if the marker is missing
const messages = withPolicy(yourMessages);CODERIFTS_POLICY is byte-identical to getCanonicalRuleText() (4,362 characters, 21 paragraphs, measured). There is deliberately no seventh generated format for this path: a seventh file would be a second copy of text the SDK already exports, with a second thing to keep in sync and a new way to go stale.
Checking that it arrived
POLICY_MARKER — "A receipt authorizes ONE operation: a merge receipt does not authorize a deploy." — appears in every carrier above. policyPresenceOf(text) returns detected / absent / unknown by looking for it, and the guard warns once per process when a host supplies a prompt without it.
That check proves the text was present, not that the model read or obeyed it. Presence is the part we can measure; compliance is what the benchmark's baseline-vs-rules delta measures.
The skill channel — gap closed
The two shipped SKILL.md files (xAI plugin marketplace, gemini-cli-extension) were hand-written, carried 0 of the canonical paragraphs, and did not carry POLICY_MARKER — so a guard-instrumented host driven by either reported policy absent. They are now generated from this same source by the skill_md renderer and re-vendored, so both carry the marker and the operation-scope rule.
Vendored copies are re-synced from canonical by scripts/sync-vendored-policy.js; each consumer keeps its own drift gate, which is what proves the copy is current.