What each proof proves — and what it does not

Asserts: these calls went through the gate.

Does not assert: that the calls we never saw went through it. The gate observes what is routed to it; anything a host invokes outside the returned tool table is invisible to this level.

Asserts: here is the target’s history set against the grants we issued, and here are the exceptions.

Does not assert: that an exception is benign, or that the history we read is complete. It names differences; a human still judges them.

Asserts: probe results, dated and pinned to the versions they were measured against.

Does not assert: that a clean run means no bypass exists, and not that the host cannot reach the target. The probe searches the host for unmediated paths, so its strongest possible result is “none of these classes found one here”. Whether the host is excluded from writing at all is a property of the target-side permission model, which the probe does not inspect and cannot infer from its own silence. It covers the probe classes it ran, in the process it ran in, against the versions named in the report — and it says so in its own output.

Asserts: for the tool set with this digest, every entry declared mutating is wrapped by the guard. The host signs the declaration; we co-sign that it is internally consistent.

Does not assert: that every tool which can mutate a governed target is in the declaration. We co-sign the consistency of what was declared, not its truth. If the host omits a mutating tool, the attestation is still internally valid and still wrong — and the host, not CodeRifts, is accountable for that omission. This is the narrow reading, and it is the only one we make.

Proves: “fresh and replay say the same thing.” “The hash therefore proves equivalence over what a replay carries, not over the full analysis tier.”

Does not prove: identity of the input bundle or scoring config (that is a different fingerprint); verbatim equality of receipt tokens; that timestamps, correlation ids, retrieval packaging, or analysis-tier sections omitted on replay are the same.

Proves: “Count proves: N distinct login strings on the list (not N real people).” “Membership proves: subject was on the supplied list at evaluation time.” “Identity: approved_by is the reviewer's GitHub login. Proves GitHub asserts this account approved a commit SHA — not that the account holds any org role.”

Does not prove: “It does NOT prove the list is correct, current, or authorised by anyone.” “Distinctness is login-string only — one person with two accounts defeats this; the code does not claim otherwise.” Approval is never “safe”: the machine verdict is unchanged (“authorized to proceed despite machine verdict”).

Proves: “The gate is suppressed only on the full happy path: the token verifies against a registry-trusted kid AND its payload.scope is user_authorization AND payload.tool matches the request tool (or is *) AND payload.op is among the request capabilities.” For source attestation: attested is true “ONLY on the full happy path” of trusted signature plus content binding to the transmitted data.

Does not prove: “Every other case — absent, malformed, unknown kid, bad signature, wrong scope, tool or op mismatch — behaves EXACTLY as if no evidence were supplied (fail-closed).” “A suppressed A1 gate does not disable the other gates: an input that also triggers a data-laundering gate still lands on BLOCK.” Replay of the same evidence re-authorizes the same action; it is request-bound, not single-use, and is not a clock-expiry proof. A fingerprint-bound policy waiver “does not apply” when the current fingerprint is absent or mismatched (fail closed on binding). Engine-verdict approval is a different claim from a policy waiver and “does not rewrite the machine verdict.”

Proves: a later omission against a host-submitted commitment is detectable. Self-consistency of submitted artifacts against that commitment.

Does not prove: “A cryptographic commitment does NOT prove the host sent every changed file.” “Mode ATTESTED_UNVERIFIED always carries both words; not a proof.” Never a boolean completeness:true on the generic path.

Proves: cryptographic authenticity of a receipt you already hold, and — when lifecycle is evaluated — whether it is currently valid authorization for a stated operation and target. “You must distinguish ‘signature ok’ from ‘currently authorized’.”

Does not prove: a new decision on a changed base→head set (verify_receipt does not re-diff). “A differently-scoped receipt is not reusable authorization.” Receipt TTL answers only “how long is this permission valid?” — it is not freshness or content-identity; a still-unexpired receipt still fails closed if authorized content drifted.

Proves: the closed set CONTINUE, CONTINUE_WITH_MONITORING, REQUEST_APPROVAL, STOP is the branch key. A known continue-valued action is a necessary condition, never a sufficient one.

Does not prove: “An unrecognised execution_action is not permission: fail closed (halt or re-preflight).” Do not branch on decision or safe_for_agent. Additive / unknown envelope fields are tolerated for validation; they are not permission. Analyze mode is informational risk only (may_execute: false) — not permission.

Proves: structured remediation guidance the agent may follow after a non-CONTINUE decision.

Does not prove: permission to act. “next_agent_step is suggestion, not permission.” Agents still branch on execution_action.

Proves: this preflight evaluates the change only.

Does not prove: “CodeRifts reports a governance decision and execution_action; it does not by itself block merges. Blocking requires separate repository configuration (required status checks, enforcement) that this rule file does not set.” Runtime enforcement of tool calls is the client-side guard; merge enforcement depends on the repository’s branch protection — “it is NOT determined by this preflight response.”

Proves: what the guarded path checked and whether that call executed, with explicit non-claims always set so missing fields cannot be read as “ok.”

Does not prove: that the change is safe; that the host cannot bypass; that an absent field is compliance; that change_fp is what executed (it is what was checked); that calls outside the guarded table are visible; that the execution-result hash is artifact-match proof; that a host-asserted conditional write was a verified compare-and-swap.

Proves: linkage of a frozen execution proof with a conditional-write outcome; authorized_and_committed only on a clean committed branch.

Does not prove: only-write-on-host; that a version token proves change-fingerprint match; that committed-stale is safe; that the execution-result hash equals CAS bytes; that the host cannot bypass; a re-decision of governance ALLOW/BLOCK.

Proves: the target, re-read after the host write, matched the authorized after (content on filesystem adapters, version token on API / DB / Registry adapters) at observation time.

Does not prove: atomicity; that no other writer acted between write and observation; content equality on token-only adapters; that the host’s attestation is true.

Proves: typed closure linking a prior BLOCK’s remediation transaction to a later ALLOW execution chain; refuses when the input fingerprints match (unchanged input is not permission).

Does not prove: the patch addressed required changes; recheck scope was honored; no other changes rode along; the new ALLOW was caused by the remediation; that the host cannot bypass.

Proves: predecessor commitments inside the token bodies you present: none removed or reordered (tamper-evident).

Does not prove: Ed25519 signatures, expiry, keys, or authorization. “Neither proves the predecessor was ever a real signed receipt.” An intact chain does not prove session completeness, that edits landed, or that downstream CI may skip re-analysis. chain_status: absent is not “unlinked”; it is a different gate. Prefer tamper-evident language over tamper-proof.

Proves: a supplied previous receipt verified against the current key (intact), was omitted (absent, annotation only), or failed verification (broken).

Does not prove: a broken chain on a read-only action changes the decision (it does not). Absent is annotation only. Broken plus a destructive capability escalates to REQUIRE_APPROVAL and never silently passes.

Proves: “Resolving content proves what was true at measurement time.”

Does not prove: the tree is still that content at write time. “A host that then writes unconditionally still races.” Opt-in execution-state recheck can detect or enforce against drift; it is not a full TOCTOU closure. Conditional write remains host-side.

Proves: agreement between a host declaration that a monitoring sink is wired and a present onEvent callback. Without both, WARN does not proceed (MONITORING_UNWIRED).

Does not prove: that any event reaches a destination. “A no-op () => {} is indistinguishable from a real logger.” “A declaration is a claim we record, not a fact we verify.” CONTINUE_WITH_MONITORING “is not ‘proceed with caution’ without monitoring.”

Proves: “only a real app_id proves the green came from OUR app.”

Does not prove: a required check matched by name only (app_id null) was produced by CodeRifts; that path is satisfiable by any repository writer.

Proves: declaration answers who intends to use X; observation answers who read X (when). Element-level traffic without a consumer id still proves traffic arrived.

Does not prove: unobserved means unused. “ABSENT ≠ ZERO”: nobody sending traffic means every field is unobserved — unobserved must never mean unused. Declared intent is not measured traffic.

Proves: a tool annotation such as readOnlyHint proves that the server declared an intent for that tool, and that a client reading the tool list received that declaration.

Does not prove: that the tool is read-only. An annotation is a server declaration, not a verified property, and that holds for the annotations we publish as much as for anyone else’s. Nothing on either side measures whether a tool annotated read-only writes. This is the same distinction as analysis is not permission, one layer down: annotation_declared is not annotation_verified.

Proves: a tool that asks for confirmation before a spending action proves that the confirmation was requested and answered at the tool layer.

Does not prove: that the spend required it. Where the credential lives inside the agent’s own configuration — an env block the agent can read — a caller that goes around the tool still holds the key, and the key still spends. A confirmation that lives in the tool layer is a convention unless something outside the agent’s scope holds the credential. This is a property of the configuration shape, not of any one implementation.

Proves: a signed spending ceiling proves the holder agreed to an upper bound before any settlement happened.

Does not prove: that a later settlement matched the intent that produced the signature. A scheme whose first “up to” authorization also grants a one-time unlimited allowance to a permit contract has a ceiling that is bounded in the signature and unbounded on chain. Nothing in the signature identifies afterwards which settlement it authorized — the same gap as a grant that carries a nonce but is never observed being consumed.

Proves: an authority bound to a live session is valid while that session is the one that was authorized.

Does not prove: that the session answering later is the same one. A stateful bridge that moves through reconnecting, crashed and unauthorized states re-establishes the transport; re-establishing the transport is not re-establishing the grant. Nothing here reports whether a re-authenticated session inherits authority issued to its predecessor.

Proves: a tool surface where every tool is read-or-prepare proves that no tool in that surface commits a side effect on its own.

Does not prove: that the boundary holds while the measured party can edit what measures it. What is free may stay free; what holds the measure must not be editable by the party being measured. A surface can be entirely read-or-prepare and still be ungoverned if the threshold it is judged against lives inside the same session. Panickssery et al., NeurIPS 2024, measured that models recognize and favor their own generations, arXiv:2404.13076, and Zheng et al., NeurIPS 2023, measured a self-enhancement bias in LLM-as-a-judge, arXiv:2306.05685, so the agent must not grade its own change.

Proves: an enumerated tool table proves which tools a host offered to the model in one context, and the guarded-table assurance proves which of them a mutator can reach.

Does not prove: that the model picked the right one. An independent catalogue of MCP server architectures measured tool-selection accuracy falling below 90% between 10 and 15 tools per context for Claude Haiku 4.5, and between 20 and 30 for Sonnet 4 (arXiv:2606.30317). A table that grows past a model’s working size does not become less guarded — coverage is a property of the table. Selection is a property of the context the table is read in, and nothing we sign measures it. A short fixed loop stays inside the measured band; a wide catalogue does not, and the receipt looks identical either way.

Proves: The provider-enforcement statements name what VERIFIED means for each provider, in that provider’s own words, with the source. Three providers, three different guarantees — uniform prose is exactly what creeps in where the guarantees differ.

Does not prove: that one provider’s guarantee transfers to another. Read them side by side on Enforcement status; the section there is generated from the CLI’s own statements and a guard fails if the page and the source drift apart.

Proves: an analysis call says what a change is. Measured on the live endpoint 2026-09-20, an analyze preflight answers may_execute: false, authorization_effect: NONE and receipt_kind: NONE — it does not merely withhold permission, it issues no receipt at all.

Does not prove: anything about permission, in any field. There is no analysis-shaped receipt that could be mistaken for a grant, because analysis returns none. And where a receipt does exist, a token on its own still answers currently_authorized: null. The hosted verify_receipt route, given a token alone, answers currently_authorized null. The open offline verifier prints VERIFIED_CURRENT and has no currently_authorized field. Measured the same day: valid: true, status: VERIFIED_CURRENT, and the note says the status “reflects signature and expiry only”. Null is not a no; it is the absence of the question’s inputs.

Proves: a verified signature proves who stood behind a statement, and that the statement has not changed since they did.

Does not prove: that the statement is true. Authority answers who authorized, not whether what they authorized is correct. Every boundary above is a case of this one: a receipt proves a decision was made and by whom, never that the decision was right.

Proves: post-hoc observed reality bound to a past decision id, when a row is recorded.

Does not prove: calibration, success rate, or that a missing row means the decision was good. Empty list interpretation is absence_is_unknown (absent ≠ zero / success).

Proves: when set, the envelope audience is the authenticated key identity; a non-null intended audience that does not match is the wrong audience.

Does not prove: org or installation scope. Anonymous receipts do not bind a holder identity.

Proves: caller-declared target sensitivity can only raise severity, never lower it.

Does not prove: absence of the signal is a finding. Absence changes nothing (the same absent-is-no-signal principle as chain attestation and evidence).

Proves: an issue timestamp inside a retired key’s closed validity window, when the window is fully stated.

Does not prove: “A retired key without retired_at cannot prove a closed window” — fail-closed false.

Proves: a derived allow / deny / require_approval from the product execution_action map (unknown or missing → deny).

Does not prove: that this module sits on a wire in front of arbitrary MCP servers. “This module alone does not sit on a wire.” Scoring is not reimplemented here.

Proves: only a completed analysis with real findings may be approved. The label may be BLOCK or REQUIRE_APPROVAL (severity, not permission).

Does not prove: that an approval on incomplete analysis is risk acceptance. “It is risk ignorance wearing process.”