Docs · provider canary

Provider canary artefacts

The provider canary writes machine-readable JSON and commits the result as an artefact. It exits non-zero if any negative would pass, and is wired to run on a schedule. Measured 2026-10-09: run 37992301946 on coderifts/app, event workflow_dispatch, commit b139fcee7a45e4ba8874104dd98e5f244091303c (committer 2026-10-09T21:15:11Z). Job provider-canary succeeded. Verdict NEGATIVES_PASS. would_pass, not_run and unbound_checks are empty. The readback is coderifts/demo pull request #4, observed 2026-10-09T21:16:10.845Z. It reads the public coderifts/demo repository with a read-only token.

Current state, measured 2026-10-09

Read this before the capture below it. The capture is dated 2026-09-06 and is kept as history. The live negatives are the run named above.

• Branch protection is on. coderifts/demo main answers "protected": true on the public branches endpoint, read 2026-10-09. It answered the same on 2026-09-20. The capture below says the branch is not protected; that was true when it was read on 2026-09-15 and is not true on this read. The homepage records the same return from the other side: it re-read the merge check on 2026-09-19 and moved that block from NOT VERIFIED to VERIFIED. So the positive below still does not prove the gate gated — on the day it was recorded the branch was open. What changed is the branch, not the capture.
• Demo main has moved since the LOOP merge. coderifts/demo main is 6cf0f98d3def9cadcb4de5f6ea9c06845ed4e60b, committed 2026-09-28T20:12:45Z. The merge the capture describes, 971aea00dc043e13932bb2b4a84ed34b3b8b4c08 at 2026-09-06T20:42:09Z, is the merge of pull request #14. It is not the current main. Pull request #4 is still open.
• The scheduled canary on coderifts/app has not completed in the runs the API lists. Workflow live.yml has total_count 15. Ten are schedule and each failed. The earliest is 2026-09-30T12:18:44Z, run 36713878366. The latest scheduled failure is 2026-10-09T12:57:42Z, run 37933501861. The only success in the list is run 37992301946, event workflow_dispatch. A second dispatch the same minute, run 37992311988, failed in heavy-tests and skipped provider-canary. The note below reports thirty consecutive scheduled failures since 2026-09-07, measured 2026-09-15. This list does not reach that date. That count is not withdrawn and is not re-measured here.
• Scheduled runs on coderifts/demo are the contract gate, not this canary. Pull request #15 merged 2026-09-20T08:58:15Z and added a scheduled run for the contract gate. coderifts/demo has one workflow, contract-gate. The Actions API returns total_count 19 for event=schedule. The latest of those in this read succeeded at 2026-10-09T13:13:57Z. A reading dated 2026-09-20 said total_count: 0. That is not the count today.

Before 2026-10-09T21:15:11Z, two of the six negatives (fake_issuer, stale_head) did not evaluate the provider's binding, and the scheduled canary had not completed since at least 2026-09-30T12:18:44Z; since b139fcee7a45e4ba8874104dd98e5f244091303c each is measured against every required check the provider reports.

The committed fixture artefact, coderifts/app commit 14696b748802380297546c6b167f5c7de7112e8a (committer 2026-10-09T21:19:15Z), is a no-network run on a 2026-09-06 readback (2026-09-06T00:00:00.000Z) with one check, CodeRifts / contract-gate bound to 2860592. Live run 37992301946 is the measurement of the provider today. Neither is a signed provider witness.

The six negatives below are what run 37992301946 refused. The capture under them is dated and kept word for word — it is history, not the current state.

Negatives

Measured against the two bindings the readback reported on coderifts/demo pull request #4: CodeRifts / issuer bound to 2860592, and CodeRifts / contract-gate bound to 15368.

• fake_issuer — same-name check from another app. Refused, check_app_id_not_authority.
• forged_signature — forged grant signature. Refused, grant_signature_invalid.
• cross_run — authentic grant from another run. Refused, evidence_root_digest_mismatch.
• stale_head — green check on a stale head. Refused, check_head_sha_stale.
• wrong_binding — grant bound elsewhere. Refused, grant_binding_mismatch.
• revoked_key — revoked issuer key. Refused, issuer_key_revoked.

Historical capture — 2026-09-06

Positive — RAN (LOOP, not signed-witness)

positive_merge_under_grant is RAN. Measured via gh: coderifts/demo PR #14 (additive timezone) merged 2026-09-06T20:42:09Z. Head bfe669539017738b3456b992c5f6a34121ba6659. App 2860592 / coderifts posted CodeRifts / contract-gate success. Merge commit 971aea00dc043e13932bb2b4a84ed34b3b8b4c08 on main.

Two things this page did not say, both measured 2026-09-15. First: the canary has been failing on every scheduled run since 2026-09-07 — thirty consecutive runs, not one success, each ending in about four seconds. The positive below was recorded on 2026-09-06, which is the last day the job worked. Nothing on this page changed while that happened. Second: the positive does not prove the gate gated. coderifts/demo main is not protected — the branch-protection endpoint answers 404 Branch not protected, and both contexts and checks are empty. The check ran, the App posted it, and the merge happened; it would have happened with a red check too. What is proven is a real App posting a real check on a real merge — not a refusal.

This is a green provider LOOP (real App, real check, real merge). provider_witness stays carried_unsigned — not the public END_TO_END profile (2 vectors, RECORDED; phase-D option B, undecided). It is a provider-integration claim, kept separate from that profile.

The public profile is END_TO_END COVERED / RECORDED, 2 vector(s) on @coderifts/conformance@0.8.11 via a hermetic bare-Git TARGET_STATE_TRANSITION_PROVEN (proof_scope TRUSTED_EXECUTOR, provider_witness NOT_APPLICABLE, externally_witnessed false). That is trusted-executor-integrity, not this GitHub loop and not PATH B. Honesty table: What each proof proves. Gate today vs roadmap (not available): claim table.