| Path |
Can prevent… |
Without extra wiring… |
@coderifts/agent-guard |
a tool call (through its table) |
nothing — must wire tools |
| PR comment |
— |
reports only |
API Contract Check |
a merge (if all four conditions) |
not a gate after bare install |
contract-gate |
a merge (Action, when required + issuer-bound) |
App check phase-1 clamped; name-only pin spoofable by anyone, issuer-bound pin by anyone who can edit workflows |
| MCP tools |
— |
agent must honour the verdict |
CLI / pre-push |
a push (if the hook runs) |
not a merge gate |
conformance 7/7 |
— (records a trusted-executor transition) |
not PATH B; not a GitHub merge; not externally witnessed |
Enforcement and decision paths
Runtime guard — @coderifts/agent-guard
npm package · tool-table composition · fail-closed
ADVISORY · GUARDED TABLE · COMPOSITION DECLARES CLOSURE INCOMPLETE
Does
Prevents a breaking contract call from running when the call goes through the returned tool table. Fail-closed on BLOCK, REQUIRE_APPROVAL, unverifiable receipt, unwired monitoring, and similar integrity failures.
Does not
Does not see calls the host registers outside that table. Does not block a human merge on GitHub. Does not replace branch protection or the PR report path.
Becomes a gate when: wire only the tools returned by withCodeRifts / the guarded registry — the runtime sees only calls through that surface. See agents quickstart.
Kubernetes admission webhook — coderifts/k8s-admission customer-hosted · open source
Admission review · denies the apply
ENFORCING · ADMISSION · CUSTOMER-PINNED KEYRING
Measured 2026-09-20 from the repository’s own README: fail-closed, with named deny reasons — receipt_missing, receipt_invalid, scope_mismatch, dsse_malformed. It runs in your cluster and you pin KEYRING_PATH.
Becomes a gate when: the webhook is registered for the resources you care about and the keyring you pinned is the one that signed the receipts.
The boundary it states about us: “No CodeRifts-operated service is called at admit time.” That is the point and also the limit — nothing we run can observe, delay or rescue an admit decision made in your cluster, and a keyring you stop updating is a keyring we cannot refresh for you.
Gateway verifier — coderifts/gateway-verifier target-side · open source
Request path · refuses the call
ENFORCING · REQUEST · CALLER-PINNED KEYRING
It calls itself a target verifier: it checks evidence the caller already holds, then forwards. Measured 2026-09-20 from its README — proves the receipt token is authentic under the caller-pinned keyring, unexpired for the configured clock, and that the resolved intent (operation and target) matches the receipt scope.
Becomes a gate when: it sits in front of the target and every route it must protect is mapped. A missing or unmapped route is refused, not waved through.
Does not prove: that the change was preflighted correctly; that execution_action was CONTINUE; that artifacts still match; that the upstream policy is right; that the keyring is fresh. It is not an analysis service — nothing here asks whether a request is risky.
Required status check — CodeRifts — API Contract Check app_id 2860592 · the CodeRifts App
GitHub check run · can block merge when fully configured
ENFORCING · MERGE · 4-CONDITION CLOSURE VERIFIED
Otherwise ADVISORY. Otherwise nothing. The four conditions, and where they stand on coderifts/demo, measured 2026-09-17: branch protection requires the context by name · the name is CodeRifts / contract-gate · the check is bound to app_id 2860592 · enforce_admins is on. All four hold today, measured 2026-09-17 by reading them back from the GitHub API: protection is present on main, checks[] carries the context bound to app_id 2860592 (the checks[] shape is what binds an issuer — the legacy contexts[] mirror cannot), and enforce_admins is true. Closure 4/4. A red check returned 405 … is FAILING; a green one passed the rule check and reached the head-SHA precondition. The gate distinguishes.
Does
Can prevent a merge when branch protection requires this context, the check is bound to the CodeRifts App (app_id: 2860592), an analysable schema is present, and administrators cannot bypass (enforce_admins).
Does not
Does not block by default after a bare App install. Name-only required checks (no app_id) are spoofable by anyone who can post a check with that name; issuer-bound ones (app_id set) narrow that to anyone who can edit .github/workflows, because the enforcing issuer is shared. Neutral completion (no analysable schema) is non-blocking. Does not stop runtime agent calls. The branch does not require being up to date with main. strict is false on purpose: a pull request that is behind can still merge once its check is green. What is required is the check, not the rebase — with strict: true a blocked and an allowed pull request both reported behind, which is exactly the distinction this gate exists to make. No human review is required either: required_pull_request_reviews is unset, so the check is the gate.
Becomes a gate when: all four conditions together — documented at Make the Check Block a Merge (link, not repeated here).
Contract-gate — CodeRifts / contract-gate app_id 15368 · the GitHub Actions App
two surfaces, same check name · Action can block · App check advisory
ADVISORY · MERGE · CLOSURE REQUIRES IMMUTABLE-SHA WORKFLOW PIN
The pin ladder, and only the last rung closes it: NAME ONLY is spoofable by anyone able to create the named check · ISSUER BOUND narrows the set to actors able to use or edit a workflow under the shared issuer · IMMUTABLE WORKFLOW SHA closes workflow identity. Issuer binding is a real strengthening; it is not a closure. Measured 2026-09-17 on coderifts/demo: the SHA pin exists on one feature branch, main carries no workflow and no branch protection.
Does
Two different surfaces post a check with this same name; only one of them can block. The GitHub Action coderifts/contract-gate posts a real check conclusion, and when that check is required by branch protection and bound to the Action’s issuer, a failing conclusion prevents the merge. That is a genuine gate.
Does not
The GitHub App’s identically named check still prevents nothing: phase-1 clamps its conclusions to neutral rather than failure unless MERGEGATE_ENFORCE is true, and it defaults false. Requiring that check and expecting a red X to stop a merge is the confusion this page exists to end. A pin by check name alone (a bare contexts[] entry with no issuer binding) is also not a gate — it is spoofable, and CLI enforce --check (since 4.9.0) reports name-only required checks as not inescapable — still true on 8.6.3, measured 2026-09-15 (the shipped version that day; 8.6.6 as of 2026-09-23, not re-measured). Issuer binding narrows who can forge it; it does not close it. The enforcing issuer is github-actions[bot] (app id 15368), which every workflow in the repository shares, so an app_id pin proves the check came from Actions — not that it came from the CodeRifts workflow. Anyone who can edit .github/workflows can post a passing check under the same issuer. Pinning the required workflow by immutable SHA is what closes that, and until it is in place the issuer-bound case is narrower than name-only, not airtight. A red PR comment prevents nothing on its own.
Becomes a gate when: require the Action’s check, bound to its issuer rather than pinned by name — coderifts setup-required-check, or the Action’s ENFORCEMENT.md. The App check needs MERGEGATE_ENFORCE before it can block. Same honesty as docs.
MCP tools — three canonical tools
preflight_change_set · verify_receipt · get_decision_details
ADVISORY · CAN ISSUE AUTHORITY · DOES NOT EXECUTE
Does
Gives an agent a preflight that is deterministic per engine build and clock (preflight_mode required: analyze = risk only; authorize = operation-bound + optional receipt), receipt verification, and stored-decision lookup over Streamable HTTP.
Does not
Prevents nothing by itself. The agent (or host) must treat an authorize verdict as binding (branch on execution_action; verify receipt). Analyze is informational — not permission. Without a runtime guard, a model can ignore the verdict and still call the broken API.
Becomes a gate when: an agent or host that treats authorize + receipt verification as binding — e.g. wire @coderifts/agent-guard, or refuse non-CONTINUE execution_action. Contract: Decision Spec v2. See for-agents and mcp.json.
CLI / pre-push hook
local check before code leaves the machine
ADVISORY · INSTALLED PRE-PUSH HOOK · TWO IN-HOOK FAIL-OPEN PATHS
Does
Can prevent a push when configured as a pre-push (or CI job) that fails on a bad verdict. Catches issues before they hit the remote.
Does not
Does not prevent a merge on GitHub once the branch is already updated (e.g. web UI merge, force-push by another actor, or a push that bypassed the hook). Does not wrap agent tool calls at runtime.
Becomes a gate when: the hook or job must actually run and fail closed on the verdict. See CLI integration.
Evidence path
Evidence is not enforcement. This path proves what happened; it stops nothing.
Conformance END_TO_END (7/7) — @coderifts/conformance@0.8.11
public npm package · recorded assurance profiles · hermetic bare-Git
EVIDENCE · PROVES · DOES NOT PREVENT
Does
Reports END_TO_END COVERED (7/7) via TARGET_STATE_TRANSITION_PROVEN: a governed ref moved to the authorized commit under a signed grant, observed afterwards by a separate read-only process. All seven assurance profiles are COVERED.
Does not
Does not mean CodeRifts witnessed or signed the provider state. Boundary, exactly: proof_scope TRUSTED_EXECUTOR, provider_witness NOT_APPLICABLE, externally_witnessed false. Not a provider merge (PATH B). Not externally witnessed. Not the GitHub positive provider-loop.
Becomes a gate when: read the honesty table, not the number alone. See What each proof proves. The GitHub loop stays on provider canary.
