# Onboarding a repository to CodeRifts, for a Grok Bot

<!-- GENERATED by scripts/generate-grok-bot-package.js from scripts/lib/grok-bot-source.js — do not hand-edit. -->

The bot guides and verifies; a human runs the two commands, opens the pull request, holds the key and makes the checks required.

**Control plane.** The control-plane files (.coderifts.yml and .github/workflows/coderifts.yml) are written by the two commands below, which a human runs, and they reach the repository in that human's pull request; the bot never writes them (the skill's Never list).
<!-- source: src/mergegate/control-plane.js:38-39 -->

## Step 1 — install-app (human)

Install the CodeRifts GitHub App on the repository.

Where: https://github.com/apps/coderifts

**The bot must not:** Install the App or accept its permissions: an installation is a decision of the account owner.
<!-- source: src/public/api/signup.html:308 -->

## Step 2 — policy (human)

Run this in the repository root with the profile you choose; the bot prints the exact command for that profile and says where to run it.

```sh
npx -y coderifts@8.8.0 init --profile {profile}
```

`{profile}` is one of: `public-api`, `internal-platform`, `regulated`.

Writes: `.coderifts.yml`.

**The bot must not:** Run the command, create or edit .coderifts.yml, or choose the profile for the user.
<!-- source: schemas/coderifts-policy.v1.json:4 -->

## Step 3 — workflow (human)

Run this in the repository root: it writes the gate workflow, pinned to coderifts/contract-gate@82e115313c10964411f433327455a34f6e7dc212 # v0.11.9, and the agent wiring. The bot prints the command.

```sh
npx -y coderifts@8.8.0 init --agents --strict
```

Writes: `.github/workflows/coderifts.yml`, agent rule files, the repo MCP config, the host hook.

**The bot must not:** Run the command, or create, edit or commit the workflow or its pin.
<!-- source: packages/cli/src/commands/init-agents.js:53-56 -->

## Step 4 — pull-request (human)

Commit those files and open one pull request; say in its description that it changes the control plane.

**The bot must not:** Commit the files, open the pull request, approve or merge it, or ask another bot to approve it.
<!-- source: src/mergegate/control-plane.js:38-39 -->

## Step 5 — key-and-required-checks (human)

Add the repository secret CODERIFTS_API_KEY, then make both checks required: "CodeRifts / contract-gate" and "CodeRifts / issuer".

Why: The required checks are the control plane: a bot that could set them could also unset them.

**The bot must not:** Edit branch protection or a ruleset, or ask for, print or store the key.
<!-- source: packages/cli/src/contract-gate-workflow.js:83-85 -->

## Step 6 — connect-mcp (human)

Add the CodeRifts MCP server to the bot as a custom connector by URL.

Where: https://app.coderifts.com/mcp

**The bot must not:** Put the key in the connector URL.
<!-- source: scripts/lib/agent-package-source.js:25 -->

## Step 7 — verify (bot)

After the first green check, verify its receipt offline and report the status.

```sh
npx -y @coderifts/receipt-verifier {token}
```

**The bot must not:** Report the repository as gated before both checks are required.
<!-- source: src/receipt-check-lines.js:76-78 -->