1
A signed decision, verified without us
Proves: the decision we return is signed, and the signature holds on your machine, from a key snapshot you cloned, without contacting us.
curl -sS https://app.coderifts.com/api/v1/action-verdict \
-d '{"action_type":"tool_call","tool":{"name":"get_customer","capabilities":["read"]}}' \
| python3 -c 'import sys,json;print(json.load(sys.stdin)["chain_receipt"])' > receipt.txt
git clone -q --depth 1 https://github.com/coderifts/receipt-verifier
node receipt-verifier/cli.js "$(cat receipt.txt)"
{"valid":true,"status":"VERIFIED_CURRENT","payload":{"v":2,"kid":"2026-07-k1","fp":"sha256:68ac3813cf53b3bd3208028fa609a11b9a17012b4f5994aafacdc7a79303952d","prev":"null","caller":"anon","ts":"2026-09-14T10:15:45.931Z","reg":"4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945"}}
Does not prove: that this endpoint evaluated your input. It returns a fixed decision so the envelope is inspectable. Your own installation evaluates its own change sets.
Measured 2026-09-14. ts is per-call; valid, status, kid and fp were stable on this run.
2
A valid signature is not authorization
Proves: the verifier separates two questions we are careful never to merge. A token can be cryptographically perfect and still authorize nothing now.
curl -sS -X POST https://app.coderifts.com/api/v1/verify-receipt \
-H 'Content-Type: application/json' \
-d "{\"token\":\"$(cat receipt.txt)\"}"
valid: true
status: VERIFIED_CURRENT
currently_authorized: null
authz_note: "status reflects signature+expiry only; provide operation/environment/fingerprint (and the body_hash-bound decision_result envelope) to evaluate current authorization"
Read the third line again. Not false. Not true. null — because with a token alone, the question cannot be answered, and an unanswered question is never a yes.
Measured 2026-09-14. Needs receipt.txt from block 1.
3
The limits, served as data
Proves: the boundaries are a field you can fetch and diff, not a paragraph in a PDF.
curl -sS https://coderifts.com/.well-known/coderifts.json \
| python3 -c 'import sys,json;[print(s) for s in json.load(sys.stdin)["does_not_prove"]]'
Evidence is RECORDED — a pinned capture, replayed — not a live provider run.
proof_scope TRUSTED_EXECUTOR, provider_witness NOT_APPLICABLE, externally_witnessed false: CodeRifts did not witness or sign a provider state.
Not externally witnessed, and not PATH B. The GitHub provider-loop is a separate claim.
The grant does not bind the canonical tool-call bytes, so what-was-called is not proven equal to what-was-authorized (planned, not available).
There is no single cross-domain evidence bundle over grant, measurement and supply chain (planned / on request, not available).
A downstream agent is not given a strictly narrower grant than its caller held — delegation attenuation is not available.
No DSSE or in-toto envelope is emitted by any published artifact.
Does not prove: that every individual decision response carries this field. It does not. These are the boundaries of the published surface as a whole.
Measured 2026-09-14. Seven entries; the copy abbreviated the last five.
4
What we serve is what we published
Proves: the tool text the live server hands an agent is byte-for-byte the tool text on this site. Two sources, one digest, computed by you.
curl -sS -X POST https://app.coderifts.com/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \
| python3 -c 'import sys,json,hashlib
t=json.load(sys.stdin)["result"]["tools"]
b=json.dumps(t,sort_keys=True,separators=(",",":"),ensure_ascii=False).encode()
print("sha256:"+hashlib.sha256(b).hexdigest())'
curl -sS https://coderifts.com/.well-known/mcp/server-card.json \
| python3 -c 'import sys,json;print(json.load(sys.stdin)["surface"]["tools_sha256"])'
sha256:4c3d2bcc7c1c00fe7cd9ee5e6df6ada47652bf9b3537a1a9d82815142afa5b38
sha256:4c3d2bcc7c1c00fe7cd9ee5e6df6ada47652bf9b3537a1a9d82815142afa5b38
Does not prove: that a model read the tool text, or obeyed it. It proves the text is the text.
Measured 2026-09-14. Live tools/list, published server-card, and the local mirror all printed this digest. App website-vendored-sync 9/9. Website check-mcp-server-card.mjs byte-identical (50841 bytes).
5
An unknown method is refused, by name
Proves: the server does not improvise. A method it does not implement gets a named refusal, not a helpful guess.
curl -sS -X POST https://app.coderifts.com/mcp \
-H 'Content-Type: application/json' \
-H 'Accept: application/json, text/event-stream' \
-d '{"jsonrpc":"2.0","id":1,"method":"server/discover"}'
{"jsonrpc":"2.0","id":1,"error":{"code":-32601,"message":"Method not found: server/discover"}}
Measured 2026-09-14. The copy abbreviated this as -32601 Method not found: server/discover; the command prints the JSON envelope.
6
The guarded table, on six vectors
Proves: on the six named vectors, the adapter does not hand over a mutating tool without a grant.
npx @coderifts/conformance --assurance GUARDED_TOOL_TABLE
GUARDED_TOOL_TABLE: COVERED / LIVE — 6 vector(s)
Does not prove: anything about a tool your host registered directly. The claim is scoped to the table CodeRifts hands the agent.
Measured 2026-09-14.
7
One grant, one use
npx @coderifts/conformance --assurance ATOMIC_COMMIT
ATOMIC_COMMIT: COVERED / RECORDED — 6 vector(s)
RECORDED, not LIVE. These are pinned captures, replayed. The profile's own output says so, and so do we: this does not prove that the live kernel behaves this way today.
Measured 2026-09-14.
8
The decision branches, on sixteen vectors
npx @coderifts/conformance --subject reference
reference profile=normative: 16 passed, 0 failed (n=16)
Proves: an adapter that reads execution_action branches the way the contract says. Does not prove: single-use consumption — that is block 7, and it is recorded.
Measured 2026-09-14. The command also printed sixteen PASS lines and measured_by: @coderifts/conformance@0.8.11; the copy's summary line is the one on the page.
9
Reproduce the evidence, do not replay it
Proves: the package does not only ship its proofs, it can rebuild the negative ones. The tamper case is regenerated, not replayed from a fixture.
npx @coderifts/conformance --assurance END_TO_END
COVERED / RECORDED — 2 vector(s)
Seven of seven does not mean CodeRifts merged a pull request.
— the profile's own output
Measured 2026-09-14. RECORDED, not LIVE.
What this page does not offer
Five things a reader might reasonably expect here, and why they are absent rather than faked:
Your own mutator table, key-free. No public endpoint exposes it.
An ALLOW from the public endpoint. It returns one fixed decision.
does_not_prove inside a decision JSON. It is on the surface, not in the verdict.
A merge you can watch being blocked. The demo check's own summary reads
"Enforcement status: not verified".
A live single-use consumption. Only recorded profiles today.
Each of these is either planned, on request, or outside what we ship. The claim table says which, per item.
What the gate reads
A change set is graded on the sentences a change adds, not on every description in the set. A sentence already sitting in a tool you did not touch does not decide your change. A tool that arrives new has no previous text, so every sentence of it is new and all of it is read — which is why a tool whose own description carries an instruction still goes to a human.
Measured 2026-09-14, the day that narrowing landed. Before it, one standing sentence in a browser tool — go forward/back in browser history, quoted as it read on that date — refused the whole set. A set-level report is the other question, is this set safe, and still reads every tool in full. The gate does not merge the two.
The claim table →
·
Proof boundaries →