Works with
Each row names one surface, the sentence measured for it, and where that sentence stops.
GitHub
On GitHub, a required check refuses the merge until a receipt for that diff verifies on the runner; the receipt names the operation it was granted for (merge, deploy, publish or a tool call) and expires.
a check is a lock only when it is required on the default branch, bound to the right app, bypass closed, SHA pinned — without all four it is a comment
https://github.com/marketplace/coderifts
https://github.com/marketplace/actions/coderifts-contract-gate
Claude Code
The api-governance plugin at tag v1.2.1 is version 1.2.1, and that plugin carries the mod.
The api-governance plugin at tag v1.2.3 is version 1.2.3.
Claude Code asks for the plugin's api_key option when you install or enable the plugin in /plugin, and you set it with /plugin configure api-governance@coderifts, or from a shell with claude plugin configure api-governance@coderifts --values-stdin and the api_key value on stdin.
The key is stored in your platform's secure credential store, not in settings.json.
The plugin no longer reads the CODERIFTS_API_KEY or CODERIFTS_API_BASE environment variables (before 1.2.2 it did), and the coderifts CLI still reads CODERIFTS_API_KEY.
Since 1.2.2 the plugin asks for the key through its userConfig api_key option, and that option is marked sensitive.
On 2026-10-03 the marketplace file on main lists agent-hooks at version 0.2.2.
The same file at tag v1.2.1 lists agent-hooks at version 0.2.0.
On every Write, Edit and MultiEdit call that touches a contract file, the mod holds the call until preflight answers, and any other decision, an error, an answer it cannot read, or no answer within 8 s is refused.
A CONTINUE or CONTINUE_WITH_MONITORING answer runs the call, and so does no break detected when there is no API key.
Without a key the no-break path is analyze, which is not an authorization.
A Write, Edit or MultiEdit call that does not touch a contract file is not refused.
The catch refuses the call when the check fails before the tool runs.
When the tool has already run, the catch still returns a deny and says the change is unchecked.
The band is for the turn.
It leads with that turn's refusal, and when the turn has both a refusal and an allowance it appends a count of how many were refused and how many were allowed this turn.
A new turn clears the band.
With one refusal and one allowance in the turn, the count text is · 1 refused, 1 allowed this turn.
The refusal mark is ✗ CodeRifts.
Installed as a mod, it is one of the mods the user installed: a mod that runs before it can answer or rewrite the call, or what this mod reads, so it never sees the change; disableAllHooks in any settings file (the .claude/settings.json of the project included), --safe-mode or --bare turns it off.
Only an organization mod (installed in place from a marketplace directory the administrator owns, and enabled in managed settings) runs before the mods users install and keeps its refusal for the calls it sees; installed from its GitHub marketplace this plugin never counts as one, and --safe-mode or three crashes of the hooks worker unload even that.
This mod (api-governance 1.2.3) does not inspect shell commands: a shell write to a contract file passes it; the required check is the guarantee.
The install lines at tag v1.2.1 are /plugin marketplace add coderifts/api-governance and /plugin install api-governance@coderifts.
The project-scope option is labeled Install for all collaborators on this repository (project scope).
That option enables the plugin for everyone who works in this repository.
Committing that entry turns the plugin on for your collaborators but does not download it to their machines, so each collaborator also runs claude plugin install api-governance@coderifts --scope project once.
Read on 2026-10-03, claude --version printed 2.1.288 (Claude Code) and claude plugin list printed api-governance@coderifts version 1.2.1, enabled, scope user, and agent-hooks@coderifts version 0.2.2, enabled, scope user.
The mods overview documents a dim line such as 1 mod active · first-mod. This round did not open /plugin, so that line is not measured for api-governance.
The module comment at tag v1.2.1 says that on 1.2.0 the mod refused the breaking edit and allowed a second edit in the same turn, and that the 1.2.0 band showed only the last one.
This round did not repeat that edit.
A search of the Claude marketplace for coderifts on 2026-10-03 returned the heading No plugins for those filters.
https://github.com/coderifts/api-governance
https://claude.com/marketplace/plugins?q=coderifts
Cursor
The Cursor plugin coderifts-api-governance at version 1.0.1 is in the same repository. cursor.directory returned HTTP 429 on 2026-10-03, so this page does not say that directory lists it.
https://github.com/coderifts/api-governance/tree/main/plugins/api-governance-cursor
OpenAI
Measured 2026-09-29, ChatGPT Plus, in the EU. A personal MCP app connected to https://app.coderifts.com/mcp with no authentication. One analyze call came back. No receipt was issued.
Authorize was not called.
The Codex plugin manifest api-governance-openai at version 1.0.1 is in the repository. This round did not call Codex.
oasdiff
Built on oasdiff for OpenAPI; we add the grant at a required check, and the same gate for MCP tool manifests.
The OpenAPI 3.1 path selects oasdiff 1.11.11. The upstream LICENSE is Apache-2.0. The app THIRD_PARTY_NOTICES.md does not name oasdiff.
https://github.com/Tufin/oasdiff
https://www.oasdiff.com/pricing
Kyverno
The Kyverno policy at examples/kyverno-decision.yaml is an example in coderifts/contract-gate. This round did not measure another installation.
examples/kyverno-decision.yaml
Sigstore and in-toto
Provenance says how it was built; the receipt says whether it was allowed.
No DSSE or in-toto envelope is emitted by any published artifact.
The layout in examples/decision.layout does not verify until a second distinct public key is added.
The predicate type in examples/attest-decision.yml is https://coderifts.com/attestations/decision/v1.
Alongside
CodeRabbit runs oasdiff version 1.32.1 and reports supported breaking API changes as review comments. oasdiff is enabled by default.
CodeRabbit comments on a breaking OpenAPI change; a required CodeRifts check keeps it from merging.
The CodeRabbit page posts findings as review comments. It does not say a CodeRabbit comment blocks the merge.
https://docs.coderabbit.ai/tools/oasdiff
Gemini CLI
Read 2026-10-04, the Gemini CLI extension gallery lists the coderifts card, dialog coderiftsgemini-cli-extension, for the repository coderifts/gemini-cli-extension.
https://geminicli.com/extensions/?name=coderiftsgemini-cli-extension