Card snapshot

This is a frozen copy of the agent's agent-card.json as we observed it at the timestamp above. We capture a new snapshot every time the card's content hash changes. Useful for: forensic drift analysis, verifying downstream callers see the right version, reproducing routing decisions made historically.

{
  "name": "CodeRifts",
  "description": "Signed, offline-verifiable authorization for API-contract changes. Only a granted change can proceed. Three tools: preflight_change_set, verify_receipt, get_decision_details.",
  "supportedInterfaces": [
    {
      "url": "https://app.coderifts.com/mcp",
      "protocolBinding": "MCP",
      "protocolVersion": "1.0"
    },
    {
      "url": "https://app.coderifts.com/api/v1/preflight",
      "protocolBinding": "REST",
      "protocolVersion": "1.0"
    }
  ],
  "provider": {
    "organization": "CodeRifts",
    "url": "https://coderifts.com"
  },
  "version": "1.0.3",
  "documentationUrl": "https://coderifts.com/docs",
  "capabilities": {
    "streaming": false,
    "pushNotifications": false,
    "extendedAgentCard": false,
    "extensions": [
      {
        "uri": "https://coderifts.com/.well-known/coderifts.json",
        "description": "Platform limits and which calls take a key. The card is discovery, not permission.",
        "required": false,
        "params": {
          "does_not_prove": [
            "Evidence is RECORDED \u2014 a pinned capture, replayed \u2014 not a live provider run.",
            "proof_scope TRUSTED_EXECUTOR, provider_witness NOT_APPLICABLE, externally_witnessed false: CodeRifts did not witness or sign a provider state.",
            "Not externally witnessed, and not PATH B. The GitHub provider-loop is a separate claim.",
            "The grant does not bind the canonical tool-call bytes, so what-was-called is not proven equal to what-was-authorized (planned, not available).",
            "There is no single cross-domain evidence bundle over grant, measurement and supply chain (planned / on request, not available).",
            "A downstream agent is not given a strictly narrower grant than its caller held \u2014 delegation attenuation is not available.",
            "No DSSE or in-toto envelope is emitted by any published artifact.",
            "The published tool-surface digest establishes what the server serves now. It does not establish that an existing client connection runs that list: clients may cache the tool list for the life of a connection, and expiry behaviour differs by client and is undocumented (measured: anthropics/claude-code#97369; on claude.ai the saved approval is keyed on a hash of the description and top-level parameter descriptions \u2014 a type, enum or required change does not reset it)."
          ],
          "does_not_prove_scope": "platform",
          "speaks_a2a": false,
          "authentication": {
            "mechanism": "Bearer token via X-API-Key header or Authorization: Bearer",
            "key_required": {
              "analyze": false,
              "verify_receipt": false,
              "authorize": true,
              "get_decision_details": false
            }
          }
        }
      }
    ]
  },
  "securitySchemes": {
    "apiKey": {
      "apiKeySecurityScheme": {
        "description": "Bearer token via X-API-Key header or Authorization: Bearer",
        "location": "header",
        "name": "X-API-Key"
      }
    },
    "bearer": {
      "httpAuthSecurityScheme": {
        "description": "Bearer token via X-API-Key header or Authorization: Bearer",
        "scheme": "Bearer"
      }
    }
  },
  "defaultInputModes": [
    "application/json"
  ],
  "defaultOutputModes": [
    "application/json"
  ],
  "skills": [
    {
      "id": "preflight_change_set",
      "name": "preflight_change_set",
      "description": "Use this when: a contract artifact (OpenAPI, GraphQL, protobuf, AsyncAPI, MCP manifests, or agent tool schemas) changes before merge, deploy, publish, or tool registration; AND any agent-executed operation with no supported contract type \u2014 send type agent_operation. Do not call for documentation-only changes, static readiness scoring, or receipt verification. Use analyze for risk only; authorize requires context.operation. Skipping this call is not permission. Absence of a key is not permission. Inputs: preflight_mode is required: \"analyze\" (risk only; no receipt, no execution_action) or \"authorize\" (may mint a receipt; requires context.operation \u2014 merge is not deploy is not publish). Supply exactly one artifact source: artifacts[] (1\u201320 items, each {id, type, before, after} as the FULL spec/schema text, not a path or URL; type is openapi|graphql|grpc|asyncapi|mcp_manifest|agent_tools|agent_operation) XOR derivation=\"server\" (server reads GitHub Compare; needs context.repository + context.base + context.head; sending artifacts[] together is 400). Grant fields sit in one object, execution_grant_request {include_execution_grant, grant_version, tenant_id, executor_id, adapter_id, target_uri, expected_state_token, state_nonce, audience, policy_hash}; analyze ignores it; required is preflight_mode only. previous_receipt is a chain token base64url(body).base64url(signature) to LINK a prior decision \u2014 it does not re-verify; use coderifts.verify_receipt instead; for details of a past decision use coderifts.get_decision_details instead. idempotency_key replays authorize only (24h), never analyze.",
      "tags": [
        "analyze",
        "authorize"
      ]
    },
    {
      "id": "verify_receipt",
      "name": "verify_receipt",
      "description": "Verify a CodeRifts signed chain-receipt you ALREADY HOLD: cryptographic\nauthenticity (signature + key id), body binding, and \u2014 when lifecycle indices\nare available \u2014 whether it is currently valid authorization (not expired,\nsuperseded, or revoked) for a stated operation/target.\n\nUse this when:\n- You already obtained a chain_receipt / receipt token from a prior preflight\n  (or CI artifact) and are about to act (merge/deploy) under that receipt.\n- A contract-gate or policy requires offline/online proof that the receipt is\n  authentic for this change before proceeding.\n- You must distinguish \"signature ok\" from \"currently authorized\" (stale or\n  superseded receipts must not be treated as live approval).\n\nDo not use when:\n- You do not have a receipt yet \u2014 call coderifts.preflight_change_set first.\n- You need a NEW decision for a changed base\u2192head set \u2014 preflight again;\n  verify_receipt does not re-diff specs.\n- The receipt you hold binds a different operation or target than the one you\n  are about to perform \u2014 call coderifts.preflight_change_set with\n  context.operation set to that operation (a merge receipt does not authorize\n  a deploy); verify_receipt cannot re-scope or re-issue a decision.\n- You only need human-readable history of an old decision_id without a receipt\n  token \u2014 use coderifts.get_decision_details.\n- The change set itself is unknown or incomplete \u2014 fix the change set and\n  preflight; do not \"verify\" a placeholder.\n\nInputs: receipt token (required); target_id = decision_result.artifact_digest \u2014 required\nfor an authorization verdict; omitted \u2192 target_not_stated. Optional intended context\n(operation, environment, fingerprint, audience, repository/branch/pull_request, base/head)\nand the body_hash-bound decision_result envelope. 30s clock-skew leeway on expiry. A 0s\ngrace for declared destructive production operations is defined in the policy but\nis unreachable today: the intended-context schema has no destructive field, so\nnothing can declare one and the 30s leeway always applies.\nReturns { valid, status, currently_authorized (bool|null), reason, payload, authz_* }.\nBranch on currently_authorized; null = not evaluated.\n\nWhen a decision envelope is also in hand (e.g. from a prior preflight), its\ncontrol_envelope.next_agent_step (if present) is structured remediation guidance\nthe agent MAY follow after a non-CONTINUE decision \u2014 still branch on\nexecution_action; next_agent_step is suggestion, not permission.",
      "tags": [
        "verify",
        "receipt"
      ]
    },
    {
      "id": "get_decision_details",
      "name": "get_decision_details",
      "description": "Retrieve a PAST CodeRifts decision by exactly one identifier\n(case_id | decision_id | fingerprint): full report, breaking changes, scores,\nand linked receipt metadata if stored.\n\nUse this when:\n- You have a decision_id (or fingerprint) from a previous preflight, PR\n  comment, or CI log and need to inspect or explain that past decision.\n- You are auditing why a prior ALLOW/WARN/BLOCK was issued.\n- You are NOT requesting a new analysis of current before/after specs.\n\nDo not use when:\n- You need a decision for the CURRENT uncommitted or PR head change set \u2014\n  call coderifts.preflight_change_set with the current artifacts.\n- You hold a receipt token and only need cryptographic/lifecycle verification \u2014\n  use coderifts.verify_receipt.\n- You have no identifier \u2014 run preflight first to create one.\n\nInputs: exactly one of case_id, decision_id, or fingerprint. {} \u2192 INVALID_INPUT;\ntwo identifiers \u2192 LOOKUP_IDENTIFIER_CONFLICT; case_id \u2192 CASE_NOT_FOUND\n(lookup never opens a case). Returns the stored document or not_found.\n\nScoping \u2014 fingerprint lookup returns only YOUR OWN decisions. A fingerprint is\nderived from content, not from an account, so two callers who preflight\nbyte-identical specs derive the same one; the lookup is therefore constrained\nto the decisions your credential can prove it owns.\n\nA decision that exists but is not yours returns the SAME not_found as one that\nwas never issued. This is deliberate: a distinguishable \"exists but forbidden\"\nwould confirm to any caller that a given content hash had been decided on by\nsomeone, which is the fact the scoping exists to withhold. Do not read\nnot_found as proof that no such decision exists anywhere.\n\nDecisions persisted without context.repository cannot currently be attributed\nto an account, and are not retrievable by fingerprint at all \u2014 not by their\nowner either. Retrieve those by decision_id, which is unchanged and unscoped.\nThis is a limitation of what older stored rows carry, not a property of the\nlookup: rows written from now on record the account directly, so the gap\nnarrows as older rows age out. If a fingerprint you expect returns not_found,\nuse the decision_id before concluding the decision is missing.\n\nWhen the stored envelope carries control fields, control_envelope.next_agent_step\nis structured remediation guidance the agent MAY follow for non-CONTINUE\nexecution_action values (null on CONTINUE*). Still branch on execution_action;\nnext_agent_step is a suggestion, not permission.",
      "tags": [
        "decision"
      ]
    }
  ]
}