A
licenseD
qualityB
maintenanceEnables AI agents to inspect, draft, validate, and locally verify contract changes against frozen policies, with separate input and output roots and no approval or verified-signing capability.
10
1
MIT
api-governance
Server Details
Signed, offline-verifiable contract-change authorization. Only a granted change can proceed.
If you are the author of this connector, you can claim ownership with GitHub, an HTTP challenge, or a DNS record. Claimed connector authors can inspect health checks, view analytics, and manage their listing.
- Status
- Healthy
- Uptime
- 99.6% over 39 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-06-18
- URL
- Repository
- coderifts/api-governance
- GitHub Stars
- 0
- Server Listing
- CodeRifts API Governance
TDQS
A4.9/5.0
Scored across 3 tools
Disambiguation5/5
Each tool maps to a distinct lifecycle stage: preflight_change_set requests a new decision, get_decision_details retrieves a stored past decision, and verify_receipt checks receipt authenticity/status. The descriptions explicitly cross-reference when not to use each tool, so an agent should not misselect.
Naming Consistency5/5
All three tool names follow a consistent snake_case action_noun pattern: preflight_change_set, get_decision_details, verify_receipt. No mixed conventions or vague verbs.
Tool Count5/5
Three tools is within the well-scoped range, and each one earns its place: submit a change set, retrieve a decision, and verify a receipt. There is no redundancy or obvious bloat.
Completeness4/5
The core decision/receipt lifecycle is covered: create via preflight, read via get_decision_details, and verify via verify_receipt. The only minor gap is the lack of a list/search surface for governance auditing without a known identifier, and no explicit revocation tool.
Available Tools
3 toolsget_decision_detailsARead-onlyInspect
Retrieve a PAST CodeRifts decision by exactly one identifier (case_id | decision_id | fingerprint): full report, breaking changes, scores, and linked receipt metadata if stored.
Use this when:
You have a decision_id (or fingerprint) from a previous preflight, PR comment, or CI log and need to inspect or explain that past decision.
You are auditing why a prior ALLOW/WARN/BLOCK was issued.
You are NOT requesting a new analysis of current before/after specs.
Do not use when:
You need a decision for the CURRENT uncommitted or PR head change set — call coderifts.preflight_change_set with the current artifacts.
You hold a receipt token and only need cryptographic/lifecycle verification — use coderifts.verify_receipt.
You have no identifier — run preflight first to create one.
Inputs: exactly one of case_id, decision_id, or fingerprint. {} → INVALID_INPUT; two identifiers → LOOKUP_IDENTIFIER_CONFLICT; case_id → CASE_NOT_FOUND (lookup never opens a case). Returns the stored document or not_found.
Scoping — fingerprint lookup returns only YOUR OWN decisions. A fingerprint is derived from content, not from an account, so two callers who preflight byte-identical specs derive the same one; the lookup is therefore constrained to the decisions your credential can prove it owns.
A decision that exists but is not yours returns the SAME not_found as one that was never issued. This is deliberate: a distinguishable "exists but forbidden" would confirm to any caller that a given content hash had been decided on by someone, which is the fact the scoping exists to withhold. Do not read not_found as proof that no such decision exists anywhere.
Decisions persisted without context.repository cannot currently be attributed to an account, and are not retrievable by fingerprint at all — not by their owner either. Retrieve those by decision_id, which is unchanged and unscoped. This is a limitation of what older stored rows carry, not a property of the lookup: rows written from now on record the account directly, so the gap narrows as older rows age out. If a fingerprint you expect returns not_found, use the decision_id before concluding the decision is missing.
When the stored envelope carries control fields, control_envelope.next_agent_step is structured remediation guidance the agent MAY follow for non-CONTINUE execution_action values (null on CONTINUE*). Still branch on execution_action; next_agent_step is a suggestion, not permission.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | No | A case identifier. Lookup never opens a case. Until the case store exists this returns CASE_NOT_FOUND. | |
| decision_id | No | The decision_id from a prior decision_result envelope. Provide exactly one identifier. | |
| fingerprint | No | A verdict fingerprint (sha256:...); returns the latest matching decision you own. Provide exactly one identifier. |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
| meta | Yes | |
| decision | No | |
| evidence | No | |
| patterns | No | |
| operation | No | |
| timestamp | No | |
| risk_score | No | |
| receipt_kind | No | |
| chain_receipt | No | |
| preflight_mode | No | |
| safe_for_agent | No | |
| decision_result | Yes | decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json). |
| pattern_sources | No | |
| breaking_changes | No | |
| control_envelope | No | Control envelope (control/1.0) derived from the stored decision_result. Includes next_agent_step (structured remediation SUGGESTION for non-CONTINUE execution_action; null on CONTINUE*; not permission — still branch on execution_action). |
| evidence_quality | No | |
| execution_action | No | |
| coderifts_version | No | |
| requires_migration | No | |
| verdict_fingerprint | No | |
| required_action_core | No | Branchable required-action core { type, reason_code, recheck_required } when present on the envelope. |
| decision_spec_version | No | |
| decision_semantic_hash | No |
TDQS
A4.9/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=true and openWorldHint=false; the description adds substantial behavioral detail beyond that. It explains fingerprint scoping (only your own decisions), the deliberate indistinguishability of 'exists but not yours' from 'never existed', the limitation on decisions without context.repository, and the meaning of control_envelope.next_agent_step. All of this is non-obvious operational behavior that an agent must know to interpret results correctly. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long, but it is well-structured with clear sections ('Use this when', 'Do not use when', 'Inputs', 'Scoping') and the core purpose is front-loaded in the first sentence. Every paragraph adds necessary nuance for a sensitive lookup tool. It could be marginally tightened (e.g., merging some sentences), but the structure earns a 4.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all aspects an agent needs: what the tool does, when to use it, error behavior, scoping/privacy implications, handling of stale rows, and even guidance on how to interpret the returned envelope's next_agent_step. An output schema exists, so return-value structure is already defined, but the description adds behavioral expectations (not_found semantics) and disambiguation of edge cases. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the input schema already has 100% coverage and detailed per-parameter descriptions, the tool description adds critical semantic context: the exact-mutex rule (exactly one identifier), the concrete error codes for each violation (INVALID_INPUT, LOOKUP_IDENTIFIER_CONFLICT, CASE_NOT_FOUND), and the nuanced behavior of fingerprint lookup (only yours, same not_found for others). This goes beyond the schema's structural description and provides actionable guidance on how to use the parameters and interpret edge cases.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a concrete verb-resource statement: 'Retrieve a PAST CodeRifts decision by exactly one identifier (case_id | decision_id | fingerprint).' It specifies what the tool returns (full report, breaking changes, scores, receipt metadata) and immediately contrasts with siblings by naming preflight_change_set and verify_receipt in the 'Do not use' block. This leaves no ambiguity about what the tool does and how it differs from its neighbors.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly enumerates three 'Use this when' scenarios and three 'Do not use when' scenarios, each naming the alternative tool and the condition that selects it (e.g., 'call coderifts.preflight_change_set' for current changes, 'coderifts.verify_receipt' for receipt verification). This is the highest clarity bar: an agent can decide without reading any other tool's schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
preflight_change_setAInspect
Use this when: a contract artifact (OpenAPI, GraphQL, protobuf, AsyncAPI, MCP manifests, or agent tool schemas) changes before merge, deploy, publish, or tool registration; AND any agent-executed operation with no supported contract type — send type agent_operation. Do not call for documentation-only changes, static readiness scoring, or receipt verification. Use analyze for risk only; authorize requires context.operation. Skipping this call is not permission. Absence of a key is not permission. Inputs: preflight_mode is required: "analyze" (risk only; no receipt, no execution_action) or "authorize" (may mint a receipt; requires context.operation — merge is not deploy is not publish). Supply exactly one artifact source: artifacts[] (1–20 items, each {id, type, before, after} as the FULL spec/schema text, not a path or URL; type is openapi|graphql|grpc|asyncapi|mcp_manifest|agent_tools|agent_operation) XOR derivation="server" (server reads GitHub Compare; needs context.repository + context.base + context.head; sending artifacts[] together is 400). Grant fields (include_execution_grant, grant_version, tenant_id, executor_id, adapter_id, target_uri, expected_state_token, state_nonce, policy_hash) apply only when preflight_mode="authorize" AND include_execution_grant=true; analyze ignores them. previous_receipt is a chain token base64url(body).base64url(signature) to LINK a prior decision — it does not re-verify; use coderifts.verify_receipt instead; for details of a past decision use coderifts.get_decision_details instead. idempotency_key replays authorize only (24h), never analyze.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | Optional apply-site context folded into the bundle fingerprint. operation distinguishes merge vs deploy vs publish (and other labels); the server accepts any non-empty string; conventional values: merge, deploy, tool_call, publish. The receipt/gate must match this label. | |
| audience | No | Requester identity for the decision envelope. Accepted here; the server-derived audience wins when both are present. | |
| artifacts | No | 1–20 contract documents analyzed together. Each item is {id, type, before, after} where before/after are the FULL document strings (YAML/JSON/proto text), not URLs or file paths. Omit this array entirely when derivation="server". | |
| tenant_id | No | Authorize+grant v2 only. Tenant the grant is issued under. ASCII slug. When omitted the server uses "default" — pin it if you are not on the default tenant. | |
| adapter_id | No | Authorize+grant v2 only. Adapter that will apply the change. Conventional values: fs, postgres, git. Must match the adapter the executor actually uses; a git grant does not authorize an fs write. | |
| derivation | No | "server" = the server derives artifacts[] from GitHub Compare via the App installation. Allowed only when context.repository, context.base and context.head are all present and the tenant has a proven binding for that repository. Do not send artifacts[] in the same call (400 — one source of truth). Omit this field for the caller-supplied artifacts[] path. | |
| target_uri | No | Authorize+grant v2 only. URI the grant binds (example: git://owner/repo.git/refs/heads/main). Fallback if omitted: context.target_uri, then repository/head-derived. Distinct from context.target_id. | |
| executor_id | No | Authorize+grant v2 only. Executor identity the grant is bound to (example: agent:ci-bot, host:github-actions). Empty/absent is not "any executor". | |
| policy_hash | No | Authorize+grant v2 only. Policy identity bound into the grant, sha256: + 64 hex. When supplied, apply must use that same policy; a different policy is a different grant. | |
| state_nonce | No | Authorize+grant only. Opaque nonce copied into the signed grant as its own field (not folded into scope_hash). Absent → BEARER grant. Ignored unless include_execution_grant is true. | |
| grant_version | No | Grant envelope to mint when include_execution_grant is true. Omitting this yields cr.exec.v1 until 2026-09-18 and cr.exec.v2 on and after it (see x-coderifts-effective-default / x-coderifts-default-changes-at). The response meta.grant_version is the version actually issued. An explicit value always wins — pin "v1" to keep current behaviour with no code change on the date. | |
| preflight_mode | Yes | REQUIRED. "analyze" = informational risk only (no decision/execution_action/safe_for_agent; analysis_outcome + may_execute:false). "authorize" = operation-bound path; may mint a receipt (requires context.operation). Decision Spec 2.0: omission is INVALID_INPUT. Do not pin 1.0 — that pin retired. | |
| idempotency_key | No | Optional client key; in authorize mode, a repeat with the same key + body replays the original decision (24h). Analyze responses are not replayed. | |
| previous_receipt | No | Optional prior chain token to LINK this call into a receipt chain: base64url(body).base64url(signature). Linking is not verification — a linked token is not re-checked here; use verify_receipt. | |
| expected_state_token | No | Authorize+grant v2 only. Compare-and-swap token the executor must observe at apply time (the "before" state). Signed as its own field. Omit only if the adapter has no prior state; do not send a placeholder. | |
| decision_spec_version | No | Optional. Omit or '2.0' = current contract. '1.0' retired (INVALID_INPUT); do not pin 1.0. | |
| include_execution_grant | No | Authorize only. When true on an allow-class authorize, the response includes a signed execution_grant, or HTTP 503 SIGNER_UNAVAILABLE — never an unsigned grant. Default false. Analyze ignores this flag. Ignored unless preflight_mode="authorize". |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
A4.9/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite only readOnlyHint=false and openWorldHint=false annotations, the description richly discloses behaviors: analyze produces no receipt/execution_action, authorize may mint receipts, execution grants can return 503 SIGNER_UNAVAILABLE, idempotency replays only authorize within 24h, previous_receipt links without re-verifying, and agent_operation is not semantically analyzed. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is lengthy but front-loaded with usage conditions and organized around operational concerns. Some redundancy with the schema descriptions exists, but most sentences add actionable guidance or constraints. For a tool with 17 parameters and two modes, the length is largely justified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the full decision context: when to call, what each mode returns at a high level, artifact source selection, grant fields, linking vs verification, idempotency, and explicit non-permission semantics. The output schema exists, so return-value details need not be repeated. Nothing critical is missing for an agent to call this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even though schema coverage is 100%, the description adds critical cross-parameter semantics: artifacts must be full text not URLs, artifacts[] XOR derivation="server" else 400, grant fields only apply on authorize+include_execution_grant, previous_receipt vs verify_receipt, and grant_version default change date. These constraints are not inferable from individual schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's role: preflight analysis/authorization for contract artifact changes, with explicit 'Use this when' conditions and two modes ('analyze' risk-only, 'authorize' may mint a receipt). It differentiates from siblings by directing receipt verification to verify_receipt and past decision details to get_decision_details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit when-to-use conditions (contract changes before merge/deploy/publish/register), exclusions ('Do not call for documentation-only changes, static readiness scoring, or receipt verification'), and alternatives named by sibling tools. It also includes safety guidance: 'Skipping this call is not permission' and 'Absence of a key is not permission.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_receiptARead-onlyInspect
Verify a CodeRifts signed chain-receipt you ALREADY HOLD: cryptographic authenticity (signature + key id), body binding, and — when lifecycle indices are available — whether it is currently valid authorization (not expired, superseded, or revoked) for a stated operation/target.
Use this when:
You already obtained a chain_receipt / receipt token from a prior preflight (or CI artifact) and are about to act (merge/deploy) under that receipt.
A contract-gate or policy requires offline/online proof that the receipt is authentic for this change before proceeding.
You must distinguish "signature ok" from "currently authorized" (stale or superseded receipts must not be treated as live approval).
Do not use when:
You do not have a receipt yet — call coderifts.preflight_change_set first.
You need a NEW decision for a changed base→head set — preflight again; verify_receipt does not re-diff specs.
The receipt you hold binds a different operation or target than the one you are about to perform — call coderifts.preflight_change_set with context.operation set to that operation (a merge receipt does not authorize a deploy); verify_receipt cannot re-scope or re-issue a decision.
You only need human-readable history of an old decision_id without a receipt token — use coderifts.get_decision_details.
The change set itself is unknown or incomplete — fix the change set and preflight; do not "verify" a placeholder.
Inputs: receipt token (required); optional intended context (operation, environment, fingerprint, target_id, audience, repository/branch/pull_request, base/head) and the body_hash-bound decision_result envelope. 30s clock-skew leeway on expiry. A 0s grace for declared destructive production operations is defined in the policy but is unreachable today: the intended-context schema has no destructive field, so nothing can declare one and the 30s leeway always applies. Returns { valid, status, currently_authorized (bool|null), reason, payload, authz_* }. Branch on currently_authorized; null = not evaluated.
When a decision envelope is also in hand (e.g. from a prior preflight), its control_envelope.next_agent_step (if present) is structured remediation guidance the agent MAY follow after a non-CONTINUE decision — still branch on execution_action; next_agent_step is suggestion, not permission.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | Intended base commit/ref SHA the receipt must match (signed-wins vs envelope.base) | |
| head | No | Intended head commit/ref SHA the receipt must match (signed-wins vs envelope.head) | |
| token | Yes | The chain receipt token (base64url(body).base64url(signature)) | |
| branch | No | Intended branch the receipt must bind (place binding; optional) | |
| audience | No | Intended audience — must match the receipt | |
| operation | No | Intended operation the receipt must authorize (conventional: merge|deploy|tool_call|publish). Triggers authorization evaluation when non-empty; supply decision_result for full scope binding. | |
| target_id | No | Intended apply-site target the receipt must bind | |
| repository | No | Intended repository the receipt must bind (place binding; optional) | |
| environment | No | Intended environment (e.g. production) — must match the receipt | |
| fingerprint | No | Intended change fingerprint — must equal the receipt fp | |
| pull_request | No | Intended pull-request id the receipt must bind (place binding; optional) | |
| decision_result | No | The body_hash-bound decision envelope (carries operation/target/decision). Required for a meaningful AUTHORIZATION evaluation of scope; without it, intended context alone fails closed on authorization (currently_authorized false) while signature status remains independent. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json. |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
| valid | Yes | true iff status is VERIFIED_CURRENT or RETIRED_KEY_VALID_AT_ISSUE |
| reason | No | |
| status | Yes | |
| payload | No | |
| authz_note | No | Present when no intended context supplied: status reflects signature+expiry only |
| authz_state | No | Lifecycle state from isCurrentlyAuthorized when authorization is evaluated (optional; omitted when currently_authorized is null) |
| authz_reason | No | When currently_authorized=false: the deny reason (operation_mismatch, decision_not_allow, superseded, expired, target_mismatch, environment_mismatch, …) |
| authz_status | No | Authorization-level status (VERIFIED_WRONG_ENVIRONMENT / VERIFIED_SUPERSEDED / VERIFIED_SCOPE_MISMATCH / …) |
| caller_value | No | Caller claim that differed from the signed envelope |
| signed_value | No | Signed envelope slot when signed-wins fail-closed (source_binding_mismatch) |
| binding_level | No | place_and_content | content_only — forensic, not a second verdict |
| correlation_id | No | Route-owned trace id, set by the route itself rather than by correlation middleware; always a non-empty string on 200 |
| currently_authorized | Yes | Whether the receipt currently authorizes the intended operation/target/fp (§106). null means authorization could not be evaluated (e.g. no intended context) — not unauthorized and not authorized. |
TDQS
A4.8/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only give readOnlyHint/openWorldHint; the description adds substantial non-obvious behavior: 30s clock-skew leeway, a 0s destructive-op grace that is unreachable today, fail-closed authorization when the envelope is absent, branching guidance ('branch on currently_authorized; null = not evaluated'), and the warning that next_agent_step is suggestion not permission. This goes well beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
It is long but front-loaded with the purpose sentence, then cleanly partitioned into when/when-not/inputs/returns/warnings with no filler. The paragraph on the unreachable 0s destructive grace is arguably over-detailed, keeping it just below a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 12-parameter tool with nested objects, two evaluation modes, and an output schema, the description covers mode semantics, required-vs-optional inputs, return fields, and interpretation guidance. Nothing an agent needs to call it correctly appears missing, and the return explanation is a bonus beyond the existing output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3; the description adds meaning beyond the schema by explaining mode selection (token-only = SIGNATURE, context+envelope = AUTHORIZATION), the fail-closed failure mode, and that operation 'triggers authorization evaluation when non-empty'. It stops short of describing individual context fields, which is acceptable given the rich schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Verify) and clearly bounded resource (a CodeRifts signed chain-receipt you ALREADY HOLD), with the crucial scope qualifier 'already hold' that separates it from preflight. It explicitly names the sibling alternatives (preflight_change_set, get_decision_details) and the conditions under which they, not this tool, apply.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit 'Use this when' and 'Do not use when' blocks with concrete routing: no receipt yet -> preflight_change_set; changed base→head -> preflight again; different operation/target -> re-scope via preflight; history only -> get_decision_details. This is exactly the when/when-not/alternatives structure that earns a top score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
- Changed
get_decision_details5 fields changed- added
Input schema / descriptionAdded value: +"Closed exclusive identifier union: exactly one of case_id | decision_id | fingerprint. Encoded as minProperties=1 + maxProperties=1 + additionalProperties=false, NOT as a top-level oneOf/anyOf/allOf — Anthropic (and other strict tool APIs) reject those combinators at the root of input_schema and then refuse the entire tools array (measured: test/mcp-input-oneof-honesty.test.js, mcp-streamable.js comment). The server enforces the same mutex with named codes: empty {} → INVALID_INPUT; two or more identifiers → LOOKUP_IDENTIFIER_CONFLICT; case_id alone → CASE_NOT_FOUND (no case store yet; lookup never opens a case)." - added
Input schema / maxPropertiesAdded value: +1 - added
Input schema / properties / case_idAdded value: +{ + "description": "A case identifier. Lookup never opens a case. Until the case store exists this returns CASE_NOT_FOUND.", + "minLength": 1, + "type": "string" +} - changed
Input schema / properties / decision_id / descriptionPrevious value: -"The decision_id from a prior decision_result envelope. Provide this and/or fingerprint (at least one non-empty string required)."New value: +"The decision_id from a prior decision_result envelope. Provide exactly one identifier." - changed
Input schema / properties / fingerprint / descriptionPrevious value: -"A verdict fingerprint (sha256:...); returns the latest matching decision. Provide this and/or decision_id (at least one non-empty string required)."New value: +"A verdict fingerprint (sha256:...); returns the latest matching decision you own. Provide exactly one identifier."
1 tool update
- Changed
preflight_change_set3 fields changed- changed
Input schema / properties / artifacts / items / properties / type / descriptionPrevious value: -"Artifact kind. One of openapi, graphql, grpc, asyncapi, mcp_manifest, agent_tools. Determines how before/after text is parsed. Not inferred from the filename."New value: +"Artifact kind. One of openapi, graphql, grpc, asyncapi, mcp_manifest, agent_tools, agent_operation. Contract types determine how before/after text is parsed. agent_operation: An opaque proposed agent operation for which no supported contract-artifact type applies. CodeRifts does not semantically analyze this content and does not issue an execution grant. Not inferred from the filename." - changed
Input schema / properties / artifacts / items / properties / type / enumPrevious value: -[ - "openapi", - "graphql", - "grpc", - "asyncapi", - "mcp_manifest", - "agent_tools" -]New value: +[ + "openapi", + "graphql", + "grpc", + "asyncapi", + "mcp_manifest", + "agent_tools", + "agent_operation" +] - changed
Output schema / oneOfPrevious value: -[ - { - "additionalProperties": true, - "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", - "not": { - "anyOf": [ - { - "required": [ - "decision" - ] - }, - { - "required": [ - "execution_action" - ] - }, - { - "required": [ - "safe_for_agent" - ] - }, - { - "required": [ - "chain_receipt" - ] - }, - { - "required": [ - "execution_grant" - ] - }, - { - "required": [ - "decision_result" - ] - }, - { - "required": [ - "control_envelope" - ] - }, - { - "required": [ - "required_action_core" - ] - } - ] - }, - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "analysis_control": { - "type": "object" - }, - "analysis_outcome": { - "description": "Closed analysis outcome set derived from engine-visible state only.", - "enum": [ - "NO_BREAK_DETECTED", - "BREAKS_DETECTED", - "ANALYSIS_FAILED" - ], - "type": "string" - }, - "artifacts": { - "type": "array" - }, - "authorization_effect": { - "const": "NONE", - "description": "Analyze never authorizes; always NONE." - }, - "blast_radius": { - "additionalProperties": false, - "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "type": [ - "string", - "null" - ] - }, - "decision_basis": {}, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "may_execute": { - "const": false, - "description": "Analyze never grants execute permission." - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "analyze" - }, - "receipt_kind": { - "const": "NONE", - "description": "Analyze never mints a receipt." - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (observation; not permission).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "analysis_outcome", - "authorization_effect", - "may_execute", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - }, - { - "additionalProperties": true, - "allOf": [ - { - "if": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind" - ] - }, - "then": { - "required": [ - "chain_receipt" - ] - } - }, - { - "if": { - "properties": { - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING" - ] - } - }, - "required": [ - "execution_action" - ] - }, - "then": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind", - "chain_receipt", - "decision_result" - ] - } - } - ], - "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "artifacts": { - "type": "array" - }, - "blast_radius": { - "additionalProperties": false, - "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "description": "Calibration model version when set; null until a calibrated model ships.", - "type": [ - "string", - "null" - ] - }, - "chain_receipt": { - "type": "string" - }, - "chain_status": { - "type": "string" - }, - "coderifts_version": { - "type": "string" - }, - "control_envelope": { - "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", - "type": "object" - }, - "decision": { - "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_basis": {}, - "decision_result": { - "additionalProperties": true, - "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", - "properties": { - "audience": { - "type": [ - "string", - "null" - ] - }, - "authority": { - "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", - "type": [ - "object", - "null" - ] - }, - "base": { - "type": [ - "string", - "null" - ] - }, - "blast_radius": { - "description": "Additive COUNTS (not a score). Not permission.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "type": "object" - }, - "decision": { - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_body_hash": { - "type": [ - "string", - "null" - ] - }, - "decision_id": { - "type": "string" - }, - "derivation": { - "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", - "type": [ - "object", - "null" - ] - }, - "environment": { - "type": [ - "string", - "null" - ] - }, - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "expires_at": { - "type": "string" - }, - "fingerprint": { - "type": "string" - }, - "head": { - "type": [ - "string", - "null" - ] - }, - "input_fingerprint": { - "type": "string" - }, - "operation": { - "type": [ - "string", - "null" - ] - }, - "receipt": { - "type": "object" - }, - "repository": { - "type": [ - "string", - "null" - ] - }, - "safe_for_agent": { - "type": "boolean" - }, - "spec_version": { - "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", - "type": "string" - } - }, - "type": "object" - }, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "execution_action": { - "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "execution_grant": { - "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash.", - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "authorize" - }, - "receipt_kind": { - "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", - "enum": [ - "operation_authorization", - "NONE" - ], - "type": "string" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "safe_for_agent": { - "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", - "type": "boolean" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "decision", - "execution_action", - "safe_for_agent", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", + "not": { + "anyOf": [ + { + "required": [ + "decision" + ] + }, + { + "required": [ + "execution_action" + ] + }, + { + "required": [ + "safe_for_agent" + ] + }, + { + "required": [ + "chain_receipt" + ] + }, + { + "required": [ + "execution_grant" + ] + }, + { + "required": [ + "decision_result" + ] + }, + { + "required": [ + "control_envelope" + ] + }, + { + "required": [ + "required_action_core" + ] + } + ] + }, + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "analysis_control": { + "type": "object" + }, + "analysis_outcome": { + "description": "Closed analysis outcome set derived from engine-visible state only. NOT_SUPPORTED = no analyzer (agent_operation / type outside the published enum). ANALYSIS_FAILED = an analyzer ran and failed.", + "enum": [ + "NO_BREAK_DETECTED", + "BREAKS_DETECTED", + "ANALYSIS_FAILED", + "NOT_SUPPORTED" + ], + "type": "string" + }, + "artifacts": { + "type": "array" + }, + "authorization_effect": { + "const": "NONE", + "description": "Analyze never authorizes; always NONE." + }, + "blast_radius": { + "additionalProperties": false, + "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "type": [ + "string", + "null" + ] + }, + "decision_basis": {}, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "may_execute": { + "const": false, + "description": "Analyze never grants execute permission." + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "analyze" + }, + "receipt_kind": { + "const": "NONE", + "description": "Analyze never mints a receipt." + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (observation; not permission).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "analysis_outcome", + "authorization_effect", + "may_execute", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + }, + { + "additionalProperties": true, + "allOf": [ + { + "if": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind" + ] + }, + "then": { + "required": [ + "chain_receipt" + ] + } + }, + { + "if": { + "properties": { + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING" + ] + } + }, + "required": [ + "execution_action" + ] + }, + "then": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind", + "chain_receipt", + "decision_result" + ] + } + } + ], + "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "artifacts": { + "type": "array" + }, + "blast_radius": { + "additionalProperties": false, + "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "description": "Calibration model version when set; null until a calibrated model ships.", + "type": [ + "string", + "null" + ] + }, + "chain_receipt": { + "type": "string" + }, + "chain_status": { + "type": "string" + }, + "coderifts_version": { + "type": "string" + }, + "control_envelope": { + "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", + "type": "object" + }, + "decision": { + "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_basis": {}, + "decision_result": { + "additionalProperties": true, + "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", + "properties": { + "audience": { + "type": [ + "string", + "null" + ] + }, + "authority": { + "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", + "type": [ + "object", + "null" + ] + }, + "base": { + "type": [ + "string", + "null" + ] + }, + "blast_radius": { + "description": "Additive COUNTS (not a score). Not permission.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "type": "object" + }, + "decision": { + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_body_hash": { + "type": [ + "string", + "null" + ] + }, + "decision_id": { + "type": "string" + }, + "derivation": { + "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", + "type": [ + "object", + "null" + ] + }, + "environment": { + "type": [ + "string", + "null" + ] + }, + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "expires_at": { + "type": "string" + }, + "fingerprint": { + "type": "string" + }, + "head": { + "type": [ + "string", + "null" + ] + }, + "input_fingerprint": { + "type": "string" + }, + "operation": { + "type": [ + "string", + "null" + ] + }, + "receipt": { + "type": "object" + }, + "repository": { + "type": [ + "string", + "null" + ] + }, + "safe_for_agent": { + "type": "boolean" + }, + "spec_version": { + "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", + "type": "string" + } + }, + "type": "object" + }, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "execution_action": { + "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "execution_grant": { + "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash.", + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "authorize" + }, + "receipt_kind": { + "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", + "enum": [ + "operation_authorization", + "NONE" + ], + "type": "string" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "safe_for_agent": { + "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", + "type": "boolean" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "decision", + "execution_action", + "safe_for_agent", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + } +]
1 tool update
- Changed
preflight_change_set3 fields changed- changed
Input schema / properties / decision_spec_version / descriptionPrevious value: -"Optional pin. '1.0' = legacy contract (soft-default mode + analyze still carries decision/execution_action) until the sunset date. Omit or '2.0' = current contract."New value: +"Optional. Omit or '2.0' = current contract. '1.0' retired (INVALID_INPUT); do not pin 1.0." - changed
Input schema / properties / decision_spec_version / enumPrevious value: -[ - "1.0", - "2.0" -]New value: +[ + "2.0" +] - changed
Input schema / properties / preflight_mode / descriptionPrevious value: -"REQUIRED. \"analyze\" = informational risk only (no decision/execution_action/safe_for_agent; analysis_outcome + may_execute:false). \"authorize\" = operation-bound path; may mint a receipt (requires context.operation). Decision Spec 2.0: omission is an error unless decision_spec_version is '1.0' (30-day legacy pin with soft-default analyze)."New value: +"REQUIRED. \"analyze\" = informational risk only (no decision/execution_action/safe_for_agent; analysis_outcome + may_execute:false). \"authorize\" = operation-bound path; may mint a receipt (requires context.operation). Decision Spec 2.0: omission is INVALID_INPUT. Do not pin 1.0 — that pin retired."
1 tool update
- Changed
preflight_change_set1 field changed- changed
Input schema / properties / grant_version / x-coderifts-effective-defaultPrevious value: -"v1"New value: +"v2"
3 tool updates
- Changed
get_decision_details1 field changed- changed
Output schema / properties / decision_result / properties / blast_radius / descriptionPrevious value: -"ID27 additive COUNTS (not a score). Not permission."New value: +"Additive COUNTS (not a score). Not permission."
- Changed
preflight_change_set1 field changed- changed
Output schema / oneOfPrevious value: -[ - { - "additionalProperties": true, - "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", - "not": { - "anyOf": [ - { - "required": [ - "decision" - ] - }, - { - "required": [ - "execution_action" - ] - }, - { - "required": [ - "safe_for_agent" - ] - }, - { - "required": [ - "chain_receipt" - ] - }, - { - "required": [ - "execution_grant" - ] - }, - { - "required": [ - "decision_result" - ] - }, - { - "required": [ - "control_envelope" - ] - }, - { - "required": [ - "required_action_core" - ] - } - ] - }, - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "analysis_control": { - "type": "object" - }, - "analysis_outcome": { - "description": "Closed analysis outcome set derived from engine-visible state only.", - "enum": [ - "NO_BREAK_DETECTED", - "BREAKS_DETECTED", - "ANALYSIS_FAILED" - ], - "type": "string" - }, - "artifacts": { - "type": "array" - }, - "authorization_effect": { - "const": "NONE", - "description": "Analyze never authorizes; always NONE." - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "type": [ - "string", - "null" - ] - }, - "decision_basis": {}, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "may_execute": { - "const": false, - "description": "Analyze never grants execute permission." - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "analyze" - }, - "receipt_kind": { - "const": "NONE", - "description": "Analyze never mints a receipt." - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (observation; not permission).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "analysis_outcome", - "authorization_effect", - "may_execute", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - }, - { - "additionalProperties": true, - "allOf": [ - { - "if": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind" - ] - }, - "then": { - "required": [ - "chain_receipt" - ] - } - }, - { - "if": { - "properties": { - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING" - ] - } - }, - "required": [ - "execution_action" - ] - }, - "then": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind", - "chain_receipt", - "decision_result" - ] - } - } - ], - "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "artifacts": { - "type": "array" - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "description": "Calibration model version when set; null until a calibrated model ships.", - "type": [ - "string", - "null" - ] - }, - "chain_receipt": { - "type": "string" - }, - "chain_status": { - "type": "string" - }, - "coderifts_version": { - "type": "string" - }, - "control_envelope": { - "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", - "type": "object" - }, - "decision": { - "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_basis": {}, - "decision_result": { - "additionalProperties": true, - "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", - "properties": { - "audience": { - "type": [ - "string", - "null" - ] - }, - "authority": { - "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", - "type": [ - "object", - "null" - ] - }, - "base": { - "type": [ - "string", - "null" - ] - }, - "blast_radius": { - "description": "ID27 additive COUNTS (not a score). Not permission.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "type": "object" - }, - "decision": { - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_body_hash": { - "type": [ - "string", - "null" - ] - }, - "decision_id": { - "type": "string" - }, - "derivation": { - "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", - "type": [ - "object", - "null" - ] - }, - "environment": { - "type": [ - "string", - "null" - ] - }, - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "expires_at": { - "type": "string" - }, - "fingerprint": { - "type": "string" - }, - "head": { - "type": [ - "string", - "null" - ] - }, - "input_fingerprint": { - "type": "string" - }, - "operation": { - "type": [ - "string", - "null" - ] - }, - "receipt": { - "type": "object" - }, - "repository": { - "type": [ - "string", - "null" - ] - }, - "safe_for_agent": { - "type": "boolean" - }, - "spec_version": { - "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", - "type": "string" - } - }, - "type": "object" - }, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "execution_action": { - "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "execution_grant": { - "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash.", - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "authorize" - }, - "receipt_kind": { - "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", - "enum": [ - "operation_authorization", - "NONE" - ], - "type": "string" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "safe_for_agent": { - "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", - "type": "boolean" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "decision", - "execution_action", - "safe_for_agent", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", + "not": { + "anyOf": [ + { + "required": [ + "decision" + ] + }, + { + "required": [ + "execution_action" + ] + }, + { + "required": [ + "safe_for_agent" + ] + }, + { + "required": [ + "chain_receipt" + ] + }, + { + "required": [ + "execution_grant" + ] + }, + { + "required": [ + "decision_result" + ] + }, + { + "required": [ + "control_envelope" + ] + }, + { + "required": [ + "required_action_core" + ] + } + ] + }, + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "analysis_control": { + "type": "object" + }, + "analysis_outcome": { + "description": "Closed analysis outcome set derived from engine-visible state only.", + "enum": [ + "NO_BREAK_DETECTED", + "BREAKS_DETECTED", + "ANALYSIS_FAILED" + ], + "type": "string" + }, + "artifacts": { + "type": "array" + }, + "authorization_effect": { + "const": "NONE", + "description": "Analyze never authorizes; always NONE." + }, + "blast_radius": { + "additionalProperties": false, + "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "type": [ + "string", + "null" + ] + }, + "decision_basis": {}, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "may_execute": { + "const": false, + "description": "Analyze never grants execute permission." + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "analyze" + }, + "receipt_kind": { + "const": "NONE", + "description": "Analyze never mints a receipt." + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (observation; not permission).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "analysis_outcome", + "authorization_effect", + "may_execute", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + }, + { + "additionalProperties": true, + "allOf": [ + { + "if": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind" + ] + }, + "then": { + "required": [ + "chain_receipt" + ] + } + }, + { + "if": { + "properties": { + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING" + ] + } + }, + "required": [ + "execution_action" + ] + }, + "then": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind", + "chain_receipt", + "decision_result" + ] + } + } + ], + "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "artifacts": { + "type": "array" + }, + "blast_radius": { + "additionalProperties": false, + "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "description": "Calibration model version when set; null until a calibrated model ships.", + "type": [ + "string", + "null" + ] + }, + "chain_receipt": { + "type": "string" + }, + "chain_status": { + "type": "string" + }, + "coderifts_version": { + "type": "string" + }, + "control_envelope": { + "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", + "type": "object" + }, + "decision": { + "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_basis": {}, + "decision_result": { + "additionalProperties": true, + "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", + "properties": { + "audience": { + "type": [ + "string", + "null" + ] + }, + "authority": { + "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", + "type": [ + "object", + "null" + ] + }, + "base": { + "type": [ + "string", + "null" + ] + }, + "blast_radius": { + "description": "Additive COUNTS (not a score). Not permission.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "type": "object" + }, + "decision": { + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_body_hash": { + "type": [ + "string", + "null" + ] + }, + "decision_id": { + "type": "string" + }, + "derivation": { + "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", + "type": [ + "object", + "null" + ] + }, + "environment": { + "type": [ + "string", + "null" + ] + }, + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "expires_at": { + "type": "string" + }, + "fingerprint": { + "type": "string" + }, + "head": { + "type": [ + "string", + "null" + ] + }, + "input_fingerprint": { + "type": "string" + }, + "operation": { + "type": [ + "string", + "null" + ] + }, + "receipt": { + "type": "object" + }, + "repository": { + "type": [ + "string", + "null" + ] + }, + "safe_for_agent": { + "type": "boolean" + }, + "spec_version": { + "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", + "type": "string" + } + }, + "type": "object" + }, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "execution_action": { + "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "execution_grant": { + "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash.", + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "authorize" + }, + "receipt_kind": { + "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", + "enum": [ + "operation_authorization", + "NONE" + ], + "type": "string" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "safe_for_agent": { + "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", + "type": "boolean" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "decision", + "execution_action", + "safe_for_agent", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + } +]
- Changed
verify_receipt1 field changed- changed
Input schema / properties / decision_result / properties / blast_radius / descriptionPrevious value: -"ID27 additive COUNTS (not a score). Not permission."New value: +"Additive COUNTS (not a score). Not permission."
2 tool updates
- Changed
preflight_change_set1 field changed- changed
Output schema / oneOfPrevious value: -[ - { - "additionalProperties": true, - "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", - "not": { - "anyOf": [ - { - "required": [ - "decision" - ] - }, - { - "required": [ - "execution_action" - ] - }, - { - "required": [ - "safe_for_agent" - ] - }, - { - "required": [ - "chain_receipt" - ] - }, - { - "required": [ - "execution_grant" - ] - }, - { - "required": [ - "decision_result" - ] - }, - { - "required": [ - "control_envelope" - ] - }, - { - "required": [ - "required_action_core" - ] - } - ] - }, - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "analysis_control": { - "type": "object" - }, - "analysis_outcome": { - "description": "Closed analysis outcome set derived from engine-visible state only.", - "enum": [ - "NO_BREAK_DETECTED", - "BREAKS_DETECTED", - "ANALYSIS_FAILED" - ], - "type": "string" - }, - "artifacts": { - "type": "array" - }, - "authorization_effect": { - "const": "NONE", - "description": "Analyze never authorizes; always NONE." - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "type": [ - "string", - "null" - ] - }, - "decision_basis": {}, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "may_execute": { - "const": false, - "description": "Analyze never grants execute permission." - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "analyze" - }, - "receipt_kind": { - "const": "NONE", - "description": "Analyze never mints a receipt." - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (observation; not permission).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "analysis_outcome", - "authorization_effect", - "may_execute", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - }, - { - "additionalProperties": true, - "allOf": [ - { - "if": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind" - ] - }, - "then": { - "required": [ - "chain_receipt" - ] - } - }, - { - "if": { - "properties": { - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING" - ] - } - }, - "required": [ - "execution_action" - ] - }, - "then": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind", - "chain_receipt", - "decision_result" - ] - } - } - ], - "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "artifacts": { - "type": "array" - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "description": "Calibration model version when set; null until a calibrated model ships.", - "type": [ - "string", - "null" - ] - }, - "chain_receipt": { - "type": "string" - }, - "chain_status": { - "type": "string" - }, - "coderifts_version": { - "type": "string" - }, - "control_envelope": { - "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", - "type": "object" - }, - "decision": { - "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_basis": {}, - "decision_result": { - "additionalProperties": true, - "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", - "properties": { - "audience": { - "type": [ - "string", - "null" - ] - }, - "authority": { - "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", - "type": [ - "object", - "null" - ] - }, - "base": { - "type": [ - "string", - "null" - ] - }, - "blast_radius": { - "description": "ID27 additive COUNTS (not a score). Not permission.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "type": "object" - }, - "decision": { - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_body_hash": { - "type": [ - "string", - "null" - ] - }, - "decision_id": { - "type": "string" - }, - "derivation": { - "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", - "type": [ - "object", - "null" - ] - }, - "environment": { - "type": [ - "string", - "null" - ] - }, - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "expires_at": { - "type": "string" - }, - "fingerprint": { - "type": "string" - }, - "head": { - "type": [ - "string", - "null" - ] - }, - "input_fingerprint": { - "type": "string" - }, - "operation": { - "type": [ - "string", - "null" - ] - }, - "receipt": { - "type": "object" - }, - "repository": { - "type": [ - "string", - "null" - ] - }, - "safe_for_agent": { - "type": "boolean" - }, - "spec_version": { - "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", - "type": "string" - } - }, - "type": "object" - }, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "execution_action": { - "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "execution_grant": { - "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash. See docs/cr-exec-v1.md / docs/cr-exec-attest-v1.md.", - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "authorize" - }, - "receipt_kind": { - "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", - "enum": [ - "operation_authorization", - "NONE" - ], - "type": "string" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "safe_for_agent": { - "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", - "type": "boolean" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "decision", - "execution_action", - "safe_for_agent", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", + "not": { + "anyOf": [ + { + "required": [ + "decision" + ] + }, + { + "required": [ + "execution_action" + ] + }, + { + "required": [ + "safe_for_agent" + ] + }, + { + "required": [ + "chain_receipt" + ] + }, + { + "required": [ + "execution_grant" + ] + }, + { + "required": [ + "decision_result" + ] + }, + { + "required": [ + "control_envelope" + ] + }, + { + "required": [ + "required_action_core" + ] + } + ] + }, + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "analysis_control": { + "type": "object" + }, + "analysis_outcome": { + "description": "Closed analysis outcome set derived from engine-visible state only.", + "enum": [ + "NO_BREAK_DETECTED", + "BREAKS_DETECTED", + "ANALYSIS_FAILED" + ], + "type": "string" + }, + "artifacts": { + "type": "array" + }, + "authorization_effect": { + "const": "NONE", + "description": "Analyze never authorizes; always NONE." + }, + "blast_radius": { + "additionalProperties": false, + "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "type": [ + "string", + "null" + ] + }, + "decision_basis": {}, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "may_execute": { + "const": false, + "description": "Analyze never grants execute permission." + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "analyze" + }, + "receipt_kind": { + "const": "NONE", + "description": "Analyze never mints a receipt." + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (observation; not permission).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "analysis_outcome", + "authorization_effect", + "may_execute", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + }, + { + "additionalProperties": true, + "allOf": [ + { + "if": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind" + ] + }, + "then": { + "required": [ + "chain_receipt" + ] + } + }, + { + "if": { + "properties": { + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING" + ] + } + }, + "required": [ + "execution_action" + ] + }, + "then": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind", + "chain_receipt", + "decision_result" + ] + } + } + ], + "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "artifacts": { + "type": "array" + }, + "blast_radius": { + "additionalProperties": false, + "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "description": "Calibration model version when set; null until a calibrated model ships.", + "type": [ + "string", + "null" + ] + }, + "chain_receipt": { + "type": "string" + }, + "chain_status": { + "type": "string" + }, + "coderifts_version": { + "type": "string" + }, + "control_envelope": { + "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", + "type": "object" + }, + "decision": { + "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_basis": {}, + "decision_result": { + "additionalProperties": true, + "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", + "properties": { + "audience": { + "type": [ + "string", + "null" + ] + }, + "authority": { + "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", + "type": [ + "object", + "null" + ] + }, + "base": { + "type": [ + "string", + "null" + ] + }, + "blast_radius": { + "description": "ID27 additive COUNTS (not a score). Not permission.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "type": "object" + }, + "decision": { + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_body_hash": { + "type": [ + "string", + "null" + ] + }, + "decision_id": { + "type": "string" + }, + "derivation": { + "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", + "type": [ + "object", + "null" + ] + }, + "environment": { + "type": [ + "string", + "null" + ] + }, + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "expires_at": { + "type": "string" + }, + "fingerprint": { + "type": "string" + }, + "head": { + "type": [ + "string", + "null" + ] + }, + "input_fingerprint": { + "type": "string" + }, + "operation": { + "type": [ + "string", + "null" + ] + }, + "receipt": { + "type": "object" + }, + "repository": { + "type": [ + "string", + "null" + ] + }, + "safe_for_agent": { + "type": "boolean" + }, + "spec_version": { + "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", + "type": "string" + } + }, + "type": "object" + }, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "execution_action": { + "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "execution_grant": { + "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash.", + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "authorize" + }, + "receipt_kind": { + "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", + "enum": [ + "operation_authorization", + "NONE" + ], + "type": "string" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "safe_for_agent": { + "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", + "type": "boolean" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "decision", + "execution_action", + "safe_for_agent", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + } +]
- Changed
verify_receipt1 field changed- changed
Output schema / properties / correlation_id / descriptionPrevious value: -"Route-owned trace id (ID828); always a non-empty string on 200"New value: +"Route-owned trace id, set by the route itself rather than by correlation middleware; always a non-empty string on 200"
3 tool updates
- Changed
get_decision_details2 fields changed- changed
Output schema / properties / decision_result / properties / authority / descriptionPrevious value: -"ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL."New value: +"Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL." - changed
Output schema / properties / decision_result / properties / derivation / descriptionPrevious value: -"ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint."New value: +"Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint."
- Changed
preflight_change_set16 fields changed- changed
Input schema / properties / adapter_id / descriptionPrevious value: -"Adapter the executor will apply the change with, e.g. fs, postgres, git (cr.exec.v2)."New value: +"Authorize+grant v2 only. Adapter that will apply the change. Conventional values: fs, postgres, git. Must match the adapter the executor actually uses; a git grant does not authorize an fs write." - changed
Input schema / properties / artifacts / descriptionPrevious value: -"Contract artifacts to analyze together (max 20). Each is { id, type, before, after }."New value: +"1–20 contract documents analyzed together. Each item is {id, type, before, after} where before/after are the FULL document strings (YAML/JSON/proto text), not URLs or file paths. Omit this array entirely when derivation=\"server\"." - changed
Input schema / properties / artifacts / items / properties / after / descriptionPrevious value: -"Updated artifact content as a string"New value: +"The proposed document as raw text, same kind as before. Must be the bytes you intend to merge/deploy/publish, not a diff." - changed
Input schema / properties / artifacts / items / properties / before / descriptionPrevious value: -"Prior artifact content (spec/schema/manifest) as a string"New value: +"The baseline document as raw text (the spec/schema/manifest body). Empty string means \"no prior version\" (create), not \"load from disk\"." - added
Input schema / properties / artifacts / items / properties / type / descriptionAdded value: +"Artifact kind. One of openapi, graphql, grpc, asyncapi, mcp_manifest, agent_tools. Determines how before/after text is parsed. Not inferred from the filename." - changed
Input schema / properties / context / descriptionPrevious value: -"Optional apply-site context folded into the bundle fingerprint. operation distinguishes merge vs deploy vs publish (and other labels); the server accepts any string for operation (change-set.js) — conventional values below."New value: +"Optional apply-site context folded into the bundle fingerprint. operation distinguishes merge vs deploy vs publish (and other labels); the server accepts any non-empty string; conventional values: merge, deploy, tool_call, publish. The receipt/gate must match this label." - changed
Input schema / properties / derivation / descriptionPrevious value: -"Opt-in (ID637 6b). \"server\" = the server derives artifacts[] from GitHub Compare via the App installation. Allowed only when the tenant has a proven binding for context.repository and context.base + context.head are present. Omit artifacts[] (caller-supplied artifacts[] with this flag is 400 — one source of truth). Default absent = today's caller-artifacts path (byte-identical)."New value: +"\"server\" = the server derives artifacts[] from GitHub Compare via the App installation. Allowed only when context.repository, context.base and context.head are all present and the tenant has a proven binding for that repository. Do not send artifacts[] in the same call (400 — one source of truth). Omit this field for the caller-supplied artifacts[] path." - changed
Input schema / properties / executor_id / descriptionPrevious value: -"Identity of the executor the grant is bound to (cr.exec.v2)."New value: +"Authorize+grant v2 only. Executor identity the grant is bound to (example: agent:ci-bot, host:github-actions). Empty/absent is not \"any executor\"." - changed
Input schema / properties / expected_state_token / descriptionPrevious value: -"State token the executor expects to observe at apply time (cr.exec.v2). Signed as a separate field; empty string when absent."New value: +"Authorize+grant v2 only. Compare-and-swap token the executor must observe at apply time (the \"before\" state). Signed as its own field. Omit only if the adapter has no prior state; do not send a placeholder." - changed
Input schema / properties / include_execution_grant / descriptionPrevious value: -"Opt-in (authorize only). When true on allow-class authorize, the response includes a signed execution_grant (cr.exec.v1) alongside chain_receipt, or HTTP 503 SIGNER_UNAVAILABLE — never unsigned. Default false. Analyze ignores this flag. See docs/cr-exec-v1.md."New value: +"Authorize only. When true on an allow-class authorize, the response includes a signed execution_grant, or HTTP 503 SIGNER_UNAVAILABLE — never an unsigned grant. Default false. Analyze ignores this flag. Ignored unless preflight_mode=\"authorize\"." - changed
Input schema / properties / policy_hash / descriptionPrevious value: -"Policy identity the grant is issued under (cr.exec.v2). Bound into the signed grant when supplied."New value: +"Authorize+grant v2 only. Policy identity bound into the grant, sha256: + 64 hex. When supplied, apply must use that same policy; a different policy is a different grant." - changed
Input schema / properties / previous_receipt / descriptionPrevious value: -"Optional prior chain receipt token to link"New value: +"Optional prior chain token to LINK this call into a receipt chain: base64url(body).base64url(signature). Linking is not verification — a linked token is not re-checked here; use verify_receipt." - changed
Input schema / properties / state_nonce / descriptionPrevious value: -"Optional ATOMIC-profile nonce. When include_execution_grant is true, copied into the signed grant as state_nonce (a separate signed field — NOT folded into scope_hash). Absent → BEARER grant (today's default). See docs/cr-exec-v1.md."New value: +"Authorize+grant only. Opaque nonce copied into the signed grant as its own field (not folded into scope_hash). Absent → BEARER grant. Ignored unless include_execution_grant is true." - changed
Input schema / properties / target_uri / descriptionPrevious value: -"Target the grant is bound to (cr.exec.v2). Falls back to context.target_uri, then to a repository/head-derived value."New value: +"Authorize+grant v2 only. URI the grant binds (example: git://owner/repo.git/refs/heads/main). Fallback if omitted: context.target_uri, then repository/head-derived. Distinct from context.target_id." - changed
Input schema / properties / tenant_id / descriptionPrevious value: -"Tenant the grant is issued under (cr.exec.v2). Defaults to \"default\" when absent."New value: +"Authorize+grant v2 only. Tenant the grant is issued under. ASCII slug. When omitted the server uses \"default\" — pin it if you are not on the default tenant." - changed
Output schema / oneOfPrevious value: -[ - { - "additionalProperties": true, - "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", - "not": { - "anyOf": [ - { - "required": [ - "decision" - ] - }, - { - "required": [ - "execution_action" - ] - }, - { - "required": [ - "safe_for_agent" - ] - }, - { - "required": [ - "chain_receipt" - ] - }, - { - "required": [ - "execution_grant" - ] - }, - { - "required": [ - "decision_result" - ] - }, - { - "required": [ - "control_envelope" - ] - }, - { - "required": [ - "required_action_core" - ] - } - ] - }, - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "analysis_control": { - "type": "object" - }, - "analysis_outcome": { - "description": "Closed analysis outcome set derived from engine-visible state only.", - "enum": [ - "NO_BREAK_DETECTED", - "BREAKS_DETECTED", - "ANALYSIS_FAILED" - ], - "type": "string" - }, - "artifacts": { - "type": "array" - }, - "authorization_effect": { - "const": "NONE", - "description": "Analyze never authorizes; always NONE." - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "type": [ - "string", - "null" - ] - }, - "decision_basis": {}, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "may_execute": { - "const": false, - "description": "Analyze never grants execute permission." - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "analyze" - }, - "receipt_kind": { - "const": "NONE", - "description": "Analyze never mints a receipt." - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (observation; not permission).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "analysis_outcome", - "authorization_effect", - "may_execute", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - }, - { - "additionalProperties": true, - "allOf": [ - { - "if": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind" - ] - }, - "then": { - "required": [ - "chain_receipt" - ] - } - }, - { - "if": { - "properties": { - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING" - ] - } - }, - "required": [ - "execution_action" - ] - }, - "then": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind", - "chain_receipt", - "decision_result" - ] - } - } - ], - "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "artifacts": { - "type": "array" - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "description": "Calibration model version when set; null until a calibrated model ships.", - "type": [ - "string", - "null" - ] - }, - "chain_receipt": { - "type": "string" - }, - "chain_status": { - "type": "string" - }, - "coderifts_version": { - "type": "string" - }, - "control_envelope": { - "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", - "type": "object" - }, - "decision": { - "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_basis": {}, - "decision_result": { - "additionalProperties": true, - "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", - "properties": { - "audience": { - "type": [ - "string", - "null" - ] - }, - "authority": { - "description": "ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", - "type": [ - "object", - "null" - ] - }, - "base": { - "type": [ - "string", - "null" - ] - }, - "blast_radius": { - "description": "ID27 additive COUNTS (not a score). Not permission.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "type": "object" - }, - "decision": { - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_body_hash": { - "type": [ - "string", - "null" - ] - }, - "decision_id": { - "type": "string" - }, - "derivation": { - "description": "ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", - "type": [ - "object", - "null" - ] - }, - "environment": { - "type": [ - "string", - "null" - ] - }, - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "expires_at": { - "type": "string" - }, - "fingerprint": { - "type": "string" - }, - "head": { - "type": [ - "string", - "null" - ] - }, - "input_fingerprint": { - "type": "string" - }, - "operation": { - "type": [ - "string", - "null" - ] - }, - "receipt": { - "type": "object" - }, - "repository": { - "type": [ - "string", - "null" - ] - }, - "safe_for_agent": { - "type": "boolean" - }, - "spec_version": { - "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", - "type": "string" - } - }, - "type": "object" - }, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "execution_action": { - "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "execution_grant": { - "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash. See docs/cr-exec-v1.md / docs/cr-exec-attest-v1.md.", - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "authorize" - }, - "receipt_kind": { - "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", - "enum": [ - "operation_authorization", - "NONE" - ], - "type": "string" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "safe_for_agent": { - "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", - "type": "boolean" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "decision", - "execution_action", - "safe_for_agent", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", + "not": { + "anyOf": [ + { + "required": [ + "decision" + ] + }, + { + "required": [ + "execution_action" + ] + }, + { + "required": [ + "safe_for_agent" + ] + }, + { + "required": [ + "chain_receipt" + ] + }, + { + "required": [ + "execution_grant" + ] + }, + { + "required": [ + "decision_result" + ] + }, + { + "required": [ + "control_envelope" + ] + }, + { + "required": [ + "required_action_core" + ] + } + ] + }, + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "analysis_control": { + "type": "object" + }, + "analysis_outcome": { + "description": "Closed analysis outcome set derived from engine-visible state only.", + "enum": [ + "NO_BREAK_DETECTED", + "BREAKS_DETECTED", + "ANALYSIS_FAILED" + ], + "type": "string" + }, + "artifacts": { + "type": "array" + }, + "authorization_effect": { + "const": "NONE", + "description": "Analyze never authorizes; always NONE." + }, + "blast_radius": { + "additionalProperties": false, + "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "type": [ + "string", + "null" + ] + }, + "decision_basis": {}, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "may_execute": { + "const": false, + "description": "Analyze never grants execute permission." + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "analyze" + }, + "receipt_kind": { + "const": "NONE", + "description": "Analyze never mints a receipt." + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (observation; not permission).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "analysis_outcome", + "authorization_effect", + "may_execute", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + }, + { + "additionalProperties": true, + "allOf": [ + { + "if": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind" + ] + }, + "then": { + "required": [ + "chain_receipt" + ] + } + }, + { + "if": { + "properties": { + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING" + ] + } + }, + "required": [ + "execution_action" + ] + }, + "then": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind", + "chain_receipt", + "decision_result" + ] + } + } + ], + "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "artifacts": { + "type": "array" + }, + "blast_radius": { + "additionalProperties": false, + "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "description": "Calibration model version when set; null until a calibrated model ships.", + "type": [ + "string", + "null" + ] + }, + "chain_receipt": { + "type": "string" + }, + "chain_status": { + "type": "string" + }, + "coderifts_version": { + "type": "string" + }, + "control_envelope": { + "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", + "type": "object" + }, + "decision": { + "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_basis": {}, + "decision_result": { + "additionalProperties": true, + "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", + "properties": { + "audience": { + "type": [ + "string", + "null" + ] + }, + "authority": { + "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", + "type": [ + "object", + "null" + ] + }, + "base": { + "type": [ + "string", + "null" + ] + }, + "blast_radius": { + "description": "ID27 additive COUNTS (not a score). Not permission.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "type": "object" + }, + "decision": { + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_body_hash": { + "type": [ + "string", + "null" + ] + }, + "decision_id": { + "type": "string" + }, + "derivation": { + "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", + "type": [ + "object", + "null" + ] + }, + "environment": { + "type": [ + "string", + "null" + ] + }, + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "expires_at": { + "type": "string" + }, + "fingerprint": { + "type": "string" + }, + "head": { + "type": [ + "string", + "null" + ] + }, + "input_fingerprint": { + "type": "string" + }, + "operation": { + "type": [ + "string", + "null" + ] + }, + "receipt": { + "type": "object" + }, + "repository": { + "type": [ + "string", + "null" + ] + }, + "safe_for_agent": { + "type": "boolean" + }, + "spec_version": { + "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", + "type": "string" + } + }, + "type": "object" + }, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "execution_action": { + "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "execution_grant": { + "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash. See docs/cr-exec-v1.md / docs/cr-exec-attest-v1.md.", + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "authorize" + }, + "receipt_kind": { + "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", + "enum": [ + "operation_authorization", + "NONE" + ], + "type": "string" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "safe_for_agent": { + "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", + "type": "boolean" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "decision", + "execution_action", + "safe_for_agent", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + } +]
- Changed
verify_receipt2 fields changed- changed
Input schema / properties / decision_result / properties / authority / descriptionPrevious value: -"ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL."New value: +"Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL." - changed
Input schema / properties / decision_result / properties / derivation / descriptionPrevious value: -"ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint."New value: +"Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint."
1 tool update
- Changed
preflight_change_set5 fields changed- added
Input schema / properties / context / properties / target_uriAdded value: +{ + "description": "Optional apply-site URI the cr.exec.v2 grant binds (handler fallback: input.target_uri, then context.target_uri, then repository/head-derived). Distinct from target_id.", + "type": "string" +} - removed
Input schema / properties / grant_version / defaultRemoved value: -"v2" - changed
Input schema / properties / grant_version / descriptionPrevious value: -"Grant envelope to mint when include_execution_grant is true. MIGRATION: omitting this yields cr.exec.v1 until 2026-09-18 and cr.exec.v2 on and after it; the response carries grant_version_deprecation while the old default is still in effect. An explicit value always wins, before and after the cutoff — pin \"v1\" to keep the current behaviour with no code change on the date."New value: +"Grant envelope to mint when include_execution_grant is true. Omitting this yields cr.exec.v1 until 2026-09-18 and cr.exec.v2 on and after it (see x-coderifts-effective-default / x-coderifts-default-changes-at). The response meta.grant_version is the version actually issued. An explicit value always wins — pin \"v1\" to keep current behaviour with no code change on the date." - added
Input schema / properties / grant_version / x-coderifts-default-changes-atAdded value: +"2026-09-18" - added
Input schema / properties / grant_version / x-coderifts-effective-defaultAdded value: +"v1"
1 tool update
- Changed
preflight_change_set2 fields changed- added
Input schema / properties / grant_version / defaultAdded value: +"v2" - changed
Input schema / properties / grant_version / descriptionPrevious value: -"Grant envelope to mint when include_execution_grant is true. Default absent = v1."New value: +"Grant envelope to mint when include_execution_grant is true. MIGRATION: omitting this yields cr.exec.v1 until 2026-09-18 and cr.exec.v2 on and after it; the response carries grant_version_deprecation while the old default is still in effect. An explicit value always wins, before and after the cutoff — pin \"v1\" to keep the current behaviour with no code change on the date."
1 tool update
- Changed
verify_receipt1 field changed- changed
Output schema / properties / status / enumPrevious value: -[ - "VERIFIED_CURRENT", - "VERIFIED_EXPIRED", - "VERIFIED_WRONG_AUDIENCE", - "VERIFIED_WRONG_ENVIRONMENT", - "VERIFIED_SUPERSEDED", - "VERIFIED_SCOPE_MISMATCH", - "UNKNOWN_KEY", - "RETIRED_KEY_VALID_AT_ISSUE", - "INVALID_SIGNATURE", - "MALFORMED", - "UNSUPPORTED_VERSION", - "REGISTRY_UNREACHABLE" -]New value: +[ + "VERIFIED_CURRENT", + "VERIFIED_EXPIRED", + "VERIFIED_WRONG_AUDIENCE", + "VERIFIED_WRONG_ENVIRONMENT", + "VERIFIED_SUPERSEDED", + "VERIFIED_SCOPE_MISMATCH", + "VERIFIED_UNBOUND_OPERATION", + "VERIFIED_UNBOUND_TARGET", + "VERIFIED_UNBOUND_REPOSITORY", + "VERIFIED_UNBOUND_BRANCH", + "VERIFIED_UNBOUND_PULL_REQUEST", + "UNKNOWN_KEY", + "UNKNOWN_KEY_STATUS", + "RETIRED_KEY_VALID_AT_ISSUE", + "KEY_RETIRED_AFTER_SIGNING", + "REVOKED_KEY", + "REVOKED_KEY_UNDECIDABLE", + "KEY_REVOKED", + "REVOCATION_UNDECIDABLE", + "AUTHORIZATION_UNDECIDABLE", + "INVALID_SIGNATURE", + "MALFORMED", + "UNSUPPORTED_VERSION", + "REGISTRY_UNREACHABLE" +]
1 tool update
- Changed
preflight_change_set8 fields changed- added
Input schema / properties / adapter_idAdded value: +{ + "description": "Adapter the executor will apply the change with, e.g. fs, postgres, git (cr.exec.v2).", + "type": "string" +} - added
Input schema / properties / audienceAdded value: +{ + "description": "Requester identity for the decision envelope. Accepted here; the server-derived audience wins when both are present.", + "type": "string" +} - added
Input schema / properties / executor_idAdded value: +{ + "description": "Identity of the executor the grant is bound to (cr.exec.v2).", + "type": "string" +} - added
Input schema / properties / expected_state_tokenAdded value: +{ + "description": "State token the executor expects to observe at apply time (cr.exec.v2). Signed as a separate field; empty string when absent.", + "type": "string" +} - added
Input schema / properties / grant_versionAdded value: +{ + "description": "Grant envelope to mint when include_execution_grant is true. Default absent = v1.", + "enum": [ + "v1", + "v2" + ], + "type": "string" +} - added
Input schema / properties / policy_hashAdded value: +{ + "description": "Policy identity the grant is issued under (cr.exec.v2). Bound into the signed grant when supplied.", + "type": "string" +} - added
Input schema / properties / target_uriAdded value: +{ + "description": "Target the grant is bound to (cr.exec.v2). Falls back to context.target_uri, then to a repository/head-derived value.", + "type": "string" +} - added
Input schema / properties / tenant_idAdded value: +{ + "description": "Tenant the grant is issued under (cr.exec.v2). Defaults to \"default\" when absent.", + "type": "string" +}
1 tool update
- Changed
preflight_change_set1 field changed- changed
Output schema / oneOfPrevious value: -[ - { - "additionalProperties": true, - "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", - "not": { - "anyOf": [ - { - "required": [ - "decision" - ] - }, - { - "required": [ - "execution_action" - ] - }, - { - "required": [ - "safe_for_agent" - ] - }, - { - "required": [ - "chain_receipt" - ] - }, - { - "required": [ - "execution_grant" - ] - }, - { - "required": [ - "decision_result" - ] - }, - { - "required": [ - "control_envelope" - ] - }, - { - "required": [ - "required_action_core" - ] - } - ] - }, - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of flat analysis fields present on the verdict plus remediations[]. ANALYSIS_TIER_FIELDS subset when present; not a closed property set.", - "type": "object" - }, - "analysis_control": { - "type": "object" - }, - "analysis_outcome": { - "description": "Closed analysis outcome set derived from engine-visible state only.", - "enum": [ - "NO_BREAK_DETECTED", - "BREAKS_DETECTED", - "ANALYSIS_FAILED" - ], - "type": "string" - }, - "artifacts": { - "type": "array" - }, - "authorization_effect": { - "const": "NONE", - "description": "Analyze never authorizes; always NONE." - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "type": [ - "string", - "null" - ] - }, - "decision_basis": {}, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "may_execute": { - "const": false, - "description": "Analyze never grants execute permission." - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "analyze" - }, - "receipt_kind": { - "const": "NONE", - "description": "Analyze never mints a receipt." - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (observation; not permission).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "analysis_outcome", - "authorization_effect", - "may_execute", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - }, - { - "additionalProperties": true, - "allOf": [ - { - "if": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind" - ] - }, - "then": { - "required": [ - "chain_receipt" - ] - } - }, - { - "if": { - "properties": { - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING" - ] - } - }, - "required": [ - "execution_action" - ] - }, - "then": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind", - "chain_receipt", - "decision_result" - ] - } - } - ], - "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of flat analysis fields present on the verdict plus remediations[]. ANALYSIS_TIER_FIELDS subset when present; not a closed property set.", - "type": "object" - }, - "artifacts": { - "type": "array" - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "description": "Calibration model version when set; null until a calibrated model ships.", - "type": [ - "string", - "null" - ] - }, - "chain_receipt": { - "type": "string" - }, - "chain_status": { - "type": "string" - }, - "coderifts_version": { - "type": "string" - }, - "control_envelope": { - "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", - "type": "object" - }, - "decision": { - "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_basis": {}, - "decision_result": { - "additionalProperties": true, - "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", - "properties": { - "audience": { - "type": [ - "string", - "null" - ] - }, - "authority": { - "description": "ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", - "type": [ - "object", - "null" - ] - }, - "base": { - "type": [ - "string", - "null" - ] - }, - "blast_radius": { - "description": "ID27 additive COUNTS (not a score). Not permission.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "type": "object" - }, - "decision": { - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_body_hash": { - "type": [ - "string", - "null" - ] - }, - "decision_id": { - "type": "string" - }, - "derivation": { - "description": "ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", - "type": [ - "object", - "null" - ] - }, - "environment": { - "type": [ - "string", - "null" - ] - }, - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "expires_at": { - "type": "string" - }, - "fingerprint": { - "type": "string" - }, - "head": { - "type": [ - "string", - "null" - ] - }, - "input_fingerprint": { - "type": "string" - }, - "operation": { - "type": [ - "string", - "null" - ] - }, - "receipt": { - "type": "object" - }, - "repository": { - "type": [ - "string", - "null" - ] - }, - "safe_for_agent": { - "type": "boolean" - }, - "spec_version": { - "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", - "type": "string" - } - }, - "type": "object" - }, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "execution_action": { - "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "execution_grant": { - "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash. See docs/cr-exec-v1.md / docs/cr-exec-attest-v1.md.", - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "authorize" - }, - "receipt_kind": { - "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", - "enum": [ - "operation_authorization", - "NONE" - ], - "type": "string" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "safe_for_agent": { - "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", - "type": "boolean" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "decision", - "execution_action", - "safe_for_agent", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", + "not": { + "anyOf": [ + { + "required": [ + "decision" + ] + }, + { + "required": [ + "execution_action" + ] + }, + { + "required": [ + "safe_for_agent" + ] + }, + { + "required": [ + "chain_receipt" + ] + }, + { + "required": [ + "execution_grant" + ] + }, + { + "required": [ + "decision_result" + ] + }, + { + "required": [ + "control_envelope" + ] + }, + { + "required": [ + "required_action_core" + ] + } + ] + }, + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "analysis_control": { + "type": "object" + }, + "analysis_outcome": { + "description": "Closed analysis outcome set derived from engine-visible state only.", + "enum": [ + "NO_BREAK_DETECTED", + "BREAKS_DETECTED", + "ANALYSIS_FAILED" + ], + "type": "string" + }, + "artifacts": { + "type": "array" + }, + "authorization_effect": { + "const": "NONE", + "description": "Analyze never authorizes; always NONE." + }, + "blast_radius": { + "additionalProperties": false, + "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "type": [ + "string", + "null" + ] + }, + "decision_basis": {}, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "may_execute": { + "const": false, + "description": "Analyze never grants execute permission." + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "analyze" + }, + "receipt_kind": { + "const": "NONE", + "description": "Analyze never mints a receipt." + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (observation; not permission).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "analysis_outcome", + "authorization_effect", + "may_execute", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + }, + { + "additionalProperties": true, + "allOf": [ + { + "if": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind" + ] + }, + "then": { + "required": [ + "chain_receipt" + ] + } + }, + { + "if": { + "properties": { + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING" + ] + } + }, + "required": [ + "execution_action" + ] + }, + "then": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind", + "chain_receipt", + "decision_result" + ] + } + } + ], + "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "artifacts": { + "type": "array" + }, + "blast_radius": { + "additionalProperties": false, + "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "description": "Calibration model version when set; null until a calibrated model ships.", + "type": [ + "string", + "null" + ] + }, + "chain_receipt": { + "type": "string" + }, + "chain_status": { + "type": "string" + }, + "coderifts_version": { + "type": "string" + }, + "control_envelope": { + "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", + "type": "object" + }, + "decision": { + "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_basis": {}, + "decision_result": { + "additionalProperties": true, + "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", + "properties": { + "audience": { + "type": [ + "string", + "null" + ] + }, + "authority": { + "description": "ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", + "type": [ + "object", + "null" + ] + }, + "base": { + "type": [ + "string", + "null" + ] + }, + "blast_radius": { + "description": "ID27 additive COUNTS (not a score). Not permission.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "type": "object" + }, + "decision": { + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_body_hash": { + "type": [ + "string", + "null" + ] + }, + "decision_id": { + "type": "string" + }, + "derivation": { + "description": "ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", + "type": [ + "object", + "null" + ] + }, + "environment": { + "type": [ + "string", + "null" + ] + }, + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "expires_at": { + "type": "string" + }, + "fingerprint": { + "type": "string" + }, + "head": { + "type": [ + "string", + "null" + ] + }, + "input_fingerprint": { + "type": "string" + }, + "operation": { + "type": [ + "string", + "null" + ] + }, + "receipt": { + "type": "object" + }, + "repository": { + "type": [ + "string", + "null" + ] + }, + "safe_for_agent": { + "type": "boolean" + }, + "spec_version": { + "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", + "type": "string" + } + }, + "type": "object" + }, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "execution_action": { + "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "execution_grant": { + "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash. See docs/cr-exec-v1.md / docs/cr-exec-attest-v1.md.", + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "authorize" + }, + "receipt_kind": { + "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", + "enum": [ + "operation_authorization", + "NONE" + ], + "type": "string" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "safe_for_agent": { + "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", + "type": "boolean" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "decision", + "execution_action", + "safe_for_agent", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + } +]
3 tool updates
- Changed
get_decision_details1 field changed- changed
Output schema / properties / decision_result / properties / derivation / descriptionPrevious value: -"ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source: github_compare, base_sha, head_sha }. Covered by body_hash; not fingerprint."New value: +"ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint."
- Changed
preflight_change_set1 field changed- changed
Output schema / oneOfPrevious value: -[ - { - "additionalProperties": true, - "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", - "not": { - "anyOf": [ - { - "required": [ - "decision" - ] - }, - { - "required": [ - "execution_action" - ] - }, - { - "required": [ - "safe_for_agent" - ] - }, - { - "required": [ - "chain_receipt" - ] - }, - { - "required": [ - "execution_grant" - ] - }, - { - "required": [ - "decision_result" - ] - }, - { - "required": [ - "control_envelope" - ] - }, - { - "required": [ - "required_action_core" - ] - } - ] - }, - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of flat analysis fields present on the verdict plus remediations[]. ANALYSIS_TIER_FIELDS subset when present; not a closed property set.", - "type": "object" - }, - "analysis_control": { - "type": "object" - }, - "analysis_outcome": { - "description": "Closed analysis outcome set derived from engine-visible state only.", - "enum": [ - "NO_BREAK_DETECTED", - "BREAKS_DETECTED", - "ANALYSIS_FAILED" - ], - "type": "string" - }, - "artifacts": { - "type": "array" - }, - "authorization_effect": { - "const": "NONE", - "description": "Analyze never authorizes; always NONE." - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "type": [ - "string", - "null" - ] - }, - "decision_basis": {}, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "may_execute": { - "const": false, - "description": "Analyze never grants execute permission." - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "analyze" - }, - "receipt_kind": { - "const": "NONE", - "description": "Analyze never mints a receipt." - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (observation; not permission).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "analysis_outcome", - "authorization_effect", - "may_execute", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - }, - { - "additionalProperties": true, - "allOf": [ - { - "if": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind" - ] - }, - "then": { - "required": [ - "chain_receipt" - ] - } - }, - { - "if": { - "properties": { - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING" - ] - } - }, - "required": [ - "execution_action" - ] - }, - "then": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind", - "chain_receipt", - "decision_result" - ] - } - } - ], - "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of flat analysis fields present on the verdict plus remediations[]. ANALYSIS_TIER_FIELDS subset when present; not a closed property set.", - "type": "object" - }, - "artifacts": { - "type": "array" - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "description": "Calibration model version when set; null until a calibrated model ships.", - "type": [ - "string", - "null" - ] - }, - "chain_receipt": { - "type": "string" - }, - "chain_status": { - "type": "string" - }, - "coderifts_version": { - "type": "string" - }, - "control_envelope": { - "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", - "type": "object" - }, - "decision": { - "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_basis": {}, - "decision_result": { - "additionalProperties": true, - "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", - "properties": { - "audience": { - "type": [ - "string", - "null" - ] - }, - "authority": { - "description": "ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", - "type": [ - "object", - "null" - ] - }, - "base": { - "type": [ - "string", - "null" - ] - }, - "blast_radius": { - "description": "ID27 additive COUNTS (not a score). Not permission.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "type": "object" - }, - "decision": { - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_body_hash": { - "type": [ - "string", - "null" - ] - }, - "decision_id": { - "type": "string" - }, - "derivation": { - "description": "ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source: github_compare, base_sha, head_sha }. Covered by body_hash; not fingerprint.", - "type": [ - "object", - "null" - ] - }, - "environment": { - "type": [ - "string", - "null" - ] - }, - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "expires_at": { - "type": "string" - }, - "fingerprint": { - "type": "string" - }, - "head": { - "type": [ - "string", - "null" - ] - }, - "input_fingerprint": { - "type": "string" - }, - "operation": { - "type": [ - "string", - "null" - ] - }, - "receipt": { - "type": "object" - }, - "repository": { - "type": [ - "string", - "null" - ] - }, - "safe_for_agent": { - "type": "boolean" - }, - "spec_version": { - "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", - "type": "string" - } - }, - "type": "object" - }, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "execution_action": { - "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "execution_grant": { - "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash. See docs/cr-exec-v1.md / docs/cr-exec-attest-v1.md.", - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "authorize" - }, - "receipt_kind": { - "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", - "enum": [ - "operation_authorization", - "NONE" - ], - "type": "string" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "safe_for_agent": { - "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", - "type": "boolean" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "decision", - "execution_action", - "safe_for_agent", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", + "not": { + "anyOf": [ + { + "required": [ + "decision" + ] + }, + { + "required": [ + "execution_action" + ] + }, + { + "required": [ + "safe_for_agent" + ] + }, + { + "required": [ + "chain_receipt" + ] + }, + { + "required": [ + "execution_grant" + ] + }, + { + "required": [ + "decision_result" + ] + }, + { + "required": [ + "control_envelope" + ] + }, + { + "required": [ + "required_action_core" + ] + } + ] + }, + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of flat analysis fields present on the verdict plus remediations[]. ANALYSIS_TIER_FIELDS subset when present; not a closed property set.", + "type": "object" + }, + "analysis_control": { + "type": "object" + }, + "analysis_outcome": { + "description": "Closed analysis outcome set derived from engine-visible state only.", + "enum": [ + "NO_BREAK_DETECTED", + "BREAKS_DETECTED", + "ANALYSIS_FAILED" + ], + "type": "string" + }, + "artifacts": { + "type": "array" + }, + "authorization_effect": { + "const": "NONE", + "description": "Analyze never authorizes; always NONE." + }, + "blast_radius": { + "additionalProperties": false, + "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "type": [ + "string", + "null" + ] + }, + "decision_basis": {}, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "may_execute": { + "const": false, + "description": "Analyze never grants execute permission." + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "analyze" + }, + "receipt_kind": { + "const": "NONE", + "description": "Analyze never mints a receipt." + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (observation; not permission).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "analysis_outcome", + "authorization_effect", + "may_execute", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + }, + { + "additionalProperties": true, + "allOf": [ + { + "if": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind" + ] + }, + "then": { + "required": [ + "chain_receipt" + ] + } + }, + { + "if": { + "properties": { + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING" + ] + } + }, + "required": [ + "execution_action" + ] + }, + "then": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind", + "chain_receipt", + "decision_result" + ] + } + } + ], + "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of flat analysis fields present on the verdict plus remediations[]. ANALYSIS_TIER_FIELDS subset when present; not a closed property set.", + "type": "object" + }, + "artifacts": { + "type": "array" + }, + "blast_radius": { + "additionalProperties": false, + "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "description": "Calibration model version when set; null until a calibrated model ships.", + "type": [ + "string", + "null" + ] + }, + "chain_receipt": { + "type": "string" + }, + "chain_status": { + "type": "string" + }, + "coderifts_version": { + "type": "string" + }, + "control_envelope": { + "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", + "type": "object" + }, + "decision": { + "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_basis": {}, + "decision_result": { + "additionalProperties": true, + "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", + "properties": { + "audience": { + "type": [ + "string", + "null" + ] + }, + "authority": { + "description": "ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", + "type": [ + "object", + "null" + ] + }, + "base": { + "type": [ + "string", + "null" + ] + }, + "blast_radius": { + "description": "ID27 additive COUNTS (not a score). Not permission.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "type": "object" + }, + "decision": { + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_body_hash": { + "type": [ + "string", + "null" + ] + }, + "decision_id": { + "type": "string" + }, + "derivation": { + "description": "ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", + "type": [ + "object", + "null" + ] + }, + "environment": { + "type": [ + "string", + "null" + ] + }, + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "expires_at": { + "type": "string" + }, + "fingerprint": { + "type": "string" + }, + "head": { + "type": [ + "string", + "null" + ] + }, + "input_fingerprint": { + "type": "string" + }, + "operation": { + "type": [ + "string", + "null" + ] + }, + "receipt": { + "type": "object" + }, + "repository": { + "type": [ + "string", + "null" + ] + }, + "safe_for_agent": { + "type": "boolean" + }, + "spec_version": { + "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", + "type": "string" + } + }, + "type": "object" + }, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "execution_action": { + "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "execution_grant": { + "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash. See docs/cr-exec-v1.md / docs/cr-exec-attest-v1.md.", + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "authorize" + }, + "receipt_kind": { + "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", + "enum": [ + "operation_authorization", + "NONE" + ], + "type": "string" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "safe_for_agent": { + "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", + "type": "boolean" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "decision", + "execution_action", + "safe_for_agent", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + } +]
- Changed
verify_receipt1 field changed- changed
Input schema / properties / decision_result / properties / derivation / descriptionPrevious value: -"ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source: github_compare, base_sha, head_sha }. Covered by body_hash; not fingerprint."New value: +"ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint."
Related MCP Connectors
Deterministic authorization for one proposed AI agent action, returned with a signed receipt.
- kanonikOAuthai.kanonik
Governance runtime for compliance: verified, human-approved writes to a tamper-evident record.
Governed AI actions with signed, verifiable receipts: free keyless reads, human-approved writes.
Post-quantum, tamper-evident receipts for agent actions. Ed25519 + ML-DSA-65, offline verify.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceProvides cryptographic governance receipts for AI agents, enabling pre-execution evaluation and signed verdicts (EXECUTE/BLOCK/REVIEW/SHADOW) with offline-verifiable audit trails.MIT
emilia-mcp-serverofficial
AlicenseAqualityAmaintenanceThe accountability layer for AI agents — a named human's signed yes before an agent does anything irreversible (payment, record change, deploy), then an offline-verifiable Trust Receipt. Apache-2.0, formally verified.3615Apache 2.0- AlicenseAqualityCmaintenanceCryptographic proof of consent for AI agents. Sign before you act. Policy engine enforces spending caps, action whitelists, and escalation rules. Independently verifiable by anyone.102Apache 2.0
Try in Browser
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd
Glama MCP Gateway
Add one secure layer between your agents and this server.