A
licenseNot graded
qualityD
maintenanceProvides cryptographic governance receipts for AI agents, enabling pre-execution evaluation and signed verdicts (EXECUTE/BLOCK/REVIEW/SHADOW) with offline-verifiable audit trails.
MIT
CodeRifts
Server Details
Contract-change authorization for AI agents: preflight a change to an API or MCP contract, get a signed decision, and verify the receipt offline. Only a granted change can proceed.
Ownership verified
- Status
- Healthy
- Uptime
- 99.6% over 59 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-06-18
- URL
- Repository
- coderifts/api-governance
- GitHub Stars
- 0
- Server Listing
- CodeRifts API Governance
TDQS
A4.8/5.0
Scored across 3 tools
Disambiguation5/5
Each tool has a clearly distinct lifecycle role: preflight_change_set creates a new decision, get_decision_details retrieves a past decision by identifier, and verify_receipt validates an existing receipt token. The descriptions explicitly cross-reference each other and list when not to use a tool, eliminating ambiguity.
Naming Consistency5/5
All three tools follow a consistent verb_noun snake_case pattern: get_decision_details, preflight_change_set, verify_receipt. The naming convention is uniform and predictable, with no mixed styles or vague verbs.
Tool Count4/5
Three tools is on the low end but well-scoped for the narrow domain of CodeRifts decision lifecycle: create, read, and verify. The set is not as minimal as one or two tools, and each earns its place, though a slightly broader governance surface might expect more.
Completeness4/5
The core workflow is covered: preflight a change set, retrieve past decision details, and verify receipt validity. Minor gaps exist—there is no list/search tool or explicit revocation tool—but agents can accomplish the primary governance tasks without dead ends.
Available Tools
3 toolsget_decision_detailsARead-onlyInspect
Retrieve a PAST CodeRifts decision by exactly one identifier (case_id | decision_id | fingerprint): full report, breaking changes, scores, and linked receipt metadata if stored.
Use this when:
You have a decision_id (or fingerprint) from a previous preflight, PR comment, or CI log and need to inspect or explain that past decision.
You are auditing why a prior ALLOW/WARN/BLOCK was issued.
You are NOT requesting a new analysis of current before/after specs.
Do not use when:
You need a decision for the CURRENT uncommitted or PR head change set — call coderifts.preflight_change_set with the current artifacts.
You hold a receipt token and only need cryptographic/lifecycle verification — use coderifts.verify_receipt.
You have no identifier — run preflight first to create one.
Inputs: exactly one of case_id, decision_id, or fingerprint. {} → INVALID_INPUT; two identifiers → LOOKUP_IDENTIFIER_CONFLICT; case_id → CASE_NOT_FOUND (lookup never opens a case). Returns the stored document or not_found.
Scoping — fingerprint lookup returns only YOUR OWN decisions. A fingerprint is derived from content, not from an account, so two callers who preflight byte-identical specs derive the same one; the lookup is therefore constrained to the decisions your credential can prove it owns.
A decision that exists but is not yours returns the SAME not_found as one that was never issued. This is deliberate: a distinguishable "exists but forbidden" would confirm to any caller that a given content hash had been decided on by someone, which is the fact the scoping exists to withhold. Do not read not_found as proof that no such decision exists anywhere.
Decisions persisted without context.repository cannot currently be attributed to an account, and are not retrievable by fingerprint at all — not by their owner either. Retrieve those by decision_id, which is unchanged and unscoped. This is a limitation of what older stored rows carry, not a property of the lookup: rows written from now on record the account directly, so the gap narrows as older rows age out. If a fingerprint you expect returns not_found, use the decision_id before concluding the decision is missing.
When the stored envelope carries control fields, control_envelope.next_agent_step is structured remediation guidance the agent MAY follow for non-CONTINUE execution_action values (null on CONTINUE*). Still branch on execution_action; next_agent_step is a suggestion, not permission.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | No | A case identifier. Lookup never opens a case. Until the case store exists this returns CASE_NOT_FOUND. | |
| decision_id | No | The decision_id from a prior decision_result envelope. Provide exactly one identifier. | |
| fingerprint | No | A verdict fingerprint (sha256:...); returns the latest matching decision you own. Provide exactly one identifier. |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
| meta | Yes | |
| decision | No | |
| evidence | No | |
| patterns | No | |
| operation | No | |
| timestamp | No | |
| risk_score | No | |
| receipt_kind | No | |
| chain_receipt | No | |
| preflight_mode | No | |
| safe_for_agent | No | |
| decision_result | Yes | decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json). |
| pattern_sources | No | |
| breaking_changes | No | |
| control_envelope | No | Control envelope (control/1.0) derived from the stored decision_result. Includes next_agent_step (structured remediation SUGGESTION for non-CONTINUE execution_action; null on CONTINUE*; not permission — still branch on execution_action). |
| evidence_quality | No | |
| execution_action | No | |
| coderifts_version | No | |
| requires_migration | No | |
| verdict_fingerprint | No | |
| required_action_core | No | Branchable required-action core { type, reason_code, recheck_required } when present on the envelope. |
| decision_spec_version | No | |
| decision_semantic_hash | No |
TDQS
A4.9/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=true and openWorldHint=false; the description adds substantial behavioral detail beyond that. It explains fingerprint scoping (only your own decisions), the deliberate indistinguishability of 'exists but not yours' from 'never existed', the limitation on decisions without context.repository, and the meaning of control_envelope.next_agent_step. All of this is non-obvious operational behavior that an agent must know to interpret results correctly. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long, but it is well-structured with clear sections ('Use this when', 'Do not use when', 'Inputs', 'Scoping') and the core purpose is front-loaded in the first sentence. Every paragraph adds necessary nuance for a sensitive lookup tool. It could be marginally tightened (e.g., merging some sentences), but the structure earns a 4.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers all aspects an agent needs: what the tool does, when to use it, error behavior, scoping/privacy implications, handling of stale rows, and even guidance on how to interpret the returned envelope's next_agent_step. An output schema exists, so return-value structure is already defined, but the description adds behavioral expectations (not_found semantics) and disambiguation of edge cases. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Although the input schema already has 100% coverage and detailed per-parameter descriptions, the tool description adds critical semantic context: the exact-mutex rule (exactly one identifier), the concrete error codes for each violation (INVALID_INPUT, LOOKUP_IDENTIFIER_CONFLICT, CASE_NOT_FOUND), and the nuanced behavior of fingerprint lookup (only yours, same not_found for others). This goes beyond the schema's structural description and provides actionable guidance on how to use the parameters and interpret edge cases.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a concrete verb-resource statement: 'Retrieve a PAST CodeRifts decision by exactly one identifier (case_id | decision_id | fingerprint).' It specifies what the tool returns (full report, breaking changes, scores, receipt metadata) and immediately contrasts with siblings by naming preflight_change_set and verify_receipt in the 'Do not use' block. This leaves no ambiguity about what the tool does and how it differs from its neighbors.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly enumerates three 'Use this when' scenarios and three 'Do not use when' scenarios, each naming the alternative tool and the condition that selects it (e.g., 'call coderifts.preflight_change_set' for current changes, 'coderifts.verify_receipt' for receipt verification). This is the highest clarity bar: an agent can decide without reading any other tool's schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
preflight_change_setAInspect
Use this when: a contract artifact (OpenAPI, GraphQL, protobuf, AsyncAPI, MCP manifests, or agent tool schemas) changes before merge, deploy, publish, or tool registration; AND any agent-executed operation with no supported contract type — send type agent_operation. Do not call for documentation-only changes, static readiness scoring, or receipt verification. Use analyze for risk only; authorize requires context.operation. Skipping this call is not permission. Absence of a key is not permission. Inputs: preflight_mode is required: "analyze" (risk only; no receipt, no execution_action) or "authorize" (may mint a receipt; requires context.operation — merge is not deploy is not publish). Supply exactly one artifact source: artifacts[] (1–20 items, each {id, type, before, after} as the FULL spec/schema text, not a path or URL; type is openapi|graphql|grpc|asyncapi|mcp_manifest|agent_tools|agent_operation) XOR derivation="server" (server reads GitHub Compare; needs context.repository + context.base + context.head; sending artifacts[] together is 400). Grant fields sit in one object, execution_grant_request {include_execution_grant, grant_version, tenant_id, executor_id, adapter_id, target_uri, expected_state_token, state_nonce, audience, policy_hash}; analyze ignores it; required is preflight_mode only. previous_receipt is a chain token base64url(body).base64url(signature) to LINK a prior decision — it does not re-verify; use coderifts.verify_receipt instead; for details of a past decision use coderifts.get_decision_details instead. idempotency_key replays authorize only (24h), never analyze.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | Optional apply-site context folded into the bundle fingerprint. operation distinguishes merge vs deploy vs publish (and other labels); the server accepts any non-empty string; conventional values: merge, deploy, tool_call, publish. The receipt/gate must match this label. | |
| artifacts | No | 1–20 contract documents analyzed together. Each item is {id, type, before, after} where before/after are the FULL document strings (YAML/JSON/proto text), not URLs or file paths. Omit this array entirely when derivation="server". | |
| derivation | No | "server" = the server derives artifacts[] from GitHub Compare via the App installation. Allowed only when context.repository, context.base and context.head are all present and the tenant has a proven binding for that repository. Do not send artifacts[] in the same call (400 — one source of truth). Omit this field for the caller-supplied artifacts[] path. | |
| preflight_mode | Yes | REQUIRED. "analyze" = informational risk only (no decision/execution_action/safe_for_agent; analysis_outcome + may_execute:false). "authorize" = operation-bound path; may mint a receipt (requires context.operation). Decision Spec 2.0: omission is INVALID_INPUT. Do not pin 1.0 — that pin retired. | |
| idempotency_key | No | Optional client key; in authorize mode, a repeat with the same key + body replays the original decision (24h). Analyze responses are not replayed. | |
| response_detail | No | How much of the response to return. control = the fields an agent branches on; standard = control + the human report and labelled break rows (the MCP default); full = everything (the REST default). Every value is copied from the full response. | |
| previous_receipt | No | Optional prior chain token to LINK this call into a receipt chain: base64url(body).base64url(signature). Linking is not verification — a linked token is not re-checked here; use verify_receipt. | |
| decision_spec_version | No | Optional. Omit or '2.0' = current contract. '1.0' retired (INVALID_INPUT); do not pin 1.0. | |
| execution_grant_request | No | Authorize + include_execution_grant only: the execution-grant request fields. Analyze ignores them. Flat root-level spellings are also accepted; the same field sent both ways with different values is INVALID_INPUT. |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
A4.9/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=false and openWorldHint=false, so the description carries the behavioral burden. It discloses key traits: analyze ignores execution_grant_request, authorize may mint a receipt, idempotency_key only replays authorize, previous_receipt links without re-verifying, and sending artifacts[] with derivation='server' returns 400. It also states 'Skipping this call is not permission' and 'Absence of a key is not permission', which are important strictness signals. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long, but every sentence carries an operational constraint or routing rule; there is no filler. It is front-loaded with use cases and exclusions before diving into parameters. It could be improved with clearer formatting/bullets, but given the tool's conditional schema and nine parameters, the density is justified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with a conditional schema, nested execution_grant_request, XOR artifact sources, and sibling routing, the description covers trigger conditions, exclusion cases, mode semantics, idempotency behavior, grant behavior, and the distinction between linking and verifying receipts. The output schema exists to cover return values, so no critical information is missing for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and each parameter already has rich descriptions, so the baseline is 3. The description adds high-value semantic context beyond the schema: before/after must be the FULL spec text, not paths or URLs; exactly one artifact source is required (artifacts[] XOR derivation='server'); grant fields sit in execution_grant_request; and previous_receipt is a chain link, not verification. These clarifications materially improve an agent's ability to populate the tool correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific purpose: evaluating contract artifacts (OpenAPI, GraphQL, protobuf, AsyncAPI, MCP manifests, agent tool schemas) before merge, deploy, publish, or tool registration, with analyze vs authorize modes. It also distinguishes itself by naming what it is not for (receipt verification, static readiness) and referencing the sibling tools verify_receipt and get_decision_details, so an agent can tell it apart from them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use triggers ('when a contract artifact changes before merge, deploy, publish, or tool registration'), explicit exclusions ('Do not call for documentation-only changes, static readiness scoring, or receipt verification'), and clear routing between analyze vs authorize. It also points to verify_receipt and get_decision_details for adjacent operations, leaving no ambiguity about which tool to choose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_receiptARead-onlyInspect
Verify a CodeRifts signed chain-receipt you ALREADY HOLD: cryptographic authenticity (signature + key id), body binding, and — when lifecycle indices are available — whether it is currently valid authorization (not expired, superseded, or revoked) for a stated operation/target.
Use this when:
You already obtained a chain_receipt / receipt token from a prior preflight (or CI artifact) and are about to act (merge/deploy) under that receipt.
A contract-gate or policy requires offline/online proof that the receipt is authentic for this change before proceeding.
You must distinguish "signature ok" from "currently authorized" (stale or superseded receipts must not be treated as live approval).
Do not use when:
You do not have a receipt yet — call coderifts.preflight_change_set first.
You need a NEW decision for a changed base→head set — preflight again; verify_receipt does not re-diff specs.
The receipt you hold binds a different operation or target than the one you are about to perform — call coderifts.preflight_change_set with context.operation set to that operation (a merge receipt does not authorize a deploy); verify_receipt cannot re-scope or re-issue a decision.
You only need human-readable history of an old decision_id without a receipt token — use coderifts.get_decision_details.
The change set itself is unknown or incomplete — fix the change set and preflight; do not "verify" a placeholder.
Inputs: receipt token (required); target_id = decision_result.artifact_digest — required for an authorization verdict; omitted → target_not_stated. Optional intended context (operation, environment, fingerprint, audience, repository/branch/pull_request, base/head) and the body_hash-bound decision_result envelope. 30s clock-skew leeway on expiry. A 0s grace for declared destructive production operations is defined in the policy but is unreachable today: the intended-context schema has no destructive field, so nothing can declare one and the 30s leeway always applies. Returns { valid, status, currently_authorized (bool|null), reason, payload, authz_* }. Branch on currently_authorized; null = not evaluated.
When a decision envelope is also in hand (e.g. from a prior preflight), its control_envelope.next_agent_step (if present) is structured remediation guidance the agent MAY follow after a non-CONTINUE decision — still branch on execution_action; next_agent_step is suggestion, not permission.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | Intended base commit/ref SHA the receipt must match (signed-wins vs envelope.base) | |
| head | No | Intended head commit/ref SHA the receipt must match (signed-wins vs envelope.head) | |
| token | Yes | The chain receipt token (base64url(body).base64url(signature)) | |
| branch | No | Intended branch the receipt must bind (place binding; optional) | |
| audience | No | Intended audience — must match the receipt | |
| operation | No | Intended operation the receipt must authorize (conventional: merge|deploy|tool_call|publish). Triggers authorization evaluation when non-empty; supply decision_result for full scope binding. | |
| target_id | No | REQUIRED to authorize under a held receipt. Set it to decision_result.artifact_digest — the digest of the artifact the receipt was issued for, which you already hold in the decision_result you are passing. The server does NOT derive it for you: it carries YOUR intended apply-site, and taking it from the envelope would compare that document against itself. Omit it and the answer is currently_authorized false with authz_reason target_not_stated and authz_status VERIFIED_TARGET_NOT_STATED — a missing input, distinct from target_mismatch, which means the receipt covers a different target. | |
| repository | No | Intended repository the receipt must bind (place binding; optional) | |
| environment | No | Intended environment (e.g. production) — must match the receipt | |
| fingerprint | No | Intended change fingerprint — must equal the receipt fp | |
| pull_request | No | Intended pull-request id the receipt must bind (place binding; optional) | |
| decision_result | No | The body_hash-bound decision envelope (carries operation/target/decision). Required for a meaningful AUTHORIZATION evaluation of scope; without it, intended context alone fails closed on authorization (currently_authorized false) while signature status remains independent. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json. |
Output Schema
ParametersJSON Schema
| Name | Required | Description |
|---|---|---|
| valid | Yes | true iff status is VERIFIED_CURRENT or RETIRED_KEY_VALID_AT_ISSUE |
| reason | No | |
| status | Yes | |
| payload | No | |
| authz_note | No | Present when no intended context supplied: status reflects signature+expiry only |
| authz_state | No | Lifecycle state from isCurrentlyAuthorized when authorization is evaluated (optional; omitted when currently_authorized is null) |
| authz_reason | No | When currently_authorized=false: the deny reason (operation_mismatch, decision_not_allow, superseded, expired, target_mismatch, environment_mismatch, …) |
| authz_status | No | Authorization-level status (VERIFIED_WRONG_ENVIRONMENT / VERIFIED_SUPERSEDED / VERIFIED_SCOPE_MISMATCH / …) |
| caller_value | No | Caller claim that differed from the signed envelope |
| signed_value | No | Signed envelope slot when signed-wins fail-closed (source_binding_mismatch) |
| authz_reasons | No | Every violation found; the first is authz_reason. [] when authorized. Fix all of them before re-verifying. |
| binding_level | No | place_and_content | content_only — forensic, not a second verdict |
| correlation_id | No | Route-owned trace id, set by the route itself rather than by correlation middleware; always a non-empty string on 200 |
| currently_authorized | Yes | Whether the receipt currently authorizes the intended operation/target/fp (§106). null means authorization could not be evaluated (e.g. no intended context) — not unauthorized and not authorized. |
TDQS
A4.9/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only say readOnlyHint=true and openWorldHint=false, so the description carries the burden of behavioral disclosure and exceeds it: it reveals the two evaluation modes, the 30s clock-skew leeway, the fail-closed behavior when the envelope is omitted (currently_authorized false vs null), the unreachable destructive-operation grace, and the caveat that next_agent_step is suggestion not permission. No contradiction with annotations — readOnlyHint is consistent with a verification tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness4/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded — purpose paragraph, then use/do-not-use lists, then inputs, returns, and envelope guidance. It is long, but the tool is genuinely complex (12 parameters, two modes, fail-closed semantics). Minor redundancy exists with the schema's own mode description, and the unreachable destructive-grace sentence is a tangent, so it falls just short of a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity — 12 parameters, nested decision_result object, output schema — the description is remarkably complete. It explains return semantics (branch on currently_authorized; null = not evaluated), fail-closed authorization, mode selection, and how to treat next_agent_step. Nothing an agent needs to call this tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters5/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Even though schema coverage is 100% (baseline 3), the description adds substantial meaning beyond the schema: it explains why target_id must be set to decision_result.artifact_digest and not derived server-side, distinguishes target_not_stated from target_mismatch, and documents the mode-discriminating behavior of supplying token-only vs token+context+envelope. This materially helps the agent supply correct parameter values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource — "Verify a CodeRifts signed chain-receipt you ALREADY HOLD" — and enumerates exactly what verification includes (cryptographic authenticity, body binding, authorization currency). It distinguishes itself from siblings by explicitly framing itself as verification of an existing receipt rather than preflight or history lookup.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines5/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description contains explicit "Use this when" and "Do not use when" sections that name both sibling tools (preflight_change_set, get_decision_details) and give precise conditions for choosing them: no receipt yet, changed base→head set, different operation/target binding, and history-only needs. This is textbook when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
- Changed
preflight_change_set13 fields changed- removed
Input schema / properties / adapter_idRemoved value: -{ - "description": "Authorize+grant v2 only. Adapter that will apply the change. Conventional values: fs, postgres, git. Must match the adapter the executor actually uses; a git grant does not authorize an fs write.", - "type": "string" -} - removed
Input schema / properties / audienceRemoved value: -{ - "description": "Requester identity for the decision envelope. Accepted here; the server-derived audience wins when both are present.", - "type": "string" -} - added
Input schema / properties / execution_grant_requestAdded value: +{ + "description": "Authorize + include_execution_grant only: the execution-grant request fields. Analyze ignores them. Flat root-level spellings are also accepted; the same field sent both ways with different values is INVALID_INPUT.", + "properties": { + "adapter_id": { + "description": "Authorize+grant v2 only. Adapter that will apply the change. Conventional values: fs, postgres, git. Must match the adapter the executor actually uses; a git grant does not authorize an fs write.", + "type": "string" + }, + "audience": { + "description": "Requester identity for the decision envelope. Accepted here; the server-derived audience wins when both are present.", + "type": "string" + }, + "executor_id": { + "description": "Authorize+grant v2 only. Executor identity the grant is bound to (example: agent:ci-bot, host:github-actions). Empty/absent is not \"any executor\".", + "type": "string" + }, + "expected_state_token": { + "description": "Authorize+grant v2 only. Compare-and-swap token the executor must observe at apply time (the \"before\" state). Signed as its own field. Omit only if the adapter has no prior state; do not send a placeholder.", + "type": "string" + }, + "grant_version": { + "description": "Grant envelope to mint when include_execution_grant is true. Omitting this yields cr.exec.v1 until 2026-09-18 and cr.exec.v2 on and after it (see x-coderifts-effective-default / x-coderifts-default-changes-at). The response meta.grant_version is the version actually issued. An explicit value always wins — pin \"v1\" to keep current behaviour with no code change on the date.", + "enum": [ + "v1", + "v2" + ], + "type": "string", + "x-coderifts-default-changes-at": "2026-09-18", + "x-coderifts-effective-default": "v2" + }, + "include_execution_grant": { + "description": "Authorize only. When true on an allow-class authorize, the response includes a signed execution_grant, or HTTP 503 SIGNER_UNAVAILABLE — never an unsigned grant. Default false. Analyze ignores this flag. Ignored unless preflight_mode=\"authorize\".", + "type": "boolean" + }, + "policy_hash": { + "description": "Authorize+grant v2 only. Policy identity bound into the grant, sha256: + 64 hex. When supplied, apply must use that same policy; a different policy is a different grant.", + "type": "string" + }, + "state_nonce": { + "description": "Authorize+grant only. Opaque nonce copied into the signed grant as its own field (not folded into scope_hash). Absent → BEARER grant. Ignored unless include_execution_grant is true.", + "type": "string" + }, + "target_uri": { + "description": "Authorize+grant v2 only. URI the grant binds (example: git://owner/repo.git/refs/heads/main). Fallback if omitted: context.target_uri, then repository/head-derived. Distinct from context.target_id.", + "type": "string" + }, + "tenant_id": { + "description": "Authorize+grant v2 only. Tenant the grant is issued under. ASCII slug. When omitted the server uses \"default\" — pin it if you are not on the default tenant.", + "type": "string" + } + }, + "type": "object" +} - removed
Input schema / properties / executor_idRemoved value: -{ - "description": "Authorize+grant v2 only. Executor identity the grant is bound to (example: agent:ci-bot, host:github-actions). Empty/absent is not \"any executor\".", - "type": "string" -} - removed
Input schema / properties / expected_state_tokenRemoved value: -{ - "description": "Authorize+grant v2 only. Compare-and-swap token the executor must observe at apply time (the \"before\" state). Signed as its own field. Omit only if the adapter has no prior state; do not send a placeholder.", - "type": "string" -} - removed
Input schema / properties / grant_versionRemoved value: -{ - "description": "Grant envelope to mint when include_execution_grant is true. Omitting this yields cr.exec.v1 until 2026-09-18 and cr.exec.v2 on and after it (see x-coderifts-effective-default / x-coderifts-default-changes-at). The response meta.grant_version is the version actually issued. An explicit value always wins — pin \"v1\" to keep current behaviour with no code change on the date.", - "enum": [ - "v1", - "v2" - ], - "type": "string", - "x-coderifts-default-changes-at": "2026-09-18", - "x-coderifts-effective-default": "v2" -} - removed
Input schema / properties / include_execution_grantRemoved value: -{ - "description": "Authorize only. When true on an allow-class authorize, the response includes a signed execution_grant, or HTTP 503 SIGNER_UNAVAILABLE — never an unsigned grant. Default false. Analyze ignores this flag. Ignored unless preflight_mode=\"authorize\".", - "type": "boolean" -} - removed
Input schema / properties / policy_hashRemoved value: -{ - "description": "Authorize+grant v2 only. Policy identity bound into the grant, sha256: + 64 hex. When supplied, apply must use that same policy; a different policy is a different grant.", - "type": "string" -} - added
Input schema / properties / response_detailAdded value: +{ + "description": "How much of the response to return. control = the fields an agent branches on; standard = control + the human report and labelled break rows (the MCP default); full = everything (the REST default). Every value is copied from the full response.", + "enum": [ + "control", + "standard", + "full" + ], + "type": "string" +} - removed
Input schema / properties / state_nonceRemoved value: -{ - "description": "Authorize+grant only. Opaque nonce copied into the signed grant as its own field (not folded into scope_hash). Absent → BEARER grant. Ignored unless include_execution_grant is true.", - "type": "string" -} - removed
Input schema / properties / target_uriRemoved value: -{ - "description": "Authorize+grant v2 only. URI the grant binds (example: git://owner/repo.git/refs/heads/main). Fallback if omitted: context.target_uri, then repository/head-derived. Distinct from context.target_id.", - "type": "string" -} - removed
Input schema / properties / tenant_idRemoved value: -{ - "description": "Authorize+grant v2 only. Tenant the grant is issued under. ASCII slug. When omitted the server uses \"default\" — pin it if you are not on the default tenant.", - "type": "string" -} - changed
Output schema / oneOfPrevious value: -[ - { - "additionalProperties": true, - "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", - "not": { - "anyOf": [ - { - "required": [ - "decision" - ] - }, - { - "required": [ - "execution_action" - ] - }, - { - "required": [ - "safe_for_agent" - ] - }, - { - "required": [ - "chain_receipt" - ] - }, - { - "required": [ - "execution_grant" - ] - }, - { - "required": [ - "decision_result" - ] - }, - { - "required": [ - "control_envelope" - ] - }, - { - "required": [ - "required_action_core" - ] - } - ] - }, - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "analysis_control": { - "type": "object" - }, - "analysis_outcome": { - "description": "Closed analysis outcome set derived from engine-visible state only. NOT_SUPPORTED = no analyzer (agent_operation / type outside the published enum). ANALYSIS_FAILED = an analyzer ran and failed.", - "enum": [ - "NO_BREAK_DETECTED", - "BREAKS_DETECTED", - "ANALYSIS_FAILED", - "NOT_SUPPORTED" - ], - "type": "string" - }, - "artifacts": { - "type": "array" - }, - "authorization_effect": { - "const": "NONE", - "description": "Analyze never authorizes; always NONE." - }, - "blast_radius": { - "additionalProperties": false, - "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "type": [ - "string", - "null" - ] - }, - "decision_basis": {}, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "may_execute": { - "const": false, - "description": "Analyze never grants execute permission." - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "analyze" - }, - "receipt_kind": { - "const": "NONE", - "description": "Analyze never mints a receipt." - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (observation; not permission).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "analysis_outcome", - "authorization_effect", - "may_execute", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - }, - { - "additionalProperties": true, - "allOf": [ - { - "if": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind" - ] - }, - "then": { - "required": [ - "chain_receipt" - ] - } - }, - { - "if": { - "properties": { - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING" - ] - } - }, - "required": [ - "execution_action" - ] - }, - "then": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind", - "chain_receipt", - "decision_result" - ] - } - } - ], - "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "artifacts": { - "type": "array" - }, - "blast_radius": { - "additionalProperties": false, - "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "description": "Calibration model version when set; null until a calibrated model ships.", - "type": [ - "string", - "null" - ] - }, - "chain_receipt": { - "type": "string" - }, - "chain_status": { - "type": "string" - }, - "coderifts_version": { - "type": "string" - }, - "control_envelope": { - "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", - "type": "object" - }, - "decision": { - "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_basis": {}, - "decision_result": { - "additionalProperties": true, - "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", - "properties": { - "audience": { - "type": [ - "string", - "null" - ] - }, - "authority": { - "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", - "type": [ - "object", - "null" - ] - }, - "base": { - "type": [ - "string", - "null" - ] - }, - "blast_radius": { - "description": "Additive COUNTS (not a score). Not permission.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "type": "object" - }, - "decision": { - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_body_hash": { - "type": [ - "string", - "null" - ] - }, - "decision_id": { - "type": "string" - }, - "derivation": { - "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", - "type": [ - "object", - "null" - ] - }, - "environment": { - "type": [ - "string", - "null" - ] - }, - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "expires_at": { - "type": "string" - }, - "fingerprint": { - "type": "string" - }, - "head": { - "type": [ - "string", - "null" - ] - }, - "input_fingerprint": { - "type": "string" - }, - "operation": { - "type": [ - "string", - "null" - ] - }, - "receipt": { - "type": "object" - }, - "repository": { - "type": [ - "string", - "null" - ] - }, - "safe_for_agent": { - "type": "boolean" - }, - "spec_version": { - "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", - "type": "string" - } - }, - "type": "object" - }, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "execution_action": { - "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "execution_grant": { - "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash.", - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "authorize" - }, - "receipt_kind": { - "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", - "enum": [ - "operation_authorization", - "NONE" - ], - "type": "string" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "safe_for_agent": { - "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", - "type": "boolean" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "decision", - "execution_action", - "safe_for_agent", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", + "not": { + "anyOf": [ + { + "required": [ + "decision" + ] + }, + { + "required": [ + "execution_action" + ] + }, + { + "required": [ + "safe_for_agent" + ] + }, + { + "required": [ + "chain_receipt" + ] + }, + { + "required": [ + "execution_grant" + ] + }, + { + "required": [ + "decision_result" + ] + }, + { + "required": [ + "control_envelope" + ] + }, + { + "required": [ + "required_action_core" + ] + } + ] + }, + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "analysis_control": { + "type": "object" + }, + "analysis_outcome": { + "description": "Closed analysis outcome set derived from engine-visible state only. NOT_SUPPORTED = no analyzer (agent_operation / type outside the published enum). ANALYSIS_FAILED = an analyzer ran and failed.", + "enum": [ + "NO_BREAK_DETECTED", + "BREAKS_DETECTED", + "ANALYSIS_FAILED", + "NOT_SUPPORTED" + ], + "type": "string" + }, + "artifacts": { + "type": "array" + }, + "authorization_effect": { + "const": "NONE", + "description": "Analyze never authorizes; always NONE." + }, + "blast_radius": { + "additionalProperties": false, + "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "type": [ + "string", + "null" + ] + }, + "decision_basis": {}, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "may_execute": { + "const": false, + "description": "Analyze never grants execute permission." + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "analyze" + }, + "receipt_kind": { + "const": "NONE", + "description": "Analyze never mints a receipt." + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (observation; not permission).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "analysis_outcome", + "authorization_effect", + "may_execute", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + }, + { + "additionalProperties": true, + "allOf": [ + { + "if": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind" + ] + }, + "then": { + "required": [ + "chain_receipt" + ] + } + }, + { + "if": { + "properties": { + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING" + ] + } + }, + "required": [ + "execution_action" + ] + }, + "then": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind", + "chain_receipt", + "decision_result" + ] + } + } + ], + "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", + "properties": { + "analysis": { + "additionalProperties": true, + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "artifacts": { + "type": "array" + }, + "blast_radius": { + "additionalProperties": false, + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "description": "Calibration model version when set; null until a calibrated model ships.", + "type": [ + "string", + "null" + ] + }, + "chain_receipt": { + "type": "string" + }, + "chain_status": { + "type": "string" + }, + "coderifts_version": { + "type": "string" + }, + "control_envelope": { + "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", + "type": "object" + }, + "decision": { + "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_basis": {}, + "decision_result": { + "additionalProperties": true, + "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", + "properties": { + "audience": { + "type": [ + "string", + "null" + ] + }, + "authority": { + "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", + "type": [ + "object", + "null" + ] + }, + "base": { + "type": [ + "string", + "null" + ] + }, + "blast_radius": { + "description": "Additive COUNTS (not a score). Not permission.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "type": "object" + }, + "decision": { + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_body_hash": { + "type": [ + "string", + "null" + ] + }, + "decision_id": { + "type": "string" + }, + "derivation": { + "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", + "type": [ + "object", + "null" + ] + }, + "environment": { + "type": [ + "string", + "null" + ] + }, + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "expires_at": { + "type": "string" + }, + "fingerprint": { + "type": "string" + }, + "head": { + "type": [ + "string", + "null" + ] + }, + "input_fingerprint": { + "type": "string" + }, + "operation": { + "type": [ + "string", + "null" + ] + }, + "receipt": { + "type": "object" + }, + "repository": { + "type": [ + "string", + "null" + ] + }, + "safe_for_agent": { + "type": "boolean" + }, + "spec_version": { + "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", + "type": "string" + } + }, + "type": "object" + }, + "decision_spec_version": { + "type": "string" + }, + "detected_patterns": { + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "type": "string" + }, + "affected_path": { + "type": "string" + }, + "consequence": { + "type": "string" + }, + "description": { + "type": "string" + }, + "name": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "side": { + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "execution_action": { + "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "execution_grant": { + "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash.", + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "authorize" + }, + "receipt_kind": { + "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", + "enum": [ + "operation_authorization", + "NONE" + ], + "type": "string" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "safe_for_agent": { + "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", + "type": "boolean" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "properties": { + "diff_severity": { + "type": "string" + }, + "governance_severity": { + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "decision", + "execution_action", + "safe_for_agent", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + } +]
- Changed
verify_receipt1 field changed- added
Output schema / properties / authz_reasonsAdded value: +{ + "description": "Every violation found; the first is authz_reason. [] when authorized. Fix all of them before re-verifying.", + "items": { + "type": "string" + }, + "type": "array" +}
1 tool update
- Changed
verify_receipt3 fields changed- changed
Input schema / descriptionPrevious value: -"Two evaluation modes (schema-documented; no mode discriminator field). SIGNATURE: supply token only — signature + expiry; currently_authorized is null. AUTHORIZATION: also supply intended context (operation, environment, fingerprint, target_id, audience, repository/branch/pull_request, and/or base/head) AND the body_hash-bound decision_result envelope so currently_authorized / authz_status / authz_reason can be evaluated. Token alone is always accepted; omitting the envelope when context fields are present yields a signature verdict plus fail-closed authorization (currently_authorized false), not a schema reject."New value: +"Two evaluation modes (schema-documented; no mode discriminator field). SIGNATURE: supply token only — signature + expiry; currently_authorized is null. AUTHORIZATION: also supply intended context (operation, environment, fingerprint, target_id set to decision_result.artifact_digest, audience, repository/branch/pull_request, and/or base/head) AND the body_hash-bound decision_result envelope so currently_authorized / authz_status / authz_reason can be evaluated. Token alone is always accepted; omitting the envelope when context fields are present yields a signature verdict plus fail-closed authorization (currently_authorized false), not a schema reject." - changed
Input schema / properties / target_id / descriptionPrevious value: -"Intended apply-site target the receipt must bind"New value: +"REQUIRED to authorize under a held receipt. Set it to decision_result.artifact_digest — the digest of the artifact the receipt was issued for, which you already hold in the decision_result you are passing. The server does NOT derive it for you: it carries YOUR intended apply-site, and taking it from the envelope would compare that document against itself. Omit it and the answer is currently_authorized false with authz_reason target_not_stated and authz_status VERIFIED_TARGET_NOT_STATED — a missing input, distinct from target_mismatch, which means the receipt covers a different target." - changed
Output schema / properties / status / enumPrevious value: -[ - "VERIFIED_CURRENT", - "VERIFIED_EXPIRED", - "VERIFIED_WRONG_AUDIENCE", - "VERIFIED_WRONG_ENVIRONMENT", - "VERIFIED_SUPERSEDED", - "VERIFIED_SCOPE_MISMATCH", - "VERIFIED_UNBOUND_OPERATION", - "VERIFIED_UNBOUND_TARGET", - "VERIFIED_UNBOUND_REPOSITORY", - "VERIFIED_UNBOUND_BRANCH", - "VERIFIED_UNBOUND_PULL_REQUEST", - "UNKNOWN_KEY", - "UNKNOWN_KEY_STATUS", - "RETIRED_KEY_VALID_AT_ISSUE", - "KEY_RETIRED_AFTER_SIGNING", - "REVOKED_KEY", - "REVOKED_KEY_UNDECIDABLE", - "KEY_REVOKED", - "REVOCATION_UNDECIDABLE", - "AUTHORIZATION_UNDECIDABLE", - "INVALID_SIGNATURE", - "MALFORMED", - "UNSUPPORTED_VERSION", - "REGISTRY_UNREACHABLE" -]New value: +[ + "VERIFIED_CURRENT", + "VERIFIED_EXPIRED", + "VERIFIED_WRONG_AUDIENCE", + "VERIFIED_WRONG_ENVIRONMENT", + "VERIFIED_SUPERSEDED", + "VERIFIED_SCOPE_MISMATCH", + "VERIFIED_UNBOUND_OPERATION", + "VERIFIED_UNBOUND_TARGET", + "VERIFIED_UNBOUND_REPOSITORY", + "VERIFIED_UNBOUND_BRANCH", + "VERIFIED_UNBOUND_PULL_REQUEST", + "VERIFIED_TARGET_NOT_STATED", + "UNKNOWN_KEY", + "UNKNOWN_KEY_STATUS", + "RETIRED_KEY_VALID_AT_ISSUE", + "KEY_RETIRED_AFTER_SIGNING", + "REVOKED_KEY", + "REVOKED_KEY_UNDECIDABLE", + "KEY_REVOKED", + "REVOCATION_UNDECIDABLE", + "AUTHORIZATION_UNDECIDABLE", + "INVALID_SIGNATURE", + "MALFORMED", + "UNSUPPORTED_VERSION", + "REGISTRY_UNREACHABLE" +]
1 tool update
- Changed
get_decision_details5 fields changed- added
Input schema / descriptionAdded value: +"Closed exclusive identifier union: exactly one of case_id | decision_id | fingerprint. Encoded as minProperties=1 + maxProperties=1 + additionalProperties=false, NOT as a top-level oneOf/anyOf/allOf — Anthropic (and other strict tool APIs) reject those combinators at the root of input_schema and then refuse the entire tools array (measured: test/mcp-input-oneof-honesty.test.js, mcp-streamable.js comment). The server enforces the same mutex with named codes: empty {} → INVALID_INPUT; two or more identifiers → LOOKUP_IDENTIFIER_CONFLICT; case_id alone → CASE_NOT_FOUND (no case store yet; lookup never opens a case)." - added
Input schema / maxPropertiesAdded value: +1 - added
Input schema / properties / case_idAdded value: +{ + "description": "A case identifier. Lookup never opens a case. Until the case store exists this returns CASE_NOT_FOUND.", + "minLength": 1, + "type": "string" +} - changed
Input schema / properties / decision_id / descriptionPrevious value: -"The decision_id from a prior decision_result envelope. Provide this and/or fingerprint (at least one non-empty string required)."New value: +"The decision_id from a prior decision_result envelope. Provide exactly one identifier." - changed
Input schema / properties / fingerprint / descriptionPrevious value: -"A verdict fingerprint (sha256:...); returns the latest matching decision. Provide this and/or decision_id (at least one non-empty string required)."New value: +"A verdict fingerprint (sha256:...); returns the latest matching decision you own. Provide exactly one identifier."
1 tool update
- Changed
preflight_change_set3 fields changed- changed
Input schema / properties / artifacts / items / properties / type / descriptionPrevious value: -"Artifact kind. One of openapi, graphql, grpc, asyncapi, mcp_manifest, agent_tools. Determines how before/after text is parsed. Not inferred from the filename."New value: +"Artifact kind. One of openapi, graphql, grpc, asyncapi, mcp_manifest, agent_tools, agent_operation. Contract types determine how before/after text is parsed. agent_operation: An opaque proposed agent operation for which no supported contract-artifact type applies. CodeRifts does not semantically analyze this content and does not issue an execution grant. Not inferred from the filename." - changed
Input schema / properties / artifacts / items / properties / type / enumPrevious value: -[ - "openapi", - "graphql", - "grpc", - "asyncapi", - "mcp_manifest", - "agent_tools" -]New value: +[ + "openapi", + "graphql", + "grpc", + "asyncapi", + "mcp_manifest", + "agent_tools", + "agent_operation" +] - changed
Output schema / oneOfPrevious value: -[ - { - "additionalProperties": true, - "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", - "not": { - "anyOf": [ - { - "required": [ - "decision" - ] - }, - { - "required": [ - "execution_action" - ] - }, - { - "required": [ - "safe_for_agent" - ] - }, - { - "required": [ - "chain_receipt" - ] - }, - { - "required": [ - "execution_grant" - ] - }, - { - "required": [ - "decision_result" - ] - }, - { - "required": [ - "control_envelope" - ] - }, - { - "required": [ - "required_action_core" - ] - } - ] - }, - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "analysis_control": { - "type": "object" - }, - "analysis_outcome": { - "description": "Closed analysis outcome set derived from engine-visible state only.", - "enum": [ - "NO_BREAK_DETECTED", - "BREAKS_DETECTED", - "ANALYSIS_FAILED" - ], - "type": "string" - }, - "artifacts": { - "type": "array" - }, - "authorization_effect": { - "const": "NONE", - "description": "Analyze never authorizes; always NONE." - }, - "blast_radius": { - "additionalProperties": false, - "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "type": [ - "string", - "null" - ] - }, - "decision_basis": {}, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "may_execute": { - "const": false, - "description": "Analyze never grants execute permission." - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "analyze" - }, - "receipt_kind": { - "const": "NONE", - "description": "Analyze never mints a receipt." - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (observation; not permission).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "analysis_outcome", - "authorization_effect", - "may_execute", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - }, - { - "additionalProperties": true, - "allOf": [ - { - "if": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind" - ] - }, - "then": { - "required": [ - "chain_receipt" - ] - } - }, - { - "if": { - "properties": { - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING" - ] - } - }, - "required": [ - "execution_action" - ] - }, - "then": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind", - "chain_receipt", - "decision_result" - ] - } - } - ], - "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "artifacts": { - "type": "array" - }, - "blast_radius": { - "additionalProperties": false, - "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "description": "Calibration model version when set; null until a calibrated model ships.", - "type": [ - "string", - "null" - ] - }, - "chain_receipt": { - "type": "string" - }, - "chain_status": { - "type": "string" - }, - "coderifts_version": { - "type": "string" - }, - "control_envelope": { - "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", - "type": "object" - }, - "decision": { - "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_basis": {}, - "decision_result": { - "additionalProperties": true, - "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", - "properties": { - "audience": { - "type": [ - "string", - "null" - ] - }, - "authority": { - "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", - "type": [ - "object", - "null" - ] - }, - "base": { - "type": [ - "string", - "null" - ] - }, - "blast_radius": { - "description": "Additive COUNTS (not a score). Not permission.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "type": "object" - }, - "decision": { - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_body_hash": { - "type": [ - "string", - "null" - ] - }, - "decision_id": { - "type": "string" - }, - "derivation": { - "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", - "type": [ - "object", - "null" - ] - }, - "environment": { - "type": [ - "string", - "null" - ] - }, - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "expires_at": { - "type": "string" - }, - "fingerprint": { - "type": "string" - }, - "head": { - "type": [ - "string", - "null" - ] - }, - "input_fingerprint": { - "type": "string" - }, - "operation": { - "type": [ - "string", - "null" - ] - }, - "receipt": { - "type": "object" - }, - "repository": { - "type": [ - "string", - "null" - ] - }, - "safe_for_agent": { - "type": "boolean" - }, - "spec_version": { - "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", - "type": "string" - } - }, - "type": "object" - }, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "execution_action": { - "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "execution_grant": { - "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash.", - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "authorize" - }, - "receipt_kind": { - "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", - "enum": [ - "operation_authorization", - "NONE" - ], - "type": "string" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "safe_for_agent": { - "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", - "type": "boolean" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "decision", - "execution_action", - "safe_for_agent", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", + "not": { + "anyOf": [ + { + "required": [ + "decision" + ] + }, + { + "required": [ + "execution_action" + ] + }, + { + "required": [ + "safe_for_agent" + ] + }, + { + "required": [ + "chain_receipt" + ] + }, + { + "required": [ + "execution_grant" + ] + }, + { + "required": [ + "decision_result" + ] + }, + { + "required": [ + "control_envelope" + ] + }, + { + "required": [ + "required_action_core" + ] + } + ] + }, + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "analysis_control": { + "type": "object" + }, + "analysis_outcome": { + "description": "Closed analysis outcome set derived from engine-visible state only. NOT_SUPPORTED = no analyzer (agent_operation / type outside the published enum). ANALYSIS_FAILED = an analyzer ran and failed.", + "enum": [ + "NO_BREAK_DETECTED", + "BREAKS_DETECTED", + "ANALYSIS_FAILED", + "NOT_SUPPORTED" + ], + "type": "string" + }, + "artifacts": { + "type": "array" + }, + "authorization_effect": { + "const": "NONE", + "description": "Analyze never authorizes; always NONE." + }, + "blast_radius": { + "additionalProperties": false, + "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "type": [ + "string", + "null" + ] + }, + "decision_basis": {}, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "may_execute": { + "const": false, + "description": "Analyze never grants execute permission." + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "analyze" + }, + "receipt_kind": { + "const": "NONE", + "description": "Analyze never mints a receipt." + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (observation; not permission).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "analysis_outcome", + "authorization_effect", + "may_execute", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + }, + { + "additionalProperties": true, + "allOf": [ + { + "if": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind" + ] + }, + "then": { + "required": [ + "chain_receipt" + ] + } + }, + { + "if": { + "properties": { + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING" + ] + } + }, + "required": [ + "execution_action" + ] + }, + "then": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind", + "chain_receipt", + "decision_result" + ] + } + } + ], + "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "artifacts": { + "type": "array" + }, + "blast_radius": { + "additionalProperties": false, + "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "description": "Calibration model version when set; null until a calibrated model ships.", + "type": [ + "string", + "null" + ] + }, + "chain_receipt": { + "type": "string" + }, + "chain_status": { + "type": "string" + }, + "coderifts_version": { + "type": "string" + }, + "control_envelope": { + "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", + "type": "object" + }, + "decision": { + "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_basis": {}, + "decision_result": { + "additionalProperties": true, + "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", + "properties": { + "audience": { + "type": [ + "string", + "null" + ] + }, + "authority": { + "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", + "type": [ + "object", + "null" + ] + }, + "base": { + "type": [ + "string", + "null" + ] + }, + "blast_radius": { + "description": "Additive COUNTS (not a score). Not permission.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "type": "object" + }, + "decision": { + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_body_hash": { + "type": [ + "string", + "null" + ] + }, + "decision_id": { + "type": "string" + }, + "derivation": { + "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", + "type": [ + "object", + "null" + ] + }, + "environment": { + "type": [ + "string", + "null" + ] + }, + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "expires_at": { + "type": "string" + }, + "fingerprint": { + "type": "string" + }, + "head": { + "type": [ + "string", + "null" + ] + }, + "input_fingerprint": { + "type": "string" + }, + "operation": { + "type": [ + "string", + "null" + ] + }, + "receipt": { + "type": "object" + }, + "repository": { + "type": [ + "string", + "null" + ] + }, + "safe_for_agent": { + "type": "boolean" + }, + "spec_version": { + "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", + "type": "string" + } + }, + "type": "object" + }, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "execution_action": { + "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "execution_grant": { + "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash.", + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "authorize" + }, + "receipt_kind": { + "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", + "enum": [ + "operation_authorization", + "NONE" + ], + "type": "string" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "safe_for_agent": { + "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", + "type": "boolean" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "decision", + "execution_action", + "safe_for_agent", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + } +]
1 tool update
- Changed
preflight_change_set3 fields changed- changed
Input schema / properties / decision_spec_version / descriptionPrevious value: -"Optional pin. '1.0' = legacy contract (soft-default mode + analyze still carries decision/execution_action) until the sunset date. Omit or '2.0' = current contract."New value: +"Optional. Omit or '2.0' = current contract. '1.0' retired (INVALID_INPUT); do not pin 1.0." - changed
Input schema / properties / decision_spec_version / enumPrevious value: -[ - "1.0", - "2.0" -]New value: +[ + "2.0" +] - changed
Input schema / properties / preflight_mode / descriptionPrevious value: -"REQUIRED. \"analyze\" = informational risk only (no decision/execution_action/safe_for_agent; analysis_outcome + may_execute:false). \"authorize\" = operation-bound path; may mint a receipt (requires context.operation). Decision Spec 2.0: omission is an error unless decision_spec_version is '1.0' (30-day legacy pin with soft-default analyze)."New value: +"REQUIRED. \"analyze\" = informational risk only (no decision/execution_action/safe_for_agent; analysis_outcome + may_execute:false). \"authorize\" = operation-bound path; may mint a receipt (requires context.operation). Decision Spec 2.0: omission is INVALID_INPUT. Do not pin 1.0 — that pin retired."
1 tool update
- Changed
preflight_change_set1 field changed- changed
Input schema / properties / grant_version / x-coderifts-effective-defaultPrevious value: -"v1"New value: +"v2"
3 tool updates
- Changed
get_decision_details1 field changed- changed
Output schema / properties / decision_result / properties / blast_radius / descriptionPrevious value: -"ID27 additive COUNTS (not a score). Not permission."New value: +"Additive COUNTS (not a score). Not permission."
- Changed
preflight_change_set1 field changed- changed
Output schema / oneOfPrevious value: -[ - { - "additionalProperties": true, - "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", - "not": { - "anyOf": [ - { - "required": [ - "decision" - ] - }, - { - "required": [ - "execution_action" - ] - }, - { - "required": [ - "safe_for_agent" - ] - }, - { - "required": [ - "chain_receipt" - ] - }, - { - "required": [ - "execution_grant" - ] - }, - { - "required": [ - "decision_result" - ] - }, - { - "required": [ - "control_envelope" - ] - }, - { - "required": [ - "required_action_core" - ] - } - ] - }, - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "analysis_control": { - "type": "object" - }, - "analysis_outcome": { - "description": "Closed analysis outcome set derived from engine-visible state only.", - "enum": [ - "NO_BREAK_DETECTED", - "BREAKS_DETECTED", - "ANALYSIS_FAILED" - ], - "type": "string" - }, - "artifacts": { - "type": "array" - }, - "authorization_effect": { - "const": "NONE", - "description": "Analyze never authorizes; always NONE." - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "type": [ - "string", - "null" - ] - }, - "decision_basis": {}, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "may_execute": { - "const": false, - "description": "Analyze never grants execute permission." - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "analyze" - }, - "receipt_kind": { - "const": "NONE", - "description": "Analyze never mints a receipt." - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (observation; not permission).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "analysis_outcome", - "authorization_effect", - "may_execute", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - }, - { - "additionalProperties": true, - "allOf": [ - { - "if": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind" - ] - }, - "then": { - "required": [ - "chain_receipt" - ] - } - }, - { - "if": { - "properties": { - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING" - ] - } - }, - "required": [ - "execution_action" - ] - }, - "then": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind", - "chain_receipt", - "decision_result" - ] - } - } - ], - "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "artifacts": { - "type": "array" - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "description": "Calibration model version when set; null until a calibrated model ships.", - "type": [ - "string", - "null" - ] - }, - "chain_receipt": { - "type": "string" - }, - "chain_status": { - "type": "string" - }, - "coderifts_version": { - "type": "string" - }, - "control_envelope": { - "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", - "type": "object" - }, - "decision": { - "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_basis": {}, - "decision_result": { - "additionalProperties": true, - "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", - "properties": { - "audience": { - "type": [ - "string", - "null" - ] - }, - "authority": { - "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", - "type": [ - "object", - "null" - ] - }, - "base": { - "type": [ - "string", - "null" - ] - }, - "blast_radius": { - "description": "ID27 additive COUNTS (not a score). Not permission.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "type": "object" - }, - "decision": { - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_body_hash": { - "type": [ - "string", - "null" - ] - }, - "decision_id": { - "type": "string" - }, - "derivation": { - "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", - "type": [ - "object", - "null" - ] - }, - "environment": { - "type": [ - "string", - "null" - ] - }, - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "expires_at": { - "type": "string" - }, - "fingerprint": { - "type": "string" - }, - "head": { - "type": [ - "string", - "null" - ] - }, - "input_fingerprint": { - "type": "string" - }, - "operation": { - "type": [ - "string", - "null" - ] - }, - "receipt": { - "type": "object" - }, - "repository": { - "type": [ - "string", - "null" - ] - }, - "safe_for_agent": { - "type": "boolean" - }, - "spec_version": { - "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", - "type": "string" - } - }, - "type": "object" - }, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "execution_action": { - "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "execution_grant": { - "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash.", - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "authorize" - }, - "receipt_kind": { - "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", - "enum": [ - "operation_authorization", - "NONE" - ], - "type": "string" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "safe_for_agent": { - "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", - "type": "boolean" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "decision", - "execution_action", - "safe_for_agent", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", + "not": { + "anyOf": [ + { + "required": [ + "decision" + ] + }, + { + "required": [ + "execution_action" + ] + }, + { + "required": [ + "safe_for_agent" + ] + }, + { + "required": [ + "chain_receipt" + ] + }, + { + "required": [ + "execution_grant" + ] + }, + { + "required": [ + "decision_result" + ] + }, + { + "required": [ + "control_envelope" + ] + }, + { + "required": [ + "required_action_core" + ] + } + ] + }, + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "analysis_control": { + "type": "object" + }, + "analysis_outcome": { + "description": "Closed analysis outcome set derived from engine-visible state only.", + "enum": [ + "NO_BREAK_DETECTED", + "BREAKS_DETECTED", + "ANALYSIS_FAILED" + ], + "type": "string" + }, + "artifacts": { + "type": "array" + }, + "authorization_effect": { + "const": "NONE", + "description": "Analyze never authorizes; always NONE." + }, + "blast_radius": { + "additionalProperties": false, + "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "type": [ + "string", + "null" + ] + }, + "decision_basis": {}, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "may_execute": { + "const": false, + "description": "Analyze never grants execute permission." + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "analyze" + }, + "receipt_kind": { + "const": "NONE", + "description": "Analyze never mints a receipt." + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (observation; not permission).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "analysis_outcome", + "authorization_effect", + "may_execute", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + }, + { + "additionalProperties": true, + "allOf": [ + { + "if": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind" + ] + }, + "then": { + "required": [ + "chain_receipt" + ] + } + }, + { + "if": { + "properties": { + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING" + ] + } + }, + "required": [ + "execution_action" + ] + }, + "then": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind", + "chain_receipt", + "decision_result" + ] + } + } + ], + "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "artifacts": { + "type": "array" + }, + "blast_radius": { + "additionalProperties": false, + "description": "Additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows, mapped from the engine's change IR. Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "description": "Calibration model version when set; null until a calibrated model ships.", + "type": [ + "string", + "null" + ] + }, + "chain_receipt": { + "type": "string" + }, + "chain_status": { + "type": "string" + }, + "coderifts_version": { + "type": "string" + }, + "control_envelope": { + "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", + "type": "object" + }, + "decision": { + "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_basis": {}, + "decision_result": { + "additionalProperties": true, + "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", + "properties": { + "audience": { + "type": [ + "string", + "null" + ] + }, + "authority": { + "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", + "type": [ + "object", + "null" + ] + }, + "base": { + "type": [ + "string", + "null" + ] + }, + "blast_radius": { + "description": "Additive COUNTS (not a score). Not permission.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "type": "object" + }, + "decision": { + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_body_hash": { + "type": [ + "string", + "null" + ] + }, + "decision_id": { + "type": "string" + }, + "derivation": { + "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", + "type": [ + "object", + "null" + ] + }, + "environment": { + "type": [ + "string", + "null" + ] + }, + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "expires_at": { + "type": "string" + }, + "fingerprint": { + "type": "string" + }, + "head": { + "type": [ + "string", + "null" + ] + }, + "input_fingerprint": { + "type": "string" + }, + "operation": { + "type": [ + "string", + "null" + ] + }, + "receipt": { + "type": "object" + }, + "repository": { + "type": [ + "string", + "null" + ] + }, + "safe_for_agent": { + "type": "boolean" + }, + "spec_version": { + "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", + "type": "string" + } + }, + "type": "object" + }, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "execution_action": { + "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "execution_grant": { + "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash.", + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "authorize" + }, + "receipt_kind": { + "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", + "enum": [ + "operation_authorization", + "NONE" + ], + "type": "string" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "safe_for_agent": { + "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", + "type": "boolean" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "decision", + "execution_action", + "safe_for_agent", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + } +]
- Changed
verify_receipt1 field changed- changed
Input schema / properties / decision_result / properties / blast_radius / descriptionPrevious value: -"ID27 additive COUNTS (not a score). Not permission."New value: +"Additive COUNTS (not a score). Not permission."
2 tool updates
- Changed
preflight_change_set1 field changed- changed
Output schema / oneOfPrevious value: -[ - { - "additionalProperties": true, - "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", - "not": { - "anyOf": [ - { - "required": [ - "decision" - ] - }, - { - "required": [ - "execution_action" - ] - }, - { - "required": [ - "safe_for_agent" - ] - }, - { - "required": [ - "chain_receipt" - ] - }, - { - "required": [ - "execution_grant" - ] - }, - { - "required": [ - "decision_result" - ] - }, - { - "required": [ - "control_envelope" - ] - }, - { - "required": [ - "required_action_core" - ] - } - ] - }, - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "analysis_control": { - "type": "object" - }, - "analysis_outcome": { - "description": "Closed analysis outcome set derived from engine-visible state only.", - "enum": [ - "NO_BREAK_DETECTED", - "BREAKS_DETECTED", - "ANALYSIS_FAILED" - ], - "type": "string" - }, - "artifacts": { - "type": "array" - }, - "authorization_effect": { - "const": "NONE", - "description": "Analyze never authorizes; always NONE." - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "type": [ - "string", - "null" - ] - }, - "decision_basis": {}, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "may_execute": { - "const": false, - "description": "Analyze never grants execute permission." - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "analyze" - }, - "receipt_kind": { - "const": "NONE", - "description": "Analyze never mints a receipt." - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (observation; not permission).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "analysis_outcome", - "authorization_effect", - "may_execute", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - }, - { - "additionalProperties": true, - "allOf": [ - { - "if": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind" - ] - }, - "then": { - "required": [ - "chain_receipt" - ] - } - }, - { - "if": { - "properties": { - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING" - ] - } - }, - "required": [ - "execution_action" - ] - }, - "then": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind", - "chain_receipt", - "decision_result" - ] - } - } - ], - "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "artifacts": { - "type": "array" - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "description": "Calibration model version when set; null until a calibrated model ships.", - "type": [ - "string", - "null" - ] - }, - "chain_receipt": { - "type": "string" - }, - "chain_status": { - "type": "string" - }, - "coderifts_version": { - "type": "string" - }, - "control_envelope": { - "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", - "type": "object" - }, - "decision": { - "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_basis": {}, - "decision_result": { - "additionalProperties": true, - "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", - "properties": { - "audience": { - "type": [ - "string", - "null" - ] - }, - "authority": { - "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", - "type": [ - "object", - "null" - ] - }, - "base": { - "type": [ - "string", - "null" - ] - }, - "blast_radius": { - "description": "ID27 additive COUNTS (not a score). Not permission.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "type": "object" - }, - "decision": { - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_body_hash": { - "type": [ - "string", - "null" - ] - }, - "decision_id": { - "type": "string" - }, - "derivation": { - "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", - "type": [ - "object", - "null" - ] - }, - "environment": { - "type": [ - "string", - "null" - ] - }, - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "expires_at": { - "type": "string" - }, - "fingerprint": { - "type": "string" - }, - "head": { - "type": [ - "string", - "null" - ] - }, - "input_fingerprint": { - "type": "string" - }, - "operation": { - "type": [ - "string", - "null" - ] - }, - "receipt": { - "type": "object" - }, - "repository": { - "type": [ - "string", - "null" - ] - }, - "safe_for_agent": { - "type": "boolean" - }, - "spec_version": { - "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", - "type": "string" - } - }, - "type": "object" - }, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "execution_action": { - "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "execution_grant": { - "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash. See docs/cr-exec-v1.md / docs/cr-exec-attest-v1.md.", - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "authorize" - }, - "receipt_kind": { - "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", - "enum": [ - "operation_authorization", - "NONE" - ], - "type": "string" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "safe_for_agent": { - "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", - "type": "boolean" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "decision", - "execution_action", - "safe_for_agent", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", + "not": { + "anyOf": [ + { + "required": [ + "decision" + ] + }, + { + "required": [ + "execution_action" + ] + }, + { + "required": [ + "safe_for_agent" + ] + }, + { + "required": [ + "chain_receipt" + ] + }, + { + "required": [ + "execution_grant" + ] + }, + { + "required": [ + "decision_result" + ] + }, + { + "required": [ + "control_envelope" + ] + }, + { + "required": [ + "required_action_core" + ] + } + ] + }, + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "analysis_control": { + "type": "object" + }, + "analysis_outcome": { + "description": "Closed analysis outcome set derived from engine-visible state only.", + "enum": [ + "NO_BREAK_DETECTED", + "BREAKS_DETECTED", + "ANALYSIS_FAILED" + ], + "type": "string" + }, + "artifacts": { + "type": "array" + }, + "authorization_effect": { + "const": "NONE", + "description": "Analyze never authorizes; always NONE." + }, + "blast_radius": { + "additionalProperties": false, + "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "type": [ + "string", + "null" + ] + }, + "decision_basis": {}, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "may_execute": { + "const": false, + "description": "Analyze never grants execute permission." + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "analyze" + }, + "receipt_kind": { + "const": "NONE", + "description": "Analyze never mints a receipt." + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (observation; not permission).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "analysis_outcome", + "authorization_effect", + "may_execute", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + }, + { + "additionalProperties": true, + "allOf": [ + { + "if": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind" + ] + }, + "then": { + "required": [ + "chain_receipt" + ] + } + }, + { + "if": { + "properties": { + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING" + ] + } + }, + "required": [ + "execution_action" + ] + }, + "then": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind", + "chain_receipt", + "decision_result" + ] + } + } + ], + "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror, assembled by the response builder alongside the control surface. Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "artifacts": { + "type": "array" + }, + "blast_radius": { + "additionalProperties": false, + "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "description": "Calibration model version when set; null until a calibrated model ships.", + "type": [ + "string", + "null" + ] + }, + "chain_receipt": { + "type": "string" + }, + "chain_status": { + "type": "string" + }, + "coderifts_version": { + "type": "string" + }, + "control_envelope": { + "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", + "type": "object" + }, + "decision": { + "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_basis": {}, + "decision_result": { + "additionalProperties": true, + "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", + "properties": { + "audience": { + "type": [ + "string", + "null" + ] + }, + "authority": { + "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", + "type": [ + "object", + "null" + ] + }, + "base": { + "type": [ + "string", + "null" + ] + }, + "blast_radius": { + "description": "ID27 additive COUNTS (not a score). Not permission.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "type": "object" + }, + "decision": { + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_body_hash": { + "type": [ + "string", + "null" + ] + }, + "decision_id": { + "type": "string" + }, + "derivation": { + "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", + "type": [ + "object", + "null" + ] + }, + "environment": { + "type": [ + "string", + "null" + ] + }, + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "expires_at": { + "type": "string" + }, + "fingerprint": { + "type": "string" + }, + "head": { + "type": [ + "string", + "null" + ] + }, + "input_fingerprint": { + "type": "string" + }, + "operation": { + "type": [ + "string", + "null" + ] + }, + "receipt": { + "type": "object" + }, + "repository": { + "type": [ + "string", + "null" + ] + }, + "safe_for_agent": { + "type": "boolean" + }, + "spec_version": { + "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", + "type": "string" + } + }, + "type": "object" + }, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows, emitted by the pattern detectors and validated against the decision-spec field contract before they leave the server. Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "execution_action": { + "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "execution_grant": { + "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash.", + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier, assembled by the response builder; analyze returns a reduced form. Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "authorize" + }, + "receipt_kind": { + "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", + "enum": [ + "operation_authorization", + "NONE" + ], + "type": "string" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "safe_for_agent": { + "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", + "type": "boolean" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes, computed once per change set. Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "decision", + "execution_action", + "safe_for_agent", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + } +]
- Changed
verify_receipt1 field changed- changed
Output schema / properties / correlation_id / descriptionPrevious value: -"Route-owned trace id (ID828); always a non-empty string on 200"New value: +"Route-owned trace id, set by the route itself rather than by correlation middleware; always a non-empty string on 200"
3 tool updates
- Changed
get_decision_details2 fields changed- changed
Output schema / properties / decision_result / properties / authority / descriptionPrevious value: -"ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL."New value: +"Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL." - changed
Output schema / properties / decision_result / properties / derivation / descriptionPrevious value: -"ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint."New value: +"Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint."
- Changed
preflight_change_set16 fields changed- changed
Input schema / properties / adapter_id / descriptionPrevious value: -"Adapter the executor will apply the change with, e.g. fs, postgres, git (cr.exec.v2)."New value: +"Authorize+grant v2 only. Adapter that will apply the change. Conventional values: fs, postgres, git. Must match the adapter the executor actually uses; a git grant does not authorize an fs write." - changed
Input schema / properties / artifacts / descriptionPrevious value: -"Contract artifacts to analyze together (max 20). Each is { id, type, before, after }."New value: +"1–20 contract documents analyzed together. Each item is {id, type, before, after} where before/after are the FULL document strings (YAML/JSON/proto text), not URLs or file paths. Omit this array entirely when derivation=\"server\"." - changed
Input schema / properties / artifacts / items / properties / after / descriptionPrevious value: -"Updated artifact content as a string"New value: +"The proposed document as raw text, same kind as before. Must be the bytes you intend to merge/deploy/publish, not a diff." - changed
Input schema / properties / artifacts / items / properties / before / descriptionPrevious value: -"Prior artifact content (spec/schema/manifest) as a string"New value: +"The baseline document as raw text (the spec/schema/manifest body). Empty string means \"no prior version\" (create), not \"load from disk\"." - added
Input schema / properties / artifacts / items / properties / type / descriptionAdded value: +"Artifact kind. One of openapi, graphql, grpc, asyncapi, mcp_manifest, agent_tools. Determines how before/after text is parsed. Not inferred from the filename." - changed
Input schema / properties / context / descriptionPrevious value: -"Optional apply-site context folded into the bundle fingerprint. operation distinguishes merge vs deploy vs publish (and other labels); the server accepts any string for operation (change-set.js) — conventional values below."New value: +"Optional apply-site context folded into the bundle fingerprint. operation distinguishes merge vs deploy vs publish (and other labels); the server accepts any non-empty string; conventional values: merge, deploy, tool_call, publish. The receipt/gate must match this label." - changed
Input schema / properties / derivation / descriptionPrevious value: -"Opt-in (ID637 6b). \"server\" = the server derives artifacts[] from GitHub Compare via the App installation. Allowed only when the tenant has a proven binding for context.repository and context.base + context.head are present. Omit artifacts[] (caller-supplied artifacts[] with this flag is 400 — one source of truth). Default absent = today's caller-artifacts path (byte-identical)."New value: +"\"server\" = the server derives artifacts[] from GitHub Compare via the App installation. Allowed only when context.repository, context.base and context.head are all present and the tenant has a proven binding for that repository. Do not send artifacts[] in the same call (400 — one source of truth). Omit this field for the caller-supplied artifacts[] path." - changed
Input schema / properties / executor_id / descriptionPrevious value: -"Identity of the executor the grant is bound to (cr.exec.v2)."New value: +"Authorize+grant v2 only. Executor identity the grant is bound to (example: agent:ci-bot, host:github-actions). Empty/absent is not \"any executor\"." - changed
Input schema / properties / expected_state_token / descriptionPrevious value: -"State token the executor expects to observe at apply time (cr.exec.v2). Signed as a separate field; empty string when absent."New value: +"Authorize+grant v2 only. Compare-and-swap token the executor must observe at apply time (the \"before\" state). Signed as its own field. Omit only if the adapter has no prior state; do not send a placeholder." - changed
Input schema / properties / include_execution_grant / descriptionPrevious value: -"Opt-in (authorize only). When true on allow-class authorize, the response includes a signed execution_grant (cr.exec.v1) alongside chain_receipt, or HTTP 503 SIGNER_UNAVAILABLE — never unsigned. Default false. Analyze ignores this flag. See docs/cr-exec-v1.md."New value: +"Authorize only. When true on an allow-class authorize, the response includes a signed execution_grant, or HTTP 503 SIGNER_UNAVAILABLE — never an unsigned grant. Default false. Analyze ignores this flag. Ignored unless preflight_mode=\"authorize\"." - changed
Input schema / properties / policy_hash / descriptionPrevious value: -"Policy identity the grant is issued under (cr.exec.v2). Bound into the signed grant when supplied."New value: +"Authorize+grant v2 only. Policy identity bound into the grant, sha256: + 64 hex. When supplied, apply must use that same policy; a different policy is a different grant." - changed
Input schema / properties / previous_receipt / descriptionPrevious value: -"Optional prior chain receipt token to link"New value: +"Optional prior chain token to LINK this call into a receipt chain: base64url(body).base64url(signature). Linking is not verification — a linked token is not re-checked here; use verify_receipt." - changed
Input schema / properties / state_nonce / descriptionPrevious value: -"Optional ATOMIC-profile nonce. When include_execution_grant is true, copied into the signed grant as state_nonce (a separate signed field — NOT folded into scope_hash). Absent → BEARER grant (today's default). See docs/cr-exec-v1.md."New value: +"Authorize+grant only. Opaque nonce copied into the signed grant as its own field (not folded into scope_hash). Absent → BEARER grant. Ignored unless include_execution_grant is true." - changed
Input schema / properties / target_uri / descriptionPrevious value: -"Target the grant is bound to (cr.exec.v2). Falls back to context.target_uri, then to a repository/head-derived value."New value: +"Authorize+grant v2 only. URI the grant binds (example: git://owner/repo.git/refs/heads/main). Fallback if omitted: context.target_uri, then repository/head-derived. Distinct from context.target_id." - changed
Input schema / properties / tenant_id / descriptionPrevious value: -"Tenant the grant is issued under (cr.exec.v2). Defaults to \"default\" when absent."New value: +"Authorize+grant v2 only. Tenant the grant is issued under. ASCII slug. When omitted the server uses \"default\" — pin it if you are not on the default tenant." - changed
Output schema / oneOfPrevious value: -[ - { - "additionalProperties": true, - "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", - "not": { - "anyOf": [ - { - "required": [ - "decision" - ] - }, - { - "required": [ - "execution_action" - ] - }, - { - "required": [ - "safe_for_agent" - ] - }, - { - "required": [ - "chain_receipt" - ] - }, - { - "required": [ - "execution_grant" - ] - }, - { - "required": [ - "decision_result" - ] - }, - { - "required": [ - "control_envelope" - ] - }, - { - "required": [ - "required_action_core" - ] - } - ] - }, - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "analysis_control": { - "type": "object" - }, - "analysis_outcome": { - "description": "Closed analysis outcome set derived from engine-visible state only.", - "enum": [ - "NO_BREAK_DETECTED", - "BREAKS_DETECTED", - "ANALYSIS_FAILED" - ], - "type": "string" - }, - "artifacts": { - "type": "array" - }, - "authorization_effect": { - "const": "NONE", - "description": "Analyze never authorizes; always NONE." - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "type": [ - "string", - "null" - ] - }, - "decision_basis": {}, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "may_execute": { - "const": false, - "description": "Analyze never grants execute permission." - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "analyze" - }, - "receipt_kind": { - "const": "NONE", - "description": "Analyze never mints a receipt." - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (observation; not permission).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "analysis_outcome", - "authorization_effect", - "may_execute", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - }, - { - "additionalProperties": true, - "allOf": [ - { - "if": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind" - ] - }, - "then": { - "required": [ - "chain_receipt" - ] - } - }, - { - "if": { - "properties": { - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING" - ] - } - }, - "required": [ - "execution_action" - ] - }, - "then": { - "properties": { - "receipt_kind": { - "const": "operation_authorization" - } - }, - "required": [ - "receipt_kind", - "chain_receipt", - "decision_result" - ] - } - } - ], - "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", - "properties": { - "analysis": { - "additionalProperties": true, - "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", - "properties": { - "breaking_changes": { - "type": "integer" - }, - "breaking_changes_details": { - "type": "array" - }, - "change_ir": { - "type": "array" - }, - "changelog": { - "type": "array" - }, - "compatibility_suggestions": { - "type": "array" - }, - "coverage_gap": { - "additionalProperties": true, - "type": "object" - }, - "coverage_gap_reason": { - "type": "string" - }, - "decision_basis": { - "additionalProperties": true, - "type": "object" - }, - "degraded": { - "type": "boolean" - }, - "detected_patterns": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "fallback_reason": { - "type": "string" - }, - "non_breaking_changes": { - "type": "array" - }, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "type": "array" - }, - "pii_findings": { - "type": "array" - }, - "policy_violations": { - "type": "array" - }, - "remediations": { - "items": { - "additionalProperties": true, - "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", - "properties": { - "change_type": { - "type": "string" - }, - "effort": { - "type": "string" - }, - "evidence": { - "additionalProperties": true, - "type": "object" - }, - "instruction": { - "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", - "type": "string" - }, - "precise_label": { - "type": "string" - }, - "recommended_transform": { - "type": "string" - }, - "target": { - "type": "string" - }, - "target_ref": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "type": "array" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_dimensions": { - "additionalProperties": true, - "type": "object" - }, - "risk_level": { - "type": "string" - }, - "risk_score": { - "type": "integer" - }, - "security_findings": { - "type": "array" - }, - "semver_suggestion": { - "type": "string" - }, - "should_block": { - "type": "boolean" - }, - "stats": { - "additionalProperties": true, - "type": "object" - }, - "token_cost_impact": { - "additionalProperties": true, - "type": "object" - } - }, - "type": "object" - }, - "artifacts": { - "type": "array" - }, - "blast_radius": { - "additionalProperties": false, - "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "enum": [ - "none", - "declared", - "observed", - "declared+observed" - ], - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "required": [ - "endpoints", - "fields", - "params", - "consumers_declared", - "consumers_observed", - "graph_source" - ], - "type": "object" - }, - "breaking_changes": { - "minimum": 0, - "type": "integer" - }, - "breaking_changes_details": { - "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", - "items": { - "additionalProperties": true, - "properties": { - "description": { - "type": "string" - }, - "field": { - "type": "string" - }, - "method": { - "type": "string" - }, - "path": { - "type": "string" - }, - "severity": { - "type": "string" - }, - "type": { - "description": "Change kind / IR type code (e.g. response.body.property.remove).", - "type": "string" - } - }, - "type": "object" - }, - "type": "array" - }, - "bundle_fingerprint": { - "type": "string" - }, - "calibration_version": { - "description": "Calibration model version when set; null until a calibrated model ships.", - "type": [ - "string", - "null" - ] - }, - "chain_receipt": { - "type": "string" - }, - "chain_status": { - "type": "string" - }, - "coderifts_version": { - "type": "string" - }, - "control_envelope": { - "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", - "type": "object" - }, - "decision": { - "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_basis": {}, - "decision_result": { - "additionalProperties": true, - "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", - "properties": { - "audience": { - "type": [ - "string", - "null" - ] - }, - "authority": { - "description": "ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", - "type": [ - "object", - "null" - ] - }, - "base": { - "type": [ - "string", - "null" - ] - }, - "blast_radius": { - "description": "ID27 additive COUNTS (not a score). Not permission.", - "properties": { - "consumers_declared": { - "minimum": 0, - "type": "integer" - }, - "consumers_observed": { - "minimum": 0, - "type": "integer" - }, - "endpoints": { - "minimum": 0, - "type": "integer" - }, - "fields": { - "minimum": 0, - "type": "integer" - }, - "graph_source": { - "type": "string" - }, - "params": { - "minimum": 0, - "type": "integer" - } - }, - "type": "object" - }, - "decision": { - "enum": [ - "ALLOW", - "WARN", - "REQUIRE_APPROVAL", - "BLOCK" - ], - "type": "string" - }, - "decision_body_hash": { - "type": [ - "string", - "null" - ] - }, - "decision_id": { - "type": "string" - }, - "derivation": { - "description": "ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", - "type": [ - "object", - "null" - ] - }, - "environment": { - "type": [ - "string", - "null" - ] - }, - "execution_action": { - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "expires_at": { - "type": "string" - }, - "fingerprint": { - "type": "string" - }, - "head": { - "type": [ - "string", - "null" - ] - }, - "input_fingerprint": { - "type": "string" - }, - "operation": { - "type": [ - "string", - "null" - ] - }, - "receipt": { - "type": "object" - }, - "repository": { - "type": [ - "string", - "null" - ] - }, - "safe_for_agent": { - "type": "boolean" - }, - "spec_version": { - "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", - "type": "string" - } - }, - "type": "object" - }, - "decision_spec_version": { - "description": "Decision Spec major for this response (typically '2.0').", - "type": "string" - }, - "detected_patterns": { - "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", - "items": { - "additionalProperties": false, - "properties": { - "affected_field": { - "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "affected_path": { - "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", - "type": "string" - }, - "consequence": { - "description": "What breaks for a consumer if this ships. Untrusted free text.", - "type": "string" - }, - "description": { - "description": "What the detector matched. Untrusted free text.", - "type": "string" - }, - "name": { - "description": "Governance pattern name; appears in patterns when both are carried.", - "type": "string" - }, - "severity": { - "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", - "type": "string" - }, - "side": { - "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", - "enum": [ - "request", - "response" - ], - "type": "string" - } - }, - "required": [ - "name", - "severity", - "description", - "consequence", - "affected_path", - "affected_field" - ], - "type": "object" - }, - "type": "array" - }, - "evidence": { - "type": "array" - }, - "evidence_quality": { - "type": "string" - }, - "execution_action": { - "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", - "enum": [ - "CONTINUE", - "CONTINUE_WITH_MONITORING", - "REQUEST_APPROVAL", - "STOP" - ], - "type": "string" - }, - "execution_grant": { - "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash. See docs/cr-exec-v1.md / docs/cr-exec-attest-v1.md.", - "type": "string" - }, - "human_report": { - "additionalProperties": false, - "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", - "properties": { - "breaking_highlights": { - "type": "array" - }, - "next_steps_prose": { - "type": "string" - }, - "suggestions": { - "type": "array" - }, - "summary": { - "type": "string" - } - }, - "type": "object" - }, - "operation": {}, - "pattern_sources": { - "type": "array" - }, - "patterns": { - "items": { - "type": "string" - }, - "type": "array" - }, - "policy_pin_status": { - "additionalProperties": true, - "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", - "type": [ - "object", - "null" - ] - }, - "preflight_mode": { - "const": "authorize" - }, - "receipt_kind": { - "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", - "enum": [ - "operation_authorization", - "NONE" - ], - "type": "string" - }, - "requires_migration": { - "type": "boolean" - }, - "risk_score": { - "maximum": 100, - "minimum": 0, - "type": "integer" - }, - "safe_for_agent": { - "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", - "type": "boolean" - }, - "scorer_version": { - "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", - "type": [ - "string", - "null" - ] - }, - "severity_summary": { - "additionalProperties": false, - "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", - "properties": { - "diff_severity": { - "description": "Structural size of the schema change.", - "type": "string" - }, - "governance_severity": { - "description": "How the rule engine rates the change.", - "type": "string" - }, - "note": { - "type": "string" - }, - "policy_effect": { - "description": "Resulting decision effect label.", - "type": "string" - } - }, - "type": "object" - }, - "timestamp": { - "type": "string" - }, - "verdict_fingerprint": { - "type": "string" - } - }, - "required": [ - "preflight_mode", - "decision", - "execution_action", - "safe_for_agent", - "receipt_kind", - "decision_spec_version" - ], - "type": "object" - } -]New value: +[ + { + "additionalProperties": true, + "description": "ANALYZE mode (Decision Spec 2.0): informational only. MUST NOT contain decision, execution_action, safe_for_agent, chain_receipt, execution_grant, decision_result, control_envelope, or required_action_core. Branch on analysis_outcome; never treat as permission. Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist).", + "not": { + "anyOf": [ + { + "required": [ + "decision" + ] + }, + { + "required": [ + "execution_action" + ] + }, + { + "required": [ + "safe_for_agent" + ] + }, + { + "required": [ + "chain_receipt" + ] + }, + { + "required": [ + "execution_grant" + ] + }, + { + "required": [ + "decision_result" + ] + }, + { + "required": [ + "control_envelope" + ] + }, + { + "required": [ + "required_action_core" + ] + } + ] + }, + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "analysis_control": { + "type": "object" + }, + "analysis_outcome": { + "description": "Closed analysis outcome set derived from engine-visible state only.", + "enum": [ + "NO_BREAK_DETECTED", + "BREAKS_DETECTED", + "ANALYSIS_FAILED" + ], + "type": "string" + }, + "artifacts": { + "type": "array" + }, + "authorization_effect": { + "const": "NONE", + "description": "Analyze never authorizes; always NONE." + }, + "blast_radius": { + "additionalProperties": false, + "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "type": [ + "string", + "null" + ] + }, + "decision_basis": {}, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "may_execute": { + "const": false, + "description": "Analyze never grants execute permission." + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "analyze" + }, + "receipt_kind": { + "const": "NONE", + "description": "Analyze never mints a receipt." + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (observation; not permission).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "analysis_outcome", + "authorization_effect", + "may_execute", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + }, + { + "additionalProperties": true, + "allOf": [ + { + "if": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind" + ] + }, + "then": { + "required": [ + "chain_receipt" + ] + } + }, + { + "if": { + "properties": { + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING" + ] + } + }, + "required": [ + "execution_action" + ] + }, + "then": { + "properties": { + "receipt_kind": { + "const": "operation_authorization" + } + }, + "required": [ + "receipt_kind", + "chain_receipt", + "decision_result" + ] + } + } + ], + "description": "AUTHORIZE mode: operation-bound decision. Branch on execution_action (not decision, not safe_for_agent). Field set GENERATED from preflight-response.v2.producer.json (agent-facing allowlist). Compatibility: https://coderifts.com/schemas/decision-result.v1.consumer.json", + "properties": { + "analysis": { + "additionalProperties": true, + "description": "Tier-2 analysis mirror (src/response-envelope.js buildAnalysisTier / attachControlSurface). Dual-write of the flat analysis fields present on the verdict, plus remediations[]. PROPERTIES ARE GENERATED from ANALYSIS_TIER_FIELDS + remediations by scripts/generate-analysis-tier-schema.js — do not hand-edit them. OPEN BY DESIGN: additionalProperties stays TRUE and this is not an oversight. The fields above are copied conditionally, so which of them appear depends on the input — a verdict with no PII findings simply omits pii_findings. Closing this object would turn every future analysis field into a breaking change that fails inside the consumer, and would reject exactly the verdict paths that no one sampled when the union was built. Declared, not closed: you can now see what you may get, and you must still tolerate more.", + "properties": { + "breaking_changes": { + "type": "integer" + }, + "breaking_changes_details": { + "type": "array" + }, + "change_ir": { + "type": "array" + }, + "changelog": { + "type": "array" + }, + "compatibility_suggestions": { + "type": "array" + }, + "coverage_gap": { + "additionalProperties": true, + "type": "object" + }, + "coverage_gap_reason": { + "type": "string" + }, + "decision_basis": { + "additionalProperties": true, + "type": "object" + }, + "degraded": { + "type": "boolean" + }, + "detected_patterns": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "fallback_reason": { + "type": "string" + }, + "non_breaking_changes": { + "type": "array" + }, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "type": "array" + }, + "pii_findings": { + "type": "array" + }, + "policy_violations": { + "type": "array" + }, + "remediations": { + "items": { + "additionalProperties": true, + "description": "One remediation for one detected breaking change. `instruction` is imperative prose that a model may read and act on; it is generated per input and is NOT a fixed string, so the schema declares that the field exists and does not pin its text.", + "properties": { + "change_type": { + "type": "string" + }, + "effort": { + "type": "string" + }, + "evidence": { + "additionalProperties": true, + "type": "object" + }, + "instruction": { + "description": "Imperative remediation text. Model-visible. Generated per input; not a closed vocabulary.", + "type": "string" + }, + "precise_label": { + "type": "string" + }, + "recommended_transform": { + "type": "string" + }, + "target": { + "type": "string" + }, + "target_ref": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "type": "array" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_dimensions": { + "additionalProperties": true, + "type": "object" + }, + "risk_level": { + "type": "string" + }, + "risk_score": { + "type": "integer" + }, + "security_findings": { + "type": "array" + }, + "semver_suggestion": { + "type": "string" + }, + "should_block": { + "type": "boolean" + }, + "stats": { + "additionalProperties": true, + "type": "object" + }, + "token_cost_impact": { + "additionalProperties": true, + "type": "object" + } + }, + "type": "object" + }, + "artifacts": { + "type": "array" + }, + "blast_radius": { + "additionalProperties": false, + "description": "ID27 additive COUNTS (not a score). Pure function of the change-set + request graphs. Not in the verdict_fingerprint preimage.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "enum": [ + "none", + "declared", + "observed", + "declared+observed" + ], + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "endpoints", + "fields", + "params", + "consumers_declared", + "consumers_observed", + "graph_source" + ], + "type": "object" + }, + "breaking_changes": { + "minimum": 0, + "type": "integer" + }, + "breaking_changes_details": { + "description": "Per-change IR/detail rows from the engine (src/blast/diff-to-change.js maps these). Measured row keys: type, path, method, field, severity, description. Distinct from breaking_changes (integer count).", + "items": { + "additionalProperties": true, + "properties": { + "description": { + "type": "string" + }, + "field": { + "type": "string" + }, + "method": { + "type": "string" + }, + "path": { + "type": "string" + }, + "severity": { + "type": "string" + }, + "type": { + "description": "Change kind / IR type code (e.g. response.body.property.remove).", + "type": "string" + } + }, + "type": "object" + }, + "type": "array" + }, + "bundle_fingerprint": { + "type": "string" + }, + "calibration_version": { + "description": "Calibration model version when set; null until a calibrated model ships.", + "type": [ + "string", + "null" + ] + }, + "chain_receipt": { + "type": "string" + }, + "chain_status": { + "type": "string" + }, + "coderifts_version": { + "type": "string" + }, + "control_envelope": { + "description": "Branch source (control/1.0). Machine-control surface from attachControlSurface / buildControlEnvelope. Agents and @coderifts/agent-guard branch on control_envelope.execution_action. Top-level decision/safe_for_agent/execution_action mirror these values for compatibility. Includes next_agent_step (structured remediation SUGGESTION derived from execution_action + required_action; null on CONTINUE*; not permission — still branch on execution_action).", + "type": "object" + }, + "decision": { + "description": "Compatibility mirror of control_envelope.decision (same value). Prefer control_envelope for branching; use decision as explanation only.", + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_basis": {}, + "decision_result": { + "additionalProperties": true, + "description": "decision-result.v1 envelope (control enums closed). Additive fields may appear and are not permission. Full schema: https://coderifts.com/schemas/decision-result.v1.consumer.json (producer: https://coderifts.com/schemas/decision-result.v1.producer.json).", + "properties": { + "audience": { + "type": [ + "string", + "null" + ] + }, + "authority": { + "description": "Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL.", + "type": [ + "object", + "null" + ] + }, + "base": { + "type": [ + "string", + "null" + ] + }, + "blast_radius": { + "description": "ID27 additive COUNTS (not a score). Not permission.", + "properties": { + "consumers_declared": { + "minimum": 0, + "type": "integer" + }, + "consumers_observed": { + "minimum": 0, + "type": "integer" + }, + "endpoints": { + "minimum": 0, + "type": "integer" + }, + "fields": { + "minimum": 0, + "type": "integer" + }, + "graph_source": { + "type": "string" + }, + "params": { + "minimum": 0, + "type": "integer" + } + }, + "type": "object" + }, + "decision": { + "enum": [ + "ALLOW", + "WARN", + "REQUIRE_APPROVAL", + "BLOCK" + ], + "type": "string" + }, + "decision_body_hash": { + "type": [ + "string", + "null" + ] + }, + "decision_id": { + "type": "string" + }, + "derivation": { + "description": "Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint.", + "type": [ + "object", + "null" + ] + }, + "environment": { + "type": [ + "string", + "null" + ] + }, + "execution_action": { + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "expires_at": { + "type": "string" + }, + "fingerprint": { + "type": "string" + }, + "head": { + "type": [ + "string", + "null" + ] + }, + "input_fingerprint": { + "type": "string" + }, + "operation": { + "type": [ + "string", + "null" + ] + }, + "receipt": { + "type": "object" + }, + "repository": { + "type": [ + "string", + "null" + ] + }, + "safe_for_agent": { + "type": "boolean" + }, + "spec_version": { + "pattern": "^decision-result\\.v1(\\.[0-9]+)?$", + "type": "string" + } + }, + "type": "object" + }, + "decision_spec_version": { + "description": "Decision Spec major for this response (typically '2.0').", + "type": "string" + }, + "detected_patterns": { + "description": "GOVERNANCE detector detail rows (src/change-patterns.js; validated by decision-spec-fields.js). Row shape measured live: name, severity, description, consequence, affected_path, affected_field; optional side (request|response) on ENUM_NARROWING. Names ⊆ patterns (not equality). Agent-detector names may appear only in patterns. Free-text fields are untrusted.", + "items": { + "additionalProperties": false, + "properties": { + "affected_field": { + "description": "Field within affected_path. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "affected_path": { + "description": "Contract path this row is about. Empty string when the detector had none — the key is always emitted.", + "type": "string" + }, + "consequence": { + "description": "What breaks for a consumer if this ships. Untrusted free text.", + "type": "string" + }, + "description": { + "description": "What the detector matched. Untrusted free text.", + "type": "string" + }, + "name": { + "description": "Governance pattern name; appears in patterns when both are carried.", + "type": "string" + }, + "severity": { + "description": "Row severity from the pattern catalog (observed set: CRITICAL, HIGH, MEDIUM). NOT a closed control enum — branch on execution_action, never on this.", + "type": "string" + }, + "side": { + "description": "Optional; currently set on ENUM_NARROWING only. Request-side narrowing is agent-breaking (threaded so safe_for_agent can distinguish it). Absent when the detector did not set it.", + "enum": [ + "request", + "response" + ], + "type": "string" + } + }, + "required": [ + "name", + "severity", + "description", + "consequence", + "affected_path", + "affected_field" + ], + "type": "object" + }, + "type": "array" + }, + "evidence": { + "type": "array" + }, + "evidence_quality": { + "type": "string" + }, + "execution_action": { + "description": "Compatibility mirror of control_envelope.execution_action (same value). Canonical branch key; unrecognised values are not permission (fail closed).", + "enum": [ + "CONTINUE", + "CONTINUE_WITH_MONITORING", + "REQUEST_APPROVAL", + "STOP" + ], + "type": "string" + }, + "execution_grant": { + "description": "Opt-in cr.exec.v1 execution grant (PHASE-0). Issued only when include_execution_grant is true on authorize. Short-lived mutation-bound sibling of chain_receipt; never unsigned. Optional inner state_nonce (ATOMIC profile) is additive and is NOT in scope_hash. See docs/cr-exec-v1.md / docs/cr-exec-attest-v1.md.", + "type": "string" + }, + "human_report": { + "additionalProperties": false, + "description": "Human-readable report tier (src/response-envelope.js buildHumanReport / analyze v2 stub). Measured keys: summary, breaking_highlights, suggestions, next_steps_prose.", + "properties": { + "breaking_highlights": { + "type": "array" + }, + "next_steps_prose": { + "type": "string" + }, + "suggestions": { + "type": "array" + }, + "summary": { + "type": "string" + } + }, + "type": "object" + }, + "operation": {}, + "pattern_sources": { + "type": "array" + }, + "patterns": { + "items": { + "type": "string" + }, + "type": "array" + }, + "policy_pin_status": { + "additionalProperties": true, + "description": "policy_pin observation (898). match null=no pin; false=drift warning (non-blocking).", + "type": [ + "object", + "null" + ] + }, + "preflight_mode": { + "const": "authorize" + }, + "receipt_kind": { + "description": "operation_authorization when a chain receipt was issued; NONE if signer unconfigured.", + "enum": [ + "operation_authorization", + "NONE" + ], + "type": "string" + }, + "requires_migration": { + "type": "boolean" + }, + "risk_score": { + "maximum": 100, + "minimum": 0, + "type": "integer" + }, + "safe_for_agent": { + "description": "Compatibility mirror of control_envelope.safe_for_agent (same value). Not a branch key — do not branch on safe_for_agent (use execution_action).", + "type": "boolean" + }, + "scorer_version": { + "description": "Fingerprint-bound scorerVersion() (same as decision_result.scorer_version / FP preimage).", + "type": [ + "string", + "null" + ] + }, + "severity_summary": { + "additionalProperties": false, + "description": "Bundle severity axes (src/change-set.js severity_summary). Distinct axes, not contradictory. Measured keys: diff_severity, governance_severity, policy_effect, note.", + "properties": { + "diff_severity": { + "description": "Structural size of the schema change.", + "type": "string" + }, + "governance_severity": { + "description": "How the rule engine rates the change.", + "type": "string" + }, + "note": { + "type": "string" + }, + "policy_effect": { + "description": "Resulting decision effect label.", + "type": "string" + } + }, + "type": "object" + }, + "timestamp": { + "type": "string" + }, + "verdict_fingerprint": { + "type": "string" + } + }, + "required": [ + "preflight_mode", + "decision", + "execution_action", + "safe_for_agent", + "receipt_kind", + "decision_spec_version" + ], + "type": "object" + } +]
- Changed
verify_receipt2 fields changed- changed
Input schema / properties / decision_result / properties / authority / descriptionPrevious value: -"ID963 additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL."New value: +"Additive. { audience, tenant_scope: bound|unbound, binding_proven_at? }. Informational — not permission, not a verify-receipt gate, not an ACL." - changed
Input schema / properties / decision_result / properties / derivation / descriptionPrevious value: -"ID637 6b additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint."New value: +"Additive. Present only when derivation:\"server\" produced this envelope. { source, platform?, base_sha, head_sha }. Covered by body_hash; not fingerprint."
1 tool update
- Changed
preflight_change_set5 fields changed- added
Input schema / properties / context / properties / target_uriAdded value: +{ + "description": "Optional apply-site URI the cr.exec.v2 grant binds (handler fallback: input.target_uri, then context.target_uri, then repository/head-derived). Distinct from target_id.", + "type": "string" +} - removed
Input schema / properties / grant_version / defaultRemoved value: -"v2" - changed
Input schema / properties / grant_version / descriptionPrevious value: -"Grant envelope to mint when include_execution_grant is true. MIGRATION: omitting this yields cr.exec.v1 until 2026-09-18 and cr.exec.v2 on and after it; the response carries grant_version_deprecation while the old default is still in effect. An explicit value always wins, before and after the cutoff — pin \"v1\" to keep the current behaviour with no code change on the date."New value: +"Grant envelope to mint when include_execution_grant is true. Omitting this yields cr.exec.v1 until 2026-09-18 and cr.exec.v2 on and after it (see x-coderifts-effective-default / x-coderifts-default-changes-at). The response meta.grant_version is the version actually issued. An explicit value always wins — pin \"v1\" to keep current behaviour with no code change on the date." - added
Input schema / properties / grant_version / x-coderifts-default-changes-atAdded value: +"2026-09-18" - added
Input schema / properties / grant_version / x-coderifts-effective-defaultAdded value: +"v1"
1 tool update
- Changed
preflight_change_set2 fields changed- added
Input schema / properties / grant_version / defaultAdded value: +"v2" - changed
Input schema / properties / grant_version / descriptionPrevious value: -"Grant envelope to mint when include_execution_grant is true. Default absent = v1."New value: +"Grant envelope to mint when include_execution_grant is true. MIGRATION: omitting this yields cr.exec.v1 until 2026-09-18 and cr.exec.v2 on and after it; the response carries grant_version_deprecation while the old default is still in effect. An explicit value always wins, before and after the cutoff — pin \"v1\" to keep the current behaviour with no code change on the date."
1 tool update
- Changed
verify_receipt1 field changed- changed
Output schema / properties / status / enumPrevious value: -[ - "VERIFIED_CURRENT", - "VERIFIED_EXPIRED", - "VERIFIED_WRONG_AUDIENCE", - "VERIFIED_WRONG_ENVIRONMENT", - "VERIFIED_SUPERSEDED", - "VERIFIED_SCOPE_MISMATCH", - "UNKNOWN_KEY", - "RETIRED_KEY_VALID_AT_ISSUE", - "INVALID_SIGNATURE", - "MALFORMED", - "UNSUPPORTED_VERSION", - "REGISTRY_UNREACHABLE" -]New value: +[ + "VERIFIED_CURRENT", + "VERIFIED_EXPIRED", + "VERIFIED_WRONG_AUDIENCE", + "VERIFIED_WRONG_ENVIRONMENT", + "VERIFIED_SUPERSEDED", + "VERIFIED_SCOPE_MISMATCH", + "VERIFIED_UNBOUND_OPERATION", + "VERIFIED_UNBOUND_TARGET", + "VERIFIED_UNBOUND_REPOSITORY", + "VERIFIED_UNBOUND_BRANCH", + "VERIFIED_UNBOUND_PULL_REQUEST", + "UNKNOWN_KEY", + "UNKNOWN_KEY_STATUS", + "RETIRED_KEY_VALID_AT_ISSUE", + "KEY_RETIRED_AFTER_SIGNING", + "REVOKED_KEY", + "REVOKED_KEY_UNDECIDABLE", + "KEY_REVOKED", + "REVOCATION_UNDECIDABLE", + "AUTHORIZATION_UNDECIDABLE", + "INVALID_SIGNATURE", + "MALFORMED", + "UNSUPPORTED_VERSION", + "REGISTRY_UNREACHABLE" +]
1 tool update
- Changed
preflight_change_set8 fields changed- added
Input schema / properties / adapter_idAdded value: +{ + "description": "Adapter the executor will apply the change with, e.g. fs, postgres, git (cr.exec.v2).", + "type": "string" +} - added
Input schema / properties / audienceAdded value: +{ + "description": "Requester identity for the decision envelope. Accepted here; the server-derived audience wins when both are present.", + "type": "string" +} - added
Input schema / properties / executor_idAdded value: +{ + "description": "Identity of the executor the grant is bound to (cr.exec.v2).", + "type": "string" +} - added
Input schema / properties / expected_state_tokenAdded value: +{ + "description": "State token the executor expects to observe at apply time (cr.exec.v2). Signed as a separate field; empty string when absent.", + "type": "string" +} - added
Input schema / properties / grant_versionAdded value: +{ + "description": "Grant envelope to mint when include_execution_grant is true. Default absent = v1.", + "enum": [ + "v1", + "v2" + ], + "type": "string" +} - added
Input schema / properties / policy_hashAdded value: +{ + "description": "Policy identity the grant is issued under (cr.exec.v2). Bound into the signed grant when supplied.", + "type": "string" +} - added
Input schema / properties / target_uriAdded value: +{ + "description": "Target the grant is bound to (cr.exec.v2). Falls back to context.target_uri, then to a repository/head-derived value.", + "type": "string" +} - added
Input schema / properties / tenant_idAdded value: +{ + "description": "Tenant the grant is issued under (cr.exec.v2). Defaults to \"default\" when absent.", + "type": "string" +}
Publisher details
- Operator
- CodeRifts · Publisher source
- Operator website
- https://coderifts.com
- Vendor relationship
- First-party · Publisher source
- Documentation
- https://coderifts.com/mcp/
- Trust center
- https://coderifts.com/trust-center/
- Restrictions
- No key is needed to connect, list tools, or analyze a change. A signed decision (authorize) needs a free API key from coderifts.com: free during the public beta, 1,000 requests a month per key. · Publisher source
Related MCP Connectors
Owner-signed permissions for AI agent actions; ALLOW/BLOCK/REVIEW with request-bound receipts.
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Preflight, approve, and prove consequential agent actions with signed evidence and x402 tools.
Machine-verifiable authorization checks for autonomous AI agents.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceEnables AI agents and MCP clients to screen proposed actions, enforce deterministic policies and limits, and produce tamper-proof signed audit receipts before any external side effect is executed.1 npmMIT
- AlicenseDqualityBmaintenanceEnables AI agents to inspect, draft, validate, and locally verify contract changes against frozen policies, with separate input and output roots and no approval or verified-signing capability.10MIT
- AlicenseNot gradedqualityBmaintenanceProvides a governed execution boundary for AI agents, enforcing deterministic policy, one-shot human approvals, and signed receipts for MCP tool effects.MIT
Try in Browser
Shareable, User-Owned Context BackendPeople, applications, and agents read, write, and coordinate together in one context lake. Reach it over MCP, a CLI, a Python SDK, or REST.fulcradynamics.comAd
Glama MCP Gateway
Add one secure layer between your agents and this server.