{ "tokens_out": 3241, "outcome": "pass", "suggested_fix": null, "cycle_checks": null, "fault": { "owner": null, "status": "resolved", "reason": null, "evidence": [] }, "runtime_revision": null, "agent_execution": "native_agent", "time_to_working_s": null, "usage_complete": true, "runtime": null, "architecture": null, "local_or_hosted": null, "agent_interfaces_note": null, "platform_details": null, "platforms_claimed": null, "maintenance": null, "evidence_strength": null, "purpose": "initial", "topic": null, "needs_which": null, "tested_with": null, "native_bundle": null, "agent_runtime": "claude-code", "maintenance_note": null, "runtime_version": null, "does_what_it_says": null, "commit": "fef5018a39be90b2b5e304bf1df5db3b10e0b697", "failure_origin": null, "stuck_step": null, "repo_url": null, "needs": null, "checks": [ { "check": "operation", "status": "PASS", "details": { "working": true, "argv": [ "/usr/bin/node", "eyJ2IjoyLCJraWQiOiIyMDI2LTA3LWsxIiwiZnAiOiJzaGEyNTY6NjhhYzM4MTNjZjUzYjNiZDMyMDgwMjhmYTYwOWExMWI5YTE3MDEyYjRmNTk5NGFhZmFjZGM3YTc5MzAzOTUyZCIsInByZXYiOiJudWxsIiwiY2FsbGVyIjoiYW5vbiIsInRzIjoiMjAyNi0wOC0yNlQyMToyMTo1OS4yMTJaIiwicmVnIjoiNGY1M2NkYTE4YzJiYWEwYzAzNTRiYjVmOWEzZWNiZTVlZDEyYWI0ZDhlMTFiYTg3M2MyZjExMTYxMjAyYjk0NSJ9.V1HOj8SKzT_KBLwlYaEYCziHsaZo390kuHReZg5yByvavNTNOxT1qhANIRc5Av0tJd6PVQvMDahGj8C4nCH8Bg", "--keys" ], "kind": "cli", "returncode": 0, "stdout": "{\"valid\":true,\"status\":\"VERIFIED_CURRENT\",\"payload\":{\"v\":2,\"kid\":\"2026-07-k1\",\"fp\":\"sha256:68ac3813cf53b3bd3208028fa609a11b9a17012b4f5994aafacdc7a79303952d\",\"prev\":\"null\",\"caller\":\"anon\",\"ts\":\"2026-08-26T21:21:59.212Z\",\"reg\":\"4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945\"},\"does_not_prove\":[\"it does not prove the agent then stopped. It is evidence about a decision we issued, never about what the caller did next.\",\"that the receipt AUTHORIZES the action you are about to take \u2014 a valid signature is authenticity, not authorization. Pass an intended context to the server verify, or use authorize() for the execution binding\",\"that the signing key is still trusted \u2014 REVOCATION and the issuer's clock are not visible to any local verifier, including this one. A key compromised a minute ago still verifies here\",\"that the bytes came from the run you think they did \u2014 this checks ONE token, and \\\"these tokens are one run\\\" is a property of a set (see cr.evidence.root.v1)\"]}", "stderr": "", "needs_credentials": false, "needs_browser": false, "scope": "product operation" } } ], "open_issues": null, "agent_runtime_version": "2.1.300 (Claude Code)", "verifies_run_id": null, "total_s": 195.86160516738892, "license": null, "tool_calls": 6, "model_version": "claude-haiku-5-5", "example_checks": [], "mcp": null, "other_model": null, "first_use_s": null, "native_tool_calls": 6, "last_commit_at": null, "source": "https://github.com/coderifts/receipt-verifier", "models_agree": null, "maintenance_verdict": null, "cost_usd": 0.006276239999999999, "safety": null, "answered_issues": null, "what_failed": null, "steps": [ "cd && ls -la && cat README.md 2>/dev/null | head -300", "cat 2>/dev/null | head -5; ls ; cd && git log -1 --format=%H 2>/dev/null; ls .coldpass 2>/dev/null", "cd && grep -n '^#' README.md; which node npm python3; node -v 2>&1; ls test scripts keys docs; cat package.json | head -60", "(sudo -n apt-get update -qq && sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs npm >/tmp/apt.log 2>&1; echo apt=$?) ; node -v; npm -v; cd && sed -n 413,468p README.md", "cd && export NODE_USE_ENV_PROXY=1 && head -c 200 test/fixtures-receipt.txt; echo; node cli.js \"$(cat test/fixtures-receipt.txt)\" --keys keys/coderifts-keys.json; echo \"exit=$?\"; node cli.js \"$(cat test/fixtures-receipt.txt)\"; echo \"default_exit=$?\"; ls -la .coldpass 2>/dev/null; ls 2>/dev/null || echo \"no .coldpass yet\"", "cd && mkdir -p .coldpass && python3 -I - <<'EOF'\nimport json\ntok = open('').read().strip()\nprobe = {\n \"kind\": \"cli\",\n \"argv\": [\"/usr/bin/node\", \"\", tok, \"--keys\", \"\"],\n \"cwd\": \"\",\n \"env\": {\"NODE_USE_ENV_PROXY\": \"1\"}\n}\njson.dump(probe, open('','w'), indent=2)\nreport = {\n \"outcome\": \"working\",\n \"operation\": \"Offline verification of a CodeRifts chain receipt (test/fixtures-receipt.txt) with `node cli.js --keys keys/coderifts-keys.json`; expected valid:true, status VERIFIED_CURRENT, exit 0.\",\n \"operation_scope\": \"Verifies signature and kid against the vendored key snapshot only. Does not verify a live demo receipt (needs a PR comment token), does not check revocation or authorization of the action. Python verifier and test suite not run (out of scope for smoke).\",\n \"steps\": [\n \"Read README.md (Requirements, Quickstart (Node), CLI reference)\",\n \"apt-get install -y nodejs npm (Node 18.19.1, npm 9.2.0); README requires Node >= 18, zero npm dependencies so no npm install or build step\",\n \"node cli.js \\\"$(cat test/fixtures-receipt.txt)\\\" --keys keys/coderifts-keys.json -> valid:true, VERIFIED_CURRENT, exit 0\",\n \"node cli.js \\\"$(cat test/fixtures-receipt.txt)\\\" (default vendored snapshot) -> same result, exit 0\",\n \"Wrote .coldpass/probe.json (kind cli)\"\n ],\n \"deviations\": [\n \"Node was not present in the guest; installed via apt-get (nodejs, npm) instead of a README installer. README does not give a specific install command for Node.\",\n \"Used repo fixture test/fixtures-receipt.txt as the receipt token instead of a freshly minted one from app.coderifts.com (network call, not needed for offline verification).\"\n ],\n \"stuck_step\": None,\n \"main_blocker\": None,\n \"suggested_fix\": None\n}\njson.dump(report, open('','w'), indent=2)\nprint(\"written\")\nEOF\n= python3 -I --validate; echo \"exit=$?\"" ], "platform_conflicts": null, "claims_note": null, "maintained_note": null, "repo": "coderifts/receipt-verifier", "service_tier": null, "maintained": null, "source_pin": null, "operation_scope": "product operation", "reasoning": "low", "claims": [], "platform": "linux", "cost_to_try": null, "backend": null, "tool_transport": "mcp-assigned-vm", "hardware": null, "agent_interface": null, "profile": { "model": "claude-haiku-5-5", "reasoning": "low" }, "date": "2026-10-18T15:20:10.288890+00:00", "kind": "repo", "resources": { "cpus": 2, "memory_mib": 4096, "disk_mib": 32768 }, "error_excerpt": null, "pass": true, "evidence_version": null, "source_revision": null, "run_id": "coderifts--receipt-verifier-claude-haiku-5-5-1792336614427272505", "last_release_at": null, "furthest_model": null, "model": "claude-haiku-5-5", "what_it_did": "Offline verification of a CodeRifts chain receipt (test/fixtures-receipt.txt) with `node cli.js --keys keys/coderifts-keys.json`; expected valid:true, status VERIFIED_CURRENT, exit 0.", "sandbox_source": null, "other_run_id": null, "hosting": null, "tested_commit": null, "guest_setup": null, "mcp_context": null, "agent_interfaces": [], "setup_identity": null, "works": null, "install_s": null, "fix_id": null, "tokens_in": 100210, "tested_at": null, "test_version": "readme-cae505cdaaa9e8cc13f1449c5e5f5816f65e8579e4bc7f8408ab66ff961f94c4", "recovery": { "source": "legacy-oct16-18", "original_run_id": "coderifts--receipt-verifier-claude-haiku-5-5-1792336614427272505", "historical": true, "ledger_sha256": "c5e6a833c182c1e2aecf69d0bd0020aec63c65d98f3e933e4b32232340312736" }, "transcript_url": "/transcripts/coderifts--receipt-verifier-claude-haiku-5-5-1792336614427272505.txt", "report_url": "/reports/coderifts--receipt-verifier-claude-haiku-5-5-1792336614427272505.json" }