What each path does — and does not

npm package · tool-table composition · fail-closed

Does: Prevents a breaking contract call from running when the call goes through the returned tool table. Fail-closed on BLOCK, REQUIRE_APPROVAL, unverifiable receipt, unwired monitoring, and similar integrity failures.

Does not: Does not see calls the host registers outside that table. Does not block a human merge on GitHub. Does not replace branch protection or the PR report path.

Needs: wire only the tools returned by withCodeRifts / the guarded registry — the runtime sees only calls through that surface. See agents quickstart.

one install · signed BLOCK / WARN / ALLOW on the pull request

Does: Reports a signed governance decision on every pull request that changes analysable contracts. Visibility for reviewers with no CI YAML required.

Does not: Prevents nothing on its own. A red comment does not stop merge, push, or an agent tool call unless something else enforces the verdict.

Needs: nothing beyond installing the App. See GitHub integration.

GitHub check run · can block merge when fully configured

Does: Can prevent a merge when branch protection requires this context, the check is bound to the CodeRifts App (app_id: 2860592), an analysable schema is present, and administrators cannot bypass (enforce_admins).

Does not: Does not block by default after a bare App install. Name-only required checks (no app_id) are spoofable. Neutral completion (no analysable schema) is non-blocking. Does not stop runtime agent calls.

Needs: all four conditions together — see Make the Check Block a Merge.

second check on PRs · phase-1 advisory

Does: Runs on pull requests and reports. It is a live check you can see next to the main CodeRifts check.

Does not: Prevents nothing today. Phase-1 clamps conclusions to neutral (not failure). MERGEGATE_ENFORCE defaults false. Do not require this context as your merge gate expecting a red check to stop the merge.

Needs: a later enforce-mode decision before this path can block. Until then it is observation only.

preflight_change_set · verify_receipt · get_decision_details

Does: Gives an agent a deterministic preflight (preflight_mode required: analyze = risk only; authorize = operation-bound + optional receipt), receipt verification, and stored-decision lookup over Streamable HTTP.

Does not: Prevents nothing by itself. The agent (or host) must treat an authorize verdict as binding (branch on execution_action; verify receipt). Analyze is informational — not permission. Without a runtime guard, a model can ignore the verdict and still call the broken API.

Needs: an agent or host that treats authorize + receipt verification as binding — e.g. wire @coderifts/agent-guard, or refuse non-CONTINUE execution_action. Contract: Decision Spec v2. See MCP integration and mcp.json.

local check before code leaves the machine

Does: Can prevent a push when configured as a pre-push (or CI job) that fails on a bad verdict. Catches issues before they hit the remote.

Does not: Does not prevent a merge on GitHub once the branch is already updated (e.g. web UI merge, force-push by another actor, or a push that bypassed the hook). Does not wrap agent tool calls at runtime.

Needs: the hook or job must actually run and fail closed on the verdict. See CLI integration.