{"ok":true,"version":"0.1.0","brand":{"name":"Countersign by Signalry","publisher":"Signalry","version":"bd-1"},"checker":"countersign-hosted/0.3.2","rules":"csr-1","qualification":"q-1","evidence_writer":"ew-1","evidence_sources":"is-1","evidence_depth":"ed-1","merge_gate":"mg-1","authority":"au-1","digest":"dg-1","onboarding":"ob-1","key_lifecycle":"kl-1","self_enroll":"se-1","whoami":"wh-1","mcp_modern":"mm-1","attribution":"sa-2","data":"dp-1","decay_index":"dx-1","decay_cadence":"off","data_reproduce":"dr-1","verifier_hardening":"vf-1","claim_blind":"cb-1","passport":"pp-2","a2a":"a2a-1","a2a_attestation":"aa-1","a2a_identity_rule":"gi-1","identity_read_rule":"gi-2","negative_record":"nr-1","negative_scope":"ns-1","reliance":"fw-1","rerun":"rr-1","rerun_record":"rr-2","held_record":"hr-1","test_vectors":"tv-1","test_vectors_ext":"tvx-1","test_vectors_passport":"tvx-2","test_vectors_merkle":"tvx-4","test_vectors_anchors":"tvx-5","deploy_continuity":"dc-1","missed_rechecks":"mr-1","recheck_adaptive_cap":"hc-2","recheck_reality":"hc-3","recheck_capacity":{"version":"hc-1","adaptive_version":"hc-2","reality_version":"hc-3","runs_24h":1023,"oldest_due_late_min":10,"grace_min":360,"worst_late_ratio":0.03,"per_host_cap":2,"self_host_cap":6,"adaptive_cap":3,"adaptive_hosts":[],"demand_per_day":430.7,"over_capacity":false,"over_capacity_hosts":[],"alert_level":"ok","alert_reasons":[],"detail":"/v1/recheck"},"verdict_changes":"vc-1","must_not_change":"mnc-1","must_not_change_suggest":"mnc-2","volatile_pin":"vp-1","pin_before_work":"pb-1","merkle_log":"ml-1","merkle_anchor":"ml-2","anchor_cadence":{"version":"ac-1","enabled":true,"interval_minutes":360,"receipt_threshold":50,"min_gap_minutes":60,"backoff_base_minutes":30,"backoff_max_minutes":360,"trigger_route":"Vercel cron GET /v1/recheck/cron (every 10 min); daily GitHub workflow as backup","rule":"anchor when the head moved and (interval elapsed or receipts_since >= receipt_threshold, never within min_gap); never when unchanged; failures back off 30 min doubling to 6 h","head_seq":14821,"last_anchor":{"id":"an-7556840249","seq":14686,"created_at":"2026-11-04T07:40:21+00:00","complete":true},"due":true,"reason":"receipt_threshold","receipts_since":135,"next_due_at":"2026-11-04T08:40:21.000Z","failures":0,"last_attempt_at":"2026-11-04T07:40:19.714Z","last_status":"anchored","last_error":null,"backoff_until":null,"next_trigger":"receipt_threshold","partial":{"version":"pa-1","last_anchor_missing":[],"retrying":false,"anchors_total":146,"missing_tsa":1,"missing_rekor":3,"latest_complete":{"id":"an-7556840249","seq":14686,"created_at":"2026-11-04T07:40:21+00:00"},"rule":"an anchor missing its RFC 3161 token or its Rekor entry is partial; the next anchor is due once the head moves and min_gap_minutes passed (trigger partial_retry), not after interval_minutes; the partial anchor itself is kept as is"}},"anchor_partial_retry":"pa-1","tsa_attempts":"tf-2","tsa_retry":"tf-3","tsa_fallback":{"version":"tf-1","order":[{"host":"freetsa.org","role":"primary"},{"host":"timestamp.sectigo.com","role":"fallback"}],"fallback_configured":true,"tokens_by_tsa":[{"host":"freetsa.org","anchors":142},{"host":"timestamp.sectigo.com","anchors":3}],"attempts":{"version":"tf-2","anchors":146,"basis":{"recorded":129,"derived":17},"fallback_used":3,"without_token":1,"by_tsa":[{"host":"freetsa.org","role":"primary","attempts":146,"granted":142,"refused":4,"http_error":0,"timeout":0,"imprint_mismatch":0,"profile_mismatch":0,"error":0,"retries":0,"last_not_granted":{"anchor":"an-2079a1b153","at":"2026-10-31T22:40:17+00:00","outcome":"refused","tsa_status":2}},{"host":"timestamp.sectigo.com","role":"fallback","attempts":3,"granted":3,"refused":0,"http_error":0,"timeout":0,"imprint_mismatch":0,"profile_mismatch":0,"error":0,"retries":0,"last_not_granted":null}],"retry":{"version":"tf-3","anchors_retried":0,"granted_on_retry":0},"streaks":{"primary_not_granted":0,"without_token":0},"profile":{"version":"ts-2","enforced":true,"anchors_checked":117,"tokens_passed":117,"tokens_refused":0,"tokens_unchecked":0,"last_refused":null,"rule":"at anchor time each granted RFC 3161 token is held to the ts-1 TSA profile with the served verifier's own check (critical timeStamping-only EKU, signed content-type id-ct-TSTInfo, ESS signing-certificate bound to the signer); tsa_attempts records profile \"ts-1 pass\", or outcome profile_mismatch with profile \"ts-1 fail\" and profile_problems[] (eku_not_critical|eku_not_timestamping_only|content_type_not_tstinfo|ess_cert_not_bound|token_structure), and a non-conforming token is never stored: the next TSA is asked; anchors from before ts-2 carry no profile field"},"fallback_used_rule":"an anchor whose token came from a TSA other than the first one asked (tf-3: a retry of the same TSA is not a fallback)","rule":"each anchor lists every TSA it asked, in order, with the outcome (granted|refused|http_error|timeout|imprint_mismatch|error) and retry: true on a tf-3 retry; anchors from before tf-2 are derived from their stored tsa_url and errors (basis derived)"},"last_probe":{"at":"2026-11-04T04:46:58+00:00","results":[{"host":"freetsa.org","role":"primary","granted":true,"gen_time":"2026-11-04T04:46:58Z","ms":292,"token":{"verified":true,"chain":"pinned_root","pin":"cert_sha256","root":"www.freetsa.org"},"consecutive_failures":0},{"host":"timestamp.sectigo.com","role":"fallback","granted":true,"gen_time":"2026-11-04T04:46:58Z","ms":223,"token":{"verified":true,"chain":"pinned_root","pin":"spki_sha256","root":"Sectigo Public Time Stamping Root R46"},"consecutive_failures":0}],"all_granted":true,"any_granted":true},"alert":{"version":"tf-3","level":"ok","reasons":[],"thresholds":{"primary_not_granted_streak":3,"probe_consecutive_failures":2,"without_token_streak":2},"rule":"critical when the last 2 anchors got no TSA token; warn when the first TSA did not grant the last 3 anchors or any TSA failed 2 probes in a row; computed on read, never sent"},"retry":{"version":"tf-3","delay_ms":1500,"budget_ms":40000,"attempt_timeout_ms":20000,"retry_timeout_ms":8000,"reserve_per_later_tsa_ms":12000,"rule":"a TSA that answers with an HTTP error or times out is asked once more after a short pause (retry: true in tsa_attempts) before the next TSA; a refusal or imprint mismatch is never retried; a retry is skipped when it would leave less than 12 s for each TSA still to ask inside the 40 s TSA budget"},"probe_every_hours":24,"verifier_pins":"countersign-verify >= 0.1.10 pins FreeTSA (certificate sha256 A6:37:9E…AA:BC) and Sectigo Public Time Stamping Root R46 (public key spki:sha256:a4db8668…824795)","rule":"the anchor's RFC 3161 token comes from the first TSA in order that grants; a later TSA is used only when an earlier one refuses or times out, and the anchor notes the refusal"},"claim_inclusion":"ip-1","audit_snapshot":"as-1","flip_record":"fr-1","identity_binding":"ib-1","identity_age":"ia-1","owner_keys":"ok-1","owner_refutation_carryover":"csr-2","outage_grace":"tr-6","baseline_counts":"bw-1","before_work_nudge":"nb-1","vercel_binding":"vb-1","vercel_selftest":"vs-1","authz_ref":"az-1","authz_offline":"av-1","unknown_check_fields":"uk-1","runner_check_fields":"uk-2","check_patterns":"fp-1","check_pattern_helper":"fh-1","deploy_claims":"dcl-1","runner_script":"pr-1","offline_verifier":"ov-27","verifier_known_exceptions":"kx-2","runner_ingest_guard":"eg-1","child_claims":"cd-1","child_claims_digest":"cd-2","used_by":"cd-1b","offline_verifier_package":"0.1.26","verifier_vectors_mode":"cv-1","verifier_live_mode":"cv-2","verifier_rekor_proofs":"rk-1","verifier_rekor_consistency":"rk-2","verifier_ledger_key_pinning":"ov-17","ledger_key_witness":"lk-1","ledger_key_witness_status":{"version":"lk-1","host":"countersign.signalry.ai","witnessed":["c39c3374decce909"],"pending":[],"enabled":true},"verifier_ledger_key_witness":"ov-18","verifier_staple_offline":"sv-1","verifier_staple_document":"sw-1","verifier_tsa_profile":"ts-1","anchor_tsa_profile":"ts-2","merkle_load_guard":"lc-1","json_field_compare":"jf-2","mnc_hold":"mh-1","mnc_hold_migration":6,"rekor_log_pin":{"version":"rk-1","log":"rekor.sigstore.dev","log_id":"c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d","public_key":"https://rekor.sigstore.dev/api/v1/log/publicKey"},"anchor_paging":"ap-1","verifier_derivations":"ov-12","offline_verifier_sha256":"21f26d617f4b815cce799a826546707586de3ec4432e8157949412ab8be0131f","hard_http":"hf-1","webhooks":"wh-1","webhook_guard":"wg-1","same_owner_countersign":"so-1","domain_proof":"dk-1","try_live_check":"gt-1","llms_short":"lt-3","fleet_marker":"fm-1","shared_operator":"op-1","html_checks":"dom-1","fleet_citations":"fc-1","challenge":"ch-1","claim_fields":"cf-1","attestation_audit":"ai-1","attestation_integrity":"ai-2","export_integrity":"ei-1","export_identities":"ei-2","attestation_audit_last":{"at":"2026-11-04T09:40:30.507Z","claims_with_attestation":1,"genuine":1,"unconfirmed":0,"suspect":0,"source":"recheck cron, at most hourly","version":"ai-2","alert_since":null,"cleared_at":null},"attestation_alert":{"version":"ai-3","max_age_s":10800,"detail":"/v1/audit/attestations","state":"ok","suspect":0,"last_audit_at":"2026-11-04T09:40:30.507Z","age_s":50,"cleared_at":null,"since":null},"windowed":"wd-1","relying_party":"ra-1","distribution":"ds-1","distribution_surfaces":{"version":"ds-1","server_json":"/server.json","registry_name":"ai.signalry/countersign","registry_schema":"https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json","well_known":["/.well-known/mcp.json","/.well-known/mcp/server-card.json","/.well-known/agent-card.json","/.well-known/agent.json","/.well-known/ai-plugin.json"],"registry_auth_configured":false,"ci":"/ci","examples":["/examples/deploy-check","/examples/ci-tests","/examples/verify-teammate"],"badge":"/badge/{id}.svg","badge_json":"/badge/{id}.json","public_repo":null},"receipt_checks":"rc-1","canaries":{"version":"kc-1","set_version":"kc-2","canary_ok":true,"kinds":9,"kinds_exercised":9,"last_canary_at":"2026-11-04T04:00:20+00:00","computed_at":"2026-11-04T09:41:20.237Z","max_age_s":60,"detail":"/v1/recipes"},"scoring":"tr-5","commit":"024f97c","rate_limits":{"anon_writes_per_min":30,"agent_writes_per_min":120,"reads_per_min":600,"repo_writes_per_min":30,"shared":true,"shared_last_error":null},"skill":{"url":"https://countersign.signalry.ai/skills/countersign/SKILL.md","install":"mkdir -p ~/.claude/skills/countersign && curl -fsSL https://countersign.signalry.ai/skills/countersign/SKILL.md -o ~/.claude/skills/countersign/SKILL.md"},"auth":{"api_key":true,"anonymous":true,"oauth":{"supported":true,"connector_url":"https://countersign.signalry.ai/mcp/oauth","issuer":"https://countersign.signalry.ai","authorization_server_metadata":"https://countersign.signalry.ai/.well-known/oauth-authorization-server","pkce":["S256"],"client_registration":["client_id_metadata_document","dynamic"],"audience_bound":true},"github_oidc":{"supported":true,"issuer":"https://token.actions.githubusercontent.com","audience":"countersign.signalry.ai","identity":"github:<owner>/<repo>","algorithms":["RS256"]},"vercel_oidc":{"supported":true,"version":"vo-1","issuer":"https://oidc.vercel.com/<team_slug>","issuer_mode":"team","global_issuer_accepted":false,"audience":"countersign.signalry.ai","identity":"vercel:<team>/<project>","pinned_to":"owner_id + project_id","binding":"key proved (Vercel signed the project identity); not bound to a person or org","agent_binding":{"version":"vb-1","bind":"POST /v1/agents/me/bindings {oidc_token} with the agent's csk_ key","list":"GET /v1/agents/me/bindings","unbind":"DELETE /v1/agents/me/bindings/{project_id}","token_max_age_s":600},"algorithms":["RS256"]}},"claims_by_status":{"decayed":168,"indeterminate":5,"refuted":22,"verified":2602,"withdrawn":470},"ops_alert":{"version":"al-1","level":"ok","critical":false,"reasons":[],"sources":{"recheck_capacity":{"level":"ok","reasons":[]},"tsa_fallback":{"level":"ok","reasons":[]},"attestation_alert":{"level":"ok","reasons":[]},"canaries":{"level":"ok","reasons":[]}},"watch":"file a hosted claim with an http check on /v1/health json_fields ops_alert.critical eq false and recheck hourly, then subscribe to claim.decayed via POST /v1/agents/me/webhooks (wh-1)","rule":"worst of recheck_capacity.alert_level, tsa_fallback.alert.level, attestation_alert.state (alert = critical; stale/unknown = warn) and canaries (canary_ok false = critical; null, never run or older than 40 h = warn); a missing source is warn; health ok stays liveness"},"missed_rechecks_24h":{"version":"al-2","window_h":24,"since":"2026-11-03T09:40:30+00:00","missed":11,"claims":4,"by_reason":{"host_backoff":11,"not_reached":0},"computed_at":"2026-11-04T09:40:30.339Z","cache_s":300,"detail":"GET /v1/claims/<id> missed_rechecks"},"ops_alert_v2":{"version":"al-2","level":"warn","critical":false,"reasons":["missed_rechecks:host_backoff_24h:11"],"sources":{"recheck_capacity":{"level":"ok","reasons":[]},"tsa_fallback":{"level":"ok","reasons":[]},"attestation_alert":{"level":"ok","reasons":[]},"canaries":{"level":"ok","reasons":[]},"anchor_cadence":{"level":"ok","reasons":[]},"missed_rechecks":{"level":"warn","reasons":["host_backoff_24h:11"]}},"thresholds":{"anchor_warn_x_interval":1.5,"anchor_critical_x_interval":2,"anchor_failures_warn":3,"missed_not_reached_critical_24h":12,"canary_stale_h":40},"watch":"file a hosted claim with an http check on /v1/health json_fields ops_alert_v2.critical eq false and recheck hourly, then subscribe to claim.decayed via POST /v1/agents/me/webhooks (wh-1); ops_alert (al-1) is unchanged","rule":"al-1's four sources plus anchor_cadence (head moved and latest anchor older than 1.5 x interval_minutes = warn, 2 x = critical; disabled, no anchor or >= 3 consecutive failures = warn) and missed_rechecks (any mr-1 window recorded missed in the last 24 h = warn; >= 12 not_reached = critical; host_backoff only warns); a missing source is warn; health ok stays liveness"},"status_page":"st-1","observer_receipts":"ro-2","peer_independence_rule":"op-2","agent_copy":"ac-1","try_now":"tn-1","peer_fail_rule":"pf-1","runner_claim_binding":"rb-1","fleet_privacy":"fp-1","key_funnel_audience":"au-2","commitment_scheme":"csc-1","private_digest_rule":"pd-1","spec_verdict_scope":"vsc-1","spec_audit_record_mapping":"arm-1","spec_audit_bof":"arm-2","verdict_record":"vr-1","spec_verdict_record":"vr-1","spec_measurement_capsule":"mc-1","inclusion_rule":"ir-1","receipt_conformance":"os-1","receipt_interop":"os-1","fleet_anonymization":"opsec-1","stapled_receipts":"sr-1","runner_staple":"sp-1","runner_refresh_staples":"rf-1","recipe_stats_fold":"rm-1","recipe_stats_snapshot":"fs-1","recipe_stats_claim_cache":"cc-1","recipe_stats_claim_changes":"cl-1","recipe_stats_snapshot_status":{"version":"fs-1","code_version":"fs-1:024f97cd28e4","loads":2,"load_misses":0,"saves":2,"save_errors":0,"rejected":0,"snapshots":[{"name":"error_rates","head_seq":14821,"rows":14821,"full_at":"2026-11-04T09:40:30.010Z","saved_at":"2026-11-04T09:40:30.010Z","full_age_min":0.8},{"name":"recipe_runs","head_seq":14821,"rows":14821,"full_at":"2026-11-04T09:40:29.197Z","saved_at":"2026-11-04T09:40:29.197Z","full_age_min":0.9}]},"deploy_skip":"ds-1","view_parity":"vw-2","view_parity_status":{"version":"vw-2","rate":0.25,"sampling":"crypto.randomInt per http check run; a check whose last hosted run differed is always re-probed","recheck_jitter":"next_due_at is jittered by +/- 15% of the interval in production (deterministic in tests)","compares":["verdict","http_status","html_title","html_canonical","body_divergence"],"fresh_confirm":"when the first pair disagrees, one more pair is read with Cache-Control: no-cache (same user agents). If that pair agrees and matches the first ordinary-reader read, the difference was a stale cache and the check keeps the fresh verdict with view_parity same. A real cloak, or a site that serves the checker copy only to cache-bypass reads, still reads differs.","reader_headers":{"user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,application/json;q=0.8,*/*;q=0.7","accept-language":"en-US,en;q=0.9"},"reader_headers_marker_free":true,"on_differs":"indeterminate (never verified, never refuted)","skipped_for":["deploy-claim propagation preflight","known-answer canaries","must_not_change pin reads"],"source":"https://arxiv.org/abs/2610.37055"},"track_record_scan":"ls-1","track_record_scan_status":{"version":"ls-1","enabled":true,"log_error":null,"claims":3267,"receipts":14821,"seq":14821,"change_seq":18226,"age_s":54,"full":1,"incremental":0,"last_mode":"full","last_receipts_fetched":14821,"last_claims_fetched":3267,"last_changed":0,"last_ms":1040,"fallback_reason":"cold","flip_error":null},"track_record_scan_last":{"version":"ls-1","at":"2026-11-04T09:40:26.838Z","head_seq":14821,"mode":"full","receipts_fetched":14821,"claims_fetched":3267,"changed":0,"ms":1040,"fallback_reason":"cold","cache":{"claims":3267,"receipts":14821},"recent":[{"at":"2026-11-04T09:40:26.838Z","head_seq":14821,"mode":"full","receipts_fetched":14821,"claims_fetched":3267,"changed":0,"ms":1040,"fallback_reason":"cold"},{"at":"2026-11-04T09:31:08.180Z","head_seq":14809,"mode":"incremental","receipts_fetched":0,"claims_fetched":0,"changed":0,"ms":55,"fallback_reason":null},{"at":"2026-11-04T09:30:19.446Z","head_seq":14809,"mode":"incremental","receipts_fetched":13,"claims_fetched":13,"changed":13,"ms":77,"fallback_reason":null},{"at":"2026-11-04T09:20:22.192Z","head_seq":14796,"mode":"full","receipts_fetched":14796,"claims_fetched":3267,"changed":0,"ms":1027,"fallback_reason":"cold"},{"at":"2026-11-04T09:10:24.932Z","head_seq":14784,"mode":"full","receipts_fetched":14784,"claims_fetched":3267,"changed":0,"ms":1273,"fallback_reason":"rebuild_window"}],"recent_modes":{"full":7,"incremental":13}},"result_read_record":"rs-1","result_read_record_status":{"version":"rs-1","receipt_id":"rh-2facf2c2c809","run_at":"2026-11-04T09:40:25+00:00","results":1,"with_read_at":0,"with_source":0,"carried":0,"fresh_with_record":0,"fresh":1,"all_fresh_have_record":false},"status_history":"st-2","status_history_status":{"version":"st-2","ticks":1087,"since":"2026-10-27T20:20:13.191Z","last_tick_at":"2026-11-04T09:40:30.370Z","last_tick_age_min":1,"recording":true},"execution_declaration":"ex-1","receipt_views":"rv-1","receipt_cta":"rv-1","receipt_cta_target":"POST /v1/start?ref=r","error_budget":{"version":"eb-1","within_budget":true,"burned":0,"objectives":4,"remaining_ratio":1,"slos":[{"id":"api_availability","health_field":"ok","target":"ok is true (the API is serving)","good":true,"detail":"ok"},{"id":"recheck_freshness","health_field":"recheck_capacity.oldest_due_late_min","target":"oldest due recheck is not later than its grace (hc-3 critical line)","good":true,"detail":"10 min late, grace 360 min"},{"id":"anchor_cadence","health_field":"anchor_cadence.last_anchor.created_at","target":"latest anchor age <= 2 × interval_minutes when the head has moved","good":true,"detail":"121 min old, limit 720 min"},{"id":"audit_integrity","health_field":"attestation_alert.state","target":"attestation audit state is ok (unknown before the first audit does not burn)","good":true,"detail":"ok"}],"consumed_by":"kc-1 canaries http_json.error_budget_pass and http_json.error_budget_fail on /v1/health; a breach fails the pass canary, ops_alert_v2 sources.canaries goes critical, and a claim on ops_alert_v2.critical decays","rule":"point sample of the four health fields. Not a 30-day ratio; /v1/status history is the windowed picture of ops_alert_v2. The budget uses the same hard lines those fields already page on."}}