Install.
What it asks for, and what stops it.
Read this before you grant anything. Every claim below is enforced by a named mechanism, not by our intention.
Four reads and one write.
contents: read · to read your workflow files. Nothing
else in the repository is requested.
pull_requests: read · to see which commits to compare.
actions: read · to observe whether checks actually ran.
metadata: read · required by GitHub for any App.
checks: write · to post its own check run.
That last one deserves the honest version. Our own analysis calls
checks: write the ability to clear a failing check of the
same name, because a later check run supersedes an earlier one in the
combined status. We hold it and cannot work without it. GitHub can bind
a required check to an expected app, which narrows the route where it
is set.
What makes it safe here is that this App never asks to be a required check. Nothing depends on the run it posts, so superseding it changes no merge decision. If you make it required, that stops being true, and we would rather you did not.
Three promises, each with the thing that enforces it.
It never blocks a merge. The App does not ask to be a required check, and never modifies a ruleset. Promotion is your decision, taken after watching it be right.
It never posts a failure it cannot support. When it cannot complete an analysis it returns neutral and says why. A green posted through our own failure would be a green with no evidence behind it.
It requests five paths, and only five. The workflow directory
and four locations for an optional WARRANT file. Being
precise about what enforces that: GitHub's
contents: read is repository-wide and the platform does
not confine a token to selected paths. What confines it is our client,
which is written and tested to fetch those five and nothing else, and
whose behaviour you can check by reading it. Private repository
contents are never used as training data, which is a contractual and
organisational control rather than a platform one.
Nothing to install. Nothing on public repositories, ever.
On private repositories the first five committers are free on every plan, and above that it is priced per committer with the rate falling as the team grows. The rates are published.
Installing does not subscribe you to anything and does not ask for a card. The App works before you pay.
You do not have to install anything to check whether it is right.
arcifact.io/r/<org>/<repo> analyses any public repository with no installation and no account. The verifiers are public, so anything a report claims can be rechecked offline without trusting our code.
What is measured, and what is not promised.
Measured and published. The receiver checks itself every six hours, and the result is at arcifact.io/canary. It returns 503 when the last run found problems and 503 when it has never run, so any uptime monitor can watch it. That is not a promise; it is an instrument you can point something at.
What it has recorded so far, measured on 27 August 2026 and offered as a description rather than a commitment: 19,393 requests over eight days with zero errors at the edge, and a cold analysis of a large repository in around fifteen seconds. Eight days is not a track record. The date is here because a figure with no date is a claim that decays quietly, and you would otherwise have to take our word that there is nothing to hide.
What is still not promised. No uptime figure, no response time and no accuracy rate. The analysis depends on GitHub's API and on infrastructure we do not own, and a number we cannot control is not a commitment we can make. A supplier who publishes a target they cannot influence is describing their hopes.
What is committed to. Three things, all of them entirely within our control.
Failing closed. When the analysis cannot decide, it says so and
claims nothing.
A check run is never left in progress. If the analysis cannot
complete, the run is completed as neutral with the reason.
The check we post is never required. Nothing of yours merges or
blocks on our opinion.
Removing it is one click in your organisation's settings, and analysis stops immediately. One line on why you removed it is worth more to us than the install was.
One click, on the repositories you choose.
Choose Only select repositories unless you have a reason not to. You can add more at any time, and the App will tell you what each one proves the first time it sees it.
This page is the contract in prose. The same thing as plain text, generated from the gates that enforce it, is what a machine should read.