opstruth_attest_donestate_handoff
ChatGPTUse this only with a sealed DoneState verification handoff v2. OpsTruth validates its digest and exact subject, freshly reads the public GitHub commit, evaluates every sealed machine-checkable requirement, and returns a signed attestation for separate submission to DoneState. It never trusts executor success, submits the attestation, or changes the repository.
opstruth_audit_environment
ChatGPTUse this to list visible environment variable names, configuration paths and package scripts. Environment values and secret-file contents are never read; do not request credentials through this tool.
opstruth_audit_repository
ChatGPTUse this for a broad, read-only evidence audit of a public GitHub repository, including readiness questions. Prefer a narrower tool for one concern. Never use it to modify, deploy or execute the repository.
opstruth_audit_secrets
ChatGPTUse this for a bounded public-source scan of selected secret-like patterns. It returns only redacted types and locations, never values. It is not a complete history or credential-validity scan.
opstruth_check_deployment
ChatGPTUse this for a static deployment preflight based on visible configuration and package scripts. It does not build, deploy, call provider APIs or prove live health.
opstruth_check_github_handoff
ChatGPTUse this when release confidence depends on current public GitHub Actions, check runs, commit status, branch protection or handoff files. It is read-only and cannot approve, merge, push or change GitHub.
opstruth_compare_snapshots
ChatGPTUse this to compare two caller-held OpsTruth Evidence Graph v1 snapshots. It checks graph integrity, signer trust and subject compatibility before reporting deterministic node, edge, contradiction and verdict changes. It performs no network request and stores nothing.
opstruth_discover_capabilities
ChatGPTUse this when you are unsure which read-only OpsTruth capability fits a concrete coding outcome. It recommends one bounded capability only and does not invoke tools, modify repositories or authorise actions.
opstruth_get_verifier_identity
ChatGPTUse this before creating a DoneState objective that requires terminal independent verification. It returns only OpsTruth's configured public Ed25519 identity and compatible fingerprints, never a private key, trust decision or verification result.
opstruth_inspect_repository
ChatGPTUse this when you need a quick evidence map of a public GitHub repository before planning changes. It returns identity, structure, manifests, workflows, tests and proof gaps without executing code. Do not use it to inspect private repositories or claim a build passed.
opstruth_plan_workflow
ChatGPTUse this to create a bounded verification sequence with checkpoints and approval gates for a coding objective. It plans only; it does not execute, approve, deploy, merge or authorise actions.
opstruth_prepare_sandbox_verification
ChatGPTUse this when the user needs a plan to verify a repository build or tests in a separately connected isolated runner. It only prepares an approval-gated handoff from declared scripts and never executes code, installs dependencies or accepts credentials.
opstruth_probe_deployment
ChatGPTUse this only when the user supplies a public HTTPS deployment URL and asks for a bounded health check. It retains status and headers but no response body; it rejects credentials, localhost, IP literals and non-HTTPS URLs. It does not deploy or diagnose private provider state.
opstruth_render_evidence
ChatGPTUse this only after another OpsTruth data tool returned a report that should be presented as an interactive evidence summary. It does not fetch new evidence, execute code or change the supplied report.
opstruth_review_api_contracts
ChatGPTUse this to inventory visible API handlers and OpenAPI, GraphQL, schema or contract paths. It does not call, mutate or validate a deployed API and cannot prove consumer compatibility.
opstruth_review_migrations
ChatGPTUse this to review visible migration files and static risk indicators before a database change. It never connects to or changes a database and cannot prove applied state or rollback safety.
opstruth_snapshot_evidence
ChatGPTUse this to bind public repository, current CI and optional explicitly supplied public HTTPS runtime observations into one portable signed Evidence Graph. It never executes repository code, stores the graph or claims that a reachable endpoint proves which commit is deployed.
opstruth_trace_routes
ChatGPTUse this when you need statically visible page, API or declared route patterns in a public GitHub repository. It cannot prove live reachability, authentication, middleware behaviour or runtime correctness.
opstruth_verify_evidence_receipt
ChatGPTUse this when an OpsTruth evidence report receipt is supplied and its digest, Ed25519 signature or signer trust needs independent checking. It never repeats the inspection or probe and does not turn evidence into a deployment approval.
opstruth_verify_execution_result
ChatGPTUse this after a separately authorised executor returns a signed receipt. OpsTruth validates the request, authorisation and receipt chain against separate authorizer and executor fingerprint allowlists, enforces signer-role separation, freshly re-observes public repository, CI and optional HTTPS evidence, then signs an independent VerificationResult. Executor success alone can never produce VERIFIED.
opstruth_verify_receipt
ChatGPTUse this when an AgentProof signed receipt v2 is supplied and its structure, digest, signature or signer trust needs checking. It never executes or repeats the underlying action and does not infer that a valid receipt proves the action was safe.
