{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=preflight/play-preflight@0.3.3","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/preflight/play-preflight@0.3.3","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/preflight/play-preflight@0.3.3","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/preflight/play-preflight@0.3.3 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"We preflighted all 161 public Plays in the registry. Every one returns a contract rote marks not fully resolved, and every one reports write_permissions as an empty list. An empty list reads like a guarantee. It only means nobody asked. Preflight tells you what a Play will carry, require and attempt before you grant it process access. It reads rote's own contract via play inspect --json, rehearses the run with rote's non-executing resolver via play run --dry-run, and scans the package itself for captured secrets, hardcoded author paths, and symlinks that escape it. It never executes the target Play, and it does not reimplement rote's contract logic. It asks rote. Run it with no arguments to watch it catch a bundled compromised sample, then point it at anything you are about to trust. Full registry findings ship in the package as REPORT.md. Effect disclosure: rote owns its own installation, workspace and backup behaviour, and running any Play may create rote run workspaces, logs and artifacts. With fetch=true","distribution":{"digest":"sha256:9dcaa7904de935a73cc9ac8bb756813350c6b0310e7c2f1aa4d6830f273e8e06","mediaType":"application/vnd.modiqo.rote-flow","size":23841,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/preflight/play-preflight@0.3.3","inputPolicy":{"optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/preflight/play-preflight@0.3.3","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/preflight/play-preflight@0.3.3.json"},"name":"play-preflight","owner":{"kind":"org","slug":"preflight"},"parameters":[{"default":"sample","description":"A local Play path, or an owner/name registry reference. The default, the literal word sample, preflights a deliberately defective Play bundled in this package, so a zero-argument run shows you what a finding looks like before you point this at your own work.","example":"modiqo/hello","input":{"allowCustom":true,"choices":[],"label":"Target"},"name":"target","required":false,"type":"string"},{"default":false,"description":"Download the Play from the registry before checking it, so the real package is read instead of only its manifest. This is the half of rote play run that does not execute anything: it puts the Play on your disk and stops. That download is a write. Rote may create package, lock and backup entries under ~/.rote/flows; rote owns that behaviour, not this Play. --no-deps is passed, so no dependency is installed. With fetch=false rote registry play pull is not invoked, though rote may still create its normal run workspaces, logs and artifacts as it does for any Play. A download is only attempted when this owner and name are absent locally and the reference names the current version: rote cannot download a pinned historical version, and an existing installation is yours to manage, not this Play's to replace. Only a package downloaded during this run can be given a verdict about the published artifact. A copy already on disk is still scanned, and its findings still stand, but the published-artifact claim is withheld a","input":{"allowCustom":true,"choices":[],"label":"Download the package first"},"name":"fetch","required":false,"type":"boolean"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/preflight/play-preflight@0.3.3 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters"},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/preflight/play-preflight@0.3.3","headlessCommandTemplate":"rote play run https://play.modiqo.ai/preflight/play-preflight@0.3.3 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.77.0"},"publishedAt":"2026-09-02T09:16:04.410378+00:00","reference":"preflight/play-preflight@0.3.3","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"localTools":["python3","rote"],"roteCli":{"minimumVersion":"0.62.0"},"sessions":false},"resolution":"pinned","schema":"rote.play.v1","stats":{"downloads":1,"installs":0},"steps":{"count":1,"names":["preflight"]},"title":"play-preflight","type":"play","version":"0.3.3","visibility":"public"}