nexus-prime 7.9.26 → 7.9.27

package/README.md

@@ -74,6 +74,17 @@ Agents should start with `nexus_session_bootstrap`, then route the raw request t
 
 ---
 
+## Provenance and social proof
+
+Nexus Prime now treats provenance as a product surface, not a footer afterthought.
+
+- Every Nexus-enabled PR can carry a **Nexus Prime Presence** block that links back to https://nexus-prime.cfd/ and states whether Nexus observed, verified, assisted, authored, or published the change.
+- Nexus-generated commits use the repo-local Git-native `Co-Authored-By` trailer for the Nexus Prime GitHub identity; human-only commits are not falsely claimed.
+- Generated artifacts can include a Nexus Prime signature with run ID, verification state, human-review state, and website proof.
+- Opt-in telemetry can send privacy-safe PLG events such as `pr_presence_added`, `commit_attributed`, `document_signed`, `release_verified`, and `proof_badge_viewed` to the configured Supabase endpoint. Raw prompts, code, repo names, branch names, file paths, secrets, and tokens are redacted by default.
+
+---
+
 ## The problem
 
 Every coding agent you use starts every session cold.

package/dist/cli.js

@@ -40,6 +40,7 @@ import { runReset } from './cli/reset.js';
 import { runUninstall } from './cli/uninstall.js';
 import { runCleanup } from './cli/cleanup.js';
 import { runDoctorStorage } from './cli/doctor-storage.js';
+import { formatNexusProofReport, verifyNexusProof } from './engines/nexus-proof.js';
 const tokenEngine = new TokenSupremacyEngine();
 import { getNexusHookSpec, writeNexusClaudeCodeHooks, } from './install/claude-code-hooks.js';
 /**
@@ -1886,6 +1887,34 @@ program
         nexus = null;
     }
 });
+program
+    .command('proof')
+    .description('Inspect Nexus Prime provenance, signatures, and opt-in proof telemetry')
+    .addCommand(new Command('verify')
+    .description('Verify Nexus Prime PR presence, generated commit trailers, artifact signatures, and telemetry redaction')
+    .option('--repo-root <path>', 'Repo root to verify (default: cwd)')
+    .option('--pr-body <path>', 'Generated pull request body markdown to verify')
+    .option('--commit-message <path>', 'Generated commit message file to verify')
+    .option('--artifact <path...>', 'Generated artifact/document files to verify')
+    .option('--strict', 'Treat warnings as failures')
+    .option('--json', 'Output raw JSON')
+    .action(async (options) => {
+    const summary = await verifyNexusProof({
+        repoRoot: options.repoRoot ? path.resolve(options.repoRoot) : getWorkspaceRoot(),
+        prBodyPath: options.prBody ? path.resolve(options.prBody) : undefined,
+        commitMessagePath: options.commitMessage ? path.resolve(options.commitMessage) : undefined,
+        artifactPaths: (options.artifact ?? []).map((artifactPath) => path.resolve(artifactPath)),
+    });
+    if (options.json) {
+        console.log(JSON.stringify(summary, null, 2));
+    }
+    else {
+        console.log(formatNexusProofReport(summary));
+    }
+    if (summary.failed > 0 || (options.strict && summary.warnings > 0)) {
+        process.exitCode = 1;
+    }
+}));
 program
     .command('memory-hygiene')
     .description('Inspect or apply memory hygiene to reduce duplicate and low-signal memories')

package/dist/dashboard/app/views/trust.js

@@ -57,10 +57,20 @@ export function render(data) {
     const synapseHealth = Array.isArray(data.synapseHealth) ? data.synapseHealth : [];
     const approvals  = Array.isArray(data.synapseApprovals) ? data.synapseApprovals : [];
     const escalations = Array.isArray(data.architectsEscalations) ? data.architectsEscalations : [];
+    const nexusProof = data.nexusProof ?? {};
 
     container.innerHTML = `
         <div class="trust-grid">
 
+            <!-- Nexus Prime proof card -->
+            <div class="card trust-card trust-card-wide">
+                <div class="trust-card-hd">
+                    <span class="trust-card-title">Nexus Prime proof</span>
+                    <span class="chip ${nexusProof.status === 'verified' ? 'chip-ok' : nexusProof.status === 'failed' ? 'chip-bad' : 'chip-warn'}">${esc(nexusProof.status ?? 'unknown')}</span>
+                </div>
+                ${_nexusProofSection(nexusProof)}
+            </div>
+
             <!-- Security posture card -->
             <div class="card trust-card">
                 <div class="trust-card-hd">
@@ -188,6 +198,37 @@ function _postureRows(gov) {
     ).join('');
 }
 
+function _nexusProofSection(proof) {
+    const telemetry = proof.telemetry ?? {};
+    const totals = telemetry.localTotals ?? {};
+    const checks = Array.isArray(proof.checks) ? proof.checks : [];
+    const events = Array.isArray(proof.proofEvents) ? proof.proofEvents : [];
+    return `
+        <div class="trust-posture-body">
+            <div class="trust-row"><span class="trust-row-k">Website</span><span class="trust-row-v">${esc(proof.website ?? 'https://nexus-prime.cfd/')}</span></div>
+            <div class="trust-row"><span class="trust-row-k">Checks</span><span class="trust-row-v">${esc(`${proof.passed ?? 0} passed · ${proof.warnings ?? 0} warning(s) · ${proof.failed ?? 0} failed`)}</span></div>
+            <div class="trust-row"><span class="trust-row-k">Telemetry</span><span class="trust-row-v">${telemetry.optedIn ? 'opted in' : 'off'} · ${telemetry.endpointConfigured ? 'endpoint ready' : 'local only'}</span></div>
+            <div class="trust-row"><span class="trust-row-k">Proof events</span><span class="trust-row-v">${esc(`${totals.prPresence ?? 0} PR · ${totals.commitAttributions ?? 0} commit · ${totals.documentsSigned ?? 0} doc · ${totals.releasesVerified ?? 0} release`)}</span></div>
+        </div>
+        <div class="trust-event-list" style="margin-top:10px">
+            ${checks.slice(0, 6).map(check => _proofCheckRow(check)).join('')}
+        </div>
+        <div class="empty-sub" style="margin-top:8px">${esc(events.slice(0, 6).join(' · '))}</div>
+    `;
+}
+
+function _proofCheckRow(check) {
+    const chip = check.status === 'pass' ? 'chip-ok' : check.status === 'fail' ? 'chip-bad' : 'chip-warn';
+    return `
+        <div class="trust-event-row">
+            <div class="trust-event-main">
+                <span class="chip ${chip}">${esc(check.status ?? 'unknown')}</span>
+                <span class="trust-event-type">${esc(check.label ?? check.id ?? 'proof check')}</span>
+                ${check.detail ? `<span style="color:var(--text-muted);font-size:var(--text-sm)">${esc(String(check.detail).slice(0, 110))}</span>` : ''}
+            </div>
+        </div>`;
+}
+
 function _auditRow(e, idx) {
     return `
         <div class="trust-event-row">

package/dist/dashboard/selectors/trust-selector.js

@@ -1,4 +1,6 @@
 import { getSharedGovernor } from '../../engines/machine-efficiency/index.js';
+import { verifyNexusProof } from '../../engines/nexus-proof.js';
+import { getSharedTelemetry } from '../../engines/telemetry-remote.js';
 import { serializeMemoryAudit, serializeMemoryQuarantine } from '../serializers/memory-serializer.js';
 import { collectDashboardBaseState } from './summary-selector.js';
 export async function buildTrustSurface(ctx, url) {
@@ -7,6 +9,8 @@ export async function buildTrustSurface(ctx, url) {
     const governorState = governor.getState();
     const synapseTeams = ctx.getSynapse()?.getStrikeTeamStatus?.();
     const synapseHealth = ctx.getSynapse()?.getOperativeHealth?.();
+    const telemetryStats = getSharedTelemetry().getStats();
+    const proofSummary = await verifyNexusProof({ repoRoot: ctx.repoRoot });
     return {
         repoIdentity: state.snapshot?.repoIdentity ?? ctx.getSelectedRepoIdentity(url),
         usage: state.usage,
@@ -29,6 +33,22 @@ export async function buildTrustSurface(ctx, url) {
             : ctx.getClientRegistry()?.listClients(ctx.getAdapters()) ?? [],
         primaryClient: state.snapshot?.clients?.primary ?? ctx.getClientRegistry()?.getPrimaryClient(ctx.getAdapters()) ?? null,
         nexusLayer: state.layer?.getSummary(state.snapshot?.orchestration?.sessionId) ?? null,
+        nexusProof: {
+            ...proofSummary,
+            telemetry: {
+                optedIn: telemetryStats.optedIn,
+                queuedEvents: telemetryStats.queuedEvents,
+                endpointConfigured: telemetryStats.endpointConfigured,
+                remoteStatsConfigured: telemetryStats.remoteStatsConfigured,
+                localTotals: {
+                    prPresence: telemetryStats.totalPrPresence,
+                    commitAttributions: telemetryStats.totalCommitAttributions,
+                    documentsSigned: telemetryStats.totalDocumentsSigned,
+                    releasesVerified: telemetryStats.totalReleasesVerified,
+                    proofBadgeViews: telemetryStats.totalProofBadgeViews,
+                },
+            },
+        },
         machinePressure: governorState.pressureLevel,
         activeWorktrees: governorState.activeWorktrees,
         governor: governorState,

package/dist/dashboard/types.d.ts

@@ -268,6 +268,7 @@ export interface TrustSurfaceDTO {
     clients: unknown[];
     primaryClient: unknown;
     nexusLayer: unknown;
+    nexusProof: unknown;
     machinePressure: PressureLevel;
     activeWorktrees: number;
     governor: GovernorState;

package/dist/engines/github-bridge.d.ts

@@ -1,3 +1,4 @@
+import { type RemoteTelemetry } from './telemetry-remote.js';
 export interface GithubBridgeDetection {
     available: boolean;
     method: 'gh-cli' | 'token' | 'none';
@@ -21,7 +22,8 @@ export interface GithubPromotionResult {
 }
 export declare class GithubBridge {
     private readonly defaultCwd;
-    constructor(defaultCwd?: string);
+    private readonly telemetry?;
+    constructor(defaultCwd?: string, telemetry?: Pick<RemoteTelemetry, 'trackProductEvent'>);
     detect(cwd?: string): GithubBridgeDetection;
     promoteToPR(input: GithubPromotionInput): Promise<GithubPromotionResult>;
     private createPullRequestViaApi;
@@ -29,6 +31,7 @@ export declare class GithubBridge {
     private resolveRepo;
     private detectBaseBranch;
     private buildBranchName;
+    private renderCommitBody;
     private renderPrBody;
     private safeExec;
     shareAsGist(pattern: {
@@ -40,5 +43,7 @@ export declare class GithubBridge {
         localPath?: string;
     }>;
     private shellQuote;
+    private telemetryConsentLabel;
+    private trackProductEvent;
 }
 export declare function getSharedGithubBridge(cwd?: string): GithubBridge;

package/dist/engines/github-bridge.js

@@ -3,10 +3,14 @@ import * as path from 'path';
 import { execSync } from 'child_process';
 import { createHash } from 'crypto';
 import { resolveNexusStateDir } from './runtime-registry.js';
+import { appendOrReplaceNexusPrPresenceBlock, buildNexusProofMetadata, ensureNexusCoauthorTrailer, NEXUS_PRIME_COAUTHOR_TRAILER, NEXUS_PRIME_WEBSITE, renderNexusDocumentSignature, renderNexusPrPresenceBlock, } from './nexus-signature.js';
+import { getSharedTelemetry } from './telemetry-remote.js';
 export class GithubBridge {
     defaultCwd;
-    constructor(defaultCwd = process.cwd()) {
+    telemetry;
+    constructor(defaultCwd = process.cwd(), telemetry) {
         this.defaultCwd = defaultCwd;
+        this.telemetry = telemetry;
     }
     detect(cwd = this.defaultCwd) {
         try {
@@ -42,20 +46,34 @@ export class GithubBridge {
             this.safeExec(`git checkout -b ${this.shellQuote(branch)}`, cwd, true);
             this.safeExec('git add -A', cwd, true);
             const subject = `[NOVA] Promote Darwin cycle ${input.cycleId ?? 'candidate'} to the fleet`;
-            const body = [
-                'The autonomous engine marked this bounded improvement worthy of review.',
-                `Hypothesis: ${input.hypothesis}`,
-                ...(input.learnings?.length ? [`Learnings: ${input.learnings.join('; ')}`] : []),
-            ].join('\n\n');
+            const body = ensureNexusCoauthorTrailer(this.renderCommitBody(input), true);
             this.safeExec(`git commit -m ${this.shellQuote(subject)} -m ${this.shellQuote(body)}`, cwd, true);
+            this.trackProductEvent('commit_attributed', {
+                surface: 'git_commit',
+                role: 'published',
+                method: detection.method,
+                attribution: 'coauthor_trailer',
+            });
             this.safeExec(`git push -u origin ${this.shellQuote(branch)}`, cwd, true);
             if (detection.method === 'gh-cli') {
                 const title = `Darwin: ${input.hypothesis}`.slice(0, 72);
                 const prBody = this.renderPrBody(input, diffSummary, baseBranch);
                 const url = this.safeExec(`gh pr create --base ${this.shellQuote(baseBranch)} --head ${this.shellQuote(branch)} --title ${this.shellQuote(title)} --body ${this.shellQuote(prBody)}`, cwd, true).trim();
+                this.trackProductEvent('pr_presence_added', {
+                    surface: 'pull_request',
+                    role: 'published',
+                    method: detection.method,
+                    verification: 'local_diff_captured',
+                });
                 return { status: 'pr_created', method: detection.method, branch, url };
             }
             const url = await this.createPullRequestViaApi(repo.owner, repo.name, branch, baseBranch, input, diffSummary);
+            this.trackProductEvent('pr_presence_added', {
+                surface: 'pull_request',
+                role: 'published',
+                method: detection.method,
+                verification: 'local_diff_captured',
+            });
             return { status: 'pr_created', method: detection.method, branch, url };
         }
         catch (error) {
@@ -100,6 +118,21 @@ export class GithubBridge {
             .slice(0, 10);
         const patchPath = path.join(stateDir, `darwin-${slug}.patch`);
         const artifactPath = path.join(stateDir, `darwin-${slug}.json`);
+        const signatureInput = {
+            source: 'github-bridge',
+            role: 'observed',
+            runId: input.cycleId,
+            cycleId: input.cycleId,
+            verificationState: diffPatch.trim() ? 'advisory' : 'not-run',
+            hooksState: 'not-applicable',
+            telemetryConsent: this.telemetryConsentLabel(),
+            humanReviewState: 'required',
+            coauthorState: 'Not claimed because no GitHub PR was created.',
+        };
+        const documentSignature = renderNexusDocumentSignature({
+            ...signatureInput,
+            artifactKind: 'GitHub promotion artifact',
+        });
         fs.writeFileSync(patchPath, diffPatch, 'utf8');
         fs.writeFileSync(artifactPath, JSON.stringify({
             createdAt: new Date().toISOString(),
@@ -111,7 +144,20 @@ export class GithubBridge {
             learnings: input.learnings ?? [],
             diffSummary,
             patchPath,
+            nexusPrime: {
+                website: NEXUS_PRIME_WEBSITE,
+                coauthorTrailer: NEXUS_PRIME_COAUTHOR_TRAILER,
+                prPresence: renderNexusPrPresenceBlock(signatureInput),
+                documentSignature,
+                metadata: buildNexusProofMetadata(signatureInput),
+            },
         }, null, 2), 'utf8');
+        this.trackProductEvent('document_signed', {
+            surface: 'github_promotion_artifact',
+            role: 'observed',
+            method,
+            status: 'artifact_saved',
+        });
         return {
             status: 'artifact_saved',
             method,
@@ -140,8 +186,15 @@ export class GithubBridge {
             .slice(0, 48);
         return `ad/${seed || 'darwin-candidate'}`;
     }
-    renderPrBody(input, diffSummary, baseBranch) {
+    renderCommitBody(input) {
         return [
+            'The autonomous engine marked this bounded improvement worthy of review.',
+            `Hypothesis: ${input.hypothesis}`,
+            ...(input.learnings?.length ? [`Learnings: ${input.learnings.join('; ')}`] : []),
+        ].join('\n\n');
+    }
+    renderPrBody(input, diffSummary, baseBranch) {
+        const body = [
             '### Mission Briefing',
             'A bounded Darwin candidate completed local validation and now seeks human review through the standard GitHub path.',
             '',
@@ -159,6 +212,17 @@ export class GithubBridge {
             diffSummary.trim() || 'No diff summary available.',
             '```',
         ].join('\n');
+        return appendOrReplaceNexusPrPresenceBlock(body, {
+            source: 'github-bridge',
+            role: 'published',
+            runId: input.cycleId,
+            cycleId: input.cycleId,
+            verificationState: diffSummary.trim() ? 'advisory' : 'unknown',
+            hooksState: 'unknown',
+            telemetryConsent: this.telemetryConsentLabel(),
+            humanReviewState: 'required',
+            coauthorState: 'Required on the Nexus-generated promotion commit.',
+        });
     }
     safeExec(command, cwd, throwOnError = false) {
         try {
@@ -233,6 +297,26 @@ export class GithubBridge {
     shellQuote(value) {
         return `'${value.replace(/'/g, `'\\''`)}'`;
     }
+    telemetryConsentLabel() {
+        try {
+            const telemetry = this.telemetry ?? getSharedTelemetry();
+            return telemetry instanceof Object && 'isOptedIn' in telemetry && typeof telemetry.isOptedIn === 'function'
+                ? (telemetry.isOptedIn() ? 'opted-in' : 'disabled')
+                : 'unknown';
+        }
+        catch {
+            return 'unknown';
+        }
+    }
+    trackProductEvent(type, metadata) {
+        try {
+            const telemetry = this.telemetry ?? getSharedTelemetry();
+            telemetry.trackProductEvent(type, metadata);
+        }
+        catch {
+            // Telemetry must never block promotion or artifact persistence.
+        }
+    }
 }
 let _sharedGithubBridge = null;
 export function getSharedGithubBridge(cwd) {

package/dist/engines/nexus-proof.d.ts

@@ -0,0 +1,26 @@
+export type NexusProofCheckStatus = 'pass' | 'warn' | 'fail';
+export interface NexusProofCheck {
+    id: string;
+    label: string;
+    status: NexusProofCheckStatus;
+    detail: string;
+    evidence?: string;
+}
+export interface NexusProofVerifyOptions {
+    repoRoot?: string;
+    prBodyPath?: string;
+    commitMessagePath?: string;
+    artifactPaths?: string[];
+}
+export interface NexusProofSummary {
+    generatedAt: number;
+    website: string;
+    status: 'verified' | 'attention' | 'failed';
+    passed: number;
+    warnings: number;
+    failed: number;
+    checks: NexusProofCheck[];
+    proofEvents: readonly string[];
+}
+export declare function verifyNexusProof(options?: NexusProofVerifyOptions): Promise<NexusProofSummary>;
+export declare function formatNexusProofReport(summary: NexusProofSummary): string;

package/dist/engines/nexus-proof.js

@@ -0,0 +1,118 @@
+import fs from 'fs/promises';
+import path from 'path';
+import { NEXUS_PLG_EVENT_TYPES, NEXUS_PRIME_COAUTHOR_TRAILER, NEXUS_PRIME_PRESENCE_END, NEXUS_PRIME_PRESENCE_START, NEXUS_PRIME_WEBSITE, } from './nexus-signature.js';
+async function readOptional(filePath) {
+    if (!filePath)
+        return null;
+    try {
+        return await fs.readFile(filePath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+}
+function addCheck(checks, id, label, status, detail, evidence) {
+    checks.push({ id, label, status, detail, evidence });
+}
+function hasPresenceBlock(value) {
+    return value.includes(NEXUS_PRIME_PRESENCE_START) && value.includes(NEXUS_PRIME_PRESENCE_END);
+}
+export async function verifyNexusProof(options = {}) {
+    const repoRoot = options.repoRoot ?? process.cwd();
+    const checks = [];
+    const prTemplatePath = path.join(repoRoot, '.github', 'pull_request_template.md');
+    const readmePath = path.join(repoRoot, 'README.md');
+    const telemetryPath = path.join(repoRoot, 'src', 'engines', 'telemetry-remote.ts');
+    addCheck(checks, 'website.identity', 'Website identity', NEXUS_PRIME_WEBSITE === 'https://nexus-prime.cfd/' ? 'pass' : 'fail', `Expected canonical website https://nexus-prime.cfd/, got ${NEXUS_PRIME_WEBSITE}`, NEXUS_PRIME_WEBSITE);
+    const prTemplate = await readOptional(prTemplatePath);
+    if (!prTemplate) {
+        addCheck(checks, 'pr.template', 'PR template presence', 'warn', 'No .github/pull_request_template.md found.');
+    }
+    else {
+        const ok = hasPresenceBlock(prTemplate) && prTemplate.includes(NEXUS_PRIME_WEBSITE);
+        addCheck(checks, 'pr.template', 'PR template presence', ok ? 'pass' : 'fail', ok
+            ? 'Pull request template contains Nexus Prime Presence and website identity.'
+            : 'Pull request template must include Nexus Prime Presence markers and website identity.', prTemplatePath);
+    }
+    const readme = await readOptional(readmePath);
+    if (!readme) {
+        addCheck(checks, 'docs.provenance', 'README provenance copy', 'warn', 'No README.md found.');
+    }
+    else {
+        const ok = readme.includes('Provenance and social proof')
+            && readme.includes('Nexus Prime Presence')
+            && readme.includes('privacy-safe PLG events')
+            && readme.includes(NEXUS_PRIME_WEBSITE);
+        addCheck(checks, 'docs.provenance', 'README provenance copy', ok ? 'pass' : 'fail', ok
+            ? 'README explains Nexus Prime signatures, attribution, telemetry, and social proof.'
+            : 'README must explain Nexus Prime Presence, attribution, privacy-safe PLG events, and the website.', readmePath);
+    }
+    const telemetry = await readOptional(telemetryPath);
+    if (!telemetry) {
+        addCheck(checks, 'telemetry.redaction', 'Telemetry redaction guard', 'warn', 'Telemetry source was not found.');
+    }
+    else {
+        const redactionPattern = String.raw `prompt|content|code|path|repo|branch|secret|token|file`;
+        const hasRedaction = telemetry.includes(redactionPattern)
+            && telemetry.includes('sanitizeEventData')
+            && telemetry.includes('trackProductEvent');
+        addCheck(checks, 'telemetry.redaction', 'Telemetry redaction guard', hasRedaction ? 'pass' : 'fail', hasRedaction
+            ? 'Proof telemetry is routed through the sanitizer and blocks sensitive key classes.'
+            : 'Proof telemetry must keep using sanitizeEventData and block prompt/code/path/repo/branch/secret/token/file keys.', telemetryPath);
+    }
+    const prBody = await readOptional(options.prBodyPath);
+    if (options.prBodyPath) {
+        const ok = Boolean(prBody && hasPresenceBlock(prBody) && prBody.includes(NEXUS_PRIME_WEBSITE));
+        addCheck(checks, 'pr.body', 'PR body proof', ok ? 'pass' : 'fail', ok ? 'PR body contains Nexus Prime Presence.' : 'PR body is missing Nexus Prime Presence.', options.prBodyPath);
+    }
+    else {
+        addCheck(checks, 'pr.body', 'PR body proof', 'warn', 'No PR body path supplied; skipping generated PR body verification.');
+    }
+    const commitMessage = await readOptional(options.commitMessagePath);
+    if (options.commitMessagePath) {
+        const ok = Boolean(commitMessage && commitMessage.includes(NEXUS_PRIME_COAUTHOR_TRAILER));
+        addCheck(checks, 'commit.coauthor', 'Generated commit co-author trailer', ok ? 'pass' : 'fail', ok ? 'Commit message contains the Nexus Prime co-author trailer.' : 'Generated commit message is missing the Nexus Prime co-author trailer.', options.commitMessagePath);
+    }
+    else {
+        addCheck(checks, 'commit.coauthor', 'Generated commit co-author trailer', 'warn', 'No commit message path supplied; skipping generated commit verification.');
+    }
+    const artifactPaths = options.artifactPaths ?? [];
+    if (artifactPaths.length === 0) {
+        addCheck(checks, 'artifact.signature', 'Generated artifact signatures', 'warn', 'No artifact paths supplied; skipping artifact signature verification.');
+    }
+    else {
+        for (const artifactPath of artifactPaths) {
+            const artifact = await readOptional(artifactPath);
+            const ok = Boolean(artifact && artifact.includes('signed by Nexus Prime') && artifact.includes(NEXUS_PRIME_WEBSITE));
+            addCheck(checks, `artifact.signature:${path.basename(artifactPath)}`, 'Generated artifact signature', ok ? 'pass' : 'fail', ok ? 'Artifact contains a Nexus Prime document signature.' : 'Artifact is missing a Nexus Prime document signature.', artifactPath);
+        }
+    }
+    const passed = checks.filter((check) => check.status === 'pass').length;
+    const warnings = checks.filter((check) => check.status === 'warn').length;
+    const failed = checks.filter((check) => check.status === 'fail').length;
+    const status = failed > 0 ? 'failed' : warnings > 0 ? 'attention' : 'verified';
+    return {
+        generatedAt: Date.now(),
+        website: NEXUS_PRIME_WEBSITE,
+        status,
+        passed,
+        warnings,
+        failed,
+        checks,
+        proofEvents: NEXUS_PLG_EVENT_TYPES,
+    };
+}
+export function formatNexusProofReport(summary) {
+    const lines = [
+        'Nexus Prime proof verification',
+        `Website: ${summary.website}`,
+        `Status: ${summary.status}`,
+        `Checks: ${summary.passed} passed, ${summary.warnings} warning(s), ${summary.failed} failed`,
+        '',
+    ];
+    for (const check of summary.checks) {
+        const marker = check.status === 'pass' ? 'PASS' : check.status === 'warn' ? 'WARN' : 'FAIL';
+        lines.push(`[${marker}] ${check.label}: ${check.detail}`);
+    }
+    return lines.join('\n');
+}

package/dist/engines/nexus-signature.d.ts

@@ -0,0 +1,33 @@
+export declare const NEXUS_PRIME_WEBSITE = "https://nexus-prime.cfd/";
+export declare const NEXUS_PRIME_GENERATOR = "Nexus Prime";
+export declare const NEXUS_PRIME_COAUTHOR_TRAILER = "Co-Authored-By: nexus-prime <33547839+sir-ad@users.noreply.github.com>";
+export declare const NEXUS_PRIME_PRESENCE_START = "<!-- nexus-prime:presence:start -->";
+export declare const NEXUS_PRIME_PRESENCE_END = "<!-- nexus-prime:presence:end -->";
+export type NexusPresenceRole = 'observed' | 'verified' | 'assisted' | 'authored' | 'published';
+export type NexusVerificationState = 'unknown' | 'not-run' | 'advisory' | 'verified' | 'failed';
+export type NexusHumanReviewState = 'required' | 'pending' | 'completed' | 'not-required';
+export type NexusPlgEventType = 'pr_presence_added' | 'commit_attributed' | 'document_signed' | 'release_verified' | 'proof_badge_viewed' | 'website_proof_viewed' | 'telemetry_batch_sent';
+export declare const NEXUS_PLG_EVENT_TYPES: readonly NexusPlgEventType[];
+export interface NexusPresenceInput {
+    role: NexusPresenceRole;
+    source: string;
+    runId?: string;
+    cycleId?: string;
+    verificationState?: NexusVerificationState | string;
+    hooksState?: string;
+    telemetryConsent?: string;
+    humanReviewState?: NexusHumanReviewState | string;
+    coauthorState?: string;
+    website?: string;
+    generatedAt?: Date | string;
+}
+export interface NexusDocumentSignatureInput extends NexusPresenceInput {
+    artifactKind?: string;
+    reviewer?: string;
+}
+export declare function renderNexusPrPresenceBlock(input: NexusPresenceInput): string;
+export declare function appendOrReplaceNexusPrPresenceBlock(body: string, input: NexusPresenceInput): string;
+export declare function ensureNexusCoauthorTrailer(message: string, shouldAttribute: boolean): string;
+export declare function renderNexusDocumentSignature(input: NexusDocumentSignatureInput): string;
+export declare function buildNexusProofMetadata(input: NexusPresenceInput): Record<string, string>;
+export declare function renderNexusWebsiteMetadata(input: NexusPresenceInput): string;

package/dist/engines/nexus-signature.js

@@ -0,0 +1,127 @@
+export const NEXUS_PRIME_WEBSITE = 'https://nexus-prime.cfd/';
+export const NEXUS_PRIME_GENERATOR = 'Nexus Prime';
+export const NEXUS_PRIME_COAUTHOR_TRAILER = 'Co-Authored-By: nexus-prime <33547839+sir-ad@users.noreply.github.com>';
+export const NEXUS_PRIME_PRESENCE_START = '<!-- nexus-prime:presence:start -->';
+export const NEXUS_PRIME_PRESENCE_END = '<!-- nexus-prime:presence:end -->';
+export const NEXUS_PLG_EVENT_TYPES = [
+    'pr_presence_added',
+    'commit_attributed',
+    'document_signed',
+    'release_verified',
+    'proof_badge_viewed',
+    'website_proof_viewed',
+    'telemetry_batch_sent',
+];
+function clean(value, fallback) {
+    const normalized = String(value ?? '').trim();
+    return normalized || fallback;
+}
+function isoStamp(value) {
+    if (value instanceof Date)
+        return value.toISOString();
+    if (typeof value === 'string' && value.trim())
+        return value.trim();
+    return new Date().toISOString();
+}
+export function renderNexusPrPresenceBlock(input) {
+    const website = clean(input.website, NEXUS_PRIME_WEBSITE);
+    const runId = clean(input.runId ?? input.cycleId, 'no-run detected');
+    const verification = clean(input.verificationState, 'unknown');
+    const hooks = clean(input.hooksState, 'unknown');
+    const telemetry = clean(input.telemetryConsent, 'unknown');
+    const humanReview = clean(input.humanReviewState, 'required');
+    const coauthor = clean(input.coauthorState, 'Not claimed unless a Nexus-generated commit includes the co-author trailer.');
+    return [
+        NEXUS_PRIME_PRESENCE_START,
+        '## Nexus Prime Presence',
+        '',
+        `- Website: ${website}`,
+        `- Role: ${input.role}`,
+        `- Source: ${clean(input.source, 'unknown')}`,
+        `- Run ID: ${runId}`,
+        `- Verification: ${verification}`,
+        `- Hooks: ${hooks}`,
+        `- Telemetry consent: ${telemetry}`,
+        `- Human review: ${humanReview}`,
+        `- Co-authorship: ${coauthor}`,
+        `- Generated at: ${isoStamp(input.generatedAt)}`,
+        '',
+        'Presence is not blanket authorship. Git co-authorship is only asserted for commits Nexus Prime generated, materially assisted, or published.',
+        NEXUS_PRIME_PRESENCE_END,
+    ].join('\n');
+}
+export function appendOrReplaceNexusPrPresenceBlock(body, input) {
+    const block = renderNexusPrPresenceBlock(input);
+    const pattern = new RegExp(`${escapeRegExp(NEXUS_PRIME_PRESENCE_START)}[\\s\\S]*?${escapeRegExp(NEXUS_PRIME_PRESENCE_END)}`, 'm');
+    const existing = String(body ?? '').trim();
+    if (pattern.test(existing))
+        return existing.replace(pattern, block);
+    return [existing, block].filter(Boolean).join('\n\n');
+}
+export function ensureNexusCoauthorTrailer(message, shouldAttribute) {
+    const normalized = String(message ?? '').trimEnd();
+    if (!shouldAttribute)
+        return normalized;
+    if (normalized.includes(NEXUS_PRIME_COAUTHOR_TRAILER))
+        return normalized;
+    return [normalized, NEXUS_PRIME_COAUTHOR_TRAILER].filter(Boolean).join('\n\n');
+}
+export function renderNexusDocumentSignature(input) {
+    return [
+        '---',
+        `${clean(input.artifactKind, 'Artifact')} signed by ${NEXUS_PRIME_GENERATOR}`,
+        `Website: ${clean(input.website, NEXUS_PRIME_WEBSITE)}`,
+        `Role: ${input.role}`,
+        `Source: ${clean(input.source, 'unknown')}`,
+        `Run ID: ${clean(input.runId ?? input.cycleId, 'no-run detected')}`,
+        `Verification: ${clean(input.verificationState, 'unknown')}`,
+        `Human review: ${clean(input.humanReviewState, 'required')}`,
+        `Reviewer: ${clean(input.reviewer, 'not recorded')}`,
+        `Generated at: ${isoStamp(input.generatedAt)}`,
+        '---',
+    ].join('\n');
+}
+export function buildNexusProofMetadata(input) {
+    return {
+        generator: NEXUS_PRIME_GENERATOR,
+        website: clean(input.website, NEXUS_PRIME_WEBSITE),
+        role: input.role,
+        source: clean(input.source, 'unknown'),
+        runId: clean(input.runId ?? input.cycleId, 'no-run detected'),
+        verificationState: clean(input.verificationState, 'unknown'),
+        humanReviewState: clean(input.humanReviewState, 'required'),
+        generatedAt: isoStamp(input.generatedAt),
+    };
+}
+export function renderNexusWebsiteMetadata(input) {
+    const metadata = buildNexusProofMetadata(input);
+    const jsonLd = {
+        '@context': 'https://schema.org',
+        '@type': 'SoftwareApplication',
+        name: NEXUS_PRIME_GENERATOR,
+        url: metadata.website,
+        applicationCategory: 'DeveloperApplication',
+        creator: {
+            '@type': 'Organization',
+            name: NEXUS_PRIME_GENERATOR,
+            url: metadata.website,
+        },
+    };
+    return [
+        '<meta name="generator" content="Nexus Prime">',
+        `<meta name="nexus-prime:role" content="${escapeHtml(metadata.role)}">`,
+        `<meta name="nexus-prime:verification" content="${escapeHtml(metadata.verificationState)}">`,
+        `<link rel="author" href="${escapeHtml(metadata.website)}">`,
+        `<script type="application/ld+json">${JSON.stringify(jsonLd)}</script>`,
+    ].join('\n');
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function escapeHtml(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/"/g, '&quot;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;');
+}

package/dist/engines/telemetry-remote.d.ts

@@ -5,7 +5,8 @@
  * Sends pseudonymous install + project activity to a Supabase REST endpoint
  * only after explicit opt-in or `NEXUS_TELEMETRY=on`.
  */
-export type TelemetryEventType = 'install' | 'session_start' | 'session_end' | 'feature_use' | 'token_savings' | 'memory_created' | 'memory_recalled' | 'autonomy_candidate' | 'autonomy_candidate_suppressed' | 'autonomy_apply_started' | 'autonomy_apply_finished' | 'autonomy_apply_blocked';
+import { type NexusPlgEventType } from './nexus-signature.js';
+export type TelemetryEventType = 'install' | 'session_start' | 'session_end' | 'feature_use' | 'token_savings' | 'memory_created' | 'memory_recalled' | 'autonomy_candidate' | 'autonomy_candidate_suppressed' | 'autonomy_apply_started' | 'autonomy_apply_finished' | 'autonomy_apply_blocked' | NexusPlgEventType;
 export interface TelemetryEvent {
     type: TelemetryEventType;
     timestamp: number;
@@ -26,6 +27,11 @@ export interface TelemetryStats {
     totalFeatureUses: number;
     totalMemoriesCreated: number;
     totalMemoriesRecalled: number;
+    totalPrPresence: number;
+    totalCommitAttributions: number;
+    totalDocumentsSigned: number;
+    totalReleasesVerified: number;
+    totalProofBadgeViews: number;
     endpointConfigured: boolean;
     remoteStatsConfigured: boolean;
     lastFlushAt?: number;
@@ -39,6 +45,7 @@ export interface RemoteInstallDrilldown {
     memoriesRecalled: number;
     featureUses: number;
     autonomyEvents: number;
+    proofEvents: number;
     recentProjects: string[];
 }
 export interface RemoteTelemetryStats {
@@ -49,6 +56,11 @@ export interface RemoteTelemetryStats {
     totalTokenSavings: number;
     totalMemoriesCreated: number;
     totalMemoriesRecalled: number;
+    totalPrPresence: number;
+    totalCommitAttributions: number;
+    totalDocumentsSigned: number;
+    totalReleasesVerified: number;
+    totalProofBadgeViews: number;
     installs: RemoteInstallDrilldown[];
 }
 export declare class RemoteTelemetry {
@@ -86,6 +98,7 @@ export declare class RemoteTelemetry {
     trackMemoryCreated(scope: string, metadata?: Record<string, unknown>): void;
     trackMemoryRecalled(hitCount: number, metadata?: Record<string, unknown>): void;
     trackAutonomyEvent(type: Extract<TelemetryEventType, 'autonomy_candidate' | 'autonomy_candidate_suppressed' | 'autonomy_apply_started' | 'autonomy_apply_finished' | 'autonomy_apply_blocked'>, metadata?: Record<string, unknown>): void;
+    trackProductEvent(type: NexusPlgEventType, metadata?: Record<string, unknown>): void;
     private enqueue;
     private persistQueue;
     private loadQueue;
@@ -100,6 +113,7 @@ export declare class RemoteTelemetry {
     getStats(): TelemetryStats;
     private getNexusVersion;
     private hashIdentifier;
+    private incrementProductCounter;
     destroy(): void;
 }
 export declare function getSharedTelemetry(options?: {

package/dist/engines/telemetry-remote.js

@@ -10,6 +10,7 @@ import * as path from 'path';
 import * as os from 'os';
 import * as crypto from 'crypto';
 import { fileURLToPath } from 'url';
+import { NEXUS_PLG_EVENT_TYPES } from './nexus-signature.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 const NEXUS_STATE_DIR = path.join(os.homedir(), '.nexus-prime');
@@ -68,6 +69,11 @@ function createEmptyState() {
         totalFeatureUses: 0,
         totalMemoriesCreated: 0,
         totalMemoriesRecalled: 0,
+        totalPrPresence: 0,
+        totalCommitAttributions: 0,
+        totalDocumentsSigned: 0,
+        totalReleasesVerified: 0,
+        totalProofBadgeViews: 0,
     };
 }
 export class RemoteTelemetry {
@@ -267,6 +273,19 @@ export class RemoteTelemetry {
             data: sanitizeEventData(metadata ?? {}),
         });
     }
+    trackProductEvent(type, metadata) {
+        this.incrementProductCounter(type);
+        this.persistState();
+        this.enqueue({
+            type,
+            timestamp: Date.now(),
+            installId: this.installId,
+            data: sanitizeEventData({
+                eventFamily: 'nexus_prime_proof',
+                ...metadata,
+            }),
+        });
+    }
     enqueue(event) {
         if (!this.isOptedIn())
             return;
@@ -381,6 +400,11 @@ export class RemoteTelemetry {
                 totalTokenSavings: 0,
                 totalMemoriesCreated: 0,
                 totalMemoriesRecalled: 0,
+                totalPrPresence: 0,
+                totalCommitAttributions: 0,
+                totalDocumentsSigned: 0,
+                totalReleasesVerified: 0,
+                totalProofBadgeViews: 0,
                 installs: [],
             };
         }
@@ -406,6 +430,11 @@ export class RemoteTelemetry {
             let totalTokenSavings = 0;
             let totalMemoriesCreated = 0;
             let totalMemoriesRecalled = 0;
+            let totalPrPresence = 0;
+            let totalCommitAttributions = 0;
+            let totalDocumentsSigned = 0;
+            let totalReleasesVerified = 0;
+            let totalProofBadgeViews = 0;
             const activeCutoff = Date.now() - ACTIVE_INSTALL_WINDOW_MS;
             for (const row of rows) {
                 const installId = String(row.install_id ?? '').trim();
@@ -425,6 +454,7 @@ export class RemoteTelemetry {
                     memoriesRecalled: 0,
                     featureUses: 0,
                     autonomyEvents: 0,
+                    proofEvents: 0,
                     recentProjects: [],
                 };
                 if (!bucket.lastSeenAt || (sentAt && Date.parse(bucket.lastSeenAt) < sentAtMs)) {
@@ -459,6 +489,30 @@ export class RemoteTelemetry {
                     case 'feature_use':
                         bucket.featureUses += 1;
                         break;
+                    case 'pr_presence_added':
+                        totalPrPresence += 1;
+                        bucket.proofEvents += 1;
+                        break;
+                    case 'commit_attributed':
+                        totalCommitAttributions += 1;
+                        bucket.proofEvents += 1;
+                        break;
+                    case 'document_signed':
+                        totalDocumentsSigned += 1;
+                        bucket.proofEvents += 1;
+                        break;
+                    case 'release_verified':
+                        totalReleasesVerified += 1;
+                        bucket.proofEvents += 1;
+                        break;
+                    case 'proof_badge_viewed':
+                    case 'website_proof_viewed':
+                        totalProofBadgeViews += 1;
+                        bucket.proofEvents += 1;
+                        break;
+                    case 'telemetry_batch_sent':
+                        bucket.proofEvents += 1;
+                        break;
                     case 'autonomy_candidate':
                     case 'autonomy_candidate_suppressed':
                     case 'autonomy_apply_started':
@@ -479,6 +533,11 @@ export class RemoteTelemetry {
                 totalTokenSavings,
                 totalMemoriesCreated,
                 totalMemoriesRecalled,
+                totalPrPresence,
+                totalCommitAttributions,
+                totalDocumentsSigned,
+                totalReleasesVerified,
+                totalProofBadgeViews,
                 installs: [...installs.values()]
                     .sort((a, b) => (b.tokenSavings - a.tokenSavings) || (b.sessions - a.sessions))
                     .slice(0, 25),
@@ -493,6 +552,11 @@ export class RemoteTelemetry {
                 totalTokenSavings: 0,
                 totalMemoriesCreated: 0,
                 totalMemoriesRecalled: 0,
+                totalPrPresence: 0,
+                totalCommitAttributions: 0,
+                totalDocumentsSigned: 0,
+                totalReleasesVerified: 0,
+                totalProofBadgeViews: 0,
                 installs: [],
             };
         }
@@ -519,6 +583,11 @@ export class RemoteTelemetry {
             totalFeatureUses: this.state.totalFeatureUses,
             totalMemoriesCreated: this.state.totalMemoriesCreated,
             totalMemoriesRecalled: this.state.totalMemoriesRecalled,
+            totalPrPresence: this.state.totalPrPresence,
+            totalCommitAttributions: this.state.totalCommitAttributions,
+            totalDocumentsSigned: this.state.totalDocumentsSigned,
+            totalReleasesVerified: this.state.totalReleasesVerified,
+            totalProofBadgeViews: this.state.totalProofBadgeViews,
             endpointConfigured: Boolean(this.endpoint && this.apiKey),
             remoteStatsConfigured: Boolean(this.endpoint && process.env.NEXUS_TELEMETRY_SERVICE_KEY),
             lastFlushAt: this.state.lastFlushAt,
@@ -537,6 +606,30 @@ export class RemoteTelemetry {
     hashIdentifier(value) {
         return crypto.createHash('sha256').update(String(value)).digest('hex').slice(0, 12);
     }
+    incrementProductCounter(type) {
+        if (!NEXUS_PLG_EVENT_TYPES.includes(type))
+            return;
+        switch (type) {
+            case 'pr_presence_added':
+                this.state.totalPrPresence += 1;
+                break;
+            case 'commit_attributed':
+                this.state.totalCommitAttributions += 1;
+                break;
+            case 'document_signed':
+                this.state.totalDocumentsSigned += 1;
+                break;
+            case 'release_verified':
+                this.state.totalReleasesVerified += 1;
+                break;
+            case 'proof_badge_viewed':
+            case 'website_proof_viewed':
+                this.state.totalProofBadgeViews += 1;
+                break;
+            case 'telemetry_batch_sent':
+                break;
+        }
+    }
     destroy() {
         if (this.flushTimer) {
             clearInterval(this.flushTimer);

package/dist/index.d.ts

@@ -289,3 +289,7 @@ export { SessionDNAManager } from './engines/session-dna.js';
 export type { SessionDNA } from './engines/session-dna.js';
 export { GithubBridge, getSharedGithubBridge } from './engines/github-bridge.js';
 export type { GithubPromotionInput, GithubPromotionResult } from './engines/github-bridge.js';
+export { appendOrReplaceNexusPrPresenceBlock, buildNexusProofMetadata, ensureNexusCoauthorTrailer, NEXUS_PLG_EVENT_TYPES, NEXUS_PRIME_COAUTHOR_TRAILER, NEXUS_PRIME_GENERATOR, NEXUS_PRIME_WEBSITE, renderNexusDocumentSignature, renderNexusPrPresenceBlock, renderNexusWebsiteMetadata, } from './engines/nexus-signature.js';
+export type { NexusDocumentSignatureInput, NexusHumanReviewState, NexusPlgEventType, NexusPresenceInput, NexusPresenceRole, NexusVerificationState, } from './engines/nexus-signature.js';
+export { formatNexusProofReport, verifyNexusProof, } from './engines/nexus-proof.js';
+export type { NexusProofCheck, NexusProofCheckStatus, NexusProofSummary, NexusProofVerifyOptions, } from './engines/nexus-proof.js';

package/dist/index.js

@@ -1211,3 +1211,5 @@ export { GhostPass, PhantomOrchestrator, PhantomWorker } from './phantom/index.j
 export { MemoryEngine, createMemoryEngine } from './engines/memory.js';
 export { SessionDNAManager } from './engines/session-dna.js';
 export { GithubBridge, getSharedGithubBridge } from './engines/github-bridge.js';
+export { appendOrReplaceNexusPrPresenceBlock, buildNexusProofMetadata, ensureNexusCoauthorTrailer, NEXUS_PLG_EVENT_TYPES, NEXUS_PRIME_COAUTHOR_TRAILER, NEXUS_PRIME_GENERATOR, NEXUS_PRIME_WEBSITE, renderNexusDocumentSignature, renderNexusPrPresenceBlock, renderNexusWebsiteMetadata, } from './engines/nexus-signature.js';
+export { formatNexusProofReport, verifyNexusProof, } from './engines/nexus-proof.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexus-prime",
-  "version": "7.9.26",
+  "version": "7.9.27",
   "description": "Local-first MCP control plane for coding agents with bootstrap-orchestrate execution, memory fabric, token budgeting, and worktree-backed swarms",
   "type": "module",
   "main": "dist/index.js",