trooth 0.2.0 → 0.4.0

package/README.md

@@ -1,12 +1,16 @@
 # trooth
 
-The trust network your terminal can check. Read any company's **witnessed** trust
-standing from the [Trooth Network](https://trooth.co). Identity, security, privacy,
-AI practices, and more, each witnessed, signed, and dated. It also scans your own Terraform
-plans against SOC 2, ISO 27001, GDPR, HIPAA, NIST AI RMF, and the EU AI Act.
+The Trooth Network from your terminal.
+
+The Trooth Network gives every company one public, signed record: what it is,
+what it sells, who runs it, where its data lives, how it handles AI, and what a
+buyer needs before signing. DNS tells a machine where a company is. A TLS
+certificate tells it the connection is authentic. Neither says anything about
+the company itself. The Trooth Network is that layer, and this CLI reads it.
 
 **`check` reads only public, already-published records. No key, no account.**
-**`scan` is advisory and report-only. Trooth never applies changes to your infrastructure.**
+**`lint` is entirely local: it opens files and opens no sockets.**
+**Trooth publishes facts and counts, never one number that sums a company up.**
 
 ## Install / run
 
@@ -19,17 +23,39 @@ npm i -g trooth
 trooth check trooth.co
 ```
 
+Requires Node 18+ (uses built-in `fetch`). Zero dependencies.
+
 ## Commands
 
 | Command | What it does |
 | --- | --- |
-| `trooth check <domain>` | Reads a company's witnessed standing from the live Trooth Network (`GET https://api.trooth.co/directory/api/vendors`) and prints the score, the per-discipline breakdown, live probes, attestations, and the badge / scan IDs you can verify. Returns an honest "not listed yet" when a company has no published standing. |
-| `trooth scan <plan>` | Posts your `terraform show -json` plan to Trooth Pre-Flight (`POST https://api.trooth.co/v1/preflight`) and prints the verdict, score, and findings. Accepts a JSON file or a binary `.tfplan` (it runs `terraform show -json` for you). |
-| `trooth eu ...` | Pushes EU AI Act evidence (datasets, evals, drift) into Trooth from CI/CD. Needs a session token or company id. |
-| `trooth lint [path]` | Local, read-only IaC drift check. Never transmits your code. |
+| `trooth check <domain>` | Reads a company's record from the live Trooth Network (`GET https://api.trooth.co/directory/api/vendors`) and prints whether it is listed, when it was witnessed and first published, the live-probe and attestation counts, the badge id, and the signature and key id you can verify. Prints an honest "not listed yet" when a company has no published record. |
+| `trooth lint [path]` | Reads the infrastructure the given directory **declares** and prints those declarations as facts, plus a canonical SHA-256 digest of them. Entirely local and offline. |
 | `trooth --help` / `--version` | Help / version. |
 
-## Examples
+## Flags
+
+- `--json`: stdout carries exactly one JSON document and nothing else; every
+  diagnostic goes to stderr. On an error the document is
+  `{"ok": false, "error": "...", "exit": N}`.
+
+Any other flag is a usage error (exit 2) that names the flag and lists the
+known ones.
+
+## Exit codes
+
+| Code | Meaning |
+| --- | --- |
+| 0 | ok: company listed; lint read at least one declaration; help / version |
+| 1 | finding: company not listed; lint found nothing to read |
+| 2 | usage error: missing argument, unknown flag or command, unreadable path |
+| 3 | Trooth unreachable, non-2xx response, or malformed response |
+
+A company that is not listed and a network that could not be read are different
+answers and they exit differently, so a pipeline never reads a Trooth outage as
+"this vendor is unverified".
+
+## `trooth check`
 
 ```bash
 trooth check trooth.co
@@ -38,50 +64,134 @@ trooth check trooth.co
 ```
 Trooth Network // witnessed · public · read-only //
 Trooth, LLC   trooth.co
-Standing: 91/100   Listed   witnessed 2026-08-30
-
-By discipline
-  Legal          ██████████  20/20
-  Security       ████████░░  16/20
-  AI governance  ██████████  19/20
-  Business       █████████░  18/20
-  IP             █████████░  18/20
+Standing: listed and witnessed   witnessed 2026-08-30   first published 2026-08-01
 
 Live probes 64/65     Attestations 27/35
-Badge bronze_rw_...   Scan rw_...
+Probes are checks Trooth read for itself. Attestations are the company's own declarations.
+They are counts, reported apart on purpose. Trooth never adds them up into one number.
+Badge bronze_rw_...   Key ed25519-2026-01
 
-A witnessed, point-in-time reading of public evidence. Not a certification.
+Recent witness events
+  • 2026-08-30  rewitnessed  64 of 65 live probes re-run
+
+A witnessed, point-in-time reading of public evidence. Not a certification. Not one number.
+Full record: https://trooth.co/network/trooth.co   ·   Signing keys: https://api.trooth.co/public/keys
 ```
 
 ```bash
-# For scripting: raw JSON, exit code 1 when a company is not listed:
-trooth check acme.com --json
+# For scripting: one JSON document on stdout, exit 1 when a company is not listed.
+trooth check trooth.co --json
 ```
 
-## Flags
+```json
+{
+  "domain": "trooth.co",
+  "listed": true,
+  "company_name": "Trooth, LLC",
+  "witnessed_at": "2026-08-30T00:00:00Z",
+  "first_published_at": "2026-08-01T00:00:00Z",
+  "badge_id": "bronze_rw_...",
+  "probes": { "passed": 64, "total": 65 },
+  "attested": { "passed": 27, "total": 35 },
+  "events": [ { "type": "rewitnessed", "at": "2026-08-30T00:00:00Z", "detail": "64 of 65 live probes re-run" } ],
+  "receipt_signature": "...",
+  "authority_key_id": "ed25519-2026-01",
+  "verify_keys": "https://api.trooth.co/public/keys",
+  "record_url": "https://trooth.co/network/trooth.co"
+}
+```
 
-- `--json`: print the raw JSON record instead of the formatted view.
-- `--strict`: scan only, exit non-zero if there are findings (default: exit 0, advisory).
+Those are the only fields `check --json` emits. Anything else the feed happens
+to carry is dropped on the way out, so a script written against this shape
+keeps working — and a field that would carry a score, tier, grade, rank or
+rating is dropped no matter what the feed sends.
 
-## Notes
+## `trooth lint`
 
-- `check` reads only the **public** witness directory. There is no key and no account, and
-  it never sends anything about you. It is a read.
-- A "not listed" result is not a judgement. It means no witnessed standing has been
-  published for that domain yet. A company gets witnessed by listing at
-  <https://trooth.co/get-started>.
-- `scan` sends only your **declared plan** to the Pre-Flight API; nothing is written back,
-  and Trooth never touches live infrastructure.
-- Set `TROOTH_API` to point at a different base URL (defaults to `https://api.trooth.co`).
-- Requires Node 18+ (uses built-in `fetch`).
+`lint` reads what your infrastructure **declares** and reports it. It does not
+judge it. There is no verdict, no pass mark, no severity and no score, and
+nothing is checked against a named standard or regulation — declaring public
+ingress is not a failing, because a load balancer is supposed to be public.
+What the facts mean is your call.
+
+```bash
+trooth lint ./infra
+```
+
+```
+trooth lint // local · offline · declarations only //
+./infra   14 declaration file(s) read
+terraform 11 · kubernetes 3
+
+Declared
+  Regions and zones                        eu-west-1, us-east-1
+  Storage declarations                     9
+    of those declaring encryption          9
+  Logging declarations                     4
+  Identity declarations                    6
+  Open to any address (0.0.0.0/0, ::/0)    1
+  Marked public                            2
+  Inline credential literals               0
+
+Digest  sha256:a963291330bce2ab…
+```
+
+It reads `.tf`, `.tf.json`, Kubernetes YAML (anything with `apiVersion` and
+`kind`), `terraform show -json` plan files and Dockerfiles. It is a declaration
+reader, not a full HCL parser, and it says so rather than pretending otherwise.
+
+**Nothing leaves the machine.** No file name, no line, no code and no value is
+ever printed or transmitted — only counts, resource type names and region
+strings. The credential count is a count: it never shows the literal it found.
+
+**The digest** is a SHA-256 over the canonical fact document with the timestamp
+excluded, so the same tree always produces the same digest. Record it in CI, or
+on your Trooth record, as evidence that a given state was observed — without
+publishing the tree it came from.
+
+```bash
+# In CI: keep the fact document as a build artifact.
+trooth lint --json > trooth-attestation.json
+```
 
 ## Use it from an AI assistant
 
-The same public network powers Trooth's read-only MCP server, so ChatGPT, Claude, Cursor,
-or any MCP client can ask about a company in plain words:
+The same public network powers Trooth's read-only MCP server, so ChatGPT,
+Claude, Cursor, or any MCP client can ask about a company in plain words:
 
 ```
 https://api.trooth.co/public/mcp
 ```
 
+## Notes
+
+- `check` reads only the **public** record. There is no key and no account, and
+  it never sends anything about you. It is a read.
+- A "not listed" result is not a judgement. It means no record has been
+  published for that domain yet. A company gets one at
+  <https://trooth.co/get-started>.
+- Set `TROOTH_API` to point at a different base URL (defaults to
+  `https://api.trooth.co`). `lint` ignores it: `lint` makes no requests.
+- Set `NO_COLOR=1` to disable ANSI colour. Colour is already off when stdout is
+  not a TTY.
+
+## Changes in 0.4.0
+
+Breaking, and deliberately so.
+
+- **`scan` and `eu` are removed.** Trooth does not scan infrastructure against a
+  standard, does not issue a verdict and does not offer a compliance product.
+  Both commands now exit 2 with a sentence saying so, rather than "unknown
+  command", so an old CI job or an old README gets an explanation.
+- **`lint` is real.** In 0.3.0 it shelled out to `@trooth/os`, which was never
+  published, so the command failed for everyone who ran it. It is now
+  implemented in this binary, entirely locally.
+- **`scan_id` is gone from `check --json`.** Every other field is unchanged.
+- **`--strict` is gone**, along with the only command that took it.
+- The package description and keywords no longer name any certification,
+  standard or regulation, because Trooth does not offer one.
+
+The Trooth Network is Trooth's only product. This CLI, the public API and the
+MCP server are interfaces to it, not separate products.
+
 Trooth automates. Trooth never signs for you.

package/bin/trooth.mjs

@@ -2,97 +2,191 @@
 // Trooth CLI. Command name: `trooth`
 // Copyright (c) 2026 Trooth, LLC. All rights reserved.
 //
+// The Trooth Network is one public record per company: identity, products and demos,
+// domain and marketing links, people, documents, security and privacy posture,
+// procurement terms, relationships and sub-processors — each one witnessed, signed
+// and dated. This CLI is the terminal interface to that record.
+//
 // Commands:
-//   trooth check <domain>  Read a company's witnessed trust standing from the
-//                          public Trooth Network (read-only, no key, no account).
-//   trooth scan <plan>     Send a Terraform plan to Trooth Pre-Flight (advisory, report-only).
-//                          <plan> may be a `terraform show -json` JSON file, OR a binary
-//                          .tfplan (the CLI will run `terraform show -json` for you).
-//   trooth eu   ...        Push EU AI Act evidence into Trooth from CI/CD (needs a token).
-//   trooth lint [path]     Local, read-only IaC drift check (never transmits your code).
-//   trooth --help          Show help.   trooth --version  Show version.
+//   trooth check <domain>   Read a company's witnessed record from the public Trooth
+//                           Network. Read-only. No key, no account, nothing sent about you.
+//   trooth lint [path]      Read the infrastructure THIS repository declares and print
+//                           the declared facts plus a canonical digest of them.
+//                           Fully local. Offline. Your source never leaves the machine.
+//   trooth --help           Show help.   trooth --version  Show version.
+//
+// WHAT THIS TOOL DOES NOT DO, ON PURPOSE:
+//   It does not score, rate, rank, grade or tier a company or a repository.
+//   It does not check anything against a named certification, standard or regulation.
+//   It does not produce a verdict, a pass mark or a percentage.
+//   It publishes facts and counts, reported apart, and never adds them into one number.
+//
+// Exit codes (stable, for scripts):
+//   0  ok                      (listed; lint read at least one declaration; help/version)
+//   1  finding                 (domain not listed; lint found nothing to read)
+//   2  usage error             (missing argument, unknown flag or command, unreadable path)
+//   3  network/upstream error  (Trooth unreachable, non-2xx, malformed response)
 //
-// `check` reads only PUBLIC, already-published witness records. `scan` is ADVISORY and
-// REPORT-ONLY: Trooth never applies changes to your infrastructure, and the scan posts
-// only your declared plan. Trooth automates. Trooth never signs for you.
+// With --json, stdout carries exactly one JSON document and nothing else. Every
+// diagnostic goes to stderr.
 
-import { readFileSync, existsSync } from 'node:fs';
-import { execFileSync } from 'node:child_process';
+import { readFileSync, existsSync, statSync, readdirSync } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { createRequire } from 'node:module';
+import { join, relative, extname, basename } from 'node:path';
 
 const API = process.env.TROOTH_API || 'https://api.trooth.co';
-const J='\x1b[32m', D='\x1b[2m', B='\x1b[1m', R='\x1b[31m', A='\x1b[33m', C='\x1b[36m', X='\x1b[0m';
 const require = createRequire(import.meta.url);
-let VERSION = '0.2.0';
+let VERSION = '0.4.0';
 try { VERSION = require('../package.json').version; } catch {}
 
+const EXIT = { OK: 0, FINDING: 1, USAGE: 2, UPSTREAM: 3 };
+
+// Colour only when stdout is a TTY and NO_COLOR is unset, so piped output is clean.
+const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
+const c = (code) => (useColor ? code : '');
+const J = c('\x1b[32m'), D = c('\x1b[2m'), B = c('\x1b[1m'), R = c('\x1b[31m'), A = c('\x1b[33m'), C = c('\x1b[36m'), X = c('\x1b[0m');
+
 const argv = process.argv.slice(2);
 const cmd = argv[0];
+const asJson = argv.includes('--json');
+
+/* ------------------------------------------------------------- output ---- */
+
+function out(s) { process.stdout.write(s + '\n'); }
+function diag(s) { process.stderr.write(s + '\n'); }
+function emitJson(obj) { out(JSON.stringify(obj, null, 2)); }
+
+function fail(code, message, extra = {}) {
+  diag(`${R}error${X} ${message}`);
+  if (asJson) emitJson({ ok: false, error: message, exit: code, ...extra });
+  process.exit(code);
+}
+
+/** Keys that would carry a score, tier, grade, rank, rating or percentage. Nothing
+ *  under these names is ever printed, in any mode, no matter what an upstream feed
+ *  sends. `rate` is matched only as a whole key so keys like generatedAt survive. */
+const BANNED_KEY = /score|tier|grade|rank|rating|level|percent|^rate$/i;
+
+function scrub(value) {
+  if (Array.isArray(value)) return value.map(scrub);
+  if (value && typeof value === 'object') {
+    const clean = {};
+    for (const [k, v] of Object.entries(value)) {
+      if (BANNED_KEY.test(k)) continue;
+      clean[k] = scrub(v);
+    }
+    return clean;
+  }
+  return value;
+}
+
+/* --------------------------------------------------------------- args ---- */
+
+const FLAGS = {
+  check: { bool: ['--json'], value: [] },
+  lint:  { bool: ['--json'], value: [] },
+};
+
+/** Commands that existed in an earlier release and are gone. Naming them explicitly
+ *  means an old README, an old CI job or an old blog post gets a sentence that says
+ *  what happened, instead of "unknown command". */
+const RETIRED = {
+  scan: 'Trooth does not scan infrastructure against a standard and does not issue a verdict. `trooth lint` reads what your infrastructure declares and prints those facts, locally.',
+  eu:   'Trooth does not ingest regulation-specific evidence. Publish evidence on your company record at https://trooth.co/dashboard.',
+  preflight: 'Retired. `trooth lint` reads declared infrastructure facts locally instead.',
+};
+
+function parseArgs(command) {
+  const spec = FLAGS[command];
+  const flags = {};
+  const positional = [];
+  for (let i = 1; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--') { positional.push(...argv.slice(i + 1)); break; }
+    if (a.startsWith('--')) {
+      const [name, inlineVal] = a.split('=', 2);
+      if (spec.bool.includes(name)) { flags[name] = true; continue; }
+      if (spec.value.includes(name)) {
+        const v = inlineVal !== undefined ? inlineVal : argv[++i];
+        if (v === undefined || v.startsWith('--')) fail(EXIT.USAGE, `${name} needs a value.`);
+        flags[name] = v; continue;
+      }
+      const known = [...spec.bool, ...spec.value];
+      fail(EXIT.USAGE, `unknown flag ${name} for \`trooth ${command}\`. ` +
+        (known.length ? `Known flags: ${known.join(', ')}.` : `\`trooth ${command}\` takes no flags.`) +
+        ` Run \`trooth --help\`.`);
+    } else if (a.startsWith('-') && a.length > 1) {
+      fail(EXIT.USAGE, `unknown flag ${a} for \`trooth ${command}\`. Run \`trooth --help\`.`);
+    } else {
+      positional.push(a);
+    }
+  }
+  return { flags, positional };
+}
 
-function help() {
-  console.log(`
-${J}${B}trooth${X} ${D}v${VERSION} · the trust network your terminal can check${X}
+/* --------------------------------------------------------------- help ---- */
+
+function helpText() {
+  return `
+${J}${B}trooth${X} ${D}v${VERSION} · the terminal interface to the Trooth Network${X}
 
 ${B}Usage${X}
-  trooth check <domain>     Read a company's witnessed standing on the Trooth Network
-  trooth scan <plan>        Scan a Terraform plan via Trooth Pre-Flight (advisory)
-  trooth lint [path]        Local read-only IaC drift check
+  trooth check <domain>     Read a company's witnessed record on the Trooth Network
+  trooth lint [path]        Read what your infrastructure declares, locally. Offline.
   trooth --help | --version
 
 ${B}Examples${X}
   trooth check stripe.com                ${D}# read a company's witnessed record${X}
-  trooth check trooth.co --json          ${D}# raw JSON, for scripting${X}
-  terraform show -json plan.tfplan > plan.json && trooth scan plan.json
+  trooth check trooth.co --json          ${D}# one JSON document on stdout, for scripting${X}
+  trooth lint ./infra                    ${D}# read declared facts + print a canonical digest${X}
+  trooth lint --json >> attestation.json ${D}# the same facts, for a CI artifact${X}
 
 ${B}Flags${X}
-  --json                    Print raw JSON instead of the formatted view
-  --strict                  (scan) exit non-zero if findings exist (default: advisory, exit 0)
+  --json                    machine-readable JSON on stdout; diagnostics on stderr
+
+${B}Exit codes${X}
+  0 ok   1 finding (not listed / nothing declared)   2 usage error   3 Trooth unreachable
+
+${D}check reads only public, already-published records. No key, no account.
+lint is entirely local: it opens files, and opens no sockets. Your source never leaves.
+Trooth publishes facts and counts, never one number that sums a company up.
+Trooth automates. Trooth never signs for you.${X}
+`;
+}
+
+/* -------------------------------------------------------------- fetch ---- */
 
-${D}check reads only public, already-published witness records. No key, no account.
-scan is advisory and report-only. Trooth automates. Trooth never signs for you.${X}
-`);
+async function callTrooth(path, init, what) {
+  let res;
+  try {
+    res = await fetch(`${API}${path}`, {
+      ...init,
+      headers: { accept: 'application/json', 'user-agent': `trooth-cli/${VERSION}`, ...(init && init.headers) },
+    });
+  } catch (e) {
+    fail(EXIT.UPSTREAM, `could not reach ${what} at ${API}: ${e && e.message ? e.message : e}`);
+  }
+  if (!res.ok) {
+    const body = await res.text().catch(() => '');
+    fail(EXIT.UPSTREAM, `${what} returned HTTP ${res.status}.${body ? ' ' + body.slice(0, 300).replace(/\s+/g, ' ') : ''}`, { http_status: res.status });
+  }
+  try { return await res.json(); }
+  catch { fail(EXIT.UPSTREAM, `${what} returned a response that is not JSON.`); }
 }
 
 /* --------------------------------------------------------------- check ---- */
 
-/** Normalize a domain the way the Trooth Network does: strip scheme, path,
- *  leading www, case, and trailing slash. */
 function normalizeDomain(input) {
   if (!input) return '';
   let s = String(input).trim().toLowerCase();
-  s = s.replace(/^[a-z]+:\/\//, '');   // scheme
-  s = s.replace(/\/.*$/, '');          // path/query/hash
-  s = s.replace(/^www\./, '');         // leading www
-  s = s.replace(/\.$/, '');            // trailing dot
+  s = s.replace(/^[a-z]+:\/\//, '');
+  s = s.replace(/\/.*$/, '');
+  s = s.replace(/^www\./, '');
+  s = s.replace(/\.$/, '');
   return s;
 }
 
-const CATEGORY_LABELS = {
-  legal: 'Legal',
-  security: 'Security',
-  ai: 'AI governance',
-  business: 'Business',
-  ip: 'IP',
-};
-
-/** Pull a 0..100 score out of the feed's score field (object or number). */
-function scorePct(score) {
-  if (score == null) return null;
-  if (typeof score === 'number') return Math.round(score);
-  if (typeof score === 'object') {
-    if (typeof score.rate === 'number') return Math.round(score.rate * 100);
-    if (typeof score.passed === 'number' && typeof score.total === 'number' && score.total > 0)
-      return Math.round((score.passed / score.total) * 100);
-  }
-  return null;
-}
-
-function bar(passed, total) {
-  if (!total) return '';
-  const filled = Math.round((passed / total) * 10);
-  return '█'.repeat(filled) + '░'.repeat(10 - filled);
-}
-
 function fmtDate(iso) {
   if (!iso) return '';
   const d = new Date(iso);
@@ -100,208 +194,328 @@ function fmtDate(iso) {
   return d.toISOString().slice(0, 10);
 }
 
+function count(obj) {
+  if (!obj || typeof obj !== 'object') return null;
+  if (typeof obj.passed !== 'number' || typeof obj.total !== 'number') return null;
+  return { passed: obj.passed, total: obj.total };
+}
+
+function projectRecord(v, domain) {
+  const events = Array.isArray(v.events)
+    ? v.events.filter((e) => e && e.type).map((e) => ({ type: String(e.type), at: e.at, detail: e.detail }))
+    : [];
+  const rec = {
+    domain,
+    listed: true,
+    company_name: v.company_name || domain,
+    witnessed_at: v.passed_at || null,
+    first_published_at: v.first_published_at || null,
+    badge_id: v.badge_id || null,
+    probes: count(v.probes),
+    attested: count(v.attested),
+    events,
+    receipt_signature: v.receipt_signature || null,
+    authority_key_id: v.authority_key_id || null,
+    verify_keys: `${API}/public/keys`,
+    record_url: `https://trooth.co/network/${encodeURIComponent(domain)}`,
+  };
+  if (v.category) rec.category = String(v.category);
+  if (v.description) rec.description = String(v.description);
+  return scrub(rec);
+}
+
 async function check() {
-  const domainArg = argv.find((a, i) => i > 0 && !a.startsWith('--'));
-  const asJson = argv.includes('--json');
-  const domain = normalizeDomain(domainArg);
-  if (!domain) {
-    console.error(`${R}error${X} missing <domain>. Try: trooth check stripe.com`);
-    process.exit(2);
-  }
+  const { positional } = parseArgs('check');
+  if (positional.length > 1) fail(EXIT.USAGE, `check takes one <domain>, got: ${positional.join(' ')}`);
+  const domain = normalizeDomain(positional[0]);
+  if (!domain) fail(EXIT.USAGE, 'missing <domain>. Try: trooth check stripe.com');
 
-  let res;
-  try {
-    res = await fetch(`${API}/directory/api/vendors`, {
-      headers: { accept: 'application/json', 'user-agent': `trooth-cli/${VERSION}` },
-    });
-  } catch (e) {
-    console.error(`${R}error${X} could not reach the Trooth Network at ${API}: ${e.message}`);
-    process.exit(1);
-  }
-  if (!res.ok) {
-    console.error(`${R}error${X} the Trooth Network returned HTTP ${res.status}.`);
-    process.exit(1);
-  }
-  let data;
-  try { data = await res.json(); } catch { data = {}; }
+  const data = await callTrooth('/directory/api/vendors', { method: 'GET' }, 'the Trooth Network');
   const vendors = Array.isArray(data && data.vendors) ? data.vendors : [];
   const vendor = vendors.find((v) => v && normalizeDomain(v.domain) === domain) || null;
 
-  if (asJson) {
-    console.log(JSON.stringify(vendor || { domain, listed: false }, null, 2));
-    process.exit(vendor ? 0 : 1);
-  }
-
   if (!vendor) {
-    console.log(`\n${B}${domain}${X} ${D}//${X} ${A}not listed on the Trooth Network yet${X}`);
-    console.log(`\n${D}No witnessed standing has been published for this domain. That is not a`);
-    console.log(`judgement. It simply has not been witnessed. A company gets witnessed by`);
-    console.log(`listing at ${X}${C}https://trooth.co/get-started${X}${D}: the scan reads its public surface and`);
-    console.log(`publishes a signed, dated standing that anyone can check.${X}\n`);
-    process.exit(1);
-  }
-
-  const pct = scorePct(vendor.score);
-  const name = vendor.company_name || domain;
-  const tier = vendor.tier ? vendor.tier[0].toUpperCase() + vendor.tier.slice(1) : 'Listed';
-  const when = fmtDate(vendor.passed_at);
-
-  console.log(`\n${J}${B}Trooth Network${X} ${D}// witnessed · public · read-only //${X}`);
-  console.log(`${B}${name}${X}   ${C}${domain}${X}`);
-  const scoreStr = pct == null ? `${D}not yet scored${X}` : `${B}${pct}/100${X}`;
-  console.log(`Standing: ${scoreStr}   ${J}${tier}${X}${when ? `   ${D}witnessed ${when}${X}` : ''}`);
-
-  // Categories (object keyed by discipline).
-  const cats = vendor.categories;
-  if (cats && typeof cats === 'object' && !Array.isArray(cats)) {
-    console.log(`\n${B}By discipline${X}`);
-    for (const key of ['legal', 'security', 'ai', 'business', 'ip']) {
-      const c = cats[key];
-      if (!c || typeof c.total !== 'number') continue;
-      const label = (CATEGORY_LABELS[key] || key).padEnd(14);
-      const r = c.total > 0 ? c.passed / c.total : 0;
-      const col = r >= 0.9 ? J : r >= 0.5 ? A : R;
-      console.log(`  ${label} ${col}${bar(c.passed, c.total)}${X}  ${String(c.passed).padStart(2)}/${c.total}`);
+    if (asJson) {
+      emitJson({ domain, listed: false, record_url: `https://trooth.co/network/${encodeURIComponent(domain)}` });
+    } else {
+      out(`\n${B}${domain}${X} ${D}//${X} ${A}not listed on the Trooth Network yet${X}`);
+      out(`\n${D}No witnessed record has been published for this domain. That is not a`);
+      out(`judgement. It simply has not been witnessed. A company gets a record by`);
+      out(`listing at ${X}${C}https://trooth.co/get-started${X}${D}: Trooth reads its public surface and`);
+      out(`publishes a signed, dated record that anyone — or any agent — can check.${X}\n`);
     }
+    process.exit(EXIT.FINDING);
   }
 
+  const rec = projectRecord(vendor, domain);
+  if (asJson) { emitJson(rec); process.exit(EXIT.OK); }
+
+  const when = fmtDate(rec.witnessed_at);
+  const since = fmtDate(rec.first_published_at);
+  out(`\n${J}${B}Trooth Network${X} ${D}// witnessed · public · read-only //${X}`);
+  out(`${B}${rec.company_name}${X}   ${C}${domain}${X}`);
+  out(`Standing: ${J}listed and witnessed${X}` +
+      (when ? `   ${D}witnessed ${when}${X}` : `   ${D}date not published${X}`) +
+      (since ? `   ${D}first published ${since}${X}` : ''));
+
   const line = [];
-  if (vendor.probes && typeof vendor.probes.total === 'number')
-    line.push(`${B}Live probes${X} ${vendor.probes.passed}/${vendor.probes.total}`);
-  if (vendor.attested && typeof vendor.attested.total === 'number')
-    line.push(`${B}Attestations${X} ${vendor.attested.passed}/${vendor.attested.total}`);
-  if (line.length) console.log(`\n${line.join('     ')}`);
+  if (rec.probes) line.push(`${B}Live probes${X} ${rec.probes.passed}/${rec.probes.total}`);
+  if (rec.attested) line.push(`${B}Attestations${X} ${rec.attested.passed}/${rec.attested.total}`);
+  if (line.length) {
+    out(`\n${line.join('     ')}`);
+    out(`${D}Probes are checks Trooth read for itself. Attestations are the company's own declarations.`);
+    out(`They are counts, reported apart on purpose. Trooth never adds them up into one number.${X}`);
+  }
 
   const ids = [];
-  if (vendor.badge_id) ids.push(`${D}Badge ${vendor.badge_id}${X}`);
-  if (vendor.scan_id) ids.push(`${D}Scan ${vendor.scan_id}${X}`);
-  if (ids.length) console.log(ids.join('   '));
-
-  const events = Array.isArray(vendor.events) ? vendor.events : [];
-  if (events.length) {
-    console.log(`\n${B}Recent witness events${X}`);
-    for (const e of events.slice(0, 3)) {
-      if (!e || !e.type) continue;
-      console.log(`  ${J}•${X} ${D}${fmtDate(e.at)}${X}  ${e.type.replace(/_/g, ' ')}${e.detail ? `${D}  ${e.detail}${X}` : ''}`);
+  if (rec.badge_id) ids.push(`${D}Badge ${rec.badge_id}${X}`);
+  if (rec.authority_key_id) ids.push(`${D}Key ${rec.authority_key_id}${X}`);
+  if (ids.length) out(ids.join('   '));
+
+  if (rec.events.length) {
+    out(`\n${B}Recent witness events${X}`);
+    for (const e of rec.events.slice(0, 3)) {
+      out(`  ${J}•${X} ${D}${fmtDate(e.at)}${X}  ${e.type.replace(/_/g, ' ')}${e.detail ? `${D}  ${e.detail}${X}` : ''}`);
     }
   }
 
-  console.log(`\n${D}A witnessed, point-in-time reading of public evidence. Not a certification.`);
-  console.log(`Full record and directory: ${X}${C}https://trooth.co/network${X}${D}   ·   Signing keys: ${API}/public/keys${X}\n`);
-  process.exit(0);
+  out(`\n${D}A witnessed, point-in-time reading of public evidence. Not a certification. Not one number.`);
+  out(`Full record: ${X}${C}${rec.record_url}${X}${D}   ·   Signing keys: ${rec.verify_keys}${X}\n`);
+  process.exit(EXIT.OK);
 }
 
-/* ---------------------------------------------------------------- scan ---- */
+/* ---------------------------------------------------------------- lint ---- */
+/* WHAT lint IS, AND WHAT IT IS CAREFULLY NOT.
+ *
+ * It reads the infrastructure a repository DECLARES and reports those
+ * declarations as facts: how many storage resources declare encryption, which
+ * regions appear, how many rules declare exposure to the whole internet. It
+ * does not judge them. There is no verdict, no pass mark, no severity, no
+ * score, and nothing is checked against a named standard or regulation.
+ * Declaring public ingress is not a failing; a load balancer is supposed to be
+ * public. What the facts mean is the reader's call.
+ *
+ * It opens files and opens no sockets. Nothing about the repository leaves the
+ * machine. The digest at the end is a SHA-256 over the canonical fact document
+ * with the timestamp excluded, so the same tree always produces the same digest
+ * and you can record it as evidence that a given state was observed, without
+ * publishing the tree it came from.
+ *
+ * It is a declaration reader, not an HCL parser: .tf.json, Kubernetes YAML and
+ * terraform plan JSON are parsed properly, and .tf files are read at the
+ * attribute level. That limit is stated in the output rather than hidden. */
+
+const SKIP_DIRS = new Set([
+  'node_modules', '.git', '.terraform', '.next', 'dist', 'build', 'vendor',
+  '.venv', 'venv', '__pycache__', '.cache', 'coverage', '.turbo',
+]);
+const MAX_FILES = 5000;
+const MAX_BYTES = 4 * 1024 * 1024;
+
+function walk(root) {
+  const found = [];
+  const stack = [root];
+  let st;
+  try { st = statSync(root); } catch { return found; }
+  if (st.isFile()) return [root];
+  while (stack.length && found.length < MAX_FILES) {
+    const dir = stack.pop();
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { continue; }
+    for (const e of entries) {
+      if (e.isDirectory()) { if (!SKIP_DIRS.has(e.name)) stack.push(join(dir, e.name)); continue; }
+      if (!e.isFile()) continue;
+      const n = e.name.toLowerCase();
+      const ext = extname(n);
+      const keep =
+        ext === '.tf' || n.endsWith('.tf.json') ||
+        ext === '.yaml' || ext === '.yml' || ext === '.json' ||
+        n === 'dockerfile' || n.startsWith('dockerfile.');
+      if (keep) found.push(join(dir, e.name));
+      if (found.length >= MAX_FILES) break;
+    }
+  }
+  return found;
+}
 
-function loadPlan(file) {
-  if (!file) { console.error(`${R}error${X} missing <plan> argument. Try: trooth scan ./plan.json`); process.exit(2); }
-  if (!existsSync(file)) { console.error(`${R}error${X} file not found: ${file}`); process.exit(2); }
-  // Try to read as JSON (a `terraform show -json` document).
-  let raw = '';
-  try { raw = readFileSync(file, 'utf8'); } catch (e) { console.error(`${R}error${X} cannot read ${file}: ${e.message}`); process.exit(2); }
-  try { return JSON.parse(raw); } catch { /* not JSON, likely a binary .tfplan */ }
-  // Fall back: ask Terraform to render the plan as JSON.
-  try {
-    const out = execFileSync('terraform', ['show', '-json', file], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
-    return JSON.parse(out);
-  } catch (e) {
-    console.error(`${R}error${X} ${file} is not JSON, and \`terraform show -json\` failed.`);
-    console.error(`${D}  Generate JSON first:  terraform show -json ${file} > plan.json  then  trooth scan plan.json${X}`);
-    process.exit(2);
+const REGION_RE = /\b(?:region|location|availability_zone|aws_region)\s*[:=]\s*["']([A-Za-z0-9][A-Za-z0-9._-]{2,40})["']/g;
+const RESOURCE_RE = /\bresource\s+"([a-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/g;
+const ENCRYPT_RE = /(?:encrypted|encryption|kms_key|sse_algorithm|server_side_encryption|encrypt_at_rest)/i;
+// Classification runs on the RESOURCE TYPE TOKEN (aws_db_instance, not the body
+// text), matched as a substring. An earlier version wrapped these in \b, which
+// never fires inside a snake_case identifier: \bdynamodb\b cannot match
+// aws_dynamodb_table because the underscore either side is a word character, so
+// every storage resource whose name was not the bare word "bucket" went
+// uncounted. Substring matching on the type is both simpler and correct.
+const STORAGE_TYPE = /(bucket|storage|blob|disk|volume|filestore|_db|database|rds|dynamodb|_sql|redis|memcache|elasticache|efs|fileshare|cosmos|bigtable|spanner)/i;
+const LOGGING_TYPE = /(log|trail|audit|monitor|insight|diagnostic)/i;
+const IDENTITY_TYPE = /(iam|role|policy|service_account|serviceaccount|rbac|identity|access_key|keyring|secret)/i;
+const OPEN_CIDR_RE = /(?:"0\.0\.0\.0\/0"|'0\.0\.0\.0\/0'|"::\/0"|'::\/0')/;
+const PUBLIC_RE = /\b(?:publicly_accessible\s*[:=]\s*true|acl\s*[:=]\s*["']public-read|public_network_access_enabled\s*[:=]\s*true|type\s*:\s*LoadBalancer|type\s*:\s*NodePort)\b/;
+// A literal that looks like a credential sitting in the file. Reported as a
+// count only: no file name, no line, and never the value itself.
+const SECRET_RE = /\b(?:password|secret|api[_-]?key|access[_-]?key|token|private[_-]?key)\s*[:=]\s*["'][^"'${}\n]{8,}["']/i;
+
+function classify(file, text) {
+  const n = basename(file).toLowerCase();
+  if (n.endsWith('.tf')) return 'terraform';
+  if (n.endsWith('.tf.json')) return 'terraform';
+  if (n === 'dockerfile' || n.startsWith('dockerfile.')) return 'container';
+  if (n.endsWith('.yaml') || n.endsWith('.yml')) {
+    return /^\s*apiVersion\s*:/m.test(text) && /^\s*kind\s*:/m.test(text) ? 'kubernetes' : null;
+  }
+  if (n.endsWith('.json')) {
+    return /"terraform_version"\s*:/.test(text) &&
+      (/"planned_values"\s*:/.test(text) || /"resource_changes"\s*:/.test(text)) ? 'terraform-plan' : null;
   }
+  return null;
 }
 
-async function scan() {
-  const file = argv.find((a, i) => i > 0 && !a.startsWith('--'));
-  const strict = argv.includes('--strict');
-  const asJson = argv.includes('--json');
-  const plan = loadPlan(file);
+/** Canonical JSON: object keys sorted at every depth, so the digest depends on
+ *  the facts and not on the order a walk happened to produce them. */
+function canonical(v) {
+  if (Array.isArray(v)) return '[' + v.map(canonical).join(',') + ']';
+  if (v && typeof v === 'object') {
+    return '{' + Object.keys(v).sort().map((k) => JSON.stringify(k) + ':' + canonical(v[k])).join(',') + '}';
+  }
+  return JSON.stringify(v === undefined ? null : v);
+}
 
-  let res;
-  try {
-    res = await fetch(`${API}/v1/preflight`, {
-      method: 'POST',
-      headers: { 'content-type': 'application/json', 'user-agent': `trooth-cli/${VERSION}` },
-      body: JSON.stringify({ plan }),
-    });
-  } catch (e) {
-    console.error(`${R}error${X} could not reach Trooth Pre-Flight at ${API}: ${e.message}`);
-    process.exit(1);
+function lint() {
+  const { positional } = parseArgs('lint');
+  if (positional.length > 1) fail(EXIT.USAGE, `lint takes one optional [path], got: ${positional.join(' ')}`);
+  const target = positional[0] || '.';
+  if (!existsSync(target)) fail(EXIT.USAGE, `path not found: ${target}`);
+
+  const files = walk(target);
+  const byKind = { terraform: 0, 'terraform-plan': 0, kubernetes: 0, container: 0 };
+  const regions = new Set();
+  const resourceTypes = new Map();
+  let read = 0, storage = 0, storageEncrypted = 0, logging = 0, identity = 0;
+  let openIngress = 0, publicAccess = 0, inlineCredentials = 0;
+
+  for (const f of files) {
+    let text;
+    try {
+      if (statSync(f).size > MAX_BYTES) continue;
+      text = readFileSync(f, 'utf8');
+    } catch { continue; }
+    const kind = classify(f, text);
+    if (!kind) continue;
+    byKind[kind]++;
+    read++;
+
+    for (const m of text.matchAll(REGION_RE)) regions.add(m[1]);
+
+    if (kind === 'terraform') {
+      for (const m of text.matchAll(RESOURCE_RE)) {
+        resourceTypes.set(m[1], (resourceTypes.get(m[1]) || 0) + 1);
+      }
+    }
+
+    // Terraform is split on top-level resource blocks so an attribute in one
+    // resource is never credited to another; every other kind is read whole.
+    const blocks = kind === 'terraform' ? text.split(/\n(?=resource\s+")/) : [text];
+    for (const b of blocks) {
+      const header = b.match(/^resource\s+"([a-z0-9_]+)"/);
+      const subject = header ? header[1] : b;
+      if (STORAGE_TYPE.test(subject)) { storage++; if (ENCRYPT_RE.test(b)) storageEncrypted++; }
+      if (LOGGING_TYPE.test(subject)) logging++;
+      if (IDENTITY_TYPE.test(subject)) identity++;
+      if (OPEN_CIDR_RE.test(b)) openIngress++;
+      if (PUBLIC_RE.test(b)) publicAccess++;
+    }
+    for (const line of text.split('\n')) if (SECRET_RE.test(line)) inlineCredentials++;
   }
-  if (!res.ok) {
-    const body = await res.text().catch(() => '');
-    console.error(`${R}error${X} Pre-Flight returned HTTP ${res.status}. ${body.slice(0, 300)}`);
-    process.exit(1);
+
+  if (read === 0) {
+    const msg = `no infrastructure declarations found under ${target}.`;
+    diag(`${A}nothing to read${X} ${msg}`);
+    diag(`${D}  lint reads .tf, .tf.json, Kubernetes YAML (apiVersion + kind), terraform plan`);
+    diag(`  JSON and Dockerfiles. ${files.length} file(s) were opened and none matched.${X}`);
+    if (asJson) emitJson({ ok: false, error: msg, exit: EXIT.FINDING, files_opened: files.length });
+    process.exit(EXIT.FINDING);
   }
-  const delta = await res.json();
-
-  if (asJson) { console.log(JSON.stringify(delta, null, 2)); process.exit(strict && (delta.summary?.fail > 0) ? 1 : 0); }
-
-  const score = delta.score ?? '-';
-  const verdict = (delta.verdict || 'reviewed').toUpperCase();
-  const s = delta.summary || {};
-  console.log(`\n${J}${B}Trooth Pre-Flight${X} ${D}// advisory · report-only //${X}`);
-  console.log(`Verdict: ${B}${verdict}${X}   Score: ${B}${score}${typeof score === 'number' ? '/100' : ''}${X}   ` +
-              `${J}pass ${s.pass ?? 0}${X} · ${A}fail ${s.fail ?? 0}${X} · ${D}n/a ${s.notApplicable ?? 0}${X}`);
-  const findings = delta.findings || [];
-  if (findings.length) {
-    console.log(`\n${B}${findings.length} finding(s):${X}\n`);
-    for (const f of findings.slice(0, 50)) {
-      const sev = (f.severity || '').toLowerCase();
-      const tag = sev === 'critical' || sev === 'high' ? `${R}● ${sev.toUpperCase()}${X}`
-                : sev === 'medium' ? `${A}● MEDIUM${X}` : `${D}● ${(sev||'LOW').toUpperCase()}${X}`;
-      console.log(`  ${tag}  ${B}${f.title || f.message || f.check || 'finding'}${X}`);
-      if (f.control || f.frameworks) console.log(`         ${J}↳${X} ${f.control || (Array.isArray(f.frameworks) ? f.frameworks.join(', ') : f.frameworks)}`);
-    }
-  } else {
-    console.log(`\n${J}✓ No findings in the declared plan.${X}`);
+
+  const topTypes = [...resourceTypes.entries()]
+    .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+    .slice(0, 12)
+    .map(([type, n]) => ({ type, count: n }));
+
+  const facts = {
+    declarations_read: read,
+    sources: Object.fromEntries(Object.entries(byKind).filter(([, n]) => n > 0)),
+    regions_and_zones_declared: [...regions].sort(),
+    resource_types: topTypes,
+    storage_declarations: storage,
+    storage_declaring_encryption: storageEncrypted,
+    logging_declarations: logging,
+    identity_declarations: identity,
+    declarations_open_to_any_address: openIngress,
+    declarations_marked_public: publicAccess,
+    inline_credential_literals: inlineCredentials,
+  };
+
+  const digest = createHash('sha256').update(canonical(facts)).digest('hex');
+  const doc = {
+    tool: 'trooth-lint',
+    cli_version: VERSION,
+    observed_at: new Date().toISOString(),
+    root: (() => { const r = relative(process.cwd(), target); return !r ? '.' : r.startsWith('..') ? target : r; })(),
+    facts,
+    digest: `sha256:${digest}`,
+    note: 'Declared facts only. Read locally; nothing was transmitted. No score, no verdict, no assessment against any standard.',
+  };
+
+  if (asJson) { emitJson(doc); process.exit(EXIT.OK); }
+
+  out(`\n${J}${B}trooth lint${X} ${D}// local · offline · declarations only //${X}`);
+  out(`${D}${doc.root}   ${read} declaration file(s) read${X}`);
+
+  const src = Object.entries(facts.sources).map(([k, n]) => `${k} ${n}`).join(' · ');
+  if (src) out(`${D}${src}${X}`);
+
+  out(`\n${B}Declared${X}`);
+  const row = (label, value) => out(`  ${label.padEnd(40)} ${value}`);
+  row('Regions and zones', facts.regions_and_zones_declared.length ? facts.regions_and_zones_declared.join(', ') : `${D}none declared${X}`);
+  row('Storage declarations', `${facts.storage_declarations}`);
+  row('  of those declaring encryption', `${facts.storage_declaring_encryption}`);
+  row('Logging declarations', `${facts.logging_declarations}`);
+  row('Identity declarations', `${facts.identity_declarations}`);
+  row('Open to any address (0.0.0.0/0, ::/0)', `${facts.declarations_open_to_any_address}`);
+  row('Marked public', `${facts.declarations_marked_public}`);
+  row('Inline credential literals', `${facts.inline_credential_literals}`);
+
+  if (topTypes.length) {
+    out(`\n${B}Most declared resource types${X}`);
+    for (const t of topTypes.slice(0, 6)) out(`  ${String(t.count).padStart(4)}  ${D}${t.type}${X}`);
   }
-  console.log(`\n${D}${delta.disclaimer || 'Advisory. Analyzes declared infrastructure intent, not live production state. Trooth never applies changes.'}${X}\n`);
 
-  process.exit(strict && (s.fail > 0) ? 1 : 0); // advisory by default: exit 0
-}
+  out(`\n${B}Digest${X}  ${C}${doc.digest}${X}`);
+  out(`${D}A SHA-256 over the facts above, in canonical form, with the timestamp excluded.`);
+  out(`The same tree always produces the same digest, so you can record it as evidence`);
+  out(`that a state was observed without publishing the tree it came from.${X}`);
 
-/* ------------------------------------------------------------------ eu ---- */
-// `trooth eu` pushes EU AI Act evidence into Trooth from CI/CD (automated observability).
-//   trooth eu --token <t> --datasets ds.json --evals ev.json --drift dr.json
-// Each file is a JSON array. Auth: TROOTH_TOKEN env or --token (bearer or x-trooth-company).
-async function eu() {
-  const flag = (name) => { const i = argv.indexOf(name); return i >= 0 ? argv[i + 1] : null; };
-  const token = flag('--token') || process.env.TROOTH_TOKEN || '';
-  const company = flag('--company') || process.env.TROOTH_COMPANY || '';
-  if (!token && !company) { console.error(`${R}error${X} provide --token <session> or --company <id> (or TROOTH_TOKEN / TROOTH_COMPANY env).`); process.exit(2); }
-  const load = (f) => { if (!f) return undefined; try { return JSON.parse(readFileSync(f, 'utf8')); } catch (e) { console.error(`${R}error${X} cannot read ${f}: ${e.message}`); process.exit(2); } };
-  const body = { datasets: load(flag('--datasets')), evals: load(flag('--evals')), drift: load(flag('--drift')) };
-  if (!body.datasets && !body.evals && !body.drift) { console.error(`${R}error${X} provide at least one of --datasets/--evals/--drift <file.json>`); process.exit(2); }
-  const headers = { 'content-type': 'application/json', 'user-agent': `trooth-cli/${VERSION}` };
-  if (token) headers['authorization'] = `Bearer ${token}`;
-  if (company) headers['x-trooth-company'] = company;
-  let res;
-  try { res = await fetch(`${API}/v1/eu/ingest`, { method: 'POST', headers, body: JSON.stringify(body) }); }
-  catch (e) { console.error(`${R}error${X} could not reach Trooth at ${API}: ${e.message}`); process.exit(1); }
-  if (!res.ok) { console.error(`${R}error${X} HTTP ${res.status}. ${(await res.text().catch(()=> '')).slice(0,300)}`); process.exit(1); }
-  const out = await res.json();
-  console.log(`\n${J}${B}Trooth EU AI Act${X} ${D}// evidence ingested //${X}`);
-  console.log(`datasets ${B}${out.ingested?.datasets ?? 0}${X} · evals ${B}${out.ingested?.evals ?? 0}${X} · drift ${B}${out.ingested?.drift ?? 0}${X}`);
-  console.log(`\n${D}${out.disclaimer || 'Advisory. Trooth automates, computes, and documents; it never signs.'}${X}\n`);
-  process.exit(0);
+  out(`\n${D}Counts of what the files declare. Not a judgement: a public load balancer is`);
+  out(`supposed to be public. Trooth issues no verdict here and checks nothing against`);
+  out(`any standard. Nothing left this machine: lint opens files and opens no sockets.`);
+  out(`Publish what you choose on your record at ${X}${C}https://trooth.co/dashboard${X}${D}.${X}\n`);
+  process.exit(EXIT.OK);
 }
 
-async function lint() {
-  // Local, read-only .tf drift check. Reuses the published @trooth/os linter if present,
-  // otherwise runs a built-in minimal ruleset. Never transmits your code.
-  const path = argv[1] && !argv[1].startsWith('--') ? argv[1] : '.';
-  const { spawnSync } = await import('node:child_process');
-  const r = spawnSync('npx', ['--yes', '@trooth/os', path], { stdio: 'inherit' });
-  process.exit(r.status ?? 0);
-}
+/* ---------------------------------------------------------------- main ---- */
 
 (async () => {
-  if (cmd === '--version' || cmd === '-v') { console.log(VERSION); return; }
-  if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') { help(); return; }
+  if (cmd === '--version' || cmd === '-v' || cmd === 'version') { out(VERSION); return; }
+  if (!cmd || cmd === '--help' || cmd === '-h' || cmd === 'help') { out(helpText()); return; }
   if (cmd === 'check') return check();
-  if (cmd === 'scan') return scan();
-  if (cmd === 'eu') return eu();
   if (cmd === 'lint') return lint();
-  console.error(`${R}error${X} unknown command: ${cmd}\n`); help(); process.exit(2);
-})();
+  if (Object.prototype.hasOwnProperty.call(RETIRED, cmd)) {
+    fail(EXIT.USAGE, `\`trooth ${cmd}\` is retired. ${RETIRED[cmd]} Run \`trooth --help\`.`);
+  }
+  if (cmd.startsWith('-')) fail(EXIT.USAGE, `unknown flag ${cmd}. Run \`trooth --help\`.`);
+  diag(helpText());
+  fail(EXIT.USAGE, `unknown command: ${cmd}. Commands: check, lint.`);
+})().catch((e) => {
+  fail(EXIT.UPSTREAM, `unexpected failure: ${e && e.message ? e.message : e}`);
+});

package/package.json

@@ -1,9 +1,11 @@
 {
   "name": "trooth",
-  "version": "0.2.0",
-  "description": "Trooth CLI. Check any company's witnessed trust standing from your terminal (read-only, no key), and scan a Terraform plan against SOC 2 / ISO 27001 / GDPR / HIPAA / NIST AI RMF / EU AI Act. Advisory and report-only. Trooth never applies changes.",
+  "version": "0.4.0",
+  "description": "The Trooth Network from your terminal. Read any company's public, signed record \u2014 identity, products, commercial terms, people, documents, security and privacy posture, AI practices, procurement terms \u2014 with no key and no account. Also reads the infrastructure your own repository declares, locally and offline. No score, no rating, no verdict.",
   "type": "module",
-  "bin": "bin/trooth.mjs",
+  "bin": {
+    "trooth": "bin/trooth.mjs"
+  },
   "files": [
     "bin/",
     "README.md"
@@ -13,32 +15,31 @@
   },
   "scripts": {
     "check": "node ./bin/trooth.mjs check",
-    "scan": "node ./bin/trooth.mjs scan"
+    "lint": "node ./bin/trooth.mjs lint"
   },
   "license": "MIT",
   "author": "Trooth, LLC",
   "homepage": "https://trooth.co",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/trooth/trooth-cli.git"
+  "bugs": {
+    "url": "https://trooth.co/contact"
   },
   "keywords": [
-    "trust",
-    "vendor-trust",
-    "trust-network",
-    "company-check",
+    "trooth",
+    "trooth-network",
+    "company-lookup",
+    "vendor-lookup",
     "due-diligence",
+    "procurement",
+    "trust-network",
+    "company-directory",
     "mcp",
     "ai-agents",
-    "compliance",
-    "soc2",
-    "iso27001",
-    "gdpr",
-    "hipaa",
-    "nist-ai-rmf",
-    "eu-ai-act",
+    "agent-tools",
+    "signed-records",
+    "provenance",
+    "infrastructure-as-code",
     "terraform",
-    "iac",
-    "trooth"
+    "kubernetes",
+    "cli"
   ]
 }