trooth 0.4.2 → 0.4.4

package/README.md

@@ -1,59 +1,56 @@
 # trooth
 
-The Trooth Network from your terminal.
+The Trooth Network from your terminal. Published on npm as **`trooth`**.
 
-The Trooth Network gives every company one public, signed record: what it is,
-what it sells, who runs it, where its data lives, how it handles AI, and what a
-buyer needs before signing. DNS tells a machine where a company is. A TLS
-certificate tells it the connection is authentic. Neither says anything about
-the company itself. The Trooth Network is that layer, and this CLI reads it.
+Trooth operates the Trooth Network: one public, signed, machine-readable record per company, carrying its identity, products and demos, commercial terms, domain and marketing links, people, documents, security and privacy posture, AI practices, procurement terms and relationships. It is Trooth's only product and it is free.
 
-**`check` reads only public, already-published records. No key, no account.**
-**`lint` is entirely local: it opens files and opens no sockets.**
-**Trooth publishes facts and counts, never one number that sums a company up.**
+DNS says where a company is. A TLS certificate says the connection is authentic. The Trooth Network says who the company is and what it does with your data.
 
-## Install / run
+This CLI is the terminal interface to that record. It does two things:
+
+- `trooth check <domain>` reads a company's published record from the public Network. No key, no account, and nothing about you is sent beyond what any web request carries (your IP address and a `trooth-cli/<version>` user-agent).
+- `trooth lint [path]` reads what your own infrastructure declares and prints those declarations as facts. Entirely local: it opens files and opens no sockets.
+
+**Trooth witnesses and dates facts. It does not grade, rate or rank anyone.** The CLI prints counts, reported apart, and never adds them into one number.
+
+## Install
 
 ```bash
-# No install needed:
+# No install:
 npx trooth check stripe.com
 
-# or install it:
-npm i -g trooth
-trooth check trooth.co
+# Or install it:
+npm install -g trooth
+trooth --version
 ```
 
-Requires Node 18+ (uses built-in `fetch`). Zero dependencies.
+Node 18 or newer, because the binary uses the built-in `fetch`. Zero dependencies.
 
 ## Commands
 
 | Command | What it does |
-| --- | --- |
-| `trooth check <domain>` | Reads a company's record from the live Trooth Network (`GET https://api.trooth.co/directory/api/vendors`) and prints whether it is listed, when it was witnessed and first published, the live-probe and attestation counts, the badge id, and the signature and key id you can verify. Prints an honest "not listed yet" when a company has no published record. |
-| `trooth lint [path]` | Reads the infrastructure the given directory **declares** and prints those declarations as facts, plus a canonical SHA-256 digest of them. Entirely local and offline. |
-| `trooth --help` / `--version` | Help / version. |
+|---|---|
+| `trooth check <domain>` | Reads a company's record from the live Network and prints whether it is listed, when it was last witnessed and first published, the live-probe and self-attestation counts, the badge id, the id of the key that signed the record, and the three newest events in its ledger, newest first. `--json` adds the signature itself and every event the feed returns. |
+| `trooth lint [path]` | Reads the infrastructure the given directory declares and prints those declarations plus a canonical SHA-256 digest of them. Local and offline. `path` defaults to `.`. |
+| `trooth --help` | Help. Also `-h` and `help`. |
+| `trooth --version` | Version. Also `-v` and `version`. |
 
 ## Flags
 
-- `--json`: stdout carries exactly one JSON document and nothing else; every
-  diagnostic goes to stderr. On an error the document is
-  `{"ok": false, "error": "...", "exit": N}`.
+`--json` is the only flag `check` and `lint` take. With it, stdout carries exactly one JSON document and nothing else, and every diagnostic goes to stderr. On an error the document is `{"ok": false, "error": "...", "exit": N}`; a non-2xx response adds `http_status`, and `lint` with nothing to read adds `files_opened`. `--help` and `--version` print plain text whether or not `--json` is given.
 
-Any other flag is a usage error (exit 2) that names the flag and lists the
-known ones.
+Any other flag is a usage error. The message names the flag, and for a `--` flag given to `check` or `lint` it also lists the ones that exist.
 
 ## Exit codes
 
 | Code | Meaning |
-| --- | --- |
-| 0 | ok: company listed; lint read at least one declaration; help / version |
-| 1 | finding: company not listed; lint found nothing to read |
-| 2 | usage error: missing argument, unknown flag or command, unreadable path |
-| 3 | Trooth unreachable, non-2xx response, or malformed response |
+|---|---|
+| 0 | The company is listed, or `lint` read at least one declaration, or you asked for help or the version. |
+| 1 | The company is not listed, or `lint` found nothing to read. |
+| 2 | Usage error: a missing argument, an unknown flag or command, or a path that does not exist. |
+| 3 | Trooth could not be read: unreachable, a non-2xx response, or a response that is not JSON. An unexpected failure inside the CLI also exits 3. |
 
-A company that is not listed and a network that could not be read are different
-answers and they exit differently, so a pipeline never reads a Trooth outage as
-"this vendor is unverified".
+A company with no record and a Network that could not be read are different answers, so they exit differently. A pipeline can tell them apart without parsing prose, and a Trooth outage never reads as a company with no record.
 
 ## `trooth check`
 
@@ -61,25 +58,37 @@ answers and they exit differently, so a pipeline never reads a Trooth outage as
 trooth check trooth.co
 ```
 
+Example output. The values are illustrative; the shape is what the binary prints.
+
 ```
-Trooth Network // witnessed · public · read-only //
+Trooth Network // public · signed · read-only //
 Trooth, LLC   trooth.co
-Standing: listed and witnessed   witnessed 2026-08-30   first published 2026-08-01
+Listing state: listed and witnessed   last witnessed 2026-08-30   first published 2026-08-01
+
+Live probes: 65 read; 64 as expected
+Self-attestations: 35 asked; 27 attested
+Live probes are readings Trooth took itself, from the company's public surface.
+Self-attestations are what the company attested about itself; Trooth records them
+and did not witness them. The two are reported apart and never added into one number.
+Badge rw_...   Key ed25519-2026-01
+
+Latest ledger events, newest first
+  • 2026-08-30  record published to the Trooth Network
+  • 2026-08-30  reading completed
+  • 2026-08-01  record published to the Trooth Network
+  --json carries the whole ledger, with the feed's own wording for each event.
+
+A dated, point-in-time record. Trooth issues no verdict and no single number.
+Full record: https://trooth.co/network/trooth.co   ·   Signing keys: https://api.trooth.co/public/keys
+```
 
-Live probes 64/65     Attestations 27/35
-Probes are checks Trooth read for itself. Attestations are the company's own declarations.
-They are counts, reported apart on purpose. Trooth never adds them up into one number.
-Badge bronze_rw_...   Key ed25519-2026-01
+The line that begins `Listing state:` gives the listing state. For a listed company it reads `listed and witnessed`, then the date of the most recent published reading (`last witnessed`) and the date the record was first published. The two counts use the same form as the record page on trooth.co: live probes (how many were read at the last reading, and how many of those returned the expected result) and self-attestations (how many the company was asked for, and how many it attested). Live probes are readings Trooth took itself; self-attestations are the company's statements about itself, which Trooth records and does not witness.
 
-Recent witness events
-  • 2026-08-30  rewitnessed  64 of 65 live probes re-run
+The events section prints the three newest entries in the record's ledger, newest first, by timestamp; entries with the same timestamp keep the feed's order, the later entry first. Known event types get a plain label: `scan_completed` prints as "reading completed", `standing_published` as "record published to the Trooth Network" and `rewitnessed` as "live probes re-read". A type the CLI does not know prints with its underscores turned into spaces. The human view leaves out each event's detail text. `--json` carries every event the feed returns, with its type and detail exactly as the feed has them.
 
-A witnessed, point-in-time reading of public evidence. Not a certification. Not one number.
-Full record: https://trooth.co/network/trooth.co   ·   Signing keys: https://api.trooth.co/public/keys
-```
+For scripting:
 
 ```bash
-# For scripting: one JSON document on stdout, exit 1 when a company is not listed.
 trooth check trooth.co --json
 ```
 
@@ -90,10 +99,15 @@ trooth check trooth.co --json
   "company_name": "Trooth, LLC",
   "witnessed_at": "2026-08-30T00:00:00Z",
   "first_published_at": "2026-08-01T00:00:00Z",
-  "badge_id": "bronze_rw_...",
+  "badge_id": "rw_...",
   "probes": { "passed": 64, "total": 65 },
   "attested": { "passed": 27, "total": 35 },
-  "events": [ { "type": "rewitnessed", "at": "2026-08-30T00:00:00Z", "detail": "64 of 65 live probes re-run" } ],
+  "events": [
+    { "type": "scan_completed", "at": "2026-08-01T00:00:00Z", "detail": "65 probes read · 64 returned the expected result · 27 declarations recorded · reading signed" },
+    { "type": "standing_published", "at": "2026-08-01T00:00:00Z", "detail": "point-in-time · published to the Trooth Network" },
+    { "type": "scan_completed", "at": "2026-08-30T00:00:00Z", "detail": "65 probes read · 64 returned the expected result · 27 declarations recorded · reading signed" },
+    { "type": "standing_published", "at": "2026-08-30T00:00:00Z", "detail": "point-in-time · published to the Trooth Network" }
+  ],
   "receipt_signature": "...",
   "authority_key_id": "ed25519-2026-01",
   "verify_keys": "https://api.trooth.co/public/keys",
@@ -101,106 +115,144 @@ trooth check trooth.co --json
 }
 ```
 
-Those are the only fields `check --json` emits. Anything else the feed happens
-to carry is dropped on the way out, so a script written against this shape
-keeps working — and a field that would carry a score, tier, grade, rank or
-rating is dropped no matter what the feed sends.
+In `probes`, `total` is how many live probes were read at the last reading and `passed` (the API's field name) is how many returned the expected result. In `attested`, `total` is how many declarations were asked for and `passed` is how many the company attested. `witnessed_at` is the date of the most recent published reading. `events` is the whole ledger, oldest first, in the feed's order. Each event's `detail` is written when the event is stored and is not rewritten afterward, so older and newer events of the same type can be worded differently.
+
+`category` and `description` are added when the record carries them. Those are the only fields `check --json` emits: anything else the feed happens to carry is dropped on the way out, so a script written against this shape keeps working. A field whose name contains `score`, `tier`, `grade`, `rank`, `rating`, `level` or `percent`, or is `rate`, is dropped no matter what the feed sends.
+
+A company with no record exits 1 and emits `{"domain": "...", "listed": false, "record_url": "..."}`. That is not a judgment. It means the Network's public feed carries no record for that domain. A company gets a record at [trooth.co/get-started](https://trooth.co/get-started), free.
+
+`receipt_signature` is Trooth's Ed25519 signature and `authority_key_id` names the key that made it; the public keys are listed at [trooth.co/verify/keys](https://trooth.co/verify/keys). You cannot re-run that signature check from this output yet: the exact bytes the signature covers are not published, and this JSON does not carry every field that goes into them. [`trooth-signatures`](https://github.com/troothllc/trooth-signatures) states that gap and what will close it.
 
 ## `trooth lint`
 
-`lint` reads what your infrastructure **declares** and reports it. It does not
-judge it. There is no verdict, no pass mark, no severity and no score, and
-nothing is checked against a named standard or regulation — declaring public
-ingress is not a failing, because a load balancer is supposed to be public.
-What the facts mean is your call.
+`lint` reads what your infrastructure **declares** and reports it. It does not judge it. There is no verdict, no threshold, no severity and no rating, and nothing is checked against a named standard or regulation. Declaring public ingress is not a failing: a load balancer is supposed to be public. What the facts mean is your decision.
 
 ```bash
 trooth lint ./infra
 ```
 
+Output for the small fixture in this repository (`trooth lint tests/fixtures/infra`, trooth 0.4.3):
+
 ```
 trooth lint // local · offline · declarations only //
-./infra   14 declaration file(s) read
-terraform 11 · kubernetes 3
+tests/fixtures/infra   2 declaration file(s) read
+terraform 1 · kubernetes 1
 
 Declared
-  Regions and zones                        eu-west-1, us-east-1
-  Storage declarations                     9
-    of those declaring encryption          9
-  Logging declarations                     4
-  Identity declarations                    6
+  Regions and zones                        us-east-1
+  Storage declarations                     1
+    of those declaring encryption          1
+  Logging declarations                     0
+  Identity declarations                    0
   Open to any address (0.0.0.0/0, ::/0)    1
-  Marked public                            2
+  Marked public                            0
   Inline credential literals               0
 
-Digest  sha256:a963291330bce2ab…
+Most declared resource types
+     1  aws_s3_bucket
+     1  aws_s3_bucket_server_side_encryption_configuration
+     1  aws_security_group_rule
+
+Digest  sha256:a40bf6cf27dfd0b9079ac48a326fb2d1423b076c96b405451dde1ed2d7848944
+A SHA-256 over the facts above, in canonical form, with the timestamp excluded.
+The same tree read by the same trooth version produces the same digest, so you can
+record it as evidence that a state was observed without publishing the tree.
+
+How this was read
+  A pattern reader, not a Terraform evaluator: variables and modules are not resolved.
+  .tf by pattern, one resource block at a time. .tf.json and plan JSON parsed, one
+  resource at a time. Kubernetes YAML by pattern, one document at a time, by kind.
+  Dockerfiles for regions, open addresses, public markers and credential literals only.
+
+Counts of what the files declare. Not a judgment: a public load balancer is
+supposed to be public. Trooth issues no verdict here and checks nothing against
+any standard. Nothing left this machine: lint opens files and opens no sockets.
+Publish what you choose on your record at https://trooth.co/dashboard.
 ```
 
-It reads `.tf`, `.tf.json`, Kubernetes YAML (anything with `apiVersion` and
-`kind`), `terraform show -json` plan files and Dockerfiles. It is a declaration
-reader, not a full HCL parser, and it says so rather than pretending otherwise.
+The bucket's encryption configuration is a setting on the bucket, not a second store, so the fixture has one storage declaration, and that one declares encryption.
+
+It reads `.tf`, `.tf.json`, Kubernetes YAML (anything carrying both `apiVersion` and `kind`), `terraform show -json` plan files and Dockerfiles. It is a pattern reader, not a Terraform evaluator: variables, modules and `for_each` are never resolved, so a count can differ from what Terraform itself would plan. `.tf` files are read by pattern, one resource block at a time. `.tf.json` and plan files are parsed as JSON, one resource at a time. Kubernetes YAML is read by pattern, one document at a time, and classified by its `kind`. Dockerfiles are read for regions, open addresses, public markers and credential literals only. Storage, logging and identity are counted by a resource's type or a document's kind, never by the words around it. The output states this under "How this was read".
 
-**Nothing leaves the machine.** No file name, no line, no code and no value is
-ever printed or transmitted — only counts, resource type names and region
-strings. The credential count is a count: it never shows the literal it found.
+Nothing leaves the machine. No file name, no line, no code and no value is printed or transmitted, only the path you gave it, counts, resource type names and region strings. The credential count is a count: the literal it found is never shown.
 
-**The digest** is a SHA-256 over the canonical fact document with the timestamp
-excluded, so the same tree always produces the same digest. Record it in CI, or
-on your Trooth record, as evidence that a given state was observed — without
-publishing the tree it came from.
+The digest is a SHA-256 over the `facts` object in canonical form. The timestamp, the path and the CLI version are outside it, so the same tree read by the same trooth version produces the same digest. A release that changes how something is counted changes the digest of the same tree: the fixture above digests differently under 0.4.2 and 0.4.3. Record the digest in CI, or on your own record, as evidence that a given state was observed, without publishing the tree it came from.
 
 ```bash
-# In CI: keep the fact document as a build artifact.
-trooth lint --json > trooth-attestation.json
+# Keep the fact document as a build artifact.
+trooth lint --json > trooth-lint.json
 ```
 
-## Use it from an AI assistant
+## In GitHub Actions
 
-The same public network powers Trooth's read-only MCP server, so ChatGPT,
-Claude, Cursor, or any MCP client can ask about a company in plain words:
+The same `lint`, as a step, is [`troothllc/trooth-action`](https://github.com/troothllc/trooth-action). It is advisory by default: it writes what your infrastructure declares to the job summary and does not fail your workflow over anything it read unless you opt in to one of two gates. It does fail the step when it could not read at all: a path that does not exist, or a CLI it could not install or start.
+
+```yaml
+- uses: troothllc/trooth-action@v1
+  with:
+    path: ./infra
+```
+
+That repository's README documents the inputs and outputs.
+
+## Environment
+
+| Variable | Effect |
+|---|---|
+| `TROOTH_API` | Base URL for `check`. Defaults to `https://api.trooth.co`. `lint` ignores it, because `lint` makes no requests. |
+| `NO_COLOR` | Disables ANSI color. Color is already off when stdout is not a TTY. |
+
+There is no API key. The binary asks for no credential of any kind and has no write path.
+
+## From an AI assistant
+
+The same public Network powers Trooth's read-only MCP server, so ChatGPT, Claude, Cursor or any MCP client can ask about a company in plain words:
 
 ```
 https://api.trooth.co/public/mcp
 ```
 
-## Notes
+Four read-only tools, public data, no key. The pattern is written up at [trooth.co/docs/agents](https://trooth.co/docs/agents).
 
-- `check` reads only the **public** record. There is no key and no account, and
-  it never sends anything about you. It is a read.
-- A "not listed" result is not a judgement. It means no record has been
-  published for that domain yet. A company gets one at
-  <https://trooth.co/get-started>.
-- Set `TROOTH_API` to point at a different base URL (defaults to
-  `https://api.trooth.co`). `lint` ignores it: `lint` makes no requests.
-- Set `NO_COLOR=1` to disable ANSI colour. Colour is already off when stdout is
-  not a TTY.
+## Changed in 0.4.4
 
-## Changes in 0.4.0
+- `check` asks the Trooth Network for the one record it needs (`/directory/api/vendors/<domain>`) instead of downloading the whole directory list and searching it. When the API does not serve that path yet, it reads the list as 0.4.3 did. The printed output, `check --json` and the exit codes are unchanged.
+
+## Changed in 0.4.3
+
+- `check` labels the listing state `Listing state:` and prints the two counts in the record page's form (`65 read; 64 as expected`, `35 asked; 27 attested`). It prints the three newest ledger events, newest first, with plain labels and without the detail text. 0.4.2 printed the ledger's three oldest events under a heading that called them recent. `check --json` is unchanged.
+- `lint` no longer counts a storage setting (a bucket's encryption configuration, a bucket policy, a volume attachment) as a second store, and a setting that declares encryption credits the store it refers to. It no longer counts `encrypted = false`, or an empty encryption setting in a plan, as declaring encryption. It classifies by resource type or Kubernetes `kind` only, parses `.tf.json` and plan JSON and counts their resource types, and reads Kubernetes YAML one document at a time. The same tree can therefore produce different counts, and a different digest, than under 0.4.2. The `lint --json` field names are unchanged.
+- The human `lint` output states how each source was read.
+
+## Removed in 0.4.0
 
 Breaking, and deliberately so.
 
-- **`scan` and `eu` are removed.** Trooth does not scan infrastructure against a
-  standard, does not issue a verdict and does not offer a compliance product.
-  Both commands now exit 2 with a sentence saying so, rather than "unknown
-  command", so an old CI job or an old README gets an explanation.
-- **`lint` is real.** In 0.3.0 it shelled out to `@trooth/os`, which was never
-  published, so the command failed for everyone who ran it. It is now
-  implemented in this binary, entirely locally.
-- **`scan_id` is gone from `check --json`.** Every other field is unchanged.
-- **`--strict` is gone**, along with the only command that took it.
-- The package description and keywords no longer name any certification,
-  standard or regulation, because Trooth does not offer one.
+- The `scan` and `eu` commands are gone. Trooth does not check infrastructure against a standard and does not issue a verdict. Running either exits 2 with a sentence saying what happened, rather than "unknown command", so an old CI job or an old bookmark gets an explanation.
+- `lint` is real. In 0.3.0 it shelled out to a package that was never published, so the command failed for everyone who ran it. It is implemented in this binary now, entirely locally.
+- `scan_id` is gone from `check --json`. Every other field is unchanged.
+- `--strict` is gone, along with the only command that took it.
+- The package description and keywords no longer name any certification, standard or regulation, because Trooth does not offer one.
+
+The Trooth Network is Trooth's only product. This CLI, the public API and the MCP server are interfaces to that one record, not separate products.
 
-The Trooth Network is Trooth's only product. This CLI, the public API and the
-MCP server are interfaces to it, not separate products.
+## Security
 
-Trooth automates. Trooth never signs for you.
+Report a vulnerability through the [Vulnerability Disclosure Policy](https://trooth.co/security/vulnerability-disclosure-policy). Nothing in this CLI takes a credential, so there is no key to leak from it.
+
+## Links
+
+- The Network: [trooth.co/network](https://trooth.co/network)
+- This CLI on the site: [trooth.co/cli](https://trooth.co/cli)
+- API reference: [trooth.co/docs/api](https://trooth.co/docs/api)
+- Developers: [trooth.co/developers](https://trooth.co/developers)
+- Publish your own record, free: [trooth.co/get-started](https://trooth.co/get-started)
+- Contact: [trooth.co/contact](https://trooth.co/contact)
 
 ## License
 
 Apache License 2.0. See [LICENSE](LICENSE).
 
-The same licence applies to this repository, to the `trooth` package on npm and
-to the copyright header in `bin/trooth.mjs`. They are meant to agree; if you
-ever find that they do not, that is a defect and we want to hear about it at
-https://trooth.co/contact.
+The same license applies to this repository, to the `trooth` package on npm and to the copyright header in `bin/trooth.mjs`. They are meant to agree. If you find that they do not, that is a defect: please report it at [trooth.co/contact](https://trooth.co/contact).
+
+Trooth signs what it witnessed. It never signs on a company's behalf.

package/bin/trooth.mjs

@@ -4,10 +4,11 @@
 // Licensed under the Apache License, Version 2.0. See the LICENSE file in this
 // repository, or http://www.apache.org/licenses/LICENSE-2.0
 //
-// The Trooth Network is one public record per company: identity, products and demos,
-// domain and marketing links, people, documents, security and privacy posture,
-// procurement terms, relationships and sub-processors — each one witnessed, signed
-// and dated. This CLI is the terminal interface to that record.
+// The Trooth Network is one public, signed record per company: identity, products and
+// demos, domain and marketing links, people, documents, security and privacy posture,
+// procurement terms, relationships and sub-processors. Each fact is dated and labeled
+// with where it came from: witnessed, public record, attested or declared. This CLI is
+// the terminal interface to that record.
 //
 // Commands:
 //   trooth check <domain>   Read a company's witnessed record from the public Trooth
@@ -18,9 +19,9 @@
 //   trooth --help           Show help.   trooth --version  Show version.
 //
 // WHAT THIS TOOL DOES NOT DO, ON PURPOSE:
-//   It does not score, rate, rank, grade or tier a company or a repository.
-//   It does not check anything against a named certification, standard or regulation.
-//   It does not produce a verdict, a pass mark or a percentage.
+//   It does not grade, rate or rank a company or a repository.
+//   It does not check anything against a named standard, framework or regulation.
+//   It does not produce a verdict, a threshold result or a percentage.
 //   It publishes facts and counts, reported apart, and never adds them into one number.
 //
 // Exit codes (stable, for scripts):
@@ -39,12 +40,12 @@ import { join, relative, extname, basename } from 'node:path';
 
 const API = process.env.TROOTH_API || 'https://api.trooth.co';
 const require = createRequire(import.meta.url);
-let VERSION = '0.4.0';
+let VERSION = '0.4.4';
 try { VERSION = require('../package.json').version; } catch {}
 
 const EXIT = { OK: 0, FINDING: 1, USAGE: 2, UPSTREAM: 3 };
 
-// Colour only when stdout is a TTY and NO_COLOR is unset, so piped output is clean.
+// Color only when stdout is a TTY and NO_COLOR is unset, so piped output is clean.
 const useColor = process.stdout.isTTY && !process.env.NO_COLOR;
 const c = (code) => (useColor ? code : '');
 const J = c('\x1b[32m'), D = c('\x1b[2m'), B = c('\x1b[1m'), R = c('\x1b[31m'), A = c('\x1b[33m'), C = c('\x1b[36m'), X = c('\x1b[0m');
@@ -94,7 +95,7 @@ const FLAGS = {
  *  means an old README, an old CI job or an old blog post gets a sentence that says
  *  what happened, instead of "unknown command". */
 const RETIRED = {
-  scan: 'Trooth does not scan infrastructure against a standard and does not issue a verdict. `trooth lint` reads what your infrastructure declares and prints those facts, locally.',
+  scan: 'Trooth does not check infrastructure against a standard and does not issue a verdict. `trooth lint` reads what your infrastructure declares and prints those facts, locally.',
   eu:   'Trooth does not ingest regulation-specific evidence. Publish evidence on your company record at https://trooth.co/dashboard.',
   preflight: 'Retired. `trooth lint` reads declared infrastructure facts locally instead.',
 };
@@ -142,7 +143,7 @@ ${B}Examples${X}
   trooth check stripe.com                ${D}# read a company's witnessed record${X}
   trooth check trooth.co --json          ${D}# one JSON document on stdout, for scripting${X}
   trooth lint ./infra                    ${D}# read declared facts + print a canonical digest${X}
-  trooth lint --json >> attestation.json ${D}# the same facts, for a CI artifact${X}
+  trooth lint --json > trooth-lint.json  ${D}# the same facts as one JSON document, for a CI artifact${X}
 
 ${B}Flags${X}
   --json                    machine-readable JSON on stdout; diagnostics on stderr
@@ -153,26 +154,33 @@ ${B}Exit codes${X}
 ${D}check reads only public, already-published records. No key, no account.
 lint is entirely local: it opens files, and opens no sockets. Your source never leaves.
 Trooth publishes facts and counts, never one number that sums a company up.
-Trooth automates. Trooth never signs for you.${X}
+Trooth signs what it witnessed. It never signs on a company's behalf.${X}
 `;
 }
 
 /* -------------------------------------------------------------- fetch ---- */
 
-async function callTrooth(path, init, what) {
-  let res;
+/** One request to the API. Exits 3 when the API cannot be reached; any HTTP
+ *  status comes back to the caller. */
+async function requestTrooth(path, init, what) {
   try {
-    res = await fetch(`${API}${path}`, {
+    return await fetch(`${API}${path}`, {
       ...init,
       headers: { accept: 'application/json', 'user-agent': `trooth-cli/${VERSION}`, ...(init && init.headers) },
     });
   } catch (e) {
     fail(EXIT.UPSTREAM, `could not reach ${what} at ${API}: ${e && e.message ? e.message : e}`);
   }
-  if (!res.ok) {
-    const body = await res.text().catch(() => '');
-    fail(EXIT.UPSTREAM, `${what} returned HTTP ${res.status}.${body ? ' ' + body.slice(0, 300).replace(/\s+/g, ' ') : ''}`, { http_status: res.status });
-  }
+}
+
+async function failHttp(res, what) {
+  const body = await res.text().catch(() => '');
+  fail(EXIT.UPSTREAM, `${what} returned HTTP ${res.status}.${body ? ' ' + body.slice(0, 300).replace(/\s+/g, ' ') : ''}`, { http_status: res.status });
+}
+
+async function callTrooth(path, init, what) {
+  const res = await requestTrooth(path, init, what);
+  if (!res.ok) await failHttp(res, what);
   try { return await res.json(); }
   catch { fail(EXIT.UPSTREAM, `${what} returned a response that is not JSON.`); }
 }
@@ -202,6 +210,37 @@ function count(obj) {
   return { passed: obj.passed, total: obj.total };
 }
 
+/** The two count lines, in the website's form ("65 read; 64 as expected"). */
+function countLines(rec) {
+  const lines = [];
+  if (rec.probes) lines.push(`${B}Live probes:${X} ${rec.probes.total} read; ${rec.probes.passed} as expected`);
+  if (rec.attested) lines.push(`${B}Self-attestations:${X} ${rec.attested.total} asked; ${rec.attested.passed} attested`);
+  return lines;
+}
+
+/** The feed keeps the ledger oldest first. This returns the `n` most recent
+ *  events, newest first, ordered by timestamp; events with the same timestamp,
+ *  or none, keep the feed's order, later entries first. */
+function latestEvents(events, n) {
+  const t = (e) => { const v = Date.parse(e.at); return Number.isNaN(v) ? -Infinity : v; };
+  return events
+    .map((e, i) => ({ e, i }))
+    .sort((a, b) => (t(b.e) - t(a.e)) || (b.i - a.i))
+    .slice(0, n)
+    .map(({ e }) => e);
+}
+
+/** Display names for the feed's event types. The type strings themselves are
+ *  identifiers and are printed unchanged in --json. */
+const EVENT_LABELS = {
+  scan_completed: 'reading completed',
+  standing_published: 'record published to the Trooth Network',
+  rewitnessed: 'live probes re-read',
+};
+function eventLabel(type) {
+  return Object.prototype.hasOwnProperty.call(EVENT_LABELS, type) ? EVENT_LABELS[type] : type.replace(/_/g, ' ');
+}
+
 function projectRecord(v, domain) {
   const events = Array.isArray(v.events)
     ? v.events.filter((e) => e && e.type).map((e) => ({ type: String(e.type), at: e.at, detail: e.detail }))
@@ -226,25 +265,68 @@ function projectRecord(v, domain) {
   return scrub(rec);
 }
 
+/** The whole list, searched here. This is how every release up to 0.4.3 read a
+ *  company, and it is now only the fallback in readVendor below. */
+async function readVendorFromList(domain, what) {
+  const data = await callTrooth('/directory/api/vendors', { method: 'GET' }, what);
+  const vendors = Array.isArray(data && data.vendors) ? data.vendors : [];
+  return vendors.find((v) => v && normalizeDomain(v.domain) === domain) || null;
+}
+
+/** One company's record from the directory feed, or null when the feed carries
+ *  no record for that domain. It asks for that one record
+ *  (/directory/api/vendors/<domain>), which returns the same object the list
+ *  carries for that domain, and does not download every company to find it. */
+async function readVendor(domain) {
+  const what = 'the Trooth Network';
+  const res = await requestTrooth(`/directory/api/vendors/${encodeURIComponent(domain)}`, { method: 'GET' }, what);
+
+  if (res.status === 404) {
+    const text = await res.text().catch(() => '');
+    let body = null;
+    try { body = JSON.parse(text); } catch {}
+    // The route answered and has no record for this domain. It says so with a
+    // JSON body carrying `listed: false`.
+    if (body && typeof body === 'object' && body.listed === false) return null;
+    // FALLBACK TO THE LIST. Any other 404 comes from a deploy of the directory
+    // worker that predates the single-record route: it answers an unknown path
+    // with a plain-text "Not found". Read the list and search it here, as 0.4.3
+    // does, so this release keeps working against a worker that has not been
+    // redeployed yet, and against a TROOTH_API that points at an older one.
+    // This fallback can go in the first release after api.trooth.co serves the
+    // route, that is, once a request for a domain with no record there returns
+    // a JSON 404 with `listed: false`.
+    return readVendorFromList(domain, what);
+  }
+  if (!res.ok) await failHttp(res, what);
+
+  let v;
+  try { v = await res.json(); }
+  catch { fail(EXIT.UPSTREAM, `${what} returned a response that is not JSON.`); }
+  if (!v || typeof v !== 'object' || Array.isArray(v) || normalizeDomain(v.domain) !== domain) {
+    fail(EXIT.UPSTREAM, `${what} returned a response that is not the record for ${domain}.`);
+  }
+  return v;
+}
+
 async function check() {
   const { positional } = parseArgs('check');
   if (positional.length > 1) fail(EXIT.USAGE, `check takes one <domain>, got: ${positional.join(' ')}`);
   const domain = normalizeDomain(positional[0]);
   if (!domain) fail(EXIT.USAGE, 'missing <domain>. Try: trooth check stripe.com');
 
-  const data = await callTrooth('/directory/api/vendors', { method: 'GET' }, 'the Trooth Network');
-  const vendors = Array.isArray(data && data.vendors) ? data.vendors : [];
-  const vendor = vendors.find((v) => v && normalizeDomain(v.domain) === domain) || null;
+  const vendor = await readVendor(domain);
 
   if (!vendor) {
     if (asJson) {
       emitJson({ domain, listed: false, record_url: `https://trooth.co/network/${encodeURIComponent(domain)}` });
     } else {
-      out(`\n${B}${domain}${X} ${D}//${X} ${A}not listed on the Trooth Network yet${X}`);
-      out(`\n${D}No witnessed record has been published for this domain. That is not a`);
-      out(`judgement. It simply has not been witnessed. A company gets a record by`);
-      out(`listing at ${X}${C}https://trooth.co/get-started${X}${D}: Trooth reads its public surface and`);
-      out(`publishes a signed, dated record that anyone — or any agent — can check.${X}\n`);
+      out(`\n${B}${domain}${X} ${D}//${X} ${A}not listed in the Trooth Network's public feed${X}`);
+      out(`\n${D}The public feed carries no record for this domain. That says nothing about the`);
+      out(`company: a domain that never listed, a listing Trooth has not published, and a`);
+      out(`record that was revoked all read this way. A company gets a record by listing at`);
+      out(`${X}${C}https://trooth.co/get-started${X}${D}: Trooth reads its public surface and publishes`);
+      out(`a signed, dated record that anyone, or any agent, can read.${X}\n`);
     }
     process.exit(EXIT.FINDING);
   }
@@ -254,19 +336,22 @@ async function check() {
 
   const when = fmtDate(rec.witnessed_at);
   const since = fmtDate(rec.first_published_at);
-  out(`\n${J}${B}Trooth Network${X} ${D}// witnessed · public · read-only //${X}`);
+  out(`\n${J}${B}Trooth Network${X} ${D}// public · signed · read-only //${X}`);
   out(`${B}${rec.company_name}${X}   ${C}${domain}${X}`);
-  out(`Standing: ${J}listed and witnessed${X}` +
-      (when ? `   ${D}witnessed ${when}${X}` : `   ${D}date not published${X}`) +
+  out(`Listing state: ${J}listed and witnessed${X}` +
+      (when ? `   ${D}last witnessed ${when}${X}` : `   ${D}date not published${X}`) +
       (since ? `   ${D}first published ${since}${X}` : ''));
 
-  const line = [];
-  if (rec.probes) line.push(`${B}Live probes${X} ${rec.probes.passed}/${rec.probes.total}`);
-  if (rec.attested) line.push(`${B}Attestations${X} ${rec.attested.passed}/${rec.attested.total}`);
-  if (line.length) {
-    out(`\n${line.join('     ')}`);
-    out(`${D}Probes are checks Trooth read for itself. Attestations are the company's own declarations.`);
-    out(`They are counts, reported apart on purpose. Trooth never adds them up into one number.${X}`);
+  // Two counts, never a ratio, in the form the website's record page uses: an
+  // "N/M" cell reads as a bar, and a bar reads as a grade. The JSON fields keep
+  // the feed's names (`passed`, `total`).
+  const counts = countLines(rec);
+  if (counts.length) {
+    out('');
+    for (const l of counts) out(l);
+    out(`${D}Live probes are readings Trooth took itself, from the company's public surface.`);
+    out(`Self-attestations are what the company attested about itself; Trooth records them`);
+    out(`and did not witness them. The two are reported apart and never added into one number.${X}`);
   }
 
   const ids = [];
@@ -274,14 +359,14 @@ async function check() {
   if (rec.authority_key_id) ids.push(`${D}Key ${rec.authority_key_id}${X}`);
   if (ids.length) out(ids.join('   '));
 
-  if (rec.events.length) {
-    out(`\n${B}Recent witness events${X}`);
-    for (const e of rec.events.slice(0, 3)) {
-      out(`  ${J}•${X} ${D}${fmtDate(e.at)}${X}  ${e.type.replace(/_/g, ' ')}${e.detail ? `${D}  ${e.detail}${X}` : ''}`);
-    }
+  const latest = latestEvents(rec.events, 3);
+  if (latest.length) {
+    out(`\n${B}Latest ledger events, newest first${X}`);
+    for (const e of latest) out(`  ${J}•${X} ${D}${fmtDate(e.at)}${X}  ${eventLabel(e.type)}`);
+    out(`${D}  --json carries the whole ledger, with the feed's own wording for each event.${X}`);
   }
 
-  out(`\n${D}A witnessed, point-in-time reading of public evidence. Not a certification. Not one number.`);
+  out(`\n${D}A dated, point-in-time record. Trooth issues no verdict and no single number.`);
   out(`Full record: ${X}${C}${rec.record_url}${X}${D}   ·   Signing keys: ${rec.verify_keys}${X}\n`);
   process.exit(EXIT.OK);
 }
@@ -292,20 +377,31 @@ async function check() {
  * It reads the infrastructure a repository DECLARES and reports those
  * declarations as facts: how many storage resources declare encryption, which
  * regions appear, how many rules declare exposure to the whole internet. It
- * does not judge them. There is no verdict, no pass mark, no severity, no
- * score, and nothing is checked against a named standard or regulation.
+ * does not judge them. There is no verdict, no threshold, no severity and no
+ * rating, and nothing is checked against a named standard or regulation.
  * Declaring public ingress is not a failing; a load balancer is supposed to be
- * public. What the facts mean is the reader's call.
+ * public. What the facts mean is the reader's decision.
  *
  * It opens files and opens no sockets. Nothing about the repository leaves the
- * machine. The digest at the end is a SHA-256 over the canonical fact document
- * with the timestamp excluded, so the same tree always produces the same digest
- * and you can record it as evidence that a given state was observed, without
+ * machine. The digest at the end is a SHA-256 over the `facts` object in
+ * canonical form (the timestamp, path and CLI version are outside it), so the
+ * same tree read by the same CLI version always produces the same digest and
+ * you can record it as evidence that a given state was observed, without
  * publishing the tree it came from.
  *
- * It is a declaration reader, not an HCL parser: .tf.json, Kubernetes YAML and
- * terraform plan JSON are parsed properly, and .tf files are read at the
- * attribute level. That limit is stated in the output rather than hidden. */
+ * HOW EACH SOURCE IS READ. It is a pattern reader, not a Terraform evaluator:
+ * variables, modules and for_each are never resolved.
+ *   .tf                 regular expressions, split into top-level resource blocks
+ *   .tf.json            parsed as JSON; each resource is one unit
+ *   plan JSON           parsed as JSON (`terraform show -json`); each planned
+ *                       managed resource is one unit
+ *   Kubernetes YAML     regular expressions, one unit per YAML document,
+ *                       classified by its top-level `kind`
+ *   Dockerfile          read for regions, open addresses, public markers and
+ *                       credential literals only; it declares no resource types
+ * Storage, logging and identity are classified on a unit's resource type or
+ * kind, never on the text around it. The human output prints this list in
+ * short, so the limit is stated where the counts are. */
 
 const SKIP_DIRS = new Set([
   'node_modules', '.git', '.terraform', '.next', 'dist', 'build', 'vendor',
@@ -357,6 +453,125 @@ const PUBLIC_RE = /\b(?:publicly_accessible\s*[:=]\s*true|acl\s*[:=]\s*["']publi
 // A literal that looks like a credential sitting in the file. Reported as a
 // count only: no file name, no line, and never the value itself.
 const SECRET_RE = /\b(?:password|secret|api[_-]?key|access[_-]?key|token|private[_-]?key)\s*[:=]\s*["'][^"'${}\n]{8,}["']/i;
+// A storage-matching Terraform type that names a SETTING on a store rather than
+// a store: aws_s3_bucket_server_side_encryption_configuration, a bucket policy,
+// a volume attachment, a subnet group. The substring match above catches these
+// (the fixture's one bucket used to count as two storage declarations), so they
+// are not counted as storage. A setting that declares encryption and references
+// a store credits that store with declaring encryption. Applied to snake_case
+// Terraform types only; Kubernetes kinds are CamelCase and are not settings.
+const STORAGE_SETTING = /_(?:configuration|policy|acl|versioning|notification|public_access_block|ownership_controls|attachment|object|item|logging|iam_member|iam_binding|access_point|mount_target|snapshot|subnet_group|parameter_group|option_group)$/;
+const isStorageSetting = (type) => type.includes('_') && STORAGE_SETTING.test(type);
+// An attribute set to false, null or empty declares nothing: `encrypted = false`
+// and `storage_encrypted: false` must not count as declaring encryption.
+const NEGATIVE_ATTR_RE = /^[^\n:=]*[:=]\s*(?:false|null|"false"|'false'|""|''|\[\]|\{\})\s*,?\s*$/gim;
+const declaresEncryption = (body) => ENCRYPT_RE.test(body.replace(NEGATIVE_ATTR_RE, ''));
+
+/** JSON text with `"key":` rewritten as `key:`, so the attribute patterns above
+ *  (written for `key = "v"` and `key: "v"`) read JSON sources too. Escaped
+ *  quotes inside string values are never rewritten. */
+function flattenJson(text) {
+  return text.replace(/"([A-Za-z_][\w.-]*)"\s*:/g, '$1:');
+}
+
+/** A parsed JSON value with false, null, empty strings, empty arrays and empty
+ *  objects removed, so a plan's unset attributes read as absent. */
+function prune(v) {
+  if (Array.isArray(v)) { const a = v.map(prune).filter((x) => x !== undefined); return a.length ? a : undefined; }
+  if (v && typeof v === 'object') {
+    const o = {};
+    for (const [k, x] of Object.entries(v)) { const y = prune(x); if (y !== undefined) o[k] = y; }
+    return Object.keys(o).length ? o : undefined;
+  }
+  return v === null || v === false || v === '' ? undefined : v;
+}
+
+const escRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+/** A pattern that finds a Terraform address (aws_s3_bucket.logs) in another
+ *  resource's body, as `aws_s3_bucket.logs.id` or `${aws_s3_bucket.logs.arn}`,
+ *  and not inside a longer address such as aws_s3_bucket.logs2. */
+const addressRef = (address) => new RegExp(`(?:^|[^\\w.])${escRe(address)}(?![\\w-])`);
+
+/** Every resource under `resource` in a .tf.json document, in either of the
+ *  shapes Terraform's JSON syntax allows (objects, or arrays of objects). */
+function tfJsonResources(doc) {
+  const out = [];
+  const each = (v, fn) => { if (Array.isArray(v)) v.forEach((x) => each(x, fn)); else if (v && typeof v === 'object') fn(v); };
+  each(doc, (top) => each(top.resource, (byType) => {
+    for (const [type, byName] of Object.entries(byType)) {
+      if (!/^[a-z0-9_]+$/.test(type)) continue;
+      each(byName, (names) => { for (const [name, body] of Object.entries(names)) out.push({ type, name, body }); });
+    }
+  }));
+  return out;
+}
+
+/** The managed resources a plan (`terraform show -json`) says will exist:
+ *  planned_values, every module deep, or resource_changes when a plan has no
+ *  planned_values. Data sources and deletions are not declarations. */
+function planResources(doc) {
+  const out = [];
+  const walkModule = (m) => {
+    if (!m || typeof m !== 'object') return;
+    for (const r of Array.isArray(m.resources) ? m.resources : []) {
+      if (r && r.mode !== 'data' && typeof r.type === 'string') out.push({ type: r.type, name: String(r.name ?? ''), body: r.values ?? {} });
+    }
+    for (const c of Array.isArray(m.child_modules) ? m.child_modules : []) walkModule(c);
+  };
+  if (doc && doc.planned_values && doc.planned_values.root_module) walkModule(doc.planned_values.root_module);
+  else {
+    for (const rc of Array.isArray(doc && doc.resource_changes) ? doc.resource_changes : []) {
+      const after = rc && rc.change ? rc.change.after : null;
+      if (rc && rc.mode !== 'data' && typeof rc.type === 'string' && after) out.push({ type: rc.type, name: String(rc.name ?? ''), body: after });
+    }
+  }
+  return out;
+}
+
+/** Split one declaration file into the units lint classifies. Each unit has a
+ *  `type` (a resource type or Kubernetes kind, or null when there is none),
+ *  `refs` (patterns another unit's body would contain to refer to this one),
+ *  `body` (the text attribute patterns run on) and `typed` (whether the type
+ *  belongs in the resource type list). */
+function unitsOf(kind, file, text) {
+  if (kind === 'terraform' && !basename(file).toLowerCase().endsWith('.tf.json')) {
+    return text.split(/\n(?=resource\s+")/).map((b) => {
+      const h = b.match(/^resource\s+"([a-z0-9_]+)"\s+"([A-Za-z0-9_-]+)"/);
+      return h ? { type: h[1], refs: [addressRef(`${h[1]}.${h[2]}`)], body: b, typed: false }
+               : { type: null, refs: [], body: b, typed: false };
+    });
+  }
+  if (kind === 'kubernetes') {
+    return text.split(/^---[^\n]*$/m).map((d) => {
+      const k = d.match(/^kind\s*:\s*["']?([A-Za-z][A-Za-z0-9]*)/m);
+      return { type: k ? k[1] : null, refs: [], body: d, typed: false };
+    });
+  }
+  if (kind === 'container') return [{ type: null, refs: [], body: text, typed: false }];
+
+  // .tf.json and plan JSON.
+  let doc;
+  try { doc = JSON.parse(text); } catch { return [{ type: null, refs: [], body: flattenJson(text), typed: false }]; }
+  const asBody = (v) => flattenJson(JSON.stringify(prune(v) ?? {}, null, 1));
+  if (kind === 'terraform-plan') {
+    return planResources(doc).map((r) => {
+      const v = prune(r.body) || {};
+      // A plan carries values, not expressions, so a setting names its store
+      // by the store's own bucket name or id.
+      const refs = ['bucket', 'id'].map((k) => v[k]).filter((x) => typeof x === 'string' && x.length >= 3)
+        .map((x) => new RegExp(escRe(JSON.stringify(x))));
+      return { type: r.type, refs, body: asBody(r.body), typed: true };
+    });
+  }
+  const units = tfJsonResources(doc).map((r) => ({ type: r.type, refs: [addressRef(`${r.type}.${r.name}`)], body: asBody(r.body), typed: true }));
+  // Everything outside `resource` (providers, variables, locals) is one untyped
+  // unit, the way the text before the first resource block is in a .tf file.
+  if (doc && typeof doc === 'object' && !Array.isArray(doc)) {
+    const rest = { ...doc }; delete rest.resource;
+    units.push({ type: null, refs: [], body: asBody(rest), typed: false });
+  }
+  return units;
+}
 
 function classify(file, text) {
   const n = basename(file).toLowerCase();
@@ -393,7 +608,9 @@ function lint() {
   const byKind = { terraform: 0, 'terraform-plan': 0, kubernetes: 0, container: 0 };
   const regions = new Set();
   const resourceTypes = new Map();
-  let read = 0, storage = 0, storageEncrypted = 0, logging = 0, identity = 0;
+  const stores = [];            // { refs, encrypted }, one per storage declaration
+  const encryptingSettings = []; // bodies of storage settings that declare encryption
+  let read = 0, logging = 0, identity = 0;
   let openIngress = 0, publicAccess = 0, inlineCredentials = 0;
 
   for (const f of files) {
@@ -407,29 +624,44 @@ function lint() {
     byKind[kind]++;
     read++;
 
-    for (const m of text.matchAll(REGION_RE)) regions.add(m[1]);
+    // JSON sources are read through flattenJson so `"region": "x"` and
+    // `"password": "..."` meet the same patterns as HCL and YAML.
+    const isJson = extname(f).toLowerCase() === '.json';
+    const flat = isJson ? flattenJson(text) : text;
+    for (const m of flat.matchAll(REGION_RE)) regions.add(m[1]);
+    for (const line of flat.split('\n')) if (SECRET_RE.test(line)) inlineCredentials++;
 
-    if (kind === 'terraform') {
+    if (kind === 'terraform' && !isJson) {
       for (const m of text.matchAll(RESOURCE_RE)) {
         resourceTypes.set(m[1], (resourceTypes.get(m[1]) || 0) + 1);
       }
     }
 
-    // Terraform is split on top-level resource blocks so an attribute in one
-    // resource is never credited to another; every other kind is read whole.
-    const blocks = kind === 'terraform' ? text.split(/\n(?=resource\s+")/) : [text];
-    for (const b of blocks) {
-      const header = b.match(/^resource\s+"([a-z0-9_]+)"/);
-      const subject = header ? header[1] : b;
-      if (STORAGE_TYPE.test(subject)) { storage++; if (ENCRYPT_RE.test(b)) storageEncrypted++; }
-      if (LOGGING_TYPE.test(subject)) logging++;
-      if (IDENTITY_TYPE.test(subject)) identity++;
-      if (OPEN_CIDR_RE.test(b)) openIngress++;
-      if (PUBLIC_RE.test(b)) publicAccess++;
+    // Each unit is classified on its own type, so an attribute in one resource
+    // is never credited to another, and a word in a file's text is never taken
+    // for a resource type.
+    for (const u of unitsOf(kind, f, text)) {
+      const t = u.type;
+      if (t && u.typed) resourceTypes.set(t, (resourceTypes.get(t) || 0) + 1);
+      if (t && STORAGE_TYPE.test(t)) {
+        if (isStorageSetting(t)) { if (declaresEncryption(u.body)) encryptingSettings.push(u.body); }
+        else stores.push({ refs: u.refs, encrypted: declaresEncryption(u.body) });
+      }
+      if (t && LOGGING_TYPE.test(t)) logging++;
+      if (t && IDENTITY_TYPE.test(t)) identity++;
+      if (OPEN_CIDR_RE.test(u.body)) openIngress++;
+      if (PUBLIC_RE.test(u.body)) publicAccess++;
     }
-    for (const line of text.split('\n')) if (SECRET_RE.test(line)) inlineCredentials++;
   }
 
+  // A store declares encryption in its own body, or through a setting resource
+  // (anywhere in the tree) that declares encryption and refers to it.
+  for (const s of stores) {
+    if (!s.encrypted && s.refs.some((re) => encryptingSettings.some((b) => re.test(b)))) s.encrypted = true;
+  }
+  const storage = stores.length;
+  const storageEncrypted = stores.filter((s) => s.encrypted).length;
+
   if (read === 0) {
     const msg = `no infrastructure declarations found under ${target}.`;
     diag(`${A}nothing to read${X} ${msg}`);
@@ -466,7 +698,7 @@ function lint() {
     root: (() => { const r = relative(process.cwd(), target); return !r ? '.' : r.startsWith('..') ? target : r; })(),
     facts,
     digest: `sha256:${digest}`,
-    note: 'Declared facts only. Read locally; nothing was transmitted. No score, no verdict, no assessment against any standard.',
+    note: 'Declared facts only. Read locally; nothing was transmitted. No verdict and no assessment against any standard.',
   };
 
   if (asJson) { emitJson(doc); process.exit(EXIT.OK); }
@@ -495,10 +727,16 @@ function lint() {
 
   out(`\n${B}Digest${X}  ${C}${doc.digest}${X}`);
   out(`${D}A SHA-256 over the facts above, in canonical form, with the timestamp excluded.`);
-  out(`The same tree always produces the same digest, so you can record it as evidence`);
-  out(`that a state was observed without publishing the tree it came from.${X}`);
+  out(`The same tree read by the same trooth version produces the same digest, so you can`);
+  out(`record it as evidence that a state was observed without publishing the tree.${X}`);
+
+  out(`\n${B}How this was read${X}`);
+  out(`${D}  A pattern reader, not a Terraform evaluator: variables and modules are not resolved.`);
+  out(`  .tf by pattern, one resource block at a time. .tf.json and plan JSON parsed, one`);
+  out(`  resource at a time. Kubernetes YAML by pattern, one document at a time, by kind.`);
+  out(`  Dockerfiles for regions, open addresses, public markers and credential literals only.${X}`);
 
-  out(`\n${D}Counts of what the files declare. Not a judgement: a public load balancer is`);
+  out(`\n${D}Counts of what the files declare. Not a judgment: a public load balancer is`);
   out(`supposed to be public. Trooth issues no verdict here and checks nothing against`);
   out(`any standard. Nothing left this machine: lint opens files and opens no sockets.`);
   out(`Publish what you choose on your record at ${X}${C}https://trooth.co/dashboard${X}${D}.${X}\n`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "trooth",
-  "version": "0.4.2",
-  "description": "The Trooth Network from your terminal. Read any company's public, signed record with no key and no account: identity, products, terms, people, documents, security and AI posture. Also reads what your own repo declares, offline. No score, no verdict.",
+  "version": "0.4.4",
+  "description": "The Trooth Network from your terminal. Read a company's public, signed record with no key and no account: listing state, dates, live-probe and self-attestation counts, signing key id. Also reads what your own repo declares, offline. No verdict.",
   "type": "module",
   "bin": {
     "trooth": "bin/trooth.mjs"
@@ -17,7 +17,7 @@
   "scripts": {
     "check": "node ./bin/trooth.mjs check",
     "lint": "node ./bin/trooth.mjs lint",
-    "test": "node ./bin/trooth.mjs lint tests/fixtures/infra --json > /dev/null && node ./bin/trooth.mjs --version"
+    "test": "node ./bin/trooth.mjs lint tests/fixtures/infra --json > /dev/null && node ./bin/trooth.mjs --version && node tests/action.test.mjs && node tests/lint.test.mjs"
   },
   "license": "Apache-2.0",
   "author": "Trooth, LLC",
@@ -36,9 +36,7 @@
     "vendor-lookup",
     "due-diligence",
     "procurement",
-    "trust-network",
     "company-directory",
-    "mcp",
     "ai-agents",
     "agent-tools",
     "signed-records",