verifyhash 0.1.0 → 0.1.1

package/docs/LOOP-HARDENING-PLAN.md

@@ -1,44 +0,0 @@
-# Loop-hardening batch 2 — engine patches (apply at the next park point)
-
-Source: `docs/LOOP-AUDIT-2026-07-03.json` (7-reviewer audit). Batch 1 (gates, launch chokepoint,
-runbook, decision sheet, adoption signal) shipped as commit `1272ffe`. Batch 2 edits
-`build-loop.workflow.js` and MUST be applied only when no run is active (a live run's Architect can
-swap the engine file and clobber edits). Re-gate with `node scripts/pre-run-gate.cjs` after applying.
-
-Ordered by priority:
-
-1. **Mechanical test gate (verification P1).** Add a per-task `test-runner` agent (haiku, effort low):
-   sole job = run TEST_CMD, return `{exitCode, passing, failing, tail}` via schema. The DRIVER then
-   requires `verdict.pass && verdict.testsPass && runner.exitCode === 0` to commit. Add a
-   validate-driver invariant pinning the `runner.exitCode === 0` conjunct in executable code. This makes
-   suite-green a mechanical fact, not an LLM claim, and lets the Verifier skip re-running the full suite
-   itself (its job becomes acceptance-criteria judgment + targeted probes) — likely net CHEAPER.
-2. **Panel width by blast radius (economics P1).** Default 3 reviewers; full panel only when
-   `build.filesChanged` touches `contracts/`, `cli/core/`, `verifier/`, `trustledger/`, or the engine.
-   Keep the dissenter-only re-score.
-3. **Per-run spend cap (economics P1).** In the main loop: break with `endReason:'run-cap'` when
-   `budget.spent() > RUN_CAP_TOKENS` (start 8M; tune from ledger). Bounds run MAGNITUDE, which the 2h
-   cooldown does not.
-4. **Dissent preservation (verification P2).** Trigger the rework path when ANY reviewer scores <=2,
-   not only when the median <=3. minUsefulness already lands in METRICS.
-5. **Single telemetry read (engine P2).** Preflight agent returns the METRICS tail + computed
-   qualityStall in its schema; the driver injects both into strategist/manager/architect prompts.
-   Kills 3 duplicate file-reads + two prose re-derivations of the same arithmetic per run.
-6. **Reporter -> haiku (engine P1, cheap now; true driver-write when the harness exposes file I/O).**
-   Its job is a verbatim append of a driver-computed line + a short MORNING.md.
-7. **Adoption-aware Strategist (strategy P0).** Strategist prompt reads `docs/ADOPTION.json`:
-   while all adoption numbers are zero — NO new verticals/epics; only distribution tasks (npm publish
-   prep, funnel, pilot materials), hardening tasks (this plan), or `newTasks: []` (explicitly a
-   rewarded outcome, not a failure). Reviewer prompts: novelty with zero adoption scores LOW.
-8. **Preflight self-heal (verification P2).** Preflight runs `scripts/archive-direction.cjs` + fixture
-   refresh BEFORE any build, so a Strategist append can never redden the suite mid-run
-   (STRATEGY.md sits ~500 bytes from the size-guard cliff).
-9. **Prompt dedup (engine P3).** qualityStall guidance collapsed to one sentence; VISION trimmed to the
-   guardrails agents act on.
-10. **Agent timeout probe (engine P1).** Test whether `setTimeout` exists in the workflow sandbox; if
-    yes, wrap agent() calls in a deadline race (timeout == failed attempt, same path as a throw). If
-    not available, document the limitation here and rely on the run-cap.
-
-Also at the same park point (non-engine): add the corresponding BACKLOG epic so the loop continues the
-remainder itself (checkpointing/partial-run METRICS, engine-writes-own-ledger-row when file I/O exists,
-prev.js archive rotation), and launch the next run with `args: {maxTasks: 4}` while adoption is zero.

package/docs/METRICS.jsonl

@@ -1,31 +0,0 @@
-{"ts":"2026-06-23T07:10:34Z","verified":4,"blocked":0,"rework":0,"newlyPlanned":4,"teamChanges":1}
-{"ts":"2026-06-23T08:24:31Z","verified":4,"blocked":0,"rework":1,"newlyPlanned":3,"teamChanges":1}
-{"ts":"2026-06-23T09:46:00Z","verified":4,"blocked":0,"rework":0,"newlyPlanned":3,"teamChanges":0,"avgUsefulness":4.5,"minUsefulness":4}
-{"ts":"2026-06-23T12:19:33Z","verified":4,"blocked":0,"rework":0,"newlyPlanned":5,"teamChanges":1,"avgUsefulness":4,"minUsefulness":4}
-{"ts":"2026-06-23T14:04:21Z","verified":4,"blocked":0,"rework":1,"newlyPlanned":3,"teamChanges":0,"avgUsefulness":3.75,"minUsefulness":3}
-{"ts":"2026-06-23T18:23:33Z","verified":4,"blocked":0,"rework":1,"newlyPlanned":0,"teamChanges":1,"avgUsefulness":4.25,"minUsefulness":4,"humanGated":3}
-{"ts":"2026-06-23T19:32:12Z","verified":4,"blocked":0,"rework":2,"newlyPlanned":6,"teamChanges":0,"avgUsefulness":4,"minUsefulness":4,"humanGated":3}
-{"ts":"2026-06-23T20:26:43Z","verified":4,"blocked":0,"rework":0,"newlyPlanned":3,"teamChanges":0,"avgUsefulness":4,"minUsefulness":4,"humanGated":3}
-{"ts":"2026-06-23T21:28:20Z","verified":4,"blocked":0,"rework":1,"newlyPlanned":3,"teamChanges":0,"avgUsefulness":4,"minUsefulness":4,"humanGated":4}
-{"ts":"2026-06-23T22:40:52Z","verified":4,"blocked":0,"rework":0,"reworkReverted":0,"newlyPlanned":6,"teamChanges":1,"avgUsefulness":4,"minUsefulness":4,"humanGated":3}
-{"ts":"2026-06-24T01:13:54Z","verified":4,"blocked":0,"rework":0,"reworkReverted":0,"newlyPlanned":2,"teamChanges":0,"avgUsefulness":4,"minUsefulness":4,"humanGated":4,"endReason":"iters"}
-{"ts":"2026-06-24T02:36:25Z","verified":4,"blocked":0,"rework":3,"reworkReverted":0,"newlyPlanned":0,"teamChanges":3,"avgUsefulness":4,"minUsefulness":4,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-24T03:54:45Z","verified":4,"blocked":0,"rework":1,"reworkReverted":0,"newlyPlanned":6,"teamChanges":0,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-24T05:13:13Z","verified":4,"blocked":0,"rework":1,"reworkReverted":0,"newlyPlanned":4,"teamChanges":0,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-24T07:23:34Z","verified":4,"blocked":0,"rework":3,"reworkReverted":0,"newlyPlanned":3,"teamChanges":2,"avgUsefulness":3.5,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-24T08:37:00Z","verified":4,"blocked":0,"rework":2,"reworkReverted":0,"newlyPlanned":0,"teamChanges":2,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-24T12:33:58Z","verified":4,"blocked":0,"rework":2,"reworkReverted":0,"newlyPlanned":6,"teamChanges":2,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":5,"endReason":"iters"}
-{"ts":"2026-06-24T15:43:39Z","verified":4,"blocked":0,"rework":0,"reworkReverted":0,"newlyPlanned":6,"teamChanges":1,"avgUsefulness":3,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-24T17:16:28Z","verified":4,"blocked":0,"rework":1,"reworkReverted":0,"newlyPlanned":3,"teamChanges":1,"avgUsefulness":4,"minUsefulness":4,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-24T20:18:25Z","verified":8,"blocked":0,"rework":1,"reworkReverted":0,"newlyPlanned":7,"teamChanges":0,"avgUsefulness":4,"minUsefulness":4,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-25T02:18:30Z","verified":8,"blocked":0,"rework":2,"reworkReverted":0,"newlyPlanned":9,"teamChanges":1,"avgUsefulness":3.25,"minUsefulness":2,"humanGated":4,"endReason":"iters"}
-{"ts":"2026-06-25T08:02:04Z","verified":8,"blocked":0,"rework":2,"reworkReverted":1,"newlyPlanned":9,"teamChanges":1,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-25T13:21:35Z","verified":8,"blocked":0,"rework":1,"reworkReverted":0,"newlyPlanned":6,"teamChanges":0,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-25T20:02:12Z","verified":7,"blocked":1,"rework":3,"reworkReverted":0,"newlyPlanned":9,"teamChanges":1,"avgUsefulness":4,"minUsefulness":4,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-26T01:01:34Z","verified":8,"blocked":0,"blockedReasons":"","rework":1,"reworkReverted":0,"newlyPlanned":6,"teamChanges":0,"avgUsefulness":3.88,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-26T06:12:11Z","verified":8,"blocked":0,"blockedReasons":"","rework":1,"reworkReverted":0,"newlyPlanned":8,"teamChanges":1,"avgUsefulness":3.63,"minUsefulness":2,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-26T13:57:52Z","verified":8,"blocked":0,"blockedReasons":"","rework":5,"reworkReverted":0,"newlyPlanned":6,"teamChanges":1,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-06-26T19:24:52Z","verified":4,"blocked":0,"blockedReasons":"","rework":4,"reworkReverted":0,"newlyPlanned":3,"teamChanges":2,"avgUsefulness":2.5,"minUsefulness":2,"humanGated":3,"endReason":"frontier"}
-{"ts":"2026-07-01T07:24:30Z","verified":8,"blocked":0,"blockedReasons":"","rework":5,"reworkReverted":2,"newlyPlanned":8,"teamChanges":0,"avgUsefulness":3.38,"minUsefulness":2,"panelSize":5,"humanGated":3,"endReason":"iters"}
-{"ts":"2026-07-02T08:25:29Z","verified":8,"blocked":0,"blockedReasons":"","rework":3,"reworkReverted":1,"newlyPlanned":3,"teamChanges":1,"avgUsefulness":3.88,"minUsefulness":3,"panelSize":5,"humanGated":3,"endReason":"iters","fableFirstShots":8,"fableFirstShotVerified":8}
-{"ts":"2026-07-02T18:51:39Z","verified":8,"blocked":0,"blockedReasons":"","rework":4,"reworkReverted":0,"newlyPlanned":9,"teamChanges":2,"avgUsefulness":4.13,"minUsefulness":4,"panelSize":5,"humanGated":3,"endReason":"iters","fableFirstShots":8,"fableFirstShotVerified":8}

package/docs/MORNING.md

@@ -1,204 +0,0 @@
-# verifyhash — Morning Report
-
-_Generated 2026-07-02T18:51Z (UTC). Snapshot of the latest autonomous loop run. Read STRATEGY.md for the *why*._
-
-## At a glance
-
-| verified | blocked | rework | rework reverted | newly planned | team changes | avg usefulness | min usefulness | panel | human-gated |
-|---------:|--------:|-------:|----------------:|--------------:|-------------:|---------------:|---------------:|------:|------------:|
-| 8 | 0 | 4 | 0 | 9 | 2 | 4.13 | 4 | 5 | 3 |
-
-The headline: **the loop stopped building more product mechanism and spent the whole run on the funnel and
-one genuinely new vertical.** The `qualityStall` flag fired again (avg window `3.63→3.75→2.5→3.38→3.88`)
-and `humanGated` has been pinned at **3** for ~20 runs, so the Strategist pivoted the build target off
-"9th primitive" and onto three things a stuck go-to-market actually runs through: a **zero-install,
-in-browser Evidence verifier** (EPIC-66), a **drift-guarded one-command release packet for the live
-verifyhash.com** (EPIC-67), and a **brand-new income vertical, AGENTTRACE** (EPIC-68), built entirely by
-re-purposing the shipped-but-dormant RFC-6962 Merkle-log core rather than inventing new crypto. Eight
-tasks verified, zero blocked. Usefulness recovered strongly to **avg 4.13 / min 4** (per-task
-4,5,4,4,4,4,4,4) — the best recent run. End reason: `iters` (hit the iteration cap). No pushes, no deploys.
-The gated FABLE-5 first-shot trial again went **8/8** (`fableFirstShots:8`, `fableFirstShotVerified:8`).
-
-## What got built / committed this run
-
-Run commit window: everything after `42a0626` (the previous run's `chore(run)` record) up to HEAD
-(`71354b8`). Eight verified tasks across three epics.
-
-### EPIC-66 — link-shaped first contact for the EVIDENCE vertical (the funnel, half 1)
-
-Closes the asymmetry where the FIRST commercial target (Evidence, per P-8) still needed Node in its first
-60 seconds while TrustLedger already had a zero-install browser app.
-
-- **T-66.1 (VERIFIED)** — Gave the verifier an **in-memory file-source seam with zero behavior change**:
-  a pure `verifyArtifactFromBytes({...})` entry so the same verify cores that read packets from disk now
-  verify from caller-supplied bytes (`{relPath: Uint8Array}`), no `fs`/`path`/`os`/`process` reachable on
-  that path, missing/extra/mismatch/wrong-vendor/tampered-sig verdicts derived from the map. Existing CLI
-  disk path stays byte-identical; every existing verifier test passes unedited.
-- **T-66.2 (VERIFIED)** — Emitted the deterministic single-file **`verifier/dist/verify-vh-standalone.html`
-  with the 60-second challenge built in** (new `verifier/build-standalone-html.js`, mirroring the proven
-  byte-stable bundler discipline). Drag-and-drop a `*.vhevidence.json` + files → same verdict + per-file
-  tamper localization the CLI prints; a "load the sample" click → ACCEPT; edit one demo byte in-page →
-  REJECT naming the file; the honest boundary is visible on the page. **No-network enforced**: the emitted
-  file contains none of `fetch`/`XMLHttpRequest`/`WebSocket`/`EventSource`/`sendBeacon`/dynamic `import(`.
-  Two builds byte-identical; committed dist `--check`-pinned; a `vm`-evaluated engine block asserts verdicts
-  byte-identical to the in-tree T-66.1 path.
-- **T-66.3 (VERIFIED)** — Wired the link-shaped path into the funnel honestly: a "No Node? Do it in your
-  browser" path at the top of `challenge/README.md`, pointers from ADOPT/PILOT/INDEPENDENT-VERIFICATION/
-  verifier READMEs, and a docs-rot test pinning the flow + grepping that **no P-3…P-9 human step was
-  deleted or relaxed** (STRATEGY.md left untouched — it sits near its byte budget and `docs/DECIDE.md` is
-  generated from P-8).
-
-### EPIC-67 — make the live verifyhash.com refresh one-command + drift-guarded (the funnel, half 2)
-
-verifyhash.com is the project's ONLY deployed outward asset and was invisible to the repo (webroot
-gitignored, landing page unversioned, live site known to have drifted from the build).
-
-- **T-67.1 (VERIFIED)** — Shipped the deterministic **site-release assembler** (`scripts/site-release.js`,
-  node-core only, never writes outside the repo) + a tracked, schema-validated **allowlist publish set**
-  (`site/publish-set.json`), brought the landing page under version control (`site/index.html`), snapshotted
-  what was actually deployed on 2026-06-26 (`site/DEPLOYED.json`, the drift baseline), and committed a
-  byte-pinned `RELEASE-MANIFEST.json`. Allowlist-only assembly makes the runbook's "must NEVER be served"
-  rule **structural**.
-- **T-67.2 (VERIFIED)** — Made **drift visible and the refresh decision-ready**: `--diff` prints a per-file
-  ADDED/CHANGED/REMOVED/UNCHANGED table + a one-line staleness verdict (exit 0 either way — staleness is a
-  human signal, not a CI failure; exit 3 only on a malformed snapshot), `--mark-deployed` closes the loop
-  after upload, and a standing test pins the SIGNAL chain (any later `verifier/dist`/docs/landing change
-  without a re-release turns the suite RED) while a stale `DEPLOYED.json` never fails the suite. Boundary
-  stated verbatim: the loop assembles + diffs INSIDE the repo only; uploading is the human-owned **P-11** step.
-
-### EPIC-68 — AGENTTRACE: a NEW income vertical on shipped primitives (`vh agent`)
-
-Tamper-evident, selectively-disclosable, independently-verifiable **AI-agent session records**
-(`*.vhagent.json`) — for the 2026 record-keeping / audit / incident-forensics buyer (EU AI Act
-Art. 12/19/26) that observability tracing (operator-editable after the fact) does not serve. The
-resume-adding criterion's "genuinely new unsaturated axis" clause is met (`grep -in agent BACKLOG.md` →
-zero prior work). **Zero new primitives or crypto**: its load-bearing engine is the shipped-but-dormant
-ordered RFC-6962 Merkle-log core (`cli/journal-log.js`, T-63.1) — this either makes that asset pay or it
-stays parked.
-
-- **T-68.1 (VERIFIED)** — Pure `cli/core/agent-session.js` (no `fs`/network/key/clock, no new dependency):
-  canonical closed-set event schema with strict named rejects; **the redaction-safe leaf** — a full event
-  and its redacted twin (payload replaced by its keccak commitment) derive the **byte-identical leaf**, so
-  redacting any subset changes neither leaves nor root; `sessionHead` via `treeHead` reused verbatim
-  (position-bound, no sorting); single-event inclusion proofs + `verifyGrowth` append-only consistency
-  between a mid-session checkpoint and the final head.
-- **T-68.2 (VERIFIED)** — The `vh agent` CLI surface (`seal`/`verify`/`redact`/`prove`/`verify-proof`/
-  `checkpoint`/`verify-growth`). `--sign` reuses the SAME attestation envelope + fail-closed `license.js`
-  gate as `vh evidence seal`, keyed to a new **DRAFT `agent_signed` capability** (no price set — pricing
-  stays P-7). Unsigned seal/verify/prove/redact are FREE; REJECT names the first offending event `seq`.
-  **No new needs-human step** — the human's one existing go-live flip sells this vertical in the same motion.
-- **T-68.3 (VERIFIED)** — Independent + zero-install verification: added `verifyAgentSeal` to the verifier's
-  auto-detection on BOTH the disk path and the in-memory T-66.1 path (deep-equal verdicts), re-derived from
-  the verifier's OWN dependency-free libs (no import from `cli/`), inlined a demo agent session (one redacted
-  `tool_call`), and rebuilt the committed standalone JS+HTML bundles so the same emailed/linked page also
-  verifies a dropped `*.vhagent.json` (demo → ACCEPT, one-byte in-page tamper → REJECT naming the seq).
-
-**Rework** fired on **4** tasks this run; **0 reverted** — all 8 still landed VERIFIED. The one remaining
-EPIC-68 child, **T-68.4** (docs/AGENTTRACE.md + a real transcript-mapping example + docs-rot test), is
-`TODO` on the frontier.
-
-## Usefulness — read the shape, not just the average
-
-Avg **4.13** / min **4** (per-task 4,5,4,4,4,4,4,4) — the strongest recent run and a clear lift off the
-~3.6 plateau. The single 5 went to the genuinely novel AGENTTRACE work; the two orbit-shaped tasks
-(T-66.3 funnel-link, T-67.2 site-drift) scored a borderline-but-defensible 4 (both widen the free→paid
-funnel / add byte-pinned release discipline). The Manager read the two 4s as run noise, not a trend.
-
-## Decisions made
-
-- **Pivot the build target off "more product mechanism" and onto the funnel (Strategist notes (m)/(n)).**
-  `qualityStall` fired again and `humanGated` has been stuck at 3 for ~20 runs, so the loop refused to add a
-  9th primitive and instead built the distribution shape the stuck P-8 ask runs through (EPIC-66/67) plus a
-  new vertical that re-purposes a dormant asset (EPIC-68).
-- **Open the new vertical by RE-PURPOSING, not inventing.** AGENTTRACE is the first product whose engine is
-  the shipped RFC-6962 log core (T-63.1) — file-SET seals structurally cannot express an ordered,
-  grow-over-time, redactable session. **EPIC-64 (witness/equivocation) stays PARKED; the primitive freeze
-  and resume-adding criterion remain in force.**
-- **Strictly additive + in-guardrails.** No new dependency, no new crypto, free verify surface only (paid
-  `--sign` reuses the existing fail-closed license gate), no new `needs-human` item, and the honest boundary
-  carried in-band from day one: a packet proves the log was NOT altered after sealing and what any disclosed
-  event said — NOT that the log faithfully records what the agent did (garbage-in), NOT a trusted timestamp
-  without P-3.
-
-## Work invented (newly planned: 9)
-
-Nine new tasks across the three new epics: EPIC-66 (T-66.1/.2/.3), EPIC-67 (T-67.1/.2), and EPIC-68
-(T-68.1/.2/.3/.4). Eight shipped and verified this same run; **T-68.4** (AGENTTRACE docs + a real
-transcript-mapping example) remains on the frontier as the single open item.
-
-## Team changes (2)
-
-**Manager MODIFIED two things — no panel growth (stays 5 reviewers + 5 builder profiles).** The new
-AGENTTRACE surface introduced three novel make-or-break properties with no standing owner
-(redaction-safe-leaf equivalence, redaction-as-withholding privacy, append-only-growth soundness):
-
-1. **MODIFIED reviewer TrustIntegrity** — appended a tight 7-pillar AGENTTRACE clause onto its existing
-   seal / Merkle-root re-derivation competency (redaction-safe leaf; redaction truly drops payload bytes;
-   `verifyGrowth` rejects rewritten history; signature-wraps-head + fail-closed `agent_signed` gate with the
-   free tier open; order/determinism + strict named rejects; honest boundary; verbatim reuse of
-   `journal-log`/`hash`/`attestation`).
-2. **MODIFIED the falsepass persona** — added agent-session redaction/growth false-PASSes to its explicit
-   hunting list.
-
-Rationale: TrustIntegrity is the natural owner (already owns seal/root re-derivation), so the Manager closed
-the gap at **zero panel growth** rather than adding a 6th reviewer at the working size of 5. A false-PASS in
-agent redaction (a leaked withheld payload) or in `verifyGrowth` (an accepted rewritten history) is a silent
-evidentiary make-or-break defect no standing lens would have caught.
-
-## What's blocked
-
-Nothing is software-blocked (`blocked: 0`). The standing constraint is human, not technical: **3 human-gated
-items** (unchanged for ~20 runs). Both verticals (Evidence + TrustLedger), the new AGENTTRACE vertical, the
-embeddable SDK, the HTTP verify-service, the integrity/transparency journal, and now the zero-install browser
-Evidence verifier are all built and locally tested. The dam is purely commercial/relational.
-
-## Needs-human (from STRATEGY.md)
-
-- **P-8 — CONSOLIDATED GO-TO-MARKET ASK: land ONE design partner and run the pilot.** The single human action
-  that de-risks P-3, P-5, P-6, and P-7 at once, and this run made its first-contact step **cheaper**: the
-  60-second cold-prospect challenge is now a single browser link (`verify-vh-standalone.html`), no Node. The
-  loop has BUILT and locally TESTED the entire deliverable (an offline, ephemeral-key pilot kit); identifying
-  a partner, provisioning a real vendor key, setting a price, and running the pilot are human actions that
-  MUST NOT be auto-executed. The one-screen version lives in [`docs/DECIDE.md`](DECIDE.md):
-  1. **Pick the lighter-gated vertical FIRST: EVIDENCE (P-7), not TrustLedger (P-5)** — no CPA/legal/per-state
-     liability layer; only a vendor key, a price, and one partner.
-  2. **One concrete first target this week:** an incident-response / digital-forensics team OR an
-     e-discovery / audit-workpaper shop — buyers for whom "this is the exact file set, byte-for-byte
-     unaltered, and here is who produced it" is contractually expensive.
-  3. **3-step first contact (no slide deck):** (a) `vh identity publish` once the vendor key exists; (b) hand
-     them the zero-install cold-prospect challenge; (c) if they lean in, run
-     `node pilot/run-pilot.js --certificate <path>` on THEIR own folder → a forwardable
-     `*.vhevidence.json` their security team verifies independently.
-  4. **Time box:** 3–5 prospects over ~2 weeks. Success = ONE who keeps using the free verify/challenge
-     weekly OR agrees to a paid pilot. Zero after the box → the signal is "wrong buyer archetype" →
-     switch to the TrustLedger broker channel, NOT "build more product."
-- **P-11 — REFRESH the live verifyhash.com publish set (~10-min recurring, deploy-gated).** The live site
-  serves stale pinned bytes; EPIC-67 makes the drift mechanical. The refresh now collapses to: (1)
-  `node scripts/site-release.js --diff` (read what the live site is missing); (2) `node scripts/site-release.js`
-  then upload `public/` per the REPLACE-mode runbook; (3) `--mark-deployed` + commit so the next `--diff` is
-  truthful. The loop NEVER uploads or touches `/var/www` — the upload is human-owned. As soon as this lands,
-  the site becomes the 60-second in-browser tamper challenge P-8's first contact can send as ONE link.
-- **P-9 — Embeddable SDK distribution + pricing.** The `verifyhash` library surface (signed + unsigned verify)
-  is built and contract-pinned; publishing to a registry and pricing the embed/usage stay human steps.
-- **P-10 — Transparency-log distribution (materially LOWER-gated than the pilot).** A public-good append-only
-  log + paid enterprise witness/monitor SLAs. Note: the enterprise witness/equivocation tier (EPIC-64) is
-  currently **PARKED** pending real demand, so P-10's paid tier is on hold until a customer pulls it.
-- P-1..P-7 unchanged (D-2 token framing, mainnet deploy, DataLedger trust-root, and the per-product
-  go-to-market gates); AGENTTRACE's paid `--sign` sells under the SAME existing P-7 key/price/partner steps —
-  it adds no new gate.
-
-**Revenue integrity (unchanged):** income is a subscription / license / meter for delivered software value;
-the license is an ACCESS credential, NOT a token/coin/NFT, not tradeable, not an appreciating asset. The
-loop ships only the mechanism + ephemeral test keys and must NEVER provision a real key, set a price, contact
-a prospect, host, take payment, or run the pilot itself.
-
-## The honest read
-
-Disciplined run. With its own panel flagging a quality stall and the go-to-market dam stuck for ~20 runs, the
-loop did the two highest-leverage non-product things available: it made its first-contact funnel a
-send-one-link browser page (removing the Node install from the Evidence pitch), and it made the one deployed
-asset — verifyhash.com — mechanically know when it's stale. Then it opened a genuinely new buyer (AI-agent
-audit/compliance) without inventing anything, by finally putting the dormant Merkle-log core to work. The
-single highest-leverage HUMAN move is unchanged and now cheaper: **pick one Evidence design partner and send
-them the browser challenge this week (`docs/DECIDE.md`), and re-deploy verifyhash.com so that link is live
-(`P-11`).**