verifyhash 0.1.0

package/docs/LOOP-HARDENING-PLAN.md

@@ -0,0 +1,44 @@
+# Loop-hardening batch 2 — engine patches (apply at the next park point)
+
+Source: `docs/LOOP-AUDIT-2026-07-03.json` (7-reviewer audit). Batch 1 (gates, launch chokepoint,
+runbook, decision sheet, adoption signal) shipped as commit `1272ffe`. Batch 2 edits
+`build-loop.workflow.js` and MUST be applied only when no run is active (a live run's Architect can
+swap the engine file and clobber edits). Re-gate with `node scripts/pre-run-gate.cjs` after applying.
+
+Ordered by priority:
+
+1. **Mechanical test gate (verification P1).** Add a per-task `test-runner` agent (haiku, effort low):
+   sole job = run TEST_CMD, return `{exitCode, passing, failing, tail}` via schema. The DRIVER then
+   requires `verdict.pass && verdict.testsPass && runner.exitCode === 0` to commit. Add a
+   validate-driver invariant pinning the `runner.exitCode === 0` conjunct in executable code. This makes
+   suite-green a mechanical fact, not an LLM claim, and lets the Verifier skip re-running the full suite
+   itself (its job becomes acceptance-criteria judgment + targeted probes) — likely net CHEAPER.
+2. **Panel width by blast radius (economics P1).** Default 3 reviewers; full panel only when
+   `build.filesChanged` touches `contracts/`, `cli/core/`, `verifier/`, `trustledger/`, or the engine.
+   Keep the dissenter-only re-score.
+3. **Per-run spend cap (economics P1).** In the main loop: break with `endReason:'run-cap'` when
+   `budget.spent() > RUN_CAP_TOKENS` (start 8M; tune from ledger). Bounds run MAGNITUDE, which the 2h
+   cooldown does not.
+4. **Dissent preservation (verification P2).** Trigger the rework path when ANY reviewer scores <=2,
+   not only when the median <=3. minUsefulness already lands in METRICS.
+5. **Single telemetry read (engine P2).** Preflight agent returns the METRICS tail + computed
+   qualityStall in its schema; the driver injects both into strategist/manager/architect prompts.
+   Kills 3 duplicate file-reads + two prose re-derivations of the same arithmetic per run.
+6. **Reporter -> haiku (engine P1, cheap now; true driver-write when the harness exposes file I/O).**
+   Its job is a verbatim append of a driver-computed line + a short MORNING.md.
+7. **Adoption-aware Strategist (strategy P0).** Strategist prompt reads `docs/ADOPTION.json`:
+   while all adoption numbers are zero — NO new verticals/epics; only distribution tasks (npm publish
+   prep, funnel, pilot materials), hardening tasks (this plan), or `newTasks: []` (explicitly a
+   rewarded outcome, not a failure). Reviewer prompts: novelty with zero adoption scores LOW.
+8. **Preflight self-heal (verification P2).** Preflight runs `scripts/archive-direction.cjs` + fixture
+   refresh BEFORE any build, so a Strategist append can never redden the suite mid-run
+   (STRATEGY.md sits ~500 bytes from the size-guard cliff).
+9. **Prompt dedup (engine P3).** qualityStall guidance collapsed to one sentence; VISION trimmed to the
+   guardrails agents act on.
+10. **Agent timeout probe (engine P1).** Test whether `setTimeout` exists in the workflow sandbox; if
+    yes, wrap agent() calls in a deadline race (timeout == failed attempt, same path as a throw). If
+    not available, document the limitation here and rely on the run-cap.
+
+Also at the same park point (non-engine): add the corresponding BACKLOG epic so the loop continues the
+remainder itself (checkpointing/partial-run METRICS, engine-writes-own-ledger-row when file I/O exists,
+prev.js archive rotation), and launch the next run with `args: {maxTasks: 4}` while adoption is zero.

package/docs/MERKLE-LEAVES.md

@@ -0,0 +1,113 @@
+# What the verifyhash directory root commits to
+
+This is the canonical spec for how `vh hash <dir>` / `hashDir()` (cli/hash.js) build a directory's
+Merkle root and exactly what that root proves. It is the reference for T-0.1 (domain separation)
+and T-0.2 (path binding).
+
+## TL;DR
+
+The directory root commits to the **full set of `(relative-path, content)` pairs** in the tree —
+both the file **names/locations** and the file **bytes**. Two directories produce the same root
+**iff** they contain the identical set of files, at the identical relative paths, with identical
+content. Therefore:
+
+- editing a single byte of any file changes the root (content binding),
+- **renaming** a file (same bytes, new name) changes the root (path binding),
+- **moving** a file to another directory (same bytes, new relPath) changes the root,
+- adding or removing a file changes the root,
+- the root does **not** depend on filesystem enumeration order or on the host OS path separator.
+
+## Leaf construction (two layers)
+
+Each file `F` at relative path `relPath` with bytes `B` produces a tree leaf in two stages.
+
+1. **Content digest** — the bare keccak256 of the file's bytes (this is also what `vh hash <file>`
+   prints and what `anchor()` stores for a single file):
+
+   ```
+   c = keccak256(B)
+   ```
+
+2. **Path-bound leaf** (T-0.2) — bind the relative path into the leaf so the root commits to names:
+
+   ```
+   pathLeaf = keccak256( DIR_LEAF_DOMAIN ‖ relPath ‖ 0x00 ‖ c )
+   ```
+
+   - `DIR_LEAF_DOMAIN = keccak256("verifyhash/dir-leaf/v1")` is a fixed 32-byte `domainPrefix`. It
+     isolates a directory leaf in its own value space so it can never collide with a bare content
+     digest, a single-file anchor, or a leaf from a future scheme. Bump the `v1` suffix if the
+     encoding ever changes, to keep old and new roots disjoint.
+   - `relPath` is normalized to forward slashes (POSIX), so a repo hashed on Windows and on Linux
+     yields the same root.
+   - The single `0x00` separator sits between the variable-length `relPath` and the fixed-length
+     32-byte `c`. Because `c` is always exactly 32 bytes, there is exactly one way to split any
+     `pathLeaf` preimage back into `(relPath, c)` — two different `(relPath, content)` pairs can
+     never alias to the same leaf via boundary ambiguity.
+
+`pathLeaf` is the value the on-chain `verifyLeaf(root, contentHash, proof)` is handed as its
+`contentHash` argument (NOT the bare digest `c`).
+
+3. **Domain-tagged tree leaf** (T-0.1) — `verifyLeaf` then re-tags `pathLeaf` with the leaf domain
+   tag to form the actual bottom-of-tree value, keeping leaves and interior nodes in disjoint value
+   spaces (second-preimage resistance):
+
+   ```
+   treeLeaf  = keccak256( LEAF_TAG ‖ pathLeaf )            // LEAF_TAG = 0x00
+   nodeHash(a,b) = keccak256( NODE_TAG ‖ min(a,b) ‖ max(a,b) )   // NODE_TAG = 0x01, sorted pair
+   ```
+
+The CLI and the contract use byte-identical conventions, so a root produced by `vh hash <dir>` is
+exactly the root `verifyLeaf` reconstructs from a `pathLeaf` + Merkle proof. The contract did not
+change for T-0.2: path binding lives entirely in the value the CLI feeds to `verifyLeaf`.
+
+## Tree shape
+
+Leaves are **sorted by their `pathLeaf` value** before the tree is built, so the root is
+independent of enumeration/creation order. Odd (lone) nodes are paired with themselves
+(`nodeHash(node, node)`) rather than promoted, giving every leaf a full-depth proof.
+
+## Which files become leaves: filesystem walk vs. `--git`
+
+The leaf/tree formulas above are unchanged regardless of how the file SET is chosen — `--git` reuses
+the identical `pathLeaf` / `leafHash` / `nodeHash` convention. Only the enumeration differs:
+
+- **`vh hash <dir>` (default)** walks the filesystem and makes a leaf for every regular file it finds,
+  including untracked files (`node_modules/`, `.env`, build artifacts, editor scratch). The root then
+  depends on whatever happens to be in the work tree.
+- **`vh hash <dir> --git [--ref <ref>]`** makes a leaf for EXACTLY the files git tracks at that commit
+  (`git ls-tree -r`, default `HEAD`), reading each file's bytes from the work tree. Untracked files
+  are ignored, so the root is reproducible across clones of the same commit. The git path is the
+  `relPath` bound into each leaf, so renaming a tracked file still changes the root. See
+  `cli/git.js` (`repoRoot` / `resolveCommit` / `listTrackedFiles`) and `test/cli.hash.git.test.js`.
+
+Because `--git` only changes which files become leaves (never how a leaf is hashed), every caveat in
+[`docs/TRUST-BOUNDARIES.md`](TRUST-BOUNDARIES.md) still applies verbatim: the on-chain record attests
+only to the resulting `contentHash`/root, and the receipt's `git` provenance (commit + scope) is an
+**untrusted hint** that records *how* the tracked set was enumerated, never a second proof (see
+[`docs/RECEIPTS.md`](RECEIPTS.md)).
+
+## What the root does NOT commit to
+
+- File mode/permissions, mtimes, or other filesystem metadata (only path + bytes).
+- Empty directories (only files become leaves).
+- Symlinks / sockets / fifos are skipped (they have no stable content hash).
+
+## Consequences for `vh prove`
+
+`vh prove <file> --root <dir>` builds the file's `pathLeaf` and Merkle proof. The proof binds the
+file to **its location** in the repo: the same bytes at a different path produce a different leaf and
+do not verify. A renamed or moved file's old proof no longer folds to the new root.
+
+## Tests
+
+See `test/cli.hash.test.js`:
+- "RENAMING a file changes the root …" and "MOVING a file …" prove path binding,
+- "a renamed file's OLD proof no longer verifies on-chain against the new root" proves it end to end
+  against the deployed `ContributionRegistry.verifyLeaf`,
+- "pathLeaf matches the explicit keccak256(domain ‖ relPath ‖ 0x00 ‖ content) formula" pins the
+  encoding.
+
+
+---
+<sub>© 2026 verifyhash.com · Licensed under Apache-2.0 (SPDX-License-Identifier: Apache-2.0) — see the [LICENSE](https://verifyhash.com/LICENSE) and [NOTICE](https://verifyhash.com/NOTICE) served with this file.</sub>

package/docs/METRICS.jsonl

@@ -0,0 +1,31 @@
+{"ts":"2026-06-23T07:10:34Z","verified":4,"blocked":0,"rework":0,"newlyPlanned":4,"teamChanges":1}
+{"ts":"2026-06-23T08:24:31Z","verified":4,"blocked":0,"rework":1,"newlyPlanned":3,"teamChanges":1}
+{"ts":"2026-06-23T09:46:00Z","verified":4,"blocked":0,"rework":0,"newlyPlanned":3,"teamChanges":0,"avgUsefulness":4.5,"minUsefulness":4}
+{"ts":"2026-06-23T12:19:33Z","verified":4,"blocked":0,"rework":0,"newlyPlanned":5,"teamChanges":1,"avgUsefulness":4,"minUsefulness":4}
+{"ts":"2026-06-23T14:04:21Z","verified":4,"blocked":0,"rework":1,"newlyPlanned":3,"teamChanges":0,"avgUsefulness":3.75,"minUsefulness":3}
+{"ts":"2026-06-23T18:23:33Z","verified":4,"blocked":0,"rework":1,"newlyPlanned":0,"teamChanges":1,"avgUsefulness":4.25,"minUsefulness":4,"humanGated":3}
+{"ts":"2026-06-23T19:32:12Z","verified":4,"blocked":0,"rework":2,"newlyPlanned":6,"teamChanges":0,"avgUsefulness":4,"minUsefulness":4,"humanGated":3}
+{"ts":"2026-06-23T20:26:43Z","verified":4,"blocked":0,"rework":0,"newlyPlanned":3,"teamChanges":0,"avgUsefulness":4,"minUsefulness":4,"humanGated":3}
+{"ts":"2026-06-23T21:28:20Z","verified":4,"blocked":0,"rework":1,"newlyPlanned":3,"teamChanges":0,"avgUsefulness":4,"minUsefulness":4,"humanGated":4}
+{"ts":"2026-06-23T22:40:52Z","verified":4,"blocked":0,"rework":0,"reworkReverted":0,"newlyPlanned":6,"teamChanges":1,"avgUsefulness":4,"minUsefulness":4,"humanGated":3}
+{"ts":"2026-06-24T01:13:54Z","verified":4,"blocked":0,"rework":0,"reworkReverted":0,"newlyPlanned":2,"teamChanges":0,"avgUsefulness":4,"minUsefulness":4,"humanGated":4,"endReason":"iters"}
+{"ts":"2026-06-24T02:36:25Z","verified":4,"blocked":0,"rework":3,"reworkReverted":0,"newlyPlanned":0,"teamChanges":3,"avgUsefulness":4,"minUsefulness":4,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-24T03:54:45Z","verified":4,"blocked":0,"rework":1,"reworkReverted":0,"newlyPlanned":6,"teamChanges":0,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-24T05:13:13Z","verified":4,"blocked":0,"rework":1,"reworkReverted":0,"newlyPlanned":4,"teamChanges":0,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-24T07:23:34Z","verified":4,"blocked":0,"rework":3,"reworkReverted":0,"newlyPlanned":3,"teamChanges":2,"avgUsefulness":3.5,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-24T08:37:00Z","verified":4,"blocked":0,"rework":2,"reworkReverted":0,"newlyPlanned":0,"teamChanges":2,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-24T12:33:58Z","verified":4,"blocked":0,"rework":2,"reworkReverted":0,"newlyPlanned":6,"teamChanges":2,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":5,"endReason":"iters"}
+{"ts":"2026-06-24T15:43:39Z","verified":4,"blocked":0,"rework":0,"reworkReverted":0,"newlyPlanned":6,"teamChanges":1,"avgUsefulness":3,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-24T17:16:28Z","verified":4,"blocked":0,"rework":1,"reworkReverted":0,"newlyPlanned":3,"teamChanges":1,"avgUsefulness":4,"minUsefulness":4,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-24T20:18:25Z","verified":8,"blocked":0,"rework":1,"reworkReverted":0,"newlyPlanned":7,"teamChanges":0,"avgUsefulness":4,"minUsefulness":4,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-25T02:18:30Z","verified":8,"blocked":0,"rework":2,"reworkReverted":0,"newlyPlanned":9,"teamChanges":1,"avgUsefulness":3.25,"minUsefulness":2,"humanGated":4,"endReason":"iters"}
+{"ts":"2026-06-25T08:02:04Z","verified":8,"blocked":0,"rework":2,"reworkReverted":1,"newlyPlanned":9,"teamChanges":1,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-25T13:21:35Z","verified":8,"blocked":0,"rework":1,"reworkReverted":0,"newlyPlanned":6,"teamChanges":0,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-25T20:02:12Z","verified":7,"blocked":1,"rework":3,"reworkReverted":0,"newlyPlanned":9,"teamChanges":1,"avgUsefulness":4,"minUsefulness":4,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-26T01:01:34Z","verified":8,"blocked":0,"blockedReasons":"","rework":1,"reworkReverted":0,"newlyPlanned":6,"teamChanges":0,"avgUsefulness":3.88,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-26T06:12:11Z","verified":8,"blocked":0,"blockedReasons":"","rework":1,"reworkReverted":0,"newlyPlanned":8,"teamChanges":1,"avgUsefulness":3.63,"minUsefulness":2,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-26T13:57:52Z","verified":8,"blocked":0,"blockedReasons":"","rework":5,"reworkReverted":0,"newlyPlanned":6,"teamChanges":1,"avgUsefulness":3.75,"minUsefulness":3,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-06-26T19:24:52Z","verified":4,"blocked":0,"blockedReasons":"","rework":4,"reworkReverted":0,"newlyPlanned":3,"teamChanges":2,"avgUsefulness":2.5,"minUsefulness":2,"humanGated":3,"endReason":"frontier"}
+{"ts":"2026-07-01T07:24:30Z","verified":8,"blocked":0,"blockedReasons":"","rework":5,"reworkReverted":2,"newlyPlanned":8,"teamChanges":0,"avgUsefulness":3.38,"minUsefulness":2,"panelSize":5,"humanGated":3,"endReason":"iters"}
+{"ts":"2026-07-02T08:25:29Z","verified":8,"blocked":0,"blockedReasons":"","rework":3,"reworkReverted":1,"newlyPlanned":3,"teamChanges":1,"avgUsefulness":3.88,"minUsefulness":3,"panelSize":5,"humanGated":3,"endReason":"iters","fableFirstShots":8,"fableFirstShotVerified":8}
+{"ts":"2026-07-02T18:51:39Z","verified":8,"blocked":0,"blockedReasons":"","rework":4,"reworkReverted":0,"newlyPlanned":9,"teamChanges":2,"avgUsefulness":4.13,"minUsefulness":4,"panelSize":5,"humanGated":3,"endReason":"iters","fableFirstShots":8,"fableFirstShotVerified":8}

package/docs/MORNING.md

@@ -0,0 +1,204 @@
+# verifyhash — Morning Report
+
+_Generated 2026-07-02T18:51Z (UTC). Snapshot of the latest autonomous loop run. Read STRATEGY.md for the *why*._
+
+## At a glance
+
+| verified | blocked | rework | rework reverted | newly planned | team changes | avg usefulness | min usefulness | panel | human-gated |
+|---------:|--------:|-------:|----------------:|--------------:|-------------:|---------------:|---------------:|------:|------------:|
+| 8 | 0 | 4 | 0 | 9 | 2 | 4.13 | 4 | 5 | 3 |
+
+The headline: **the loop stopped building more product mechanism and spent the whole run on the funnel and
+one genuinely new vertical.** The `qualityStall` flag fired again (avg window `3.63→3.75→2.5→3.38→3.88`)
+and `humanGated` has been pinned at **3** for ~20 runs, so the Strategist pivoted the build target off
+"9th primitive" and onto three things a stuck go-to-market actually runs through: a **zero-install,
+in-browser Evidence verifier** (EPIC-66), a **drift-guarded one-command release packet for the live
+verifyhash.com** (EPIC-67), and a **brand-new income vertical, AGENTTRACE** (EPIC-68), built entirely by
+re-purposing the shipped-but-dormant RFC-6962 Merkle-log core rather than inventing new crypto. Eight
+tasks verified, zero blocked. Usefulness recovered strongly to **avg 4.13 / min 4** (per-task
+4,5,4,4,4,4,4,4) — the best recent run. End reason: `iters` (hit the iteration cap). No pushes, no deploys.
+The gated FABLE-5 first-shot trial again went **8/8** (`fableFirstShots:8`, `fableFirstShotVerified:8`).
+
+## What got built / committed this run
+
+Run commit window: everything after `42a0626` (the previous run's `chore(run)` record) up to HEAD
+(`71354b8`). Eight verified tasks across three epics.
+
+### EPIC-66 — link-shaped first contact for the EVIDENCE vertical (the funnel, half 1)
+
+Closes the asymmetry where the FIRST commercial target (Evidence, per P-8) still needed Node in its first
+60 seconds while TrustLedger already had a zero-install browser app.
+
+- **T-66.1 (VERIFIED)** — Gave the verifier an **in-memory file-source seam with zero behavior change**:
+  a pure `verifyArtifactFromBytes({...})` entry so the same verify cores that read packets from disk now
+  verify from caller-supplied bytes (`{relPath: Uint8Array}`), no `fs`/`path`/`os`/`process` reachable on
+  that path, missing/extra/mismatch/wrong-vendor/tampered-sig verdicts derived from the map. Existing CLI
+  disk path stays byte-identical; every existing verifier test passes unedited.
+- **T-66.2 (VERIFIED)** — Emitted the deterministic single-file **`verifier/dist/verify-vh-standalone.html`
+  with the 60-second challenge built in** (new `verifier/build-standalone-html.js`, mirroring the proven
+  byte-stable bundler discipline). Drag-and-drop a `*.vhevidence.json` + files → same verdict + per-file
+  tamper localization the CLI prints; a "load the sample" click → ACCEPT; edit one demo byte in-page →
+  REJECT naming the file; the honest boundary is visible on the page. **No-network enforced**: the emitted
+  file contains none of `fetch`/`XMLHttpRequest`/`WebSocket`/`EventSource`/`sendBeacon`/dynamic `import(`.
+  Two builds byte-identical; committed dist `--check`-pinned; a `vm`-evaluated engine block asserts verdicts
+  byte-identical to the in-tree T-66.1 path.
+- **T-66.3 (VERIFIED)** — Wired the link-shaped path into the funnel honestly: a "No Node? Do it in your
+  browser" path at the top of `challenge/README.md`, pointers from ADOPT/PILOT/INDEPENDENT-VERIFICATION/
+  verifier READMEs, and a docs-rot test pinning the flow + grepping that **no P-3…P-9 human step was
+  deleted or relaxed** (STRATEGY.md left untouched — it sits near its byte budget and `docs/DECIDE.md` is
+  generated from P-8).
+
+### EPIC-67 — make the live verifyhash.com refresh one-command + drift-guarded (the funnel, half 2)
+
+verifyhash.com is the project's ONLY deployed outward asset and was invisible to the repo (webroot
+gitignored, landing page unversioned, live site known to have drifted from the build).
+
+- **T-67.1 (VERIFIED)** — Shipped the deterministic **site-release assembler** (`scripts/site-release.js`,
+  node-core only, never writes outside the repo) + a tracked, schema-validated **allowlist publish set**
+  (`site/publish-set.json`), brought the landing page under version control (`site/index.html`), snapshotted
+  what was actually deployed on 2026-06-26 (`site/DEPLOYED.json`, the drift baseline), and committed a
+  byte-pinned `RELEASE-MANIFEST.json`. Allowlist-only assembly makes the runbook's "must NEVER be served"
+  rule **structural**.
+- **T-67.2 (VERIFIED)** — Made **drift visible and the refresh decision-ready**: `--diff` prints a per-file
+  ADDED/CHANGED/REMOVED/UNCHANGED table + a one-line staleness verdict (exit 0 either way — staleness is a
+  human signal, not a CI failure; exit 3 only on a malformed snapshot), `--mark-deployed` closes the loop
+  after upload, and a standing test pins the SIGNAL chain (any later `verifier/dist`/docs/landing change
+  without a re-release turns the suite RED) while a stale `DEPLOYED.json` never fails the suite. Boundary
+  stated verbatim: the loop assembles + diffs INSIDE the repo only; uploading is the human-owned **P-11** step.
+
+### EPIC-68 — AGENTTRACE: a NEW income vertical on shipped primitives (`vh agent`)
+
+Tamper-evident, selectively-disclosable, independently-verifiable **AI-agent session records**
+(`*.vhagent.json`) — for the 2026 record-keeping / audit / incident-forensics buyer (EU AI Act
+Art. 12/19/26) that observability tracing (operator-editable after the fact) does not serve. The
+resume-adding criterion's "genuinely new unsaturated axis" clause is met (`grep -in agent BACKLOG.md` →
+zero prior work). **Zero new primitives or crypto**: its load-bearing engine is the shipped-but-dormant
+ordered RFC-6962 Merkle-log core (`cli/journal-log.js`, T-63.1) — this either makes that asset pay or it
+stays parked.
+
+- **T-68.1 (VERIFIED)** — Pure `cli/core/agent-session.js` (no `fs`/network/key/clock, no new dependency):
+  canonical closed-set event schema with strict named rejects; **the redaction-safe leaf** — a full event
+  and its redacted twin (payload replaced by its keccak commitment) derive the **byte-identical leaf**, so
+  redacting any subset changes neither leaves nor root; `sessionHead` via `treeHead` reused verbatim
+  (position-bound, no sorting); single-event inclusion proofs + `verifyGrowth` append-only consistency
+  between a mid-session checkpoint and the final head.
+- **T-68.2 (VERIFIED)** — The `vh agent` CLI surface (`seal`/`verify`/`redact`/`prove`/`verify-proof`/
+  `checkpoint`/`verify-growth`). `--sign` reuses the SAME attestation envelope + fail-closed `license.js`
+  gate as `vh evidence seal`, keyed to a new **DRAFT `agent_signed` capability** (no price set — pricing
+  stays P-7). Unsigned seal/verify/prove/redact are FREE; REJECT names the first offending event `seq`.
+  **No new needs-human step** — the human's one existing go-live flip sells this vertical in the same motion.
+- **T-68.3 (VERIFIED)** — Independent + zero-install verification: added `verifyAgentSeal` to the verifier's
+  auto-detection on BOTH the disk path and the in-memory T-66.1 path (deep-equal verdicts), re-derived from
+  the verifier's OWN dependency-free libs (no import from `cli/`), inlined a demo agent session (one redacted
+  `tool_call`), and rebuilt the committed standalone JS+HTML bundles so the same emailed/linked page also
+  verifies a dropped `*.vhagent.json` (demo → ACCEPT, one-byte in-page tamper → REJECT naming the seq).
+
+**Rework** fired on **4** tasks this run; **0 reverted** — all 8 still landed VERIFIED. The one remaining
+EPIC-68 child, **T-68.4** (docs/AGENTTRACE.md + a real transcript-mapping example + docs-rot test), is
+`TODO` on the frontier.
+
+## Usefulness — read the shape, not just the average
+
+Avg **4.13** / min **4** (per-task 4,5,4,4,4,4,4,4) — the strongest recent run and a clear lift off the
+~3.6 plateau. The single 5 went to the genuinely novel AGENTTRACE work; the two orbit-shaped tasks
+(T-66.3 funnel-link, T-67.2 site-drift) scored a borderline-but-defensible 4 (both widen the free→paid
+funnel / add byte-pinned release discipline). The Manager read the two 4s as run noise, not a trend.
+
+## Decisions made
+
+- **Pivot the build target off "more product mechanism" and onto the funnel (Strategist notes (m)/(n)).**
+  `qualityStall` fired again and `humanGated` has been stuck at 3 for ~20 runs, so the loop refused to add a
+  9th primitive and instead built the distribution shape the stuck P-8 ask runs through (EPIC-66/67) plus a
+  new vertical that re-purposes a dormant asset (EPIC-68).
+- **Open the new vertical by RE-PURPOSING, not inventing.** AGENTTRACE is the first product whose engine is
+  the shipped RFC-6962 log core (T-63.1) — file-SET seals structurally cannot express an ordered,
+  grow-over-time, redactable session. **EPIC-64 (witness/equivocation) stays PARKED; the primitive freeze
+  and resume-adding criterion remain in force.**
+- **Strictly additive + in-guardrails.** No new dependency, no new crypto, free verify surface only (paid
+  `--sign` reuses the existing fail-closed license gate), no new `needs-human` item, and the honest boundary
+  carried in-band from day one: a packet proves the log was NOT altered after sealing and what any disclosed
+  event said — NOT that the log faithfully records what the agent did (garbage-in), NOT a trusted timestamp
+  without P-3.
+
+## Work invented (newly planned: 9)
+
+Nine new tasks across the three new epics: EPIC-66 (T-66.1/.2/.3), EPIC-67 (T-67.1/.2), and EPIC-68
+(T-68.1/.2/.3/.4). Eight shipped and verified this same run; **T-68.4** (AGENTTRACE docs + a real
+transcript-mapping example) remains on the frontier as the single open item.
+
+## Team changes (2)
+
+**Manager MODIFIED two things — no panel growth (stays 5 reviewers + 5 builder profiles).** The new
+AGENTTRACE surface introduced three novel make-or-break properties with no standing owner
+(redaction-safe-leaf equivalence, redaction-as-withholding privacy, append-only-growth soundness):
+
+1. **MODIFIED reviewer TrustIntegrity** — appended a tight 7-pillar AGENTTRACE clause onto its existing
+   seal / Merkle-root re-derivation competency (redaction-safe leaf; redaction truly drops payload bytes;
+   `verifyGrowth` rejects rewritten history; signature-wraps-head + fail-closed `agent_signed` gate with the
+   free tier open; order/determinism + strict named rejects; honest boundary; verbatim reuse of
+   `journal-log`/`hash`/`attestation`).
+2. **MODIFIED the falsepass persona** — added agent-session redaction/growth false-PASSes to its explicit
+   hunting list.
+
+Rationale: TrustIntegrity is the natural owner (already owns seal/root re-derivation), so the Manager closed
+the gap at **zero panel growth** rather than adding a 6th reviewer at the working size of 5. A false-PASS in
+agent redaction (a leaked withheld payload) or in `verifyGrowth` (an accepted rewritten history) is a silent
+evidentiary make-or-break defect no standing lens would have caught.
+
+## What's blocked
+
+Nothing is software-blocked (`blocked: 0`). The standing constraint is human, not technical: **3 human-gated
+items** (unchanged for ~20 runs). Both verticals (Evidence + TrustLedger), the new AGENTTRACE vertical, the
+embeddable SDK, the HTTP verify-service, the integrity/transparency journal, and now the zero-install browser
+Evidence verifier are all built and locally tested. The dam is purely commercial/relational.
+
+## Needs-human (from STRATEGY.md)
+
+- **P-8 — CONSOLIDATED GO-TO-MARKET ASK: land ONE design partner and run the pilot.** The single human action
+  that de-risks P-3, P-5, P-6, and P-7 at once, and this run made its first-contact step **cheaper**: the
+  60-second cold-prospect challenge is now a single browser link (`verify-vh-standalone.html`), no Node. The
+  loop has BUILT and locally TESTED the entire deliverable (an offline, ephemeral-key pilot kit); identifying
+  a partner, provisioning a real vendor key, setting a price, and running the pilot are human actions that
+  MUST NOT be auto-executed. The one-screen version lives in [`docs/DECIDE.md`](DECIDE.md):
+  1. **Pick the lighter-gated vertical FIRST: EVIDENCE (P-7), not TrustLedger (P-5)** — no CPA/legal/per-state
+     liability layer; only a vendor key, a price, and one partner.
+  2. **One concrete first target this week:** an incident-response / digital-forensics team OR an
+     e-discovery / audit-workpaper shop — buyers for whom "this is the exact file set, byte-for-byte
+     unaltered, and here is who produced it" is contractually expensive.
+  3. **3-step first contact (no slide deck):** (a) `vh identity publish` once the vendor key exists; (b) hand
+     them the zero-install cold-prospect challenge; (c) if they lean in, run
+     `node pilot/run-pilot.js --certificate <path>` on THEIR own folder → a forwardable
+     `*.vhevidence.json` their security team verifies independently.
+  4. **Time box:** 3–5 prospects over ~2 weeks. Success = ONE who keeps using the free verify/challenge
+     weekly OR agrees to a paid pilot. Zero after the box → the signal is "wrong buyer archetype" →
+     switch to the TrustLedger broker channel, NOT "build more product."
+- **P-11 — REFRESH the live verifyhash.com publish set (~10-min recurring, deploy-gated).** The live site
+  serves stale pinned bytes; EPIC-67 makes the drift mechanical. The refresh now collapses to: (1)
+  `node scripts/site-release.js --diff` (read what the live site is missing); (2) `node scripts/site-release.js`
+  then upload `public/` per the REPLACE-mode runbook; (3) `--mark-deployed` + commit so the next `--diff` is
+  truthful. The loop NEVER uploads or touches `/var/www` — the upload is human-owned. As soon as this lands,
+  the site becomes the 60-second in-browser tamper challenge P-8's first contact can send as ONE link.
+- **P-9 — Embeddable SDK distribution + pricing.** The `verifyhash` library surface (signed + unsigned verify)
+  is built and contract-pinned; publishing to a registry and pricing the embed/usage stay human steps.
+- **P-10 — Transparency-log distribution (materially LOWER-gated than the pilot).** A public-good append-only
+  log + paid enterprise witness/monitor SLAs. Note: the enterprise witness/equivocation tier (EPIC-64) is
+  currently **PARKED** pending real demand, so P-10's paid tier is on hold until a customer pulls it.
+- P-1..P-7 unchanged (D-2 token framing, mainnet deploy, DataLedger trust-root, and the per-product
+  go-to-market gates); AGENTTRACE's paid `--sign` sells under the SAME existing P-7 key/price/partner steps —
+  it adds no new gate.
+
+**Revenue integrity (unchanged):** income is a subscription / license / meter for delivered software value;
+the license is an ACCESS credential, NOT a token/coin/NFT, not tradeable, not an appreciating asset. The
+loop ships only the mechanism + ephemeral test keys and must NEVER provision a real key, set a price, contact
+a prospect, host, take payment, or run the pilot itself.
+
+## The honest read
+
+Disciplined run. With its own panel flagging a quality stall and the go-to-market dam stuck for ~20 runs, the
+loop did the two highest-leverage non-product things available: it made its first-contact funnel a
+send-one-link browser page (removing the Node install from the Evidence pitch), and it made the one deployed
+asset — verifyhash.com — mechanically know when it's stale. Then it opened a genuinely new buyer (AI-agent
+audit/compliance) without inventing anything, by finally putting the dormant Merkle-log core to work. The
+single highest-leverage HUMAN move is unchanged and now cheaper: **pick one Evidence design partner and send
+them the browser challenge this week (`docs/DECIDE.md`), and re-deploy verifyhash.com so that link is live
+(`P-11`).**