[DealAppSeo]

Part of the 2026-10-23 repo-alignment sprint (hub: DealAppSeo/hyperdag-protocol#61). Code first, then copy.

Weight.

• The label fix is LOW: a bug fix, and the pinned digest moves with it.
• The README narrowing and credits are LOW.
• Removing the extra licence term and naming Sean Goodwin as copyright holder are Sean's calls, approved in chat on 2026-10-23.
• The package.json description ships with the next npm release.

Code

Where	Before	After	Proof
src/lib/check.ts:261 (run check, commit fact)	"The commit exists on the remote"	"GitHub reports the commit this run ran on"	No lookup of the commit is made; the value is GitHub's head_sha for the run
dist/lib/check.js	old label	rebuilt	Only this dist file changes (git diff --ignore-cr-at-eol)
tests/action-evidence.test.ts pinned digest	cb114733…	9b7c9646…	The label is in the record. Recomputed independently: Python json.dumps(sort_keys=True) + sha256 on the same record gives the same value

Copy

Where	Before	After	Why
README "The portable agentic trust harness"	"hands back a ZK-verifiable receipt", "carries a portable, earned RepID that travels with the agent"	what runs today (Inspect; a record that is canonical JSON + SHA-256, not yet signed) and where it is going (Carry, merged not released; reputation that moves with you as an aim)	README's own "v2… not shipped"; the range proof's score is a public input
README feature list	three protocols; "real cross-provider fact-check quorum"; "portable reputation… client-verifiable range proof"	Inspect first; "two AI checkers… a second opinion, not proof"; "range proof anyone can check; the score itself is public (test network)"	Different checkers share errors (Kim et al., ICML 2025)
README "one live install" and install table	"ERC-8004 portable RepID"	Inspect, HAL, RepID reads and range proofs, x402 with a spend guard (test network)	What 1.8.0 contains
README check section	"and that the commit exists on the remote"	"and which commit it ran on, as GitHub reports it"	Matches the code fix
README badge	ERC-8004 → hyperdag-protocol	ERC-8004 → EIP-8004	Canonical source
README credits	x402 and Plonky3 unlinked	x402 by Coinbase, Plonky3 by Polygon Labs, ERC-8004 by its authors; link to the hub's ACKNOWLEDGEMENTS.md	Credit
README licence	"Commercial use of the (experimental) Pythagorean Comma Veto methodology in closed-source systems requires written permission from DealApp Inc."	removed	The Apache-2.0 LICENSE has no such term
LICENSE appendix and README	"Copyright 2026 DealApp Inc."	"Copyright 2026 Sean Goodwin"	One holder across the repos
README footer	"Built on HyperDAG Protocol. ERC-8004 compatible."	the hub blurb, linking only the map (BUILDERS.md#how-the-pieces-fit)	The star rule (tests/readme-where-this-sits.test.ts)
package.json description	"HAL hallucination filtering, portable RepID… verifiable receipts"	"Check what your AI agent says it did against the evidence. Inspect…"	What the package does

Checks

• tsc --noEmit: clean.
• jest (3 workers): every suite these edits touch passes, among them action-evidence, readme-truth, readme-where-this-sits, readme-first-screen and install-docs.
• The only failures are the six that fail on this Windows machine even on clean main and pass on Linux CI: kernel-client, measure-home-samples, publish-trusted-publishing, receipts-workflow, scrub-battery, stranger-rail.

Not in this PR

• repid.dev's certificate does not verify (checked from two networks), so the "Register your agent at repid.dev/start" link fails for strangers. That is an infrastructure fix for Sean; the link is unchanged here.
• The GitHub "About" line still says "Portable Safe and Ethical Trust Layer". It changes in the repo settings, not in code.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
trustshell-landing	Ready	Preview	Oct 23, 2026 7:30pm UTC

[strix-security]

Strix Security Review

✅ No open security findings.

PR summary: This PR corrects the Inspect check's commit label to say only what the code verifies, moves the corresponding pinned record digest, and rewrites README, LICENSE and package metadata to narrow overstated claims, credit upstream projects, and name a single copyright holder.

Review summary

The diff contains no executable-logic change beyond one user-facing label string, so the review focused on whether the new wording matches what the code actually does and whether the moved test pin weakens any integrity check. The commit label now states that GitHub reports the commit the run ran on, which is exactly what the code produces (head_sha, with no commit lookup), and the compiled artifact matches the source. The updated record digest was independently recomputed from the recorded GitHub fixture through the record builder and matches the new pin, while the companion assertion that recomputes the JCS SHA-256 at runtime still guards the record format. The documentation edits narrow previously overstated assurance claims (ZK-verifiable receipts, portable earned RepID, cross-provider quorum) and add an accurate description of the digest, which reduces rather than creates misleading security claims; the new statement that Inspect's only network call is to api.github.com is consistent with the code. The licence and package metadata edits have no runtime effect. No security-relevant issue was found in the changed code.

_{Review 1 on this PR · e98b261 · requested Oct 23 19:32 UTC when the PR was opened}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[strix-security]

The diff contains no executable-logic change beyond one user-facing label string, so the review focused on whether the new wording matches what the code actually does and whether the moved test pin weakens any integrity check. The commit label now states that GitHub reports the commit the run ran on, which is exactly what the code produces (head_sha, with no commit lookup), and the compiled artifact matches the source. The updated record digest was independently recomputed from the recorded GitHub fixture through the record builder and matches the new pin, while the companion assertion that recomputes the JCS SHA-256 at runtime still guards the record format. The documentation edits narrow previously overstated assurance claims (ZK-verifiable receipts, portable earned RepID, cross-provider quorum) and add an accurate description of the digest, which reduces rather than creates misleading security claims; the new statement that Inspect's only network call is to api.github.com is consistent with the code. The licence and package metadata edits have no runtime effect. No security-relevant issue was found in the changed code.

---

Reviewed by Strix
_{Configure security review settings}

[github-actions]

🧾 Receipt

1 claim(s) checked against GitHub's own check runs on e98b261: 1 verified · 0 not checked · 0 failed

Claim	Said in	Evidence	Result
type check: tsc --noEmit: clean.	PR description	step `Typecheck` in check passed and the job's own workflow file at this commit runs a matching command, and every other check on this commit finished green, skipped or neutral.	✅ VERIFIED

What this receipt does not prove

• A green check proves that check passed on this commit. It does not prove the check tested this change.
• Evidence is read at the strongest level each check offers: the run: command of the job, taken from the workflow file at this commit; else the step name and that step own result; else the check name alone. The Result column says which. A check name is a label, not evidence.
• At command level the receipt confirms the job runs a command that normally runs this kind of check. It cannot confirm the command asserted anything: a test script that exits 0 without running a test still reads as tests.
• A job whose steps cannot be read (a third-party check, or no actions: read permission) is matched by its name alone, and a job whose work happens inside a composite action shows no command.
• Claims are read from the PR description and the latest commit message by plain patterns. A claim worded unusually is not seen. Text in double quotes, code blocks and block quotes is ignored on purpose; text in single quotes is read, because a single quote is also an apostrophe.
• A check created after this receipt was written is not counted until the receipt runs again.

_{Receipts by TrustShell. Read-only: it reads this PR and its check runs, and writes only this comment. No code leaves the repo.}