[DealAppSeo]

Weight: MAJOR (new public copy and launch language, r31). Sean approves explicitly; no self-merge. A new page at /gateway. It does not touch the home page or hero, and it is noindex until Sean decides whether it becomes the landing page.

Full report: E:\dev\reports\2026-10-24\GATEWAY_PAGE.md.

What the page does

1. The record. Seven documented AI failures from 2024–2025: Air Canada's chatbot (tribunal, Feb 2024), Google AI Overviews (Google's own post, May 2024), Cursor's support bot (Ars Technica, Apr 2025), Replit's agent deleting a database (The Register, Jul 2025), the AI-written fake reading list (NPR, May 2025), Deloitte's report for the Australian government (AP, Oct 2025), and the UK High Court's 18 fake citations (National Archives, Jun 2025). Each shows its source link and date, a paraphrase of the source, and a quote. Every source was fetched on 2026-10-24, and every quote was matched word for word against the fetched text (lib/ai-incidents.ts lists the traps we avoided).

2. The plan, in Sean's voice. HAL, RepID, receipts, x402, testnet, and portability/privacy. Each shows the idea, a Today line that is true of the shipped code and the live engine, and a Not yet line. The wording follows the 2026-10-23 claims audit (fix(site): narrow claims strangers meet tonight to what the code does (keys, extension, model families, /inspect) #615, fix: say only what the code does (Inspect commit label), credit what we build on, one copyright holder (LOW + Sean-approved licence) #619, fix(site,docs): narrow deeper-page claims to what the code does (replays #616 on main; LOW) #644).

3. Install. The CLI (Inspect plus the sentence check), the npm package (the README's verifyOutput snippet) and the MCP server. All of it reuses components/home-agent.tsx constants, so / and /gateway pin the same version. Below that, the six-stage ramp from /agents to /leaderboard.

4. Join. An email plus an optional note, saved to trustshell_v15_waitlist with no new table. That table is clean:

   • RLS is on, anon may only insert, and there are no triggers;
   • the site's v15 form wrote to it from production on 2026-09-19.

   Not waitlist. Its insert trigger emails a TrustTrader welcome ("Drawdown: 0% vs 49.63%", "$499/mo value"), and another trigger posts the address to Telegram. Any failure reads "Not saved" and points to GitHub; it never shows success.

For Sean

• TrustMarket.dev and TrustTrader.dev are named as "coming soon" with no link. trusttrader.dev is live and says "Hallucination-free AI trading recommendations", "mathematically-proven hallucination veto" and "0% drawdown across 4 major crashes". Those claims conflict with the claims audit.
• The report lists six more findings that this PR does not fix:
  • the waitlist welcome email;
  • the shadow x402 gate, which would block every new PROBATIONARY agent from trading;
  • public agents being stored with a trinity- prefix;
  • GitHub Discussions being off;
  • no contact for deleting an email;
  • whether Vercel prod holds the browser Supabase key (NOT CHECKED; there is a probe to run after merge).

Verified

• npx jest tests/gateway-page.test.ts: 20/20. It renders the page with fetch stubbed and confirms zero requests. Two deliberate mutants were caught: a write to waitlist, and the copy "hallucination-free".
• npx tsc --noEmit: exit 0.
• npm run test:gateway-walk (Chromium, Supabase origin stubbed): 21/21. It covers:
  • copy buttons;
  • every ramp stage is served;
  • the form says Saved only on a 201, and Not saved on a refusal or a dropped request;
  • it writes only {email, source, metadata:{note}}, and only to trustshell_v15_waitlist;
  • no sideways scroll at 375 px.
• Live ramp against production, using @hyperdag/trustshell@1.8.1 from npm:
  • passed: install, Inspect (SUPPORTED, exit 0), the sentence check (veto, exit 1), the page's SDK snippet, the MCP handshake (20 tools), register, wallet account, claim (two signatures plus the agent key), the public owner read, the service listing, and contract creation;
  • blocked at escrow: x402 is enforced, and it wants 0.05 test USDC. The throwaway payer holds 0, so a payment signed by guardedX402Payment got "Payment verification failed". No transaction was sent, so there are no new tx hashes.
  • The report says exactly what Sean does to finish the run with a funded test-only wallet. It needs no test ETH, because the facilitator pays gas.

Windows npm test shows 8 env-only failures in 7 suites (CRLF, path join, timing), none in this PR's files. Linux CI is the gate.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
trustshell-landing	Ready	Preview	Nov 4, 2026 7:06am UTC

[strix-security]

Strix Security Review

✅ No open security findings.

PR summary: Adds a new `noindex` `/gateway` page that documents seven sourced AI failure cases, pairs each part of the product plan with what runs today versus what is not built yet, gives install instructions for the CLI, npm package and MCP server, and includes an email-and-note join form that writes to the existing v15 signup table.

Review summary

Reviewed all seven changed files: the new /gateway page, the install and join client components, the incident data module, the test script added to package.json, and the two new test files. No security vulnerabilities found.

The page renders only build-time constants — AI_INCIDENTS, the PIECES array, and the BaseScan transaction literals — with no request, URL, cookie, or user-derived value anywhere on the path, so there is no tainted input reaching a text node or an href; every external link is a literal https URL and the source links are pinned by assertions in the new test suite. The install component copies fixed npm and MCP strings to the local clipboard on click only, and none of them contains a credential, while the client never fetches on load.

The join form is the only write path: an explicit three-field insert (email, source, metadata.note) into trustshell_v15_waitlist through the browser publishable key. It adds no new capability — that table and key were already writable anonymously from production code — narrows the payload compared with the two existing signup forms, keeps the service-role key out of the client bundle, and fails closed to a fixed "Not saved" message instead of surfacing raw PostgREST errors. Nothing in the repository reads the table, so the stored note has no rendering sink. The CodeQL double-escaping alert is test-only and decodes entities in the safe order.

Two suspicions were raised during review and both were rejected on validation: the client-only note-length cap and the test harness's --base write path. Formal verdict is approve.

Ruled out (2)

• Can a visitor store an unbounded note by bypassing the form's client-side 1000-character cap?
  The cap is browser-only, but the table already accepted anonymous inserts with the same publicly shipped key before this PR, it stores fewer fields than the existing v15 form, and nothing in the repository reads `metadata.note`, so no confidentiality, integrity or availability boundary is crossed.
• Can `test:gateway-walk --base` write real signup rows into a live deployment?
  Triggering it requires a maintainer to point a non-CI, non-published harness at a server they built themselves, and the resulting rows are exactly what any anonymous visitor can insert through the form, so it is test-harness hygiene rather than an attacker-reachable vulnerability.

Review history (2)

• Review 2 · 5e07efd · Nov 4 07:08 UTC · Nothing new
• Review 1 · 8ec6c9c · Oct 26 15:32 UTC · Nothing new

_{Review 2 on this PR · 5e07efd · requested Nov 4 07:05 UTC on a new commit}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[strix-security]

Reviewed all seven changed files in the pull request: the new /gateway page, the install and join components, the incident data module, the added npm script, and the two new tests. The page is a server component that renders only repository-authored copy; every outbound link and transaction hash is a hard-coded constant, and no user input reaches a rendering sink, so React's escaping covers the whole surface. The single untrusted input is the join form, which sends an email and an optional note through a parameterized supabase-js insert with a fixed column set into the signup table; inserts are validated as failures on both error and thrown exceptions, so a failed write is never shown as success. No authentication, authorization, cryptographic, deserialization, path, redirect, or command-execution logic is added or removed, and static analysis of the changed source files returned no results. No security vulnerabilities were confirmed in the changed code.

---

Reviewed by Strix
_{Configure security review settings}

[strix-security]

Reviewed all seven changed files: the new /gateway page, the install and join client components, the incident data module, the test script added to package.json, and the two new test files. No security vulnerabilities found.

The page renders only build-time constants — AI_INCIDENTS, the PIECES array, and the BaseScan transaction literals — with no request, URL, cookie, or user-derived value anywhere on the path, so there is no tainted input reaching a text node or an href; every external link is a literal https URL and the source links are pinned by assertions in the new test suite. The install component copies fixed npm and MCP strings to the local clipboard on click only, and none of them contains a credential, while the client never fetches on load.

The join form is the only write path: an explicit three-field insert (email, source, metadata.note) into trustshell_v15_waitlist through the browser publishable key. It adds no new capability — that table and key were already writable anonymously from production code — narrows the payload compared with the two existing signup forms, keeps the service-role key out of the client bundle, and fails closed to a fixed "Not saved" message instead of surfacing raw PostgREST errors. Nothing in the repository reads the table, so the stored note has no rendering sink. The CodeQL double-escaping alert is test-only and decodes entities in the safe order.

Two suspicions were raised during review and both were rejected on validation: the client-only note-length cap and the test harness's --base write path. Formal verdict is approve.

---

Reviewed by Strix
_{Configure security review settings}