Repository navigation
docs(site): trustshell.dev "Receipts, not promises" draft section (DRAFT — no deploy) - #682
Conversation
…y, no deploy) A self-contained HTML draft of one explainer section for trustshell.dev, built to be shown and reviewed, then ported into the live site by the owner if approved. Nothing here deploys; no new public claim goes live from this folder. - Inherits trustshell.dev's own world verbatim (ground #0a0a0a, accent #f6851b, IBM Plex Serif / Inter / JetBrains Mono, state palette teal/slate/rose) so it drops in without a visual seam. This is an extension, not a redesign. - Renders the offline receipt loop (D1/D4/D5) as a page a skeptic reads first: the six-claim non-collapsing verdict, the three-rung evidence ladder (owner-self-signed -> independently-verified -> RepID-eligible), and a "What a receipt does not prove" block. - Honesty rules honored: no first/only/unique/unhackable; NOT_CHECKED shown and never rounded up; three evidence levels kept distinct; owner self-signature earns no production RepID; developer-preview framing; no accuracy number. - impeccable detect: 1 accepted finding (Inter = the site's own body face); all others fixed. Verified rendered at desktop and 375px mobile. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
…; fix fabricated commands - Restructure the explainer to the owner's five-step IA (step rail + one step per section); the six-claim verdict panel lives in Verify, the evidence ladder in Earn. - Remove three fabricated CLI commands (trustshell demo, npx … demo, sign-receipt) — none exist; every command shown now runs offline (guard/run/inspect/verify-receipt/bundle), verified against src/cli/index.ts and L-E2E. - Rung 2 relabeled Issuer-attested (not independently-verified), reconciling with #681's INDEPENDENTLY_VERIFIED→ISSUER_ATTESTED: the engine's key is not independent of the issuer. - Add Enforce (guard pin), Observe (inspect + 'observed nothing'), Reuse (bundle; authority never travels). Verified rendered desktop + mobile; no console errors. DRAFT only — no deploy, no new public claim ships. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Strix Security Review✅ No open security findings. PR summary: Adds a non-deployed draft of one trustshell.dev explainer section: a self-contained static HTML page walking the Enforce → Observe → Verify → Earn → Reuse progression, plus a README describing the draft and how to view it locally. Review summaryNo security issues found. The PR adds only two documentation artifacts — Review 1 on this PR · Reviewed by Strix |
![strix-security[bot]](https://avatars.githubusercontent.com/in/2749804?s=60&v=4){kind=small}
There was a problem hiding this comment.
No security issues found. The PR adds only two documentation artifacts — docs/trustshell-dev-draft/README.md and a self-contained static receipts-section.html draft — with no runtime code, no user input, no data sinks, no secrets, and no deployment wiring. The HTML's single inline script only toggles a CSS class via IntersectionObserver (no innerHTML, eval, fetch, or storage access), and its only external references are Google Fonts over HTTPS. Lint triage over all 147 items found no item on either changed path and nothing reachable from them; the sole adjacent item (L127, unpinned npx @hyperdag/trustshell@latest in docs) is a copy-hygiene pattern the draft repeats in its illustrative commands, not a code path, and is already tracked by that lint item.
Reviewed by Strix
Configure security review settings
Status: DRAFT. Not deployed. No new public claim ships from this PR. A self-contained HTML draft of one trustshell.dev explainer section, split out of the receipt-seam work (#681) so design can be reviewed without distracting the security lanes (owner decision, 2026-11-07).
What it is
docs/trustshell-dev-draft/receipts-section.html— the offline receipt loop told as a page a skeptic reads before runningnpx @hyperdag/trustshell@latest demo: the six-claim non-collapsing verdict, the three-rung evidence ladder (owner-self-signed → the engine's independent verification → RepID-eligible), and "what a receipt does not prove". Inherits the live site's own world (IBM Plex Serif / Inter / JetBrains Mono,#0a0a0a, orange accent, teal/slate state palette).impeccable detect: 8 → 1 accepted finding (Inter = the site's own body face); verified at desktop + 375px.Honesty held
No "first / only / unique / unhackable". NOT_CHECKED is shown, never rounded to a pass; the six claims never collapse into one badge; an owner self-signature earns no production RepID; "independent verification" is attributed to the engine's key, not the offline check. No accuracy number (none has a ruler to carry here).
Next on this PR (not yet done)
Align the page IA to the owner's Enforce → Observe → Verify → Earn → Reuse progression, and reconcile against
/inspectand Getting Started. Kept in draft until then and until the owner approves any deploy.🤖 Generated with Claude Code