From df97bb498f2237796035e776ae18405015bf9dd3 Mon Sep 17 00:00:00 2001 From: Sean Goodwin Date: Sat, 7 Nov 2026 09:41:26 -0800 Subject: [PATCH 1/2] D7: trustshell.dev "Receipts, not promises" draft section (drafts-only, no deploy) A self-contained HTML draft of one explainer section for trustshell.dev, built to be shown and reviewed, then ported into the live site by the owner if approved. Nothing here deploys; no new public claim goes live from this folder. - Inherits trustshell.dev's own world verbatim (ground #0a0a0a, accent #f6851b, IBM Plex Serif / Inter / JetBrains Mono, state palette teal/slate/rose) so it drops in without a visual seam. This is an extension, not a redesign. - Renders the offline receipt loop (D1/D4/D5) as a page a skeptic reads first: the six-claim non-collapsing verdict, the three-rung evidence ladder (owner-self-signed -> independently-verified -> RepID-eligible), and a "What a receipt does not prove" block. - Honesty rules honored: no first/only/unique/unhackable; NOT_CHECKED shown and never rounded up; three evidence levels kept distinct; owner self-signature earns no production RepID; developer-preview framing; no accuracy number. - impeccable detect: 1 accepted finding (Inter = the site's own body face); all others fixed. Verified rendered at desktop and 375px mobile. Co-Authored-By: Claude Opus 4.8 --- docs/trustshell-dev-draft/README.md | 54 +++++ .../receipts-section.html | 227 ++++++++++++++++++ 2 files changed, 281 insertions(+) create mode 100644 docs/trustshell-dev-draft/README.md create mode 100644 docs/trustshell-dev-draft/receipts-section.html diff --git a/docs/trustshell-dev-draft/README.md b/docs/trustshell-dev-draft/README.md new file mode 100644 index 00000000..9e6a10a6 --- /dev/null +++ b/docs/trustshell-dev-draft/README.md @@ -0,0 +1,54 @@ +# trustshell.dev — "Receipts, not promises" draft section (D7) + +**Status: DRAFT. Not deployed. Not published.** This is a self-contained HTML draft of one +explainer section for trustshell.dev, built to be shown and reviewed, then ported into the live +site by the site owner if approved. Nothing here ships automatically, and no new public claim +goes live from this folder. + +## What it is + +`receipts-section.html` — a single, self-contained page that renders the "Receipts, not promises" +section: the one-receipt / six-claim non-collapsing verdict, the three-rung evidence ladder +(owner-self-signed → independently-verified → RepID-eligible), and a "What a receipt does not +prove" block. It is the offline receipt loop (D1/D4/D5) told as a page a skeptic reads before +they run `npx @hyperdag/trustshell@latest demo`. + +## How to view it + +``` +cd docs/trustshell-dev-draft +python -m http.server 8787 +# open http://127.0.0.1:8787/receipts-section.html +``` + +Opening the file directly (`file://`) works too; a server is only needed if a tool must drive it. + +## It inherits trustshell.dev's own world (extension, not a redesign) + +Captured from the live site and reused verbatim, so this drops in without a visual seam: + +- Ground `#0a0a0a`, foreground `#fafafa`, muted `#a1a1aa`, accent `#f6851b`, card `#18181b`, + border `#27272a`. +- State palette doing the semantic work: `--state-measured #2dd4bf` (VERIFIED), `--state-not-checked + #8b97a8` (NOT_CHECKED), `--state-failed #fb7185` (reserved for FAILED). +- Type: IBM Plex Serif display headings, Inter body, JetBrains Mono for receipts / commands / state. + +## Honesty rules honored (PRODUCT.md copy rules) + +- No "first / only / unique / unhackable" anywhere. +- NOT_CHECKED is shown, never rounded up to a pass; the six claims never collapse into one badge. +- The three evidence levels are kept distinct; an owner self-signature earns **no** production RepID. +- Framed as a developer preview; ends with explicit "what a pass does not prove". +- No accuracy number is quoted (none has a ruler to carry here). + +## Design-detector result + +`impeccable detect` → **1 finding, accepted:** `overused-font: inter`. Inter is trustshell.dev's +own body face; this section inherits the established world, so the face is intentional, not a +default. All other findings (contrast, sub-11px micro-labels, flat type steps, italic-serif hero +tell, em-dash saturation) were fixed. Verified rendered at desktop and 375px mobile. + +## What this draft does NOT do + +It does not deploy, it does not touch the live trustshell.dev, and it introduces no claim the +engine cannot already back. Any new public copy here is a MAJOR change and is the owner's call. diff --git a/docs/trustshell-dev-draft/receipts-section.html b/docs/trustshell-dev-draft/receipts-section.html new file mode 100644 index 00000000..dec11351 --- /dev/null +++ b/docs/trustshell-dev-draft/receipts-section.html @@ -0,0 +1,227 @@ + + + + + +Receipts, not promises — trustshell.dev draft + + + + + + +
+ +
+

Receipts, not promises.

+

A TrustShell action can seal a signed receipt of what it did. Verifying one offline tells you exactly what it proves, and it is strict about what it refuses to claim.

+
+ +
+

One receipt, six separate claims

+

There is no single “valid” badge. verify-receipt recomputes the hash and the signature locally and reports each claim on its own, with its own gaps.

+ +
+
+ $ trustshell verify-receipt r.json --root 0x8e8c…7222 + exit 0 +
+
Offline verdict — sealer ✓ trusted under the pinned key. No network was used.
+
    +
  • IntegrityVERIFIEDThe bytes are whole: the hash matches the contents, and a pinned Ed25519 key sealed them.
    • +
  • AuthenticityNOT_CHECKEDNo six-claim envelope was supplied, and this cannot be derived from the receipt alone.
    • +
  • ObservationNOT_CHECKEDNo outcome (e.g. a payment settling on chain) was observed and attested.
    • +
  • CorrectnessNOT_CHECKEDThe content was not verified against its source.
    • +
  • AuthorizationNOT_CHECKEDWhether the kernel permitted this action under its policy is not established here.
    • +
  • ContainmentNOT_CHECKEDThat the tool ran only under an ALLOW decision is not established here.
    • +
+
NOT_CHECKED is never a pass. Offline verification proves two things by cryptography: the bytes are whole, and a pinned key sealed them. Every other claim is the issuer’s own attestation, read but not re-derived, so it shows as NOT_CHECKED until an authenticated envelope backs it.
+
+
+ +
+

Three levels of evidence, never collapsed

+

A signature says who sealed a receipt, not that an action was permitted or that it earned a reputation. The levels do not blur together, and you can only reach the first one by yourself.

+ +
+
+

Owner-self-signed you can do this now

+

Sealed with your install’s own key, offline — trustshell demo or sign-receipt. Integrity verifies under the key you pin.

+

Proves authorship and wholeness, nothing more. Not independent verification, and it earns no production RepID.

+
+
+

Independently-verified the engine’s key

+

An engine key sealed the receipt and an authenticated six-claim envelope backs it, so at least one claim beyond Integrity reads VERIFIED.

+

Still not reputation. Verification and reputation are separate gates.

+
+
+

RepID-eligible the engine decides

+

Whether a receipt earns portable reputation is the engine’s call, against its own pinned key.

+

Never an offline verdict, and never self-declared. An owner cannot promote their own receipt here.

+
+
+
+ +
+

What a receipt does not prove

+
    +
  • An owner self-signature proves authorship and wholeness — not that the engine permitted the action, and not that it earned reputation.
    • +
  • NOT_CHECKED is never rounded up to a pass. A claim with no evidence stays not-checked; there is no single rollup “valid”.
    • +
  • Offline verification is stateless. It does not catch a verbatim replay of one receipt. Replay is prevented by the engine’s receipt-id and nullifier, not by the offline verifier.
    • +
  • A pinned root is required to accept a seal. With no key pinned, a whole-but-unaccountable receipt is NOT_CHECKED, never exit 0.
    • +
+ +
+

Run the whole loop yourself — no account, no network:

+
$ npx @hyperdag/trustshell@latest demo       # seals a sample receipt, verifies it in front of you
+$ trustshell sign-receipt body.json > r.json # or seal your own
+$ trustshell verify-receipt r.json --root 0x…
+
+ +

Developer preview·Apache-2.0·free, no account·offline verification, no engine required

+
+ +
+ + + From 8660f03832d653dc91df9529b44fd4515eb62256 Mon Sep 17 00:00:00 2001 From: Sean Goodwin Date: Sat, 7 Nov 2026 14:49:21 -0800 Subject: [PATCH 2/2] =?UTF-8?q?docs(site):=20align=20Receipts=20draft=20to?= =?UTF-8?q?=20Enforce=E2=86=92Observe=E2=86=92Verify=E2=86=92Earn=E2=86=92?= =?UTF-8?q?Reuse;=20fix=20fabricated=20commands?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Restructure the explainer to the owner's five-step IA (step rail + one step per section); the six-claim verdict panel lives in Verify, the evidence ladder in Earn. - Remove three fabricated CLI commands (trustshell demo, npx … demo, sign-receipt) — none exist; every command shown now runs offline (guard/run/inspect/verify-receipt/bundle), verified against src/cli/index.ts and L-E2E. - Rung 2 relabeled Issuer-attested (not independently-verified), reconciling with #681's INDEPENDENTLY_VERIFIED→ISSUER_ATTESTED: the engine's key is not independent of the issuer. - Add Enforce (guard pin), Observe (inspect + 'observed nothing'), Reuse (bundle; authority never travels). Verified rendered desktop + mobile; no console errors. DRAFT only — no deploy, no new public claim ships. Co-Authored-By: Claude Opus 4.8 --- docs/trustshell-dev-draft/README.md | 27 +++- .../receipts-section.html | 144 ++++++++++++++---- 2 files changed, 138 insertions(+), 33 deletions(-) diff --git a/docs/trustshell-dev-draft/README.md b/docs/trustshell-dev-draft/README.md index 9e6a10a6..e8abff4e 100644 --- a/docs/trustshell-dev-draft/README.md +++ b/docs/trustshell-dev-draft/README.md @@ -7,11 +7,26 @@ goes live from this folder. ## What it is -`receipts-section.html` — a single, self-contained page that renders the "Receipts, not promises" -section: the one-receipt / six-claim non-collapsing verdict, the three-rung evidence ladder -(owner-self-signed → independently-verified → RepID-eligible), and a "What a receipt does not -prove" block. It is the offline receipt loop (D1/D4/D5) told as a page a skeptic reads before -they run `npx @hyperdag/trustshell@latest demo`. +`receipts-section.html` — a single, self-contained page that walks the owner's five-step +progression — **Enforce → Observe → Verify → Earn → Reuse** — with the real CLI at each step: +the owner policy that decides before a tool runs and pins it by path+sha256 (`guard` / `run`), the +hash-chained log checked offline (`inspect`), the one-receipt / six-claim non-collapsing verdict +(`verify-receipt`), the three-rung evidence ladder (owner-self-signed → issuer-attested → +RepID-eligible), and the signed carry where authority never travels (`bundle`). It ends with +"What a receipt does not prove" and a runnable, offline, no-account loop. + +## This revision (2026-11-07): IA aligned, commands made real, one label corrected + +- **IA now follows the owner's progression** Enforce → Observe → Verify → Earn → Reuse — a step rail + up top, one step per section. The six-claim verdict panel lives inside Verify; the ladder inside Earn. +- **Three fabricated commands removed.** The prior draft told a skeptic to run `trustshell demo`, + `npx … demo`, and `trustshell sign-receipt` — none of which exist in the CLI (`demo` is only a + `check --demo` flag; sealing lives in the `sandbox` / `run` path, which needs a container or the + engine). Every command shown now is one the CLI actually has and runs offline: `guard`, `run`, + `inspect`, `verify-receipt`, `bundle` (verified against `src/cli/index.ts` and L-E2E). +- **Rung 2 is "Issuer-attested", not "independently-verified"** — reconciled with #681's + `INDEPENDENTLY_VERIFIED → ISSUER_ATTESTED` rename: the engine's key is not independent of the + issuer, so the page says exactly that instead of claiming an independence it does not have. ## How to view it @@ -40,6 +55,8 @@ Captured from the live site and reused verbatim, so this drops in without a visu - The three evidence levels are kept distinct; an owner self-signature earns **no** production RepID. - Framed as a developer preview; ends with explicit "what a pass does not prove". - No accuracy number is quoted (none has a ruler to carry here). +- Every command shown exists in the CLI and runs offline — no fabricated `demo` / `sign-receipt`. +- "Independently-verified" is not claimed where the code only reaches `ISSUER_ATTESTED` (#681). ## Design-detector result diff --git a/docs/trustshell-dev-draft/receipts-section.html b/docs/trustshell-dev-draft/receipts-section.html index dec11351..eb1372b6 100644 --- a/docs/trustshell-dev-draft/receipts-section.html +++ b/docs/trustshell-dev-draft/receipts-section.html @@ -26,27 +26,67 @@ :focus-visible { outline:2px solid var(--accent); outline-offset:3px; border-radius:3px; } a { color:var(--foreground); text-decoration:underline; text-decoration-color:rgba(246,133,27,.55); text-underline-offset:3px; } a:hover { text-decoration-color:var(--accent); } + code { font-family:var(--mono); font-size:.88em; color:#d4d4d8; } ::-webkit-scrollbar { width:12px; height:12px; } ::-webkit-scrollbar-track { background:#0a0a0a; } ::-webkit-scrollbar-thumb { background:#27272a; border:3px solid #0a0a0a; border-radius:8px; } ::-webkit-scrollbar-thumb:hover { background:#3a3a40; } .wrap { max-width:60rem; margin:0 auto; padding:clamp(3.5rem,8vw,7rem) clamp(1rem,5vw,2rem); } - section + section { margin-top:clamp(3.5rem,7vw,6rem); } + section + section { margin-top:clamp(3.25rem,6vw,5.5rem); } /* ---- header -------------------------------------------------------------- */ - .lede { max-width:40ch; } + .lede { max-width:46ch; } h2.title { font-family:var(--serif); font-weight:600; letter-spacing:-.02em; line-height:1.04; font-size:clamp(2.4rem,6vw,3.75rem); margin:0 0 1.1rem; } h2.title em { font-style:normal; color:var(--accent); } - .sub { color:var(--muted); font-size:clamp(1.02rem,2.2vw,1.18rem); margin:0; max-width:58ch; line-height:1.55; } + .sub { color:var(--muted); font-size:clamp(1.02rem,2.2vw,1.18rem); margin:0; max-width:60ch; line-height:1.55; } + /* ---- the five-step rail: the spine the page walks ------------------------ */ + .rail { display:flex; flex-wrap:wrap; gap:.5rem; margin-top:2.2rem; list-style:none; padding:0; } + .rail li { display:flex; align-items:center; gap:.5rem; } + .rail .step { + display:flex; align-items:center; gap:.5rem; + font-family:var(--mono); font-size:.76rem; font-weight:500; letter-spacing:.04em; + color:#d4d4d8; background:var(--card); border:1px solid var(--border); + padding:.42rem .7rem; border-radius:7px; white-space:nowrap; + } + .rail .step b { color:var(--accent); font-weight:700; } + .rail .arrow { color:#52525b; font-family:var(--mono); font-size:.8rem; } + .rail li:last-child .arrow { display:none; } + + /* ---- step heading -------------------------------------------------------- */ + .eyebrow { + font-family:var(--mono); font-size:.74rem; font-weight:700; letter-spacing:.09em; text-transform:uppercase; + color:var(--accent); margin:0 0 .5rem; display:block; + } + .eyebrow .n { color:var(--muted); margin-right:.55rem; } h3.kerning { font-family:var(--serif); font-weight:600; letter-spacing:-.01em; font-size:clamp(1.7rem,3.6vw,2.2rem); margin:0 0 .5rem; } - .section-note { color:var(--muted); margin:0 0 1.8rem; max-width:62ch; } + .section-note { color:var(--muted); margin:0 0 1.5rem; max-width:64ch; } + .section-note b { color:#e4e4e7; font-weight:600; } - /* ---- the verdict panel --------------------------------------------------- */ + /* ---- command panel (enforce / observe / reuse) --------------------------- */ + .cmdpanel { background:#131316; border:1px solid var(--border); border-radius:12px; overflow:hidden; } + pre.cmd { + font-family:var(--mono); font-size:.84rem; line-height:1.75; color:#e4e4e7; + margin:0; padding:1.1rem 1.25rem; overflow-x:auto; white-space:pre; + } + pre.cmd .p { color:var(--accent); -webkit-user-select:none; user-select:none; } + pre.cmd .c { color:#9aa1ab; } + pre.cmd .deny { color:var(--state-failed); font-weight:700; } + pre.cmd .ok { color:var(--state-measured); font-weight:700; } + .note-strip { + display:flex; gap:.7rem; align-items:flex-start; margin-top:1rem; padding:.85rem 1rem; + border:1px solid var(--border); border-left:3px solid var(--state-not-checked); border-radius:8px; + background:var(--card); color:var(--muted); font-size:.92rem; line-height:1.5; max-width:66ch; + } + .note-strip.measured { border-left-color:var(--state-measured); } + .note-strip b { color:var(--foreground); font-weight:600; } + .note-strip code { color:#d4d4d8; } + + /* ---- the verdict panel (verify) ------------------------------------------ */ .panel { background:var(--card); border:1px solid var(--border); border-radius:14px; overflow:hidden; } .panel-cmd { font-family:var(--mono); font-size:.86rem; color:var(--muted); @@ -69,7 +109,7 @@ padding:.26rem .55rem; border-radius:6px; white-space:nowrap; justify-self:start; font-variant-numeric:tabular-nums; } - .chip.verified { color:#063; color:#042f2a; background:var(--state-measured); } + .chip.verified { color:#042f2a; background:var(--state-measured); } .chip.notchecked { color:var(--state-not-checked); background:rgba(139,151,168,.14); } .chip.failed { color:var(--state-failed); background:rgba(251,113,133,.14); } .panel-foot { @@ -78,7 +118,7 @@ } .panel-foot b { color:var(--foreground); font-weight:600; } - /* ---- the evidence ladder ------------------------------------------------- */ + /* ---- the evidence ladder (earn) ------------------------------------------ */ .ladder { display:grid; gap:0; margin-top:.5rem; } .rung { position:relative; padding:1.5rem 1.5rem 1.5rem 3.4rem; @@ -111,19 +151,13 @@ /* ---- reproduce ----------------------------------------------------------- */ .repro { margin-top:1.4rem; } - pre.cmd { - font-family:var(--mono); font-size:.86rem; line-height:1.7; color:#e4e4e7; - background:#131316; border:1px solid var(--border); border-radius:10px; - padding:1rem 1.15rem; margin:.5rem 0 0; overflow-x:auto; white-space:pre; - } - pre.cmd .p { color:var(--accent); -webkit-user-select:none; user-select:none; } - pre.cmd .c { color:#9aa1ab; } - .repro .cap { color:var(--muted); font-size:.9rem; margin:.1rem 0 0; } + .repro .cap { color:var(--muted); font-size:.9rem; margin:.1rem 0 .4rem; } + .repro pre.cmd { background:#131316; border:1px solid var(--border); border-radius:10px; } .foot-meta { margin-top:3rem; font-family:var(--mono); font-size:.76rem; letter-spacing:.03em; color:#9aa1ab; } .foot-meta .dot { color:#52525b; margin:0 .5rem; } - /* one authored motion moment: verdict rows settle in on first view. + /* one authored motion moment: verdict rows and ladder rungs settle in on first view. visible by default — the keyframe only runs when JS opts in. */ .reveal { opacity:1; } .js .reveal { opacity:0; transform:translateY(10px); } @@ -134,6 +168,7 @@ .claim { grid-template-columns:1fr; gap:.3rem; } .claim .chip { justify-self:start; } .panel-cmd { font-size:.78rem; } + .rail .step { font-size:.72rem; } } @@ -142,12 +177,47 @@

Receipts, not promises.

-

A TrustShell action can seal a signed receipt of what it did. Verifying one offline tells you exactly what it proves, and it is strict about what it refuses to claim.

+

A TrustShell action is decided before it runs, recorded while it runs, and sealed into a receipt anyone can check offline — one that is strict about what it refuses to claim. Five steps, no single “valid” badge at the end of any of them.

+
    +
  1. 1 Enforce→
    2. +
  2. 2 Observe→
    3. +
  3. 3 Verify→
    4. +
  4. 4 Earn→
    5. +
  5. 5 Reuse→
    6. +
+
+ + +
+ Step 1Enforce +

The owner decides before the tool runs

+

A policy you own lists what may run and pins each tool to one executable by path and sha256. The decision and its record come before the command starts — a command that is not listed, or whose binary was swapped, never starts.

+
+
$ trustshell guard init                                 # write the owner policy; every limit 0
+$ trustshell guard allow tool:git --exe "$(command -v git)"   # list it AND pin it by path+sha256
+$ trustshell run --tool git -- "$(command -v git)" --version  # decided+recorded, then runs
+$ trustshell run --tool git -- ./not-the-pinned-git --version # REFUSED before it starts (exit 5)
+
+
With a policy in place, anything unlisted is denied, and no policy at all means nothing runs (exit 2) — never a silent allow. This is where the receipt’s authorization and containment claims come from.
+ +
+ Step 2Observe +

What happened is recorded — and so is what no one watched

+

The run records the plain facts it has: the exit code, the signal, the duration. It does not claim to have watched the work. The card says so in those words, and the record goes into a local, hash-chained log you can check offline.

+
+
$ trustshell inspect                     # verify the local tool-call log — opens NO socket
+INTACT  .trustshell/session.jsonl      # exit 0 · BROKEN (1) / UNCHAINED (3) / NO_LOG (3)
+
+
The run card reads independently observed — nothing: no outside party watched this command. “Exited 0” is recorded as an exit code, never promoted to “succeeded”, “correct”, or “verified”.
+
+ +
+ Step 3Verify

One receipt, six separate claims

-

There is no single “valid” badge. verify-receipt recomputes the hash and the signature locally and reports each claim on its own, with its own gaps.

+

There is no single “valid” badge. verify-receipt recomputes the hash and the signature locally — no network, no engine — and reports each claim on its own, with its own gaps.

@@ -163,24 +233,26 @@

One receipt, six separate claims

  • AuthorizationNOT_CHECKEDWhether the kernel permitted this action under its policy is not established here.
  • ContainmentNOT_CHECKEDThat the tool ran only under an ALLOW decision is not established here.
    • -
    NOT_CHECKED is never a pass. Offline verification proves two things by cryptography: the bytes are whole, and a pinned key sealed them. Every other claim is the issuer’s own attestation, read but not re-derived, so it shows as NOT_CHECKED until an authenticated envelope backs it.
    +
    NOT_CHECKED is never a pass. Offline verification proves two things by cryptography: the bytes are whole, and a pinned key sealed them. Every other claim is read from an authenticated envelope or stays NOT_CHECKED — so exit is keyed to integrity: 0 VERIFIED, 1 FAILED, 2 NOT_CHECKED.
    +
    + Step 4Earn

    Three levels of evidence, never collapsed

    -

    A signature says who sealed a receipt, not that an action was permitted or that it earned a reputation. The levels do not blur together, and you can only reach the first one by yourself.

    +

    A signature says who sealed a receipt — not that an action was permitted, and not that it earned a reputation. The levels do not blur together, and you can only reach the first one by yourself.

    Owner-self-signed you can do this now

    -

    Sealed with your install’s own key, offline — trustshell demo or sign-receipt. Integrity verifies under the key you pin.

    +

    Sealed with your install’s own key. Integrity verifies under the key you pin, offline.

    Proves authorship and wholeness, nothing more. Not independent verification, and it earns no production RepID.

    -

    Independently-verified the engine’s key

    -

    An engine key sealed the receipt and an authenticated six-claim envelope backs it, so at least one claim beyond Integrity reads VERIFIED.

    -

    Still not reputation. Verification and reputation are separate gates.

    +

    Issuer-attested the engine’s key

    +

    An engine key sealed the receipt and an authenticated six-claim envelope backs it, so a claim beyond Integrity reads VERIFIED.

    +

    The engine’s key is not independent of the issuer, so this is not yet independent verification — and still not reputation. Verification and reputation are separate gates.

    RepID-eligible the engine decides

    @@ -190,6 +262,19 @@

    RepID-eligible the engine decides

    + +
    + Step 5Reuse +

    Carry what was earned — authority stays home

    +

    A bundle is one Ed25519-signed file: your profile, the policy by hash, the notes you choose, and evidence pointers by sha256. Never credentials, keys, or spending authority. What travels is evidence a stranger can check; what does not travel is the power to act.

    +
    +
    $ trustshell bundle export carry.sig --notes released   # sign a carry; the key never goes in it
+$ trustshell bundle import carry.sig                    # verify its signature, then write it here
    +
    +
    On import, authority does not come with it: notes land untrusted and quarantined, and a policy is enforced only if its owner signature verifies with a key you trust and its nonce is higher than the one in force. The same receipt and the same RepID carry across contexts without carrying the right to act.
    +
    + +

    What a receipt does not prove

      @@ -200,10 +285,13 @@

      What a receipt does not prove

    -

    Run the whole loop yourself — no account, no network:

    -
    $ npx @hyperdag/trustshell@latest demo       # seals a sample receipt, verifies it in front of you
-$ trustshell sign-receipt body.json > r.json # or seal your own
-$ trustshell verify-receipt r.json --root 0x…
    +

    Run the enforced path and check its log yourself — no account, no network, no container:

    +
    $ npx @hyperdag/trustshell@latest guard init
+$ npx @hyperdag/trustshell@latest guard allow tool:git --exe "$(command -v git)"
+$ npx @hyperdag/trustshell@latest run --tool git -- "$(command -v git)" --version
+$ npx @hyperdag/trustshell@latest inspect                 # INTACT — the local log holds
    +

    And verify any receipt you are handed, offline:

    +
    $ npx @hyperdag/trustshell@latest verify-receipt r.json --root 0x…

    Developer preview·Apache-2.0·free, no account·offline verification, no engine required