release: 1.9.1, do not merge until npm view returns 1.9.1

.gitattributes

@@ -4,3 +4,4 @@ extension/** text=auto eol=lf
 # The /build page prints the sha-256 of these sample-receipt files; LF on every checkout keeps the
 # served bytes equal to the printed hash (tests/build-ledger.test.ts checks it).
 public/samples/** text eol=lf
+tests/fixtures/trust-report-1.9.0/** -text

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to the `@hyperdag/trustshell` package.
 
+## 1.9.1 — 2026-11-08
+
+A fix for 1.9.0. One word in the Trust Report changes, and nothing else in how the package behaves. The package is still 165 files, and the MCP server still lists 21 tools.
+
+- **A claim paired with a command now reads `COMMAND_PASSED`, not `SUPPORTED`.** In 1.9.0, one run that selected no tests and exited 0 made "All tests pass" SUPPORTED. A note beside it said this showed only that the command passed, but the word claimed more than an exit code can show. Reports now use schema `dev.trustshell.trust-report/0.2-draft`. A folder made by 1.9.0 still verifies, under the word it was made with. Claims checked against GitHub's record of a run can still be SUPPORTED.
+
 ## 1.9.0 — 2026-11-08
 
 Cut from main, not from the 1.8.1 branch. The fixes in 1.8.1 are here too: its four regression suites

PRODUCT.md

@@ -16,7 +16,7 @@ Developers building AI agents who need to check what an agent says it did before
 Owner-controlled authority, evidence-backed actions, portable context and earned autonomy, as one harness that works with any model. This is shown with a reproducible demo (the pinned-run challenge), never asserted as unique: no comparative research supports "nobody else does this".
 
 ## Operating Context
-- `npx @hyperdag/trustshell@latest check <run-url> --claims-file <file>` (Inspect): reads one public GitHub Actions run from api.github.com, no account, no key. Developer preview, in npm `latest` (1.9.0).
+- `npx @hyperdag/trustshell@latest check <run-url> --claims-file <file>` (Inspect): reads one public GitHub Actions run from api.github.com, no account, no key. Developer preview, in npm `latest` (1.9.1).
 - trustshell.dev: the hosted sentence check (sends text to the engine), `/inspect` (the challenge), `/docs`.
 - Developers arrive from GitHub, npm and their community channels; they evaluate by running a command, not by reading claims.
 

README.md

@@ -91,7 +91,7 @@ That run exited 1 (1.6.0, 2026-10-07). The last line names who decided; your run
 
 | | Today |
 |---|---|
-| npm `latest` | **1.9.0** (`npm view @hyperdag/trustshell version`). |
+| npm `latest` | **1.9.1** (`npm view @hyperdag/trustshell version`). |
 | HAL quorum | **3 answering / 5 configured** (MEASURED 2026-10-06, `GET /api/v1/hal/stats` → `quorum_health`, 24-hour window). Not a constant 6. |
 | Chain | **Base Sepolia**, not mainnet. |
 | Grounding | **shadow** — does not mutate live RepID. |
@@ -206,14 +206,14 @@ npm install @hyperdag/trustshell
 
 This is the one live, published install today. It delivers Inspect, the hosted **HAL** check, **ERC-8004** RepID reads and range proofs, and **x402** payments with a spend guard, against the live backend (anything on-chain is on the Base Sepolia test network).
 
-The package does not carry the Next.js/React site. The 1.9.0 tarball is 165 files: `dist/`, the command shims in `bin/`, `scripts/init-pai.mjs`, `scripts/value-events.mjs`, `lib/interview.js`, and the README, changelog and license. Runtime dependencies are `@hyperdag/proof-verifier` (dynamically imported; degrades gracefully if the optional WASM build is absent), `@modelcontextprotocol/sdk` and `zod` (for the `trustshell-mcp` server), and `@noble/hashes` (the receipt hash). `ethers` is an **optional** peer dependency: install it (`npm i ethers@^6`) only if you sign x402 payments or call `verifySigner`. (`npm view @hyperdag/trustshell@1.9.0 dependencies peerDependencies dist.fileCount`)
+The package does not carry the Next.js/React site. The 1.9.1 tarball is 165 files: `dist/`, the command shims in `bin/`, `scripts/init-pai.mjs`, `scripts/value-events.mjs`, `lib/interview.js`, and the README, changelog and license. Runtime dependencies are `@hyperdag/proof-verifier` (dynamically imported; degrades gracefully if the optional WASM build is absent), `@modelcontextprotocol/sdk` and `zod` (for the `trustshell-mcp` server), and `@noble/hashes` (the receipt hash). `ethers` is an **optional** peer dependency: install it (`npm i ethers@^6`) only if you sign x402 payments or call `verifySigner`. (`npm view @hyperdag/trustshell@1.9.1 dependencies peerDependencies dist.fileCount`)
 
 ### Which package do I install?
 
 | If you're… | Install | What you get |
 |---|---|---|
 | A developer building an agent/app **in code** | `npm install @hyperdag/trustshell` | The SDK — Inspect, HAL verification, ERC-8004 RepID reads and x402 payments, in your TypeScript/JS |
-| Using an **AI tool** (Claude Desktop, Cursor, Claude Code), **no code** | `npm i -g @hyperdag/trustshell@1.9.0`, then point the tool at the `trustshell-mcp` bin (below) | The checks as AI-callable tools |
+| Using an **AI tool** (Claude Desktop, Cursor, Claude Code), **no code** | `npm i -g @hyperdag/trustshell@1.9.1`, then point the tool at the `trustshell-mcp` bin (below) | The checks as AI-callable tools |
 | Only verifying **ZK proofs** client-side | `npm install @hyperdag/proof-verifier` | Standalone checking of [Plonky3](https://github.com/Plonky3/Plonky3) proofs (Plonky3 is Polygon Labs' proof system). It is a dependency of `@hyperdag/trustshell`, so installing that installs this too — rarely installed directly |
 
 **Most people want `@hyperdag/trustshell`. The SDK, the CLI and the MCP server are all in that one package. `proof-verifier` is a separate package it depends on: npm installs it alongside, and the published tarball contains none of its files.**
@@ -223,7 +223,7 @@ The package does not carry the Next.js/React site. The 1.9.0 tarball is 165 file
 The MCP server is the `trustshell-mcp` bin inside `@hyperdag/trustshell`. A global install puts it on PATH:
 
 ```bash
-npm i -g @hyperdag/trustshell@1.9.0
+npm i -g @hyperdag/trustshell@1.9.1
 ```
 
 Then add it to your Claude Desktop / Cursor / Claude Code config:
@@ -232,21 +232,21 @@ Then add it to your Claude Desktop / Cursor / Claude Code config:
 { "mcpServers": { "trustshell": { "command": "trustshell-mcp" } } }
 ```
 
-In 1.9.0 its tools are `inspect_run` (Inspect over MCP; new in 1.9.0), `check_claim`, `verify_output`, `get_repid`, `getLeaderboard`, `present_proof`, `verify_proof`, `status`, `my_job` (the agent's role and allowed tools, read from its live grants), `kernel_receipt` (a policy-kernel receipt read back, hash checked locally, with its six claims; needs a REPID_API_KEY), `ground_quote` (`trustshell ground` for agents, with the source as text; local, no network), the quarantine tools `quarantine_list` and `quarantine_explain` (there is no release tool over MCP), the learning-loop tools `learn_lessons_for` and `learn_record` (local, no network; see "Learning loop v1" below), and the local `remember` / `recall` (plus deprecated aliases `verify`, `evaluate`, `repid` and `getRepID`). `learn_lessons_for` and `learn_record` are new in 1.8.0. `kernel_receipt`, `ground_quote`, `quarantine_list` and `quarantine_explain` came in 1.7.0; 1.6.1 had the rest, and 1.6.0 also lacked `my_job`. 1.6.0 and 1.6.1 also had a local redact tool; 1.7.0 removes it, because it let any connected agent delete the operator's keyed rows. Deleting stays at the CLI. Since 1.7.0, a note written through the MCP `remember` tool is untrusted and quarantined (see "Quarantine (immune system v0)" below). This tree also registers `inspect_run`, Inspect for agents: a run URL and the claims as text in, the same record, digest and card `trustshell check <runUrl> --claims "<text>"` produces out, deterministic and from api.github.com only. It is a different check from `check_claim`, which labels one sentence with a hosted, model-based check. 1.8.0 does not include it. It has no purchase tool; buying is the SDK's `executeA2A`. Since 1.7.0, every tool that reads the network answers `{untrusted_data, screening}`: data from outside your machine, never instructions. A string in it that reads as instructions is withheld and its place listed in `screening.withheld`.
+In 1.9.1 its tools are `inspect_run` (Inspect over MCP; new in 1.9.0), `check_claim`, `verify_output`, `get_repid`, `getLeaderboard`, `present_proof`, `verify_proof`, `status`, `my_job` (the agent's role and allowed tools, read from its live grants), `kernel_receipt` (a policy-kernel receipt read back, hash checked locally, with its six claims; needs a REPID_API_KEY), `ground_quote` (`trustshell ground` for agents, with the source as text; local, no network), the quarantine tools `quarantine_list` and `quarantine_explain` (there is no release tool over MCP), the learning-loop tools `learn_lessons_for` and `learn_record` (local, no network; see "Learning loop v1" below), and the local `remember` / `recall` (plus deprecated aliases `verify`, `evaluate`, `repid` and `getRepID`). `learn_lessons_for` and `learn_record` are new in 1.8.0. `kernel_receipt`, `ground_quote`, `quarantine_list` and `quarantine_explain` came in 1.7.0; 1.6.1 had the rest, and 1.6.0 also lacked `my_job`. 1.6.0 and 1.6.1 also had a local redact tool; 1.7.0 removes it, because it let any connected agent delete the operator's keyed rows. Deleting stays at the CLI. Since 1.7.0, a note written through the MCP `remember` tool is untrusted and quarantined (see "Quarantine (immune system v0)" below). This tree also registers `inspect_run`, Inspect for agents: a run URL and the claims as text in, the same record, digest and card `trustshell check <runUrl> --claims "<text>"` produces out, deterministic and from api.github.com only. It is a different check from `check_claim`, which labels one sentence with a hosted, model-based check. 1.8.0 does not include it. It has no purchase tool; buying is the SDK's `executeA2A`. Since 1.7.0, every tool that reads the network answers `{untrusted_data, screening}`: data from outside your machine, never instructions. A string in it that reads as instructions is withheld and its place listed in `screening.withheld`.
 
 The separate npm package `@hyperdag/trustshell-mcp` is older (1.0.0, published 2026-07-08). It has no `check_claim`. Use the bin above.
 
 ### Install straight from GitHub (no npm registry) — LIVE
 
-The SDK also installs directly from the repo. That gives you `main`, which can run ahead of the published 1.9.0 — useful for pinning a commit or as a registry-independent fallback:
+The SDK also installs directly from the repo. That gives you `main`, which can run ahead of the published 1.9.1 — useful for pinning a commit or as a registry-independent fallback:
 
 ```bash
 npm install github:DealAppSeo/trustshell
 # or pin a commit / branch:
 npm install github:DealAppSeo/trustshell#<commit-or-branch>
 ```
 
-The package ships a committed `dist/`, so there is no build step on your side, and the lean-package guarantee holds (no Next.js/React tree is pulled). That `dist/` is built from `main`, which can run ahead of the published release. For exactly what npm serves, install `@hyperdag/trustshell@1.9.0`.
+The package ships a committed `dist/`, so there is no build step on your side, and the lean-package guarantee holds (no Next.js/React tree is pulled). That `dist/` is built from `main`, which can run ahead of the published release. For exactly what npm serves, install `@hyperdag/trustshell@1.9.1`.
 
 ---
 
@@ -732,10 +732,10 @@ Run `trustshell --help` for the full reference.
 
 ## Agent skill
 
-OpenClaw, Claude, and Grok load [`skills/trustshell/SKILL.md`](skills/trustshell/SKILL.md). A global install of `@hyperdag/trustshell@1.9.0` puts `trustshell` and `trustshell-mcp` on PATH. Agents shell out to those bins. They do not call a new API.
+OpenClaw, Claude, and Grok load [`skills/trustshell/SKILL.md`](skills/trustshell/SKILL.md). A global install of `@hyperdag/trustshell@1.9.1` puts `trustshell` and `trustshell-mcp` on PATH. Agents shell out to those bins. They do not call a new API.
 
 ```bash
-npm i -g @hyperdag/trustshell@1.9.0
+npm i -g @hyperdag/trustshell@1.9.1
 
 trustshell verify "<claim>"
 trustshell repid <id>

components/test-agent-flow.tsx

@@ -27,7 +27,7 @@ const SECONDARY = `${BUTTON} border border-slate-600 text-white hover:border-sla
 /** Every status carries its word as well as its colour. */
 function Status({ value }: { value: string }) {
   const tone =
-    value === 'SUPPORTED' || value === 'ALLOWED'
+    value === 'SUPPORTED' || value === 'COMMAND_PASSED' || value === 'ALLOWED'
       ? 'border-emerald-500/60 text-emerald-300'
       : value === 'CONTRADICTED' || value === 'DENIED'
         ? 'border-red-500/60 text-red-300'
@@ -229,7 +229,7 @@ function PathTwo() {
         </a>
         .
       </p>
-      <Command text="npm i -g @hyperdag/trustshell@1.9.0" />
+      <Command text="npm i -g @hyperdag/trustshell@1.9.1" />
       <p className="text-sm text-[#cbd5e1]">Use a fresh TRUSTSHELL_HOME for each test, then, in your project:</p>
       <ol className="space-y-3">
         {PATH_TWO_COMMANDS.map((c, i) => (

dist/cli/trust-report.d.ts

@@ -1,5 +1,8 @@
 import { type SealableReceipt } from '../lib/owner-receipt';
-export declare const TRUST_REPORT_SCHEMA: "dev.trustshell.trust-report/0.1-draft";
+export declare const TRUST_REPORT_SCHEMA: "dev.trustshell.trust-report/0.2-draft";
+/** TrustShell 1.9.0 called a passed command SUPPORTED. `verify` rebuilds a report under its own schema, so a folder made then stays checkable. */
+declare const TRUST_REPORT_SCHEMA_0_1: "dev.trustshell.trust-report/0.1-draft";
+type ReportSchema = typeof TRUST_REPORT_SCHEMA | typeof TRUST_REPORT_SCHEMA_0_1;
 export declare const TRUST_REPORT_USAGE = "trustshell trust-report --out <new dir> [--record <record.json>]... [--bind \"<tool or script>=<claim>\"]... [--title <text>] [--json]\ntrustshell trust-report verify <dir> [--root <0x key>] [--json]";
 export declare const NOT_MEDIATED_ALWAYS = "Anything the agent did without `trustshell run`: edits it made directly, its own network calls, commands in another terminal. This report cannot see them.";
 export interface Bind {
@@ -40,12 +43,13 @@ export interface CommandRow {
 export interface BoundClaim {
     claim: string;
     decided_by: string;
-    status: 'SUPPORTED' | 'CONTRADICTED' | 'NOT_CHECKED';
+    /** COMMAND_PASSED is the most an exit code can stand for: TrustShell cannot tell whether a command tested anything. */
+    status: 'COMMAND_PASSED' | 'SUPPORTED' | 'CONTRADICTED' | 'NOT_CHECKED';
     why: string;
     record_seq: number | null;
 }
 export interface TrustReport {
-    schema: typeof TRUST_REPORT_SCHEMA;
+    schema: ReportSchema;
     title: string;
     generated_at: string;
     generator: string;
@@ -76,6 +80,8 @@ export interface TrustReport {
     exit: number;
 }
 export interface BuildInput {
+    /** Only `verify` sets this, to rebuild a report under the schema it was made with. */
+    schema?: ReportSchema;
     title: string;
     generatedAt: string;
     generator: string;