Add durable ProofProgram and NodeKit proof binding

[HomenShum]

What changed

• adds the canonical proofloop.receipt/v1 envelope and authority rules
• adds a dependency-ordered durable ProofProgram over existing immutable runner plans
• enforces local read/proposal authority, budgets, attempt ceilings, lock recovery, resumable ledgers, and receipt hooks
• verifies NodeKit release proof against the exact candidate commit, compiled definition, config hash, discovery bytes, screenshot manifest, trace, and video receipts

Why

NodeKit needs an independent evidence substrate that can continue bounded proof work without trusting an agent's prose or introducing a second execution platform. The verifier must fail closed on authority, budget, candidate, config, receipt, or integrity drift.

Current status

• NodeProof evidence substrate: ready for independent PR review
• NodeKit E0 support: implemented for the committed UI packet
• Developer alpha/ease certification: not established by this PR
• Convex adapter/component/submission: not established by this PR
• external egress, publication, production promotion, and directory submission remain outside authority

Validation

• npm test: 30 test files and 174 tests passed
• TypeScript build and site bundle passed on the branch
• NodeKit committed screenshot, trace, and video evidence verifies independently

Deliberate limits

This PR proves evidence binding and verification mechanics. It does not prove that unfamiliar people or agents find NodeKit easy, that a Convex adapter satisfies reactive lifecycle guarantees, or that any package is ready for public submission.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
proofloop	Ready	Preview, Comment	Jul 21, 2026 10:25pm