An agent prepares a branch
The public branch is feat-site. Its recorded head is eb5f834ab238530a22abe64f07a0680428d95be3. The work stays in a separate checkout until the gate passes.
About / A process you can inspect
Agents wrote it.
You can check it.
FLOP asks users to trust proofs of inference. We built tools to ask what those proofs establish. The same question applies to our own work: what can a reader check?
Written by agents. Published through a gate.
Each build agent works from a written brief in its own checkout. It records decisions and checkpoints on disk. Agents cannot push a branch, open a pull request or hold the signing key.
A separate publisher refuses changes without green builds, tests, plain claims and stated limits. It publishes the branch and signs a list of the changed file hashes. A person reviews and merges.
One real contribution
The site shell, from branch to merge.
Recorded from GitHub's public API ↗
Pull request 8
feat(web): add shared site shell and tool registry ↗
44 file hashes in the signed manifest. The signature covers the published branch head below.
feat-site / eb5f834ab238530a22abe64f07a0680428d95be3
Reading guide
Follow the published record.
The line tracks your place in this explanation.
The gate checks the change
Install, lint, type checks, tests and production builds must pass for the final commit. The publisher also checks wording, scope and the package README. The PR body records the checks that were run.
The publisher signs the file list
The manifest names 44 file hashes. Its Ed25519 signature starts KK3jF9INsbG_jlcl. The full signed bytes are available below.
A person merges
GitHub records zkasuran merging this pull request at 2026-11-05T15:02:27Z. The merge commit is 88d72d7297a34aba1d2444b83921b5d8b0b2d55c. This is GitHub metadata. The contribution signature covers the branch head, not this merge record.
You check the signature
Your browser uses the existing contribution verifier to check the pinned public key, signed branch and recorded head. Try changing a byte below. Reading this far does not count as verification.
Check it here.
This result is computed in your browser from the recorded proof. It is not a saved PASS label.
Checking the recorded signature locally...
What trust rests on
A signature is a starting point.
It binds the signed text to the publisher's public key. It does not make the code right.
Check the code and the deployed build.
Every published pull request carries a signature and a recipe for checking it. The signed deployment carries /SIGNATURE.json for the repository. The contribution verifier checks that build manifest against the deployed commit. An unsigned local build is labelled as such.
Tests check behavior. Mutation checks deliberately break logic to see whether tests catch it. Run the tools yourself and keep the source time with the result.
What this does not verify
The browser checks signed manifest bytes. It does not download and hash repository files. A pull request manifest covers changed files, not the whole repository. Merge details and capture times are recorded GitHub metadata, not signed claims.
A valid signature does not prove code safety, a person's identity, inference correctness or network finality. A green gate records checks that passed. It is not a proof that every defect was found.