# Proof of Done (Carehab Open Duo, v0.1.0, MIT)

An agent says "deployed". This duo makes it show evidence. It has a skill
(advice to the agent), a verifier (`verifier/proof_of_done.py`, Python 3.8+,
stdlib only), a human card of five "done on paper" signals, and a video
storyboard/script (no video exists).

## Use

```
python3 verifier/proof_of_done.py --url https://example.com/ --expect-status 200 --json
```

Options: `--expect-redirect-to URL`, `--sha256 HEX` or `--sha256-file PATH`
(checksum of the fetched body, 5 MB cap), `--expect-text STR`, `--timeout S`
(per request, default 10), `--json`. Exit codes: 0 LIVE_VERIFIED, 1 FAIL or
CODE_ONLY, 2 usage error or refused target.

Behavior: TLS is verified with the default trust store and there is no bypass
flag. Redirects are not auto-followed; with `--expect-redirect-to` each hop is
reported (max 5) and the landing is checked; an undeclared redirect fails.
Non-http(s) schemes, URLs with credentials and private/loopback/link-local
targets are refused (exit 2). `--allow-local` lifts only the address guard and
is for tests only.

## Install (proven scope: Claude Code only)

Copy `skills/proof-of-done/` to `~/.claude/skills/proof-of-done/` (or
`<project>/.claude/skills/proof-of-done/`) and keep the verifier where the agent
can run it.

## Test

```
./run_tests.sh
```

Tests start a synthetic local server (`fixtures/serve_fixture.py`). The TLS
test needs `openssl` and is skipped otherwise.
`tests/live_example_output.txt` is one captured real run against
https://aicarehab.com/; `tests/test_output.txt` is a captured test run.

## What it does NOT claim

- Not an enforcement gate: SKILL.md is advice, nothing forces an agent to run it.
- Not cross-agent compatible beyond the tested Claude Code skill directory.
- LIVE_VERIFIED means the URL answered as expected once, at the timestamp shown.
- Does not check content correctness beyond your text/checksum expectations, and
  cannot detect a server that answers differently per client.
- No video has been produced.

## Privacy

The verifier contacts only the URL you give it (and redirect targets it
reports). It sends no telemetry, stores nothing and reads no local files except
the optional `--sha256-file`.

## Trust model (who runs the verifier)

- The verifier lives in `verifier/`, outside `skills/<name>/`. The Claude Code skill-directory install copies only `SKILL.md`; run the verifier from the unpacked zip.
- A verifier result counts as evidence only when a human or CI ran it. If the agent runs its own verifier, the output is still an agent claim.
- The sha256 values in `manifest.json` and on the website are served from the same origin as the files: they detect corruption, not a compromised host. Nothing here is labelled "verified" by a third party.
- The verifier declarations in `manifest.json` (`tools_permissions`) are documentation, not an enforced sandbox.
- No wellbeing or effectiveness effect is claimed for any artifact in this package.