# Five signals of "done on paper"

A report can say done while the thing the owner cares about is not live. Look for these.

| # | Signal | How to check |
|---|--------|--------------|
| 1 | The report names a repo, commit or PR but no URL. | Ask for the exact URL the owner would open. No URL, no done. |
| 2 | The URL was never fetched after the change; "it should be live". | Ask for a timestamped fetch. Run `proof_of_done.py --url URL --expect-status 200 --json` yourself. |
| 3 | The URL answers, but with the wrong thing: 404, an unexpected redirect, an old page. | Check the status and each redirect hop, and `--expect-text` for a phrase only the new version has. |
| 4 | A file or release is "published" but nobody compared bytes. | Compare the published sha256 with the one from the build: `--sha256 HEX`. |
| 5 | Evidence comes from the author's own machine (localhost, VPN, cache, logged-in browser). | Verify from a different network, and insist on a trusted TLS cert; a browser warning means not done. |

Rule of thumb: done = an observed response from the owner's URL, with a time, that you can re-run.
Synthetic card; it makes no claim about any specific vendor or incident.