Add dated verification proof

README.md

@@ -6,6 +6,14 @@ Agent Proof is a small TypeScript CLI for recording the checks run after an agen
 
 It has no runtime dependencies, does not call an AI service and does not send code anywhere.
 
+## Availability
+
+Version `0.1.0` is intended to be cloned and run from source; it is not a published npm package. Its [`package.json`](package.json) has `"private": true`, so npm will not publish this checkout.
+
+## Current verification
+
+The dated [verification record](docs/verification-2026-07-27.md) documents the commands run against this checkout on 2026-07-27: typechecking passed, all five tests passed, and the production-dependency audit reported zero vulnerabilities. It is a point-in-time record, not a claim about future clones, dependencies, or environments.
+
 ## What it records
 
 For each check, the report includes:
@@ -77,6 +85,18 @@ The selected output directory receives:
 
 The CLI exits `0` when every check passes, `1` when a check fails, times out or is disallowed, and `2` for invalid input or invocation.
 
+### Sample evidence excerpt
+
+This is the kind of concise result a reviewer sees in a generated report (values vary by run):
+
+```text
+## typecheck: PASSED
+- Command: `npm run typecheck`
+- Exit code: 0
+```
+
+The complete generated report includes the working directory, duration, stdout, and stderr; review it before relying on a result.
+
 ## Development
 
 ```bash

docs/verification-2026-07-27.md

@@ -0,0 +1,28 @@
+# Verification record — 2026-07-27
+
+This record reflects commands run locally in this repository on 2026-07-27. It is evidence of these command results in that environment only; it does not establish correctness, comprehensive security, or results in another clone or at a later time.
+
+## Results
+
+| Command | Result |
+| --- | --- |
+| `npm run typecheck` | Passed (TypeScript completed with no diagnostics) |
+| `npm test` | Passed: 5 tests passed; 0 failed, cancelled, skipped, or todo |
+| `npm audit --omit=dev` | `found 0 vulnerabilities` |
+
+## Sample evidence excerpt
+
+```text
+✔ records a passing command
+✔ records a failing command and its exit code
+✔ times out a command
+ℹ pass 5
+ℹ fail 0
+found 0 vulnerabilities
+```
+
+The test output above is abbreviated. The test suite also covers disallowed commands and redaction/truncation. The audit command omits development dependencies by design, so this result is not a full dependency-security assessment.
+
+## Distribution status
+
+This is a source/clone-run release at version `0.1.0`, not a published npm package. [`package.json`](../package.json) sets `"private": true`, which prevents npm publication from this checkout.