Add deterministic buyer demo proof path

[matt-dean-git]

Summary

• Add a deterministic public /sandbox#golden-path buyer proof path: 401 no authority, scoped authority, 200 allowed, 403 scope denial, 402 budget denial, revoke/replay denial, and proof artifact export.
• Route homepage proof CTAs to the deterministic path and Evidence Pack viewer.
• Add /protect buyer-safe proof CTAs and remove revocation overclaims from touched demo surfaces.
• Surface receipt IDs in the Evidence Pack viewer timeline.
• Update demo IA regression to require /sandbox#golden-path.

Verification

• npm run build
• npm run test:demo-ia
• strict touched-file claim/copy hygiene scan
• local HTTP route checks for /, /sandbox, /sandbox#golden-path, /protect, /evidence-pack-demo, JSON and schema assets
• outside-in browser check: homepage → Run authority proof → /sandbox#golden-path

Caveats

• No production deploy.
• No production mutation.
• This does not authorize production promotion.
• Budget-before-upstream remains response-shape proof, not keyed upstream counter/log-delta proof.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
satgate	Ready	Preview, Comment	Jun 27, 2026 5:54pm