{
  "summary": "The code BotKelp supplies is gated, kept current, and independently verifiable. Nothing here is asserted that you cannot re-run yourself.",
  "gates": [
    {
      "name": "Types",
      "command": "npm run typecheck",
      "detail": "tsc --noEmit, strict mode"
    },
    {
      "name": "Lint",
      "command": "npm run lint",
      "detail": "eslint, zero errors permitted"
    },
    {
      "name": "Tests",
      "command": "npm test",
      "detail": "397 unit + integration tests"
    },
    {
      "name": "Build",
      "command": "npm run build",
      "detail": "tsc build"
    },
    {
      "name": "Generated project actually builds",
      "command": "npm run test:e2e",
      "detail": "a project built from every component runs a real npm install + next build"
    }
  ],
  "freshness": [
    "Daily freshness CI rebuilds every component and the full combination and runs `npm outdated` (component-freshness.yml).",
    "search_components returns a live `freshness` field (status / checkedAt / outdatedDependencies) so an agent can skip a component whose last build failed.",
    "check_component_updates reports when a newer, re-validated version of what you pinned is available.",
    "Dependabot opens grouped dependency + GitHub-Actions update PRs weekly."
  ],
  "provenance": "All catalog components cite three source types — docs, github-releases, github-examples — each a real URL with a verifiedAt date (and a commit SHA for examples), enforced by schema + test. Source of truth is https://github.com/botkelp/components. You can open the cited source and diff the generated code against the official pattern.",
  "security": [
    "npm audit runs daily and on every push; high/critical fail the build. Current state: 0 vulnerabilities.",
    "verify_scaffold runs untrusted, caller-supplied builds on an isolated GitHub Actions runner with no secrets and no repo token (permissions: {}), with a path-traversal guard and a hard timeout.",
    "Every user-scoped table has row-level security with auth.uid() policies, enforced by a test that fails the build if a policy is dropped.",
    "x402 (USDC) payments are verified against the facilitator before a tool runs and settled only after it succeeds.",
    "API keys are hashed at rest; raw keys are shown once, never stored or logged. Rate limiting and an explicit CORS allowlist on the HTTP host."
  ],
  "validateGenerated": {
    "note": "The scaffold BotKelp returns is ordinary source with exact version pins, a strict tsconfig, an ESLint config, and a real build. Point any standard third-party tool at it — you do not have to trust us.",
    "ownGuardrails": [
      "npm install",
      "npx tsc --noEmit",
      "npm run lint",
      "npm run build"
    ],
    "thirdParty": [
      "npm audit --audit-level=moderate",
      "npx osv-scanner --lockfile=package-lock.json",
      "npx @socketsecurity/cli scan create .",
      "npx snyk test",
      "trivy fs .",
      "npm outdated"
    ],
    "botkelpTools": [
      "verify_scaffold — real npm install + build on an isolated runner; returns OK / WAIT / FAIL with the compiler error",
      "search_components — freshness + sources fields to refuse a stale component",
      "check_component_updates — newer re-validated versions of what you use"
    ]
  },
  "reproduce": "Every figure above re-runs from a clean checkout. If a command disagrees with this page, trust the command.",
  "docs": "https://www.botkelp.com/trust"
}