chargeback-prevention: the proof does not survive every party going offline - #33
Merged
Conversation
…ffline Page read end to end. It is the best-disclosed page on the site — every beat is labelled Real, Scripted or Mixed, and NeuralBridge is declared fictional in the paragraph that introduces it. Two defects, both in the same claim family. "Any third party with the authorization-proof JSON and NeuralBridge's published public key (via standard did:web resolution) can verify without runtime dependency on AT's or NeuralBridge's backend. The authorization proof survives every party going offline." The two halves contradict each other. did:web resolution is an HTTPS fetch against the issuer's domain, which the sentence itself names as how you get the key. If every party is offline, that resolution fails and you verify nothing — unless you already hold the DID document. Now says so, and keeps the strength: hold a copy and the proof verifies with every party offline. SIXTH AND SEVENTH VOCABULARY for the offline claim, both untagged: - "without runtime dependency on AT's or NeuralBridge's backend" (line 284) - "no runtime dependency" — bare, no object at all (line 299) The pattern added yesterday was "runtime dependency on (OP|us|Observer)", which required an object. Widened to "(no|without) runtime dependency". That is the fourth time this session the matcher knew one spelling of its subject, and the correct response each time was to widen from the site's own examples rather than to conclude the sweep was finished. Verified the new $requiresDisclosure check's pass on this page is genuine and not a false pass: the page names no deprecated package at all (grep count 0). Base case: untagging line 299 fails the check, restoring it passes.
✅ Deploy Preview for observerprotocol ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
chargeback-prevention/index.htmlread end to end. It is the best-disclosed page on the site — every beat is labelled Real, Scripted or Mixed, and NeuralBridge is declared fictional in the paragraph that introduces it. Two defects, both in the same claim family.The contradiction
The two halves contradict each other.
did:webresolution is an HTTPS fetch against the issuer's domain — which the sentence itself names as how you get the key. If every party is offline, that resolution fails and you verify nothing, unless you already hold the DID document.Now says so, and keeps the strength: hold a copy and the proof verifies with every party offline.
Sixth and seventh vocabulary for the offline claim
Both untagged:
without runtime dependency on AT's or NeuralBridge's backend(line 284)no runtime dependency— bare, no object at all (line 299)The pattern added yesterday was
runtime dependency on (OP|us|Observer), which required an object. Widened to(no|without) runtime dependency.That is the fourth time this session the matcher knew one spelling of its subject, and the correct response each time was to widen from the site's own examples rather than conclude the sweep was finished.
Verifying the new check's pass was genuine
$requiresDisclosurepassed on this page. Confirmed that is a real pass and not a silent one: the page names no deprecated package at all (grep count 0). A check that passes because its subject is absent is not the same as a check that passes because its subject is disclosed.Base case: untagging line 299 fails the check, restoring it passes. All three checks green; block count 13 → 14.