From 20d5144ae0292aada9a07267e1fde3e5c273ab5e Mon Sep 17 00:00:00 2001 From: Boyd Cohen Date: Sun, 9 Aug 2026 00:39:32 -0600 Subject: [PATCH] chargeback-prevention: the proof does not survive every party going offline MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Page read end to end. It is the best-disclosed page on the site — every beat is labelled Real, Scripted or Mixed, and NeuralBridge is declared fictional in the paragraph that introduces it. Two defects, both in the same claim family. "Any third party with the authorization-proof JSON and NeuralBridge's published public key (via standard did:web resolution) can verify without runtime dependency on AT's or NeuralBridge's backend. The authorization proof survives every party going offline." The two halves contradict each other. did:web resolution is an HTTPS fetch against the issuer's domain, which the sentence itself names as how you get the key. If every party is offline, that resolution fails and you verify nothing — unless you already hold the DID document. Now says so, and keeps the strength: hold a copy and the proof verifies with every party offline. SIXTH AND SEVENTH VOCABULARY for the offline claim, both untagged: - "without runtime dependency on AT's or NeuralBridge's backend" (line 284) - "no runtime dependency" — bare, no object at all (line 299) The pattern added yesterday was "runtime dependency on (OP|us|Observer)", which required an object. Widened to "(no|without) runtime dependency". That is the fourth time this session the matcher knew one spelling of its subject, and the correct response each time was to widen from the site's own examples rather than to conclude the sweep was finished. Verified the new $requiresDisclosure check's pass on this page is genuine and not a false pass: the page names no deprecated package at all (grep count 0). Base case: untagging line 299 fails the check, restoring it passes. --- chargeback-prevention/index.html | 4 ++-- scripts/shared-copy.json | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/chargeback-prevention/index.html b/chargeback-prevention/index.html index 510e1ec..2e43d44 100644 --- a/chargeback-prevention/index.html +++ b/chargeback-prevention/index.html @@ -281,7 +281,7 @@

NeuralBridge issues an authorization proof

NeuralBridge signs the authorization proof with their own key, under their own DID. We provide the SDK; they do the signing. The authorization proof carries transaction details, a reference to the delegation credential, the authorization level, my principal DID, and NeuralBridge's signature.

-

Crucially: independently verifiable. Any third party with the authorization-proof JSON and NeuralBridge's published public key (via standard did:web resolution) can verify without runtime dependency on AT's or NeuralBridge's backend. The authorization proof survives every party going offline.

+

Crucially: independently verifiable. Any third party with the authorization-proof JSON and NeuralBridge's published public key (via standard did:web resolution) can verify without runtime dependency on AT's or NeuralBridge's backend at the moment of settlement. Resolving NeuralBridge's key by did:web does need their domain to answer; hold a copy of that DID document and the proof verifies with every party offline.

@@ -296,7 +296,7 @@

Dispute prevention & the NeuralBridge operations view

Imagine a dispute. Weeks later, the principal claims they didn't authorize the transaction. NeuralBridge presents the authorization proof. It cryptographically establishes: an approval was issued against this exact transaction, signed by the key the delegation names; the authorization was one-time; the delegation credential is valid; the scope matches; the timestamp is consistent. The dispute is resolved before it becomes a chargeback.

-

The operations view shows what NeuralBridge sees: the recorded transaction, four-line integration snippet (no API key, no runtime dependency -any third party can verify), stored authorization proof, and dispute prevention indicator. AI infra companies don't displace anything to adopt this -they add the trust layer.

+

The operations view shows what NeuralBridge sees: the recorded transaction, four-line integration snippet (no API key, no runtime dependency on us -any third party holding the issuer's key can verify), stored authorization proof, and dispute prevention indicator. AI infra companies don't displace anything to adopt this -they add the trust layer.

diff --git a/scripts/shared-copy.json b/scripts/shared-copy.json index b7c08e0..b3726f4 100644 --- a/scripts/shared-copy.json +++ b/scripts/shared-copy.json @@ -37,7 +37,8 @@ "trading.html", "verify.html", "integrate/index.html", - "blog/op-crossrail/index.html" + "blog/op-crossrail/index.html", + "chargeback-prevention/index.html" ], "phrases": [], "claimPatterns": [ @@ -53,7 +54,7 @@ "makes no network call at all", "our uptime", "permission from us", - "runtime dependency on (OP|us|Observer)" + "(no|without) runtime dependency" ], "claimPatternsAreRegex": "Case-insensitive regexes, matched by check-shared-copy.mjs. Written from the site's own examples rather than from one remembered sentence: the claim is spelled 'call back to us' on index.html and 'callback to Observer' on docs.html, and a literal lower-case list saw neither the capitalised heading nor the Observer variant. Four assertions were invisible to this block on 2026-08-09 for exactly that reason. When you add a home for the claim, add its WORDING here, not just its file.", "claimPatternNote": "Any occurrence of these in an HTML file MUST sit inside an element tagged data-shared-copy=\"offline-scope\". That is what makes a tenth instance a build failure rather than a discovery. Add the tag, or add the file to mustAppearIn if it is a new home for the claim. Some tagged instances REFER to the claim rather than asserting it (docs.html's resolution-hosting rationale is one). They are tagged anyway: the enumeration's job is to know everywhere the phrase appears, and a human scoping the claim decides per instance."