{"content":[{"text":"/sandbox/repo\ntotal 16\ndrwxr-xr-x 3 root root 4096 Sep 18 08:00 .\ndrwxr-xr-x 7 root root 4096 Sep 19 15:31 ..\ndrwxr-xr-x 8 root root 4096 Sep 18 08:00 .git\n-rw-r--r-- 1 root root  408 Sep 18 08:00 .gitignore\n---\nPI_CODING_AGENT=true\nPI_REASONING_LEVEL=medium\nPI_SESSION_FILE=/sandbox/.gauge/pi/sessions/2026-09-19T15-31-09-427Z_01a0ba4a-f3f3-75a5-a2c8-6ebaf6096a73.jsonl\nPI_PROVIDER=gauge-fireworks\nPI_MODEL=accounts/fireworks/models/qwen3p8-max\nPI_SESSION_ID=01a0ba4a-f3f3-75a5-a2c8-6ebaf6096a73\nPI_GATEWAY_API_KEY=unused\n","type":"text"}]}

cd /tmp; for u in https://workproof.com https://workproof.io https://www.workproof.com https://docs.workproof.com; do echo "== $u"; curl -sS -m 10 -o /dev/null -w "%{http_code} %{url_effective}\n" -L "$u" 2>&1 | tail -2; done

{"content":[{"text":"== https://workproof.com\n502 https://workproof.com/\n== https://workproof.io\ncurl: (6) Could not resolve host: workproof.io\n000 https://workproof.io/\n== https://www.workproof.com\n502 https://www.workproof.com/\n== https://docs.workproof.com\n502 https://docs.workproof.com/\n","type":"text"}]}

cd /tmp; for q in "workproof" "workproof-api"; do echo "== npm $q"; curl -sS -m 15 "https://registry.npmjs.org/-/v1/search?text=$q&size=5" | head -c 1500; echo; done; echo "== pypi"; curl -sS -m 15 "https://pypi.org/search/?q=workproof" -o /dev/null -w "%{http_code}\n"; curl -sS -m 15 "https://pypi.org/pypi/workproof/json" | head -c 500

{"content":[{"text":"== npm workproof\n{\"objects\":[{\"downloads\":{\"monthly\":1654,\"weekly\":295},\"dependents\":0,\"updated\":\"2026-09-17T22:26:20.333Z\",\"searchScore\":892.70044,\"package\":{\"name\":\"workproof\",\"keywords\":[\"git\",\"git-blame\",\"engineering-report\",\"verifiable\",\"proof-of-work\",\"portfolio\",\"resume\",\"hiring\",\"career\",\"authorship\",\"code-ownership\",\"surviving-lines\",\"engineering-evidence\",\"in-toto\",\"sigstore\",\"attestation\",\"github-action\",\"cli\"],\"version\":\"0.4.2\",\"description\":\"Turn a private git repository into a verifiable engineering report for one author, without showing any code: thirteen figures from git, a hash anyone can recompute offline, verify, and an in-toto attestation.\",\"sanitized_name\":\"workproof\",\"publisher\":{\"email\":\"npm-oidc-no-reply@github.com\",\"trustedPublisher\":{\"oidcConfigId\":\"oidc:cb2b3339-babc-4f31-bc2e-502764f32d33\",\"id\":\"github\"},\"username\":\"GitHub Actions\"},\"maintainers\":[{\"email\":\"efegenc95@gmail.com\",\"username\":\"efegenc\"}],\"license\":\"MIT\",\"date\":\"2026-09-12T21:16:15.618Z\",\"links\":{\"homepage\":\"https://github.com/Bubblegunn/workproof#readme\",\"repository\":\"git+https://github.com/Bubblegunn/workproof.git\",\"bugs\":\"https://github.com/Bubblegunn/workproof/issues\",\"npm\":\"https://www.npmjs.com/package/workproof\"}},\"score\":{\"final\":892.70044,\"detail\":{\"popularity\":1,\"quality\":1,\"maintenance\":1}},\"flags\":{\"insecure\":0}},{\"downloads\":{\"monthly\":33,\"weekly\":6},\"dependents\":\"1\",\"updated\":\"2026-09-14T21:26:30.129Z\",\"searchScore\":139.81535,\"package\":{\"name\":\"@gtcx/workproof\",\"keywords\":[],\"version\":\"1.0\n== npm workproof-api\n{\"objects\":[{\"downloads\":{\"monthly\":1654,\"weekly\":295},\"dependents\":0,\"updated\":\"2026-09-17T22:26:20.333Z\",\"searchScore\":71.53977,\"package\":{\"name\":\"workproof\",\"keywords\":[\"git\",\"git-blame\",\"engineering-report\",\"verifiable\",\"proof-of-work\",\"portfolio\",\"resume\",\"hiring\",\"career\",\"authorship\",\"code-ownership\",\"surviving-lines\",\"engineering-evidence\",\"in-toto\",\"sigstore\",\"attestation\",\"github-action\",\"cli\"],\"version\":\"0.4.2\",\"description\":\"Turn a private git repository into a verifiable engineering report for one author, without showing any code: thirteen figures from git, a hash anyone can recompute offline, verify, and an in-toto attestation.\",\"sanitized_name\":\"workproof\",\"publisher\":{\"email\":\"npm-oidc-no-reply@github.com\",\"trustedPublisher\":{\"oidcConfigId\":\"oidc:cb2b3339-babc-4f31-bc2e-502764f32d33\",\"id\":\"github\"},\"username\":\"GitHub Actions\"},\"maintainers\":[{\"email\":\"efegenc95@gmail.com\",\"username\":\"efegenc\"}],\"license\":\"MIT\",\"date\":\"2026-09-12T21:16:15.618Z\",\"links\":{\"homepage\":\"https://github.com/Bubblegunn/workproof#readme\",\"repository\":\"git+https://github.com/Bubblegunn/workproof.git\",\"bugs\":\"https://github.com/Bubblegunn/workproof/issues\",\"npm\":\"https://www.npmjs.com/package/workproof\"}},\"score\":{\"final\":71.53977,\"detail\":{\"popularity\":1,\"quality\":1,\"maintenance\":1}},\"flags\":{\"insecure\":0}},{\"downloads\":{\"monthly\":33,\"weekly\":6},\"dependents\":\"1\",\"updated\":\"2026-09-14T21:26:30.129Z\",\"searchScore\":32.149258,\"package\":{\"name\":\"@gtcx/workproof\",\"keywords\":[],\"version\":\"1.0.4\n== pypi\n200\n{\"message\": \"Not Found\"}","type":"text"}]}

cd /tmp; curl -sS -m 20 "https://registry.npmjs.org/workproof" > wp.json; python3 -c "
import json
d=json.load(open('wp.json'))
print('versions:', list(d['versions'].keys()))
print('bin:', d['versions']['0.4.2'].get('bin'))
print('deps:', d['versions']['0.4.2'].get('dependencies'))
print('desc:', d['description'][:300])
"

{"content":[{"text":"versions: ['0.1.0', '0.1.1', '0.1.2', '0.1.3', '0.2.0', '0.3.0', '0.3.1', '0.4.0', '0.4.1', '0.4.2']\nbin: {'workproof': 'dist/src/cli.js'}\ndeps: {'surviving-lines': '^0.1.1'}\ndesc: Turn a private git repository into a verifiable engineering report for one author, without showing any code: thirteen figures from git, a hash anyone can recompute offline, verify, and an in-toto attestation.\n","type":"text"}]}

{"content":[{"text":"621 wp_readme.md\n<p align=\"center\"><img src=\"assets/wordmark.svg\" width=\"480\" alt=\"workproof\"></p>\n\n<p align=\"center\">English | <a href=\"README.tr.md\">Türkçe</a></p>\n\n<p align=\"center\"><em>Your best work is in private repos. Prove it anyway.</em></p>\n\n<p align=\"center\">\n  <img src=\"https://img.shields.io/npm/v/workproof?style=flat-square&color=111111&label=npm\" alt=\"npm\">\n  <img src=\"https://img.shields.io/npm/dm/workproof?style=flat-square&color=111111\" alt=\"npm downloads\">\n  <img src=\"https://img.shields.io/github/actions/workflow/status/Bubblegunn/workproof/ci.yml?style=flat-square&color=111111&label=ci\" alt=\"ci\">\n  <img src=\"https://img.shields.io/github/stars/Bubblegunn/workproof?style=flat-square&color=111111\" alt=\"stars\">\n  <img src=\"https://img.shields.io/badge/license-MIT-111111?style=flat-square\" alt=\"MIT\">\n  <a href=\"https://doi.org/10.5281/zenodo.22394558\"><img src=\"https://img.shields.io/badge/DOI-10.5281%2Fzenodo.22394558-111111?style=flat-square\" alt=\"DOI\"></a>\n</p>\n\nworkproof turns a git repository into a verifiable engineering report for one author,\nwithout showing any code. You run it in the repository you cannot share. The reader gets\nthirteen figures, the exact command behind each one, what each one cannot show, and a\nhash that anyone can recompute offline. It is not a productivity metric: it measures what\nsurvived and what was touched, and it prints its own limits under every number.\n\n## 30 seconds\n\n```\ncd your-private-repo\nnpx workproof\n```\n\nThat writes `workproof-report.md` (paste it into a résumé, a portfolio, a visa\napplication) and `workproof-report.json` (for tools, and for verification). This is the\nreal transcript of the run behind the example below, on a clone of\n[langchain-ai/openwiki](https://github.com/langchain-ai/openwiki) at `1e6d54c`:\n\n```\n$ npx workproof --author \"Colin Francis\" --sample 5\nfingerprint key 9dc900a6227a1faaaa17d774565afbf3 (keep it to compare reports or to verify the fingerprint; it is not stored)\nopenwiki: reading history...\nopenwiki: 369 commits read\nopenwiki: blaming files (1 in 5 sample)...\nopenwiki: blamed 123 of 547 files\nwrote workproof-report.md and workproof-report.json in 2.7s\n\n$ npx workproof check workproof-report.json\nschema ok\nhash ok 63d4fd1373b06b090086a653d52dfed234edcf35645bce3a34137a0447049355\n\n$ npx workproof verify workproof-report.json --fingerprint-key 9dc900a6227a1faaaa17d774565afbf3\nschema ok\nhash ok 63d4fd1373b06b090086a653d52dfed234edcf35645bce3a34137a0447049355\nopenwiki: fingerprint ok\nall figures reproduce\n```\n\n`check` needs the JSON and nothing else. `verify` needs the repository.\n\n## What a report looks like\n\nReal output for one maintainer of openwiki at `1e6d54c`, run on 6 September 2026 with\n`--author \"Colin Francis\" --sample 5`, paths and emails hidden (the defaults). Under every\nfigure the full report also prints `How:` with the git command and `What this cannot show:`;\n","type":"text"}]}

{"content":[{"text":"12:  <img src=\"https://img.shields.io/badge/license-MIT-111111?style=flat-square\" alt=\"MIT\">\n319:  --certificate-oidc-issuer https://token.actions.githubusercontent.com \\\n346:  endpoint you choose (`WORKPROOF_API_URL`, `WORKPROOF_API_KEY`, `WORKPROOF_MODEL`;\n373:--badge                 also write <out>.badge.json, a shields.io endpoint document\n389:[shields.io endpoint format](https://shields.io/badges/endpoint-badge):\n398:![workproof](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/<you>/<repo>/main/workproof-report.badge.json&style=flat-square)\n420:  id-token: write # only for attest: \"true\"\n","type":"text"}]}

{"content":[{"text":"22:## 30 seconds\n56:## What a report looks like\n64:## openwiki\n70:### Tenure window\n73:### Share of commits in tenure\n76:### Cadence\n80:### Footprint\n85:### Test-file changes and documents created\n89:### Files authored\n92:### Major-contributor components\n95:### Commit size\n98:### Co-authored commits\n101:### Absence factor\n104:### AI-assisted commits\n107:### Surviving lines at HEAD\n110:### Survival by cohort\n121:## When someone reformatted the code\n148:## When you are two people\n179:## Names that are not ASCII\n221:## In plain language\n240:## What it measures\n261:## How verification works\n331:## Privacy\n350:## Options\n386:## Badge\n404:## GitHub Action\n446:## Gaming and bias\n515:### Bot identities\n530:## For candidates\n537:## For hiring managers\n544:## For visa and immigration evidence\n551:## What it does not do\n556:## What the research says about numbers like these\n578:## Where it comes from\n587:## Thanks\n602:## Cite this\n614:## Development\n=== usage section ===\n","type":"text"}]}

{"content":[{"text":"## Privacy\n\n- No code content, ever. The tool reads `git log --numstat` and `git blame` and emits counts.\n- No file paths by default. `--paths` adds directory names at the configured `--depth`\n  (default 2), never files.\n- No email addresses by default. `--emails` adds them; without it, even the `--author` you\n  typed is replaced by `(email hidden)` in the stored parameters. GitHub noreply addresses\n  (`<id>+<login>@users.noreply.github.com`) are never written, with or without the flag,\n  because the login is in the local part.\n- Non-subject names are never written. The absence-factor figure carries counts only.\n- The fingerprint is `HMAC-SHA256(key, root commit + remote)` under a 16-byte key generated\n  per report. The key is printed once and stored nowhere, so a public repository cannot be\n  looked up from its fingerprint. Pass `--fingerprint-key` to reuse a key across reports of\n  the same repository.\n- The optional narrative (`--narrate`) sends the figures, and only the figures, to a model\n  endpoint you choose (`WORKPROOF_API_URL`, `WORKPROOF_API_KEY`, `WORKPROOF_MODEL`;\n  OpenAI-compatible or Anthropic). The paragraph is appended under \"Generated narrative\n  (not verified)\" and is excluded from the hash.\n\n## Options\n\n```\n\n[270 more lines in file. Use offset=353 to continue.]","type":"text"}]}