feat(proof): public per-repo proof summary, endpoint and README badge (#9569) (#9608)

* feat(proof): public per-repo proof summary, endpoint and README badge (#9569)

The shareable, unauthenticated twin of the in-app trust panel. One
composition serves both, so the public page and #9193's panel cannot
disagree about a figure -- which is the property the page exists to
demonstrate.

THE PRIVACY BOUNDARY IS STRUCTURAL. Every field is built by NAMING it,
never by filtering a wider object. A blocklist has to anticipate every
field a future upstream type might grow and silently leaks the one it did
not; an allowlisted shape cannot leak a field nobody wrote down. Tested by
feeding hostile records carrying hotkey/wallet/reward/trust-score/private-
rank and asserting none of it reaches the serialized page -- while the
named fields do, so the test proves allowlisting rather than an empty
object.

NEVER A BARE SCALAR. Any accuracy figure carries its coverage and a Wilson
interval; below a 20-decision floor there is no rate at all, only an
explicit insufficient_data state that still publishes the count. A perfect
record over 19 decisions must not render as 100%. Wilson rather than Wald
because a gate metric lives near p->1, exactly where Wald claims
impossible certainty.

HONEST BOUNDARY STATES. An empty ledger is `empty`, not `verified` --
different claims. A failed read is `unavailable`, not `broken`, which
would accuse the operator of tampering. A FAILED anchor attempt is not an
anchor: the public attempt log is where failures are legible, and
presenting one here would claim corroboration that does not exist. The
verification-contract boundary statement travels IN the payload, so a
screenshot or embed cannot shed it the way a footer caption can.

The badge reports the LEDGER's state rather than an accuracy percentage: a
badge is a one-glance claim, and an accuracy number without the interval
that makes it honest does not fit in one. Disabled and errored both render
a neutral SVG -- a broken image in a README is worse than an honest
"unavailable".

DECISION (requirement 6), recorded beside the code that implements it: the
page is opt-OUT per repo, default ON once the operator's fleet-wide flag
(default OFF) is on. Every figure is already publicly fetchable through
the ledger-verify / anchors / decision-record endpoints, so gating a page
over it would add friction without privacy. The per-repo switch still
exists because a page is a different artifact from an API -- discoverable,
linkable, and it markets a repo's numbers whether or not the maintainer
wants that. A repo can opt out but cannot opt IN when the operator has
not, which keeps the fleet switch a real switch.

Found and fixed while testing: `DB.prepare()` throws SYNCHRONOUSLY on a
driver-level failure, so the `.catch()` chain never ran and a D1 outage
would have 503'd the whole public page instead of degrading. Each section
is now a real try/catch, which is the difference between the
fail-safe-per-section contract being documented and being true.

Backend half of #9569; the /proof/:owner/:repo UI route renders this
payload and lands separately.

* fix(proof): actually wire the per-repo opt-out the routes only claimed to honor (#9569)

Review caught the real defect: both handlers called
isProofPageEnabledForRepo(c.env) with no second argument, so the
ProofPageRepoOverride documented at length in proof-summary.ts and in the
PR body was never loaded or passed. Every repo was effectively
opt-out-less once the fleet flag was on -- a gate that is described,
typed, and unit-tested as a pure function, but never reachable from the
surface it governs. That is the registered-but-unreachable class, and the
long comment made it worse rather than better by making it look done.

- Adds a real `publicProof:` focus-manifest block (engine parser + toJson
  + loader snapshot), mirroring `publicStats:`/`ops:`. Precedence is
  deliberately the opposite of those two: read from the TARGET repo's
  manifest rather than the operator's self-repo, because the thing being
  opted out of is that repo's own page.
- loadProofPageRepoOverride resolves it, degrading a failed manifest load
  to "no override" -- a broken manifest never takes a page DOWN, which is
  the failure direction worth accepting here and is now stated in the
  doc comment rather than left implicit.
- Both routes load the override BEFORE anything else, so a repo that
  turned its page off does not have its decision records queried to build
  a summary that will be discarded.
- Documents the block in .loopover.yml.example, including the precedence
  and the opt-out default.

Tests that would have caught it: a repo opting out in its manifest now
gets 404 from BOTH routes with the fleet flag on, while a different repo
in the same fleet still serves 200 (the opt-out is per repo, not a kill
switch); explicit opt-in and no-block-at-all both serve; and the resolver
is covered across absent/explicit/failing loads.

* fix(build): build @loopover/contract in ui:build, unbreaking the Cloudflare Workers build

The Workers build for loopover-ui has been failing on every PR since #9521
(merged as #9590) made src/openapi/schemas.ts import
@loopover/contract/public-api:

  Cannot find module '.../node_modules/@loopover/contract/dist/public-api.js'
    imported from /opt/buildhome/repo/src/openapi/schemas.ts

ui:build builds ui-kit and engine, then runs ui:openapi -- but never builds
the contract package, so the import resolves to a dist/ that does not
exist. CI did not catch it because the GitHub workflow has its own
separate "Build contract package" step (ci.yml:361) before the drift
checks; the Cloudflare build runs npm run build:cloudflare -> ui:build
directly and gets no such step. The two paths had silently diverged.

Add @loopover/contract to the same turbo invocation that already builds
the engine, so the one script both paths share produces everything
ui:openapi imports.

Reproduced locally by deleting packages/loopover-contract/dist and running
ui:openapi (identical ERR_MODULE_NOT_FOUND), then confirmed the fixed
chain builds the package and writes the spec with no drift.

* fix(manifest): register publicProof as a known top-level field, and sync the example template

Two failures from the #9569 manifest block, both mine.

1. The unknown-top-level-field validator never learned about `publicProof`,
   so every manifest carrying it warned "Manifest contains unknown
   top-level field: publicProof." That was invisible on the first pass and
   appeared on every LATER one, because the first pass parses a manifest
   with no such key while later passes reload the persisted snapshot --
   which my loader change now serializes the field into. The warning lands
   in the published review comment, so an unchanged PR got a fresh comment
   PATCH on every regate sweep: exactly the #3379 churn that test exists to
   prevent, reintroduced by a field the writer knew about and the reader
   did not.

   Found by instrumenting the test's PATCH interception to diff the two
   comment bodies rather than guessing at the cause; the added line named
   itself.

2. config/examples/loopover.full.yml must mirror .loopover.yml.example
   from "WHERE IT LIVES" onward, and I documented the block in only one of
   the two.

Verified against origin/main first to confirm both were regressions from
this branch rather than pre-existing.

* test(proof): close the patch-coverage gaps, and fix a second sync-throw the gap exposed

Codecov flagged 8 uncovered changed lines across focus-manifest.ts and
routes.ts. I had measured coverage on proof-summary.ts and proof-badge.ts
only, and never on the two files the manifest block and the routes
actually touched -- so the gap was in my own verification, not just the
tests.

Closing it turned up a real defect rather than only missing assertions:
loadProofPageRepoOverride used `.catch()` on the injected manifest loader,
so a loader throwing SYNCHRONOUSLY (a driver-level failure before it ever
returns a promise) skipped the handler entirely and would have escaped to
the route -- 503ing a public page over a manifest read that is supposed to
be optional. That is the same defect this file already had in
loadProofSummary's section reads, which I fixed there and then
reintroduced here. Now a real try/catch, with a regression test using a
synchronously-throwing loader.

Coverage:
- parsePublicProofConfig / publicProofConfigToJson: explicit on/off, a
  present-but-empty block (present-but-false, which the resolver keys on),
  absence, three non-mapping shapes warning rather than throwing, and a
  snapshot round-trip.
- A regression test asserting publicProof is a KNOWN top-level field, so
  the writer/reader split behind the #3379 regate churn cannot return.
- The two route 503 arms are unreachable today (every inner read is
  individually fail-safe), so they are excluded with the house v8 pragma
  and a note on why they are kept: a future unguarded read should degrade
  to 503 rather than 500 on an unauthenticated public route. The badge arm
  uses ignore start/stop -- `next 2` miscounts across a multi-line comment
  and left the return uncovered.

All three changed files now report zero uncovered changed lines.

* refactor(proof): one shared resolver for both surfaces, and delete the unreachable arms

Replaces the coverage pragmas with the fix they were papering over.

The gate, the read and the outcome now live in ONE resolver
(resolveProofPage) that both handlers render. That is not tidiness: the
gate previously lived inline in both route bodies and exactly one of them
was wired to the per-repo opt-out, which is the defect review caught. A
shared resolver makes "the page and the badge agree about whether this
repo is published" true by construction instead of by two call sites
remembering the same thing.

With that in place the two 503 arms were provably unreachable, because
loadProofSummary is TOTAL -- every read is wrapped per section, so a
failing ledger/anchor/record read degrades to that section's honest
neutral state and the page still composes. Rather than excluding dead
branches from coverage, the outcome is gone from the type: ProofPageResult
is `ok | disabled`. A test asserts the totality directly -- every
dependency failing at once, including a DB binding that throws on property
access, still resolves to a rendered page in its neutral states.

Same treatment for buildProofAccuracy's `!interval` guard: wilsonInterval
returns null exactly when there are no trials, which IS the
nothing-decided case, so one reachable guard covers both reasons a rate is
unpublishable instead of a dead branch behind a pragma.

Net: no `v8 ignore` pragmas anywhere in the #9569 code, and zero
uncovered changed lines or branches across proof-summary.ts, routes.ts and
focus-manifest.ts.

---------

Co-authored-by: loopover-orb[bot] <296761690+loopover-orb[bot]@users.noreply.github.com>

Author: JSONbored

.loopover.yml.example

@@ -1493,3 +1493,17 @@ settings:
 #   # To stop trusting a peer, remove its key -- that is the whole revocation story, by design.
 #   peerKeys:
 #     - 0000000000000000000000000000000000000000000000000000000000000000
+
+# Public proof page (#9569) — the shareable, unauthenticated per-repo verification page
+# (`/proof/<owner>/<repo>`) and its README badge.
+#
+# OPT-OUT, not opt-in. Every figure the page renders is ALREADY publicly fetchable through the
+# ledger-verify, anchors and decision-record endpoints, so gating a page over data anyone can already
+# curl would add friction without adding privacy. This block exists because a page is nonetheless a
+# different artifact from an API: it is discoverable, linkable, and it markets this repo's numbers.
+#
+# Precedence: the operator's fleet-wide LOOPOVER_PUBLIC_PROOF flag must be on first. This block can turn
+# THIS repo's page OFF; it cannot turn one ON that the operator has not enabled. Omit the block entirely
+# to keep the page on once the operator enables it.
+# publicProof:
+#   enabled: false   # Bool. Default when the block is absent: true (opt-out).

apps/loopover-ui/public/openapi.json

@@ -26299,6 +26299,82 @@
           }
         }
       }
+    },
+    "/v1/public/repos/{owner}/{repo}/proof": {
+      "get": {
+        "operationId": "getPublicRepoProof",
+        "tags": [
+          "Public"
+        ],
+        "summary": "Public proof summary for one repo — ledger status, anchor, calibration with coverage and interval, sample records",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "owner",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "repo",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "ProofSummary. Any accuracy figure carries its coverage AND a Wilson confidence interval; below the sample floor it is an explicit `insufficient_data` state, never a bare percentage. Carries the verification-boundary statement in the payload"
+          },
+          "404": {
+            "description": "The proof page is disabled fleet-wide, or this repo has opted out"
+          },
+          "503": {
+            "description": "Composition failed — no partial or fabricated summary is served"
+          }
+        }
+      }
+    },
+    "/v1/public/repos/{owner}/{repo}/proof-badge.svg": {
+      "get": {
+        "operationId": "getPublicRepoProofBadge",
+        "tags": [
+          "Public"
+        ],
+        "summary": "README badge for the proof page — reports the ledger's state, never a bare accuracy percentage",
+        "parameters": [
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "owner",
+            "in": "path"
+          },
+          {
+            "schema": {
+              "type": "string"
+            },
+            "required": true,
+            "name": "repo",
+            "in": "path"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "SVG badge"
+          },
+          "404": {
+            "description": "Disabled or opted out — still an SVG (a neutral 'unavailable' badge), so a README never shows a broken image"
+          },
+          "503": {
+            "description": "Same neutral SVG on an internal error"
+          }
+        }
+      }
     }
   },
   "servers": [

config/examples/loopover.full.yml

@@ -1507,3 +1507,17 @@ settings:
 #   # To stop trusting a peer, remove its key -- that is the whole revocation story, by design.
 #   peerKeys:
 #     - 0000000000000000000000000000000000000000000000000000000000000000
+
+# Public proof page (#9569) — the shareable, unauthenticated per-repo verification page
+# (`/proof/<owner>/<repo>`) and its README badge.
+#
+# OPT-OUT, not opt-in. Every figure the page renders is ALREADY publicly fetchable through the
+# ledger-verify, anchors and decision-record endpoints, so gating a page over data anyone can already
+# curl would add friction without adding privacy. This block exists because a page is nonetheless a
+# different artifact from an API: it is discoverable, linkable, and it markets this repo's numbers.
+#
+# Precedence: the operator's fleet-wide LOOPOVER_PUBLIC_PROOF flag must be on first. This block can turn
+# THIS repo's page OFF; it cannot turn one ON that the operator has not enabled. Omit the block entirely
+# to keep the page on once the operator enables it.
+# publicProof:
+#   enabled: false   # Bool. Default when the block is absent: true (opt-out).

packages/loopover-engine/src/focus-manifest.ts

@@ -440,6 +440,21 @@ export type FocusManifestPublicStatsConfig = {
   enabled: boolean;
 };
 
+/**
+ * Per-repo opt-OUT for the public proof page and its badge (#9569), declared under `publicProof:`.
+ *
+ * Shape matches `publicStats:`/`ops:`, but the PRECEDENCE is deliberately different: those are fleet-wide
+ * and read from the operator's self-repo manifest, whereas this is read from the TARGET repo's own manifest,
+ * because the thing being opted out of is that repo's own page. Not present ⇒ enabled, once the operator's
+ * LOOPOVER_PUBLIC_PROOF flag is on — opt-OUT, since every figure the page renders is already publicly
+ * fetchable through the ledger-verify / anchors / decision-record endpoints. A repo can turn its page off;
+ * it cannot turn one on that the operator has not enabled.
+ */
+export type FocusManifestPublicProofConfig = {
+  present: boolean;
+  enabled: boolean;
+};
+
 /**
  * Config-as-code override for the internal, bearer-gated contributor-trust-profile / fairness-analytics
  * surface (LOOPOVER_FAIRNESS_ANALYTICS, #fairness-analytics), declared under `fairnessAnalytics:`. Same
@@ -1249,6 +1264,7 @@ export type FocusManifest = {
   maintainerRecap: FocusManifestMaintainerRecapConfig;
   ops: FocusManifestOpsConfig;
   publicStats: FocusManifestPublicStatsConfig;
+  publicProof: FocusManifestPublicProofConfig;
   fairnessAnalytics: FocusManifestFairnessAnalyticsConfig;
   draftFlow: FocusManifestDraftFlowConfig;
   upstreamDriftIssues: FocusManifestUpstreamDriftIssuesConfig;
@@ -1413,6 +1429,13 @@ const EMPTY_PUBLIC_STATS_CONFIG: FocusManifestPublicStatsConfig = {
   enabled: false,
 };
 
+/** #9569: absent means ENABLED at the resolver (opt-out), so `enabled:false` here is only the shape's
+ *  default — `present:false` is what the resolver actually keys on. */
+const EMPTY_PUBLIC_PROOF_CONFIG: FocusManifestPublicProofConfig = {
+  present: false,
+  enabled: false,
+};
+
 const EMPTY_FAIRNESS_ANALYTICS_CONFIG: FocusManifestFairnessAnalyticsConfig = {
   present: false,
   enabled: false,
@@ -1478,6 +1501,7 @@ const EMPTY_MANIFEST: FocusManifest = {
   maintainerRecap: { ...EMPTY_MAINTAINER_RECAP_CONFIG },
   ops: { ...EMPTY_OPS_CONFIG },
   publicStats: { ...EMPTY_PUBLIC_STATS_CONFIG },
+  publicProof: { ...EMPTY_PUBLIC_PROOF_CONFIG },
   fairnessAnalytics: { ...EMPTY_FAIRNESS_ANALYTICS_CONFIG },
   draftFlow: { ...EMPTY_DRAFT_FLOW_CONFIG },
   upstreamDriftIssues: { ...EMPTY_UPSTREAM_DRIFT_ISSUES_CONFIG },
@@ -1520,6 +1544,7 @@ function emptyManifest(source: FocusManifestSource, warnings: string[] = []): Fo
     maintainerRecap: { ...EMPTY_MAINTAINER_RECAP_CONFIG },
     ops: { ...EMPTY_OPS_CONFIG },
     publicStats: { ...EMPTY_PUBLIC_STATS_CONFIG },
+    publicProof: { ...EMPTY_PUBLIC_PROOF_CONFIG },
     fairnessAnalytics: { ...EMPTY_FAIRNESS_ANALYTICS_CONFIG },
     draftFlow: { ...EMPTY_DRAFT_FLOW_CONFIG },
     upstreamDriftIssues: { ...EMPTY_UPSTREAM_DRIFT_ISSUES_CONFIG },
@@ -2356,6 +2381,24 @@ export function publicStatsConfigToJson(config: FocusManifestPublicStatsConfig):
   return { enabled: config.enabled };
 }
 
+/** Parse the optional `publicProof:` mapping (#9569). Mirrors {@link parsePublicStatsConfig} exactly. */
+function parsePublicProofConfig(value: JsonValue | undefined, warnings: string[]): FocusManifestPublicProofConfig {
+  if (value === undefined || value === null) return { ...EMPTY_PUBLIC_PROOF_CONFIG };
+  if (typeof value !== "object" || Array.isArray(value)) {
+    warnings.push('Manifest field "publicProof" must be a mapping; ignoring it.');
+    return { ...EMPTY_PUBLIC_PROOF_CONFIG };
+  }
+  const record = value as Record<string, JsonValue>;
+  const enabled = normalizeOptionalBoolean(record.enabled, "publicProof.enabled", warnings) ?? false;
+  return { present: true, enabled };
+}
+
+/** Serialize a publicProof config so a cached snapshot round-trips through {@link parsePublicProofConfig}. */
+export function publicProofConfigToJson(config: FocusManifestPublicProofConfig): JsonValue {
+  if (!config.present) return null;
+  return { enabled: config.enabled };
+}
+
 /** Parse the optional `fairnessAnalytics:` mapping (#fairness-analytics). Mirrors {@link parsePublicStatsConfig}
  *  exactly -- the only field is `enabled`, no DB layer to overlay onto. */
 function parseFairnessAnalyticsConfig(value: JsonValue | undefined, warnings: string[]): FocusManifestFairnessAnalyticsConfig {
@@ -4247,6 +4290,7 @@ export const FOCUS_MANIFEST_TOP_LEVEL_FIELDS = [
   "maintainerRecap",
   "ops",
   "publicStats",
+  "publicProof",
   "draftFlow",
   "upstreamDriftIssues",
   "sweepWatchdog",
@@ -4326,6 +4370,7 @@ export function parseFocusManifest(raw: unknown, source?: FocusManifestSource):
     maintainerRecap: parseMaintainerRecapConfig(record.maintainerRecap, warnings),
     ops: parseOpsConfig(record.ops, warnings),
     publicStats: parsePublicStatsConfig(record.publicStats, warnings),
+    publicProof: parsePublicProofConfig(record.publicProof, warnings),
     fairnessAnalytics: parseFairnessAnalyticsConfig(record.fairnessAnalytics, warnings),
     draftFlow: parseDraftFlowConfig(record.draftFlow, warnings),
     upstreamDriftIssues: parseUpstreamDriftIssuesConfig(record.upstreamDriftIssues, warnings),

src/api/proof-badge.ts

@@ -0,0 +1,39 @@
+// README badge for the public proof page (#9569). Renders through the SAME flat-badge primitive and the
+// SAME XML escaping as the repo-quality badge (`./badge.ts`), so an unauthenticated, embeddable surface
+// cannot become an injection vector and the two badges cannot drift apart visually.
+import { escapeXml } from "./badge";
+import { buildProofBadgeColor, buildProofBadgeMessage, type ProofSummary } from "../review/proof-summary";
+
+export const PROOF_BADGE_LABEL = "loopover proof";
+const UNAVAILABLE_COLOR = "#9e9e9e";
+
+/** `null` renders the neutral unavailable badge — used for both the flag-off 404 and the error 503, since
+ *  from a README's point of view those are the same thing: no claim is being made right now. */
+export function renderProofBadgeSvg(summary: ProofSummary | null): string {
+  const message = summary ? buildProofBadgeMessage(summary) : "unavailable";
+  const color = summary ? buildProofBadgeColor(summary) : UNAVAILABLE_COLOR;
+  return renderFlatBadge(PROOF_BADGE_LABEL, message, color);
+}
+
+function renderFlatBadge(label: string, message: string, color: string): string {
+  const labelText = escapeXml(label);
+  const messageText = escapeXml(message);
+  const labelWidth = textWidth(label);
+  const messageWidth = textWidth(message);
+  const totalWidth = labelWidth + messageWidth;
+  return [
+    `<svg xmlns="http://www.w3.org/2000/svg" width="${totalWidth}" height="20" role="img" aria-label="${labelText}: ${messageText}">`,
+    `<title>${labelText}: ${messageText}</title>`,
+    `<rect width="${totalWidth}" height="20" rx="3" fill="#fff"/>`,
+    `<rect width="${labelWidth}" height="20" rx="3" fill="#24292f"/>`,
+    `<rect x="${labelWidth}" width="${messageWidth}" height="20" rx="3" fill="${escapeXml(color)}"/>`,
+    `<g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="11">`,
+    `<text x="${labelWidth / 2}" y="14">${labelText}</text>`,
+    `<text x="${labelWidth + messageWidth / 2}" y="14">${messageText}</text>`,
+    `</g></svg>`,
+  ].join("");
+}
+
+function textWidth(text: string): number {
+  return Math.max(40, Math.round(text.length * 6.5) + 10);
+}

src/api/routes.ts

@@ -306,6 +306,8 @@ import { isRagEnabled } from "../review/rag-wire";
 import { loadDecisionLedgerTip, loadPublicDecisionRecord, loadPublicLedgerRow, verifyDecisionLedger } from "../review/decision-record";
 import { buildEvalScoreRecordsFromRulePrecision, filterEvalScoreRecords } from "../review/eval-score-records";
 import { anchorSigningInput, buildLedgerAnchorPayload, currentAnchorKey, parseAnchorPublicKeys, publicAnchorStatus, signLedgerAnchorPayload } from "../review/ledger-anchor";
+import { resolveProofPage } from "../review/proof-summary";
+import { renderProofBadgeSvg } from "./proof-badge";
 import { ingestBittensorAnchorReport, parseBittensorAnchorReport } from "../review/ledger-anchor-bittensor";
 import { loadPublicLedgerAnchors } from "../review/ledger-anchor-persistence";
 import { getPublicStats, isPublicStatsEnabled, resolvePublicStatsManifestOverride } from "../review/public-stats";
@@ -1366,6 +1368,41 @@ export function createApp() {
     });
   });
 
+  // #9569: the public proof page's data, and its README badge. Read-only over the SAME public sources the
+  // standalone endpoints already serve -- no new verification mechanism and no new SQL surface.
+  //
+  // Both handlers are thin renderers over ONE resolver (resolveProofPage): the gate, the read and the
+  // failure outcome are decided there, so the page and the badge cannot disagree about whether a repo is
+  // published. That is not a stylistic preference -- the gate previously lived inline in both bodies and
+  // exactly one of them was wired to the per-repo opt-out.
+  const proofPageDeps = {
+    loadManifest: loadRepoFocusManifest,
+    verifyLedger: (env: Env) => verifyDecisionLedger(env),
+    loadAnchors: (env: Env) => loadPublicLedgerAnchors(env, { limit: 20 }),
+  };
+
+  app.get("/v1/public/repos/:owner/:repo/proof", async (c) => {
+    const result = await resolveProofPage(c.env, `${c.req.param("owner")}/${c.req.param("repo")}`, proofPageDeps);
+    if (result.status === "disabled") return c.json({ error: "not_found" }, 404);
+    c.header("Cache-Control", "public, max-age=60, stale-while-revalidate=300");
+    return c.json(result.summary);
+  });
+
+  // The badge deliberately reports the LEDGER's state rather than an accuracy percentage: a badge is a
+  // one-glance claim, and an accuracy number without the interval that makes it honest (which does not fit
+  // in a badge) is exactly the bare scalar the proof summary refuses to publish. A disabled repo renders
+  // the neutral badge rather than an error -- a broken image in a README is worse than an honest one.
+  app.get("/v1/public/repos/:owner/:repo/proof-badge.svg", async (c) => {
+    c.header("Content-Type", "image/svg+xml; charset=utf-8");
+    const result = await resolveProofPage(c.env, `${c.req.param("owner")}/${c.req.param("repo")}`, proofPageDeps);
+    if (result.status === "disabled") {
+      c.header("Cache-Control", "public, max-age=300");
+      return c.body(renderProofBadgeSvg(null), 404);
+    }
+    c.header("Cache-Control", "public, max-age=600, stale-while-revalidate=86400");
+    return c.body(renderProofBadgeSvg(result.summary));
+  });
+
   // #9277 (epic #9267): the current tip's SIGNED checkpoint, for the operator's off-Worker Bittensor
   // commitment submitter to fetch and commit on-chain (sha256 of `signingInput` is the exact 32 bytes
   // `Data::Sha256` holds). Unauthenticated like every /v1/public/* sibling: it is the same payload the

src/auth/route-auth.ts

@@ -48,6 +48,11 @@ export function requiresApiToken(path: string): boolean {
   if (path === "/v1/public/decision-ledger/anchor-key") return false;
   // #9271: the public anchor-attempt listing, added in the SAME PR as its route.
   if (path === "/v1/public/decision-ledger/anchors") return false;
+  // #9569: the public proof page's data and its README badge. Unauthenticated by design -- every figure
+  // they render is already served unauthenticated by the ledger-verify / anchors / decision-record routes
+  // above; this is a composition, not a new disclosure. Added in the SAME PR as the routes, per #9120.
+  if (/^\/v1\/public\/repos\/[^/]+\/[^/]+\/proof$/.test(path)) return false;
+  if (/^\/v1\/public\/repos\/[^/]+\/[^/]+\/proof-badge\.svg$/.test(path)) return false;
   // #9277: the current tip's signed checkpoint, for the operator's off-Worker Bittensor submitter (and
   // anyone else — it is the same payload the Rekor/git backends already publish externally). Added in the
   // SAME PR as its route, per the #9120 lesson.

src/env.d.ts

@@ -609,6 +609,10 @@ declare global {
      *  worker is byte-identical to today. Exposes review-disposition counts + a reversal-grounded accuracy
      *  percentage + an estimated-time-saved figure ONLY — never PR content, authors, scores, or reward internals.
      *  See review/public-stats.ts. */
+    /** #9569: fleet-wide switch for the public proof page (`/proof/:owner/:repo`) and its badge. Default
+     *  OFF like every sibling public surface. A repo can opt OUT via its own manifest, but cannot opt IN
+     *  when this is off -- see isProofPageEnabledForRepo's recorded decision in review/proof-summary.ts. */
+    LOOPOVER_PUBLIC_PROOF?: string;
     LOOPOVER_PUBLIC_STATS?: string;
     /** Proof of Power (#1059): comma-separated allowlist of repo full-names ("owner/repo") whose OWN historical
      *  review ledger (audit_events "published a review surface" + pull_requests terminal state) counts toward

src/openapi/spec.ts

@@ -1909,6 +1909,32 @@ export function buildOpenApiSpec() {
       200: { description: "{ anchors: [{ id, seq, rowHash, keyId, backend, backendRef, status, error, createdAt }], nextBefore, status } — a failed attempt is returned identically to a successful one, never filtered out or reshaped. The top-level `status` (anchored | empty_ledger | unconfigured | pending) says why the list looks as it does, so an empty list cannot be mistaken for a healthy one; it is omitted when a backend/before filter is applied, where empty just means none matched" },
     },
   });
+  registry.registerPath({
+    method: "get",
+    path: "/v1/public/repos/{owner}/{repo}/proof",
+    operationId: "getPublicRepoProof",
+    tags: ["Public"],
+    summary: "Public proof summary for one repo — ledger status, anchor, calibration with coverage and interval, sample records",
+    request: { params: z.object({ owner: z.string(), repo: z.string() }) },
+    responses: {
+      200: { description: "ProofSummary. Any accuracy figure carries its coverage AND a Wilson confidence interval; below the sample floor it is an explicit `insufficient_data` state, never a bare percentage. Carries the verification-boundary statement in the payload" },
+      404: { description: "The proof page is disabled fleet-wide, or this repo has opted out" },
+      503: { description: "Composition failed — no partial or fabricated summary is served" },
+    },
+  });
+  registry.registerPath({
+    method: "get",
+    path: "/v1/public/repos/{owner}/{repo}/proof-badge.svg",
+    operationId: "getPublicRepoProofBadge",
+    tags: ["Public"],
+    summary: "README badge for the proof page — reports the ledger's state, never a bare accuracy percentage",
+    request: { params: z.object({ owner: z.string(), repo: z.string() }) },
+    responses: {
+      200: { description: "SVG badge" },
+      404: { description: "Disabled or opted out — still an SVG (a neutral 'unavailable' badge), so a README never shows a broken image" },
+      503: { description: "Same neutral SVG on an internal error" },
+    },
+  });
   registry.registerPath({
     method: "get",
     path: "/v1/public/decision-ledger/anchor-payload",