Social Proof & Credibility — re-run

Date: 2026-07-09. Read-only pass over the proof-carrying surfaces: landing (template.html / built index.html), the 141 /b/<id> + 35 /p/<key> detail pages (build.py builders), /examples/, studio.html, README.md, the install script, CREDIBILITY.md, metrics.json, and the git history behind every on-page citation. Companion reports from today's run: COMPETITIVE.md (0-star reality vs 23k–50k-star rivals), CRO.md (persuasion mechanics — not duplicated here), REVENUE.md (partner flow).

Honesty note (unchanged house rule): every recommendation below is collect real proof or place existing real proof better. Nothing here suggests fabricating a testimonial, a logo, or a number.

---

What changed since the last PROOF.md

The previous report's fixes shipped, and most held up under re-inspection:

• F1 (checksum reassurance at curl | sh) — SHIPPED, half. The install line

now reads "SHA-256 verified when your shell has a hash tool · read the script first" with a link to /install (template.html:661) — honest even about the no-hash-tool fallback, which matches the script's real behavior (install:26-43). But the MCP npx -y github:… line (:668) never got its half — see NF5.

• F3 (unverifiable HN quotes) — RESOLVED beyond the ask. The three anonymous

quotes are gone entirely. In their place: three linked, first-party evidence cards (template.html:522-526) — the sample-report gallery, a real S2 self-XSS finding with a commit link, and the FIXLOG. Strictly better than linking the quotes. (One residue: NF4.)

• F4 (proof stranded at the bottom) — SHIPPED. Proof now sits beside claims:

the Problem section itself is evidence, the catalog lead links "See a real report one wrote →" (:580), and 20 brief detail pages carry "See a real report ↗" at the copy CTA (build.py:825-827).

• F5 (no human) — SHIPPED. Footer: "Built by @GhostlyGawd, an independent

developer · using it? tell me how ↗" (:758, verified in built index.html).

• F6 (partner band implies a partnership) — SHIPPED. "example" pill +

"No real partnership implied." (:739-740), plus a real "Partner with us →" CTA.

• F2 (no third-party proof) — ARMED, still dark. metrics.json holds the

real count (still {"stars": 0, "forks": 0}); build.py:1298-1304 renders a stargazers badge only at ≥25 stars. Nothing faked, nothing shown. The strategy is documented in CREDIBILITY.md — whose four maintainer decisions (star threshold, npm publish, quotes real-or-illustrative, enable Discussions) are all still open.

New proof assets that didn't exist last time: an animated run walk-through honestly labeled "walk-through, not a screen capture" (:679-690), a real Report Studio screenshot captured from the live tool (img/studio.png, scripts/studio-shot.cjs, :704-707), a finding → commit before/after whose commit I verified in git (683dff5 matches the claim exactly, :709-722), a venture dogfood wing in /examples/ ending in a self-disconfirming "pivot" verdict, and plugin distribution as the README's primary path.

The two structural gaps from last time are narrower but still the story: (1) zero third-party evidence anyone else uses it, and (2) a few claims and decision points where the proof isn't where the doubt is. Plus one new problem the growth created: the flagship dogfood claim now overclaims.

---

1 · Proof inventory

Pattern: first-party proof went from good to excellent — layered, linked, and honestly labeled. Third-party proof is still zero (0 stars, no testimonials, no named users, npm unpublished, Discussions off). The site compensates about as well as honesty allows; the remaining fixes are precision (don't overclaim) and placement (finish the decision-point coverage).

---

2 · Findings (lens · location · doubt · fix · effort)

Ranked by doubt removed at the moment of decision.

NF1 — The flagship proof claim overclaims, and shrinks under scrutiny (lens 7: freshness & honesty · lens 2: specific over generic) — HIGH · effort S

• Location: evidence card template.html:523 — "Every brief is

dogfooded on this repo before it ships — the reports the briefs wrote sit at the repo root, in the open, linked as live samples from their briefs."

• The check a skeptic runs: 141 briefs; ~26 reports at the root; 20 of 141

detail pages link a sample. No PERF.md, DEPS.md, A11Y.md… for the majority of the catalog. The site's best proof asset is fronted by its one falsifiable sentence — on a page whose whole stance is "evidence, not vibes," an overclaim costs double.

• Fix (pick one): (a) scope it honestly — "The Day-1, design, growth and

venture playbooks have all been run against this repo — every report they wrote sits at the root, in the open"; or (b) make it true, and turn the gap into a linter rule later. Option (a) is a one-line edit and loses nothing: the true number (~26 real reports) is still more output-proof than any rival shows.

NF2 — "Nothing leaves your machine" shares a page with an analytics beacon, and nothing reconciles them (lens 8: transparency · lens 7: honesty) — MED-HIGH · effort S

• Location: hero micro :502 ("nothing leaves your machine") and Studio sub

(studio.html:214, "no upload, no backend") vs /_vercel/insights/script.js loaded on landing, Studio, and Vitals (template.html:24, studio.html:21, vitals.html:20) plus a locally-generated anonymous cohort id attached to events (template.html:874-882). No privacy note anywhere on the site or README explains the boundary.

• The doubt: the claim is true in spirit — your code, reports, and setup

never touch a server — but the exact visitor this site courts (a developer about to paste an agent prompt) is the one who opens devtools, sees a first-party analytics beacon with an aid, and re-reads the promise as marketing. Trust, once dented on the honesty axis, takes the dogfood proof down with it.

• Fix: one honest line where the claim is made or in the footer: "Your code,

reports, and setup never leave your device. The site itself counts page views with cookie-free, anonymous analytics — no code or repo data is ever sent." Optionally link the analytics snippet in source. Cheap, and it converts a latent gotcha into a transparency signal.

NF3 — Third-party proof is still zero, and the honest substitute isn't where a star count would sit (lens 6: numbers that reassure · lens 3: proof at the decision) — MED-HIGH · effort S (placement) + external (earning)

• Location: whole site — confirmed absence, unchanged from last run.

metrics.json = 0 stars / 0 forks; badge armed but dark; no testimonials, no named users, no npm downloads (unpublished); COMPETITIVE.md: rivals lead with 23k–50k stars.

• The doubt: "am I the first person to ever run one of these?" First-party

proof shows it works; nothing shows it's used.

• Fix (placement, now): put the proof-of-output where rivals put the star

count — one line in the hero region, e.g. under the micro-line: "run against this repo's own code — read the reports →" (COMPETITIVE.md recommends the same; today the first dogfood link is a scroll below the fold). Fix (earning, maintainer): the four open decisions in CREDIBILITY.md — enable Discussions, npm publish (creates an honest downloads number), confirm the star threshold, and a launch that could earn the first stars. All four have been pending since that plan was written.

NF4 — The XSS evidence card cites a squashed release commit a checker can't actually verify (lens 5: credibility of the source) — MED · effort S

• Location: evidence card :524 — "fixed the same release" links "fixed in

0.4 ↗" to commit d041b3f. Verified in git: that commit is the entire 0.4.0 release (hundreds of files). The fix is genuinely in there, but a visitor who clicks to check finds an unreviewably huge diff with no XSS mention in the message — the citation is real yet functionally unfalsifiable, which reads like hand-waving on the site's most security-flavored claim.

• Fix: point the link at the verifiable artifact instead: /BUGS.md

(finding 2 states location, trigger, root cause, and "FIXED in 0.4 — built with textContent"), or keep both — "BUGS.md, finding 2 ↗ · shipped in 0.4". The before/after block lower down already models this correctly (its commit 683dff5 is small and exactly matches its claim).

NF5 — The MCP npx -y line is still bare — the un-shipped half of old F1 (lens 3: proof at the decision · lens 8: security) — MED · effort S

• Location: Ways in, way 03 (:668): `claude mcp add goal-prompts -- npx -y

github:GhostlyGawd/goal-prompts — auto-executes code from a stranger's repo, shown with only a copy button; the sibling curl line got its reassurance, this one didn't. Same gap on the /b/` pages' way-03 (raw URL — lower fear) and the plugin marketplace line (mitigated by Claude Code's own trust UI, but a "MIT · source on GitHub" nod costs nothing).

• Fix: mirror the install line's treatment: "runs the zero-dependency server

straight from the public source — inspect mcp/server.cjs ↗" linking the GitHub path.

NF6 — 121 of 141 detail pages ask for the paste with no proof in eyeshot (lens 3: proof at the decision · lens 1: proof beside the claim) — MED · effort S

• Location: build.py:825-827 adds "See a real report ↗" to a brief's hero

CTA only when example: front matter exists (20 briefs). The other 121 — the cold-search side doors per SEO.md — offer a "Copy this prompt" button with no evidence link near it; the footer "fine" line (b/*.html) carries MIT/free but sits at the very bottom. (CRO.md NF2 covers the missing risk-reversal triad on these pages; this finding is the missing evidence — fix them in the same build.py pass.)

• Fix: in the detail-hero builder, fall back to a generic

"See real sample reports ↗ → /examples/" ghost link when no per-brief example exists, ideally alongside CRO NF2's one-line offer/guard micro-line.

NF7 — When the star badge finally wakes, it wakes in the footer (lens 3 · lens 6) — LOW · effort S (forward-looking)

• Location: build.py:1303-1304 injects __GH_STARS__ into the footer

buildnote (template.html:758) — the weakest placement on the page for the moment the project finally has a third-party number to show.

• Fix: when it crosses the threshold, render it in the hero micro-line

(next to "free & open") as well as the footer. Zero cost today — the change can ship now and stays invisible until the number is real.

NF8 — Today's eight growth reports are proof that isn't merchandised (lens 1 · lens 7: freshness) — LOW · effort S

• Location: FUNNEL.md, COMPETITIVE.md, REVENUE.md, AI-IDEAS.md, SEO.md,

CRO.md, RETENTION.md (+ this file) sit at the root, dated today — fresh, self-critical dogfood including a competitive scan that openly records the 0-star gap. /examples/ still shows only Day-1 + Venture.

• Fix: add a third gallery section ("Growth · the whole funnel, audited")

linking a few of them. Self-critical reports are the brand; freshness dates are visible in the files. (Also keeps /examples/ from reading as a one-time stunt — its Day-1 reports are from 0.4.)

What already earns trust — keep and protect

• Linked, layered dogfood — gallery → finding → commit → FIXLOG is a proof

chain no rival shows (COMPETITIVE.md confirms).

• Honest labeling under constraint — "walk-through, not a screen capture,"

the "example" partner pill, the checksum note admitting its fallback, the badge that refuses to show a zero. This discipline is the moat; NF1/NF2 are the two places it slipped.

• The transparency block on every /b/ page — "nothing hidden, verbatim"

is the right reassurance at the copy decision.

• The "pivot" verdict — still the single most trustworthy artifact on the

site.

---

3 · Proof at the decision (what to place at each, in order)

• Hero CTA (:498-503): keep the offer micro-line; add the one-line

dogfood pointer ("run against this repo's own code — read the reports →") where a rival's star badge would sit. (NF3) Later: the star count joins it at ≥ threshold. (NF7)

• Catalog copy buttons (:580, cards): already covered — sample-report

link in the lead + per-card transparency. No change.

• /b/<id> "Copy this prompt" (141 pages): generic sample-gallery link on

the 121 pages lacking one (NF6), plus CRO NF2's offer/guard micro-line.

• Install curl | sh (:661): shipped last round — keep.
• MCP npx -y line (:668): "runs from public source — inspect

mcp/server.cjs ↗". (NF5)

• Studio drop zone (studio.html:214): "no upload, no backend" is right;

append the analytics-honesty clause or footer-link it. (NF2)

• Partner "Partner with us →" (:741): example label shipped; REVENUE.md

handles the channel (public issue → private option).

---

4 · Proof to earn (collect, never invent)

Unchanged in kind since last run — none has been collected yet, and CREDIBILITY.md's four maintainer decisions are still the bottleneck:

• First stars — a launch ("Show HN" with the dogfood/pivot story as the

hook); the armed badge then turns itself on.

• An honest downloads number — publish the MCP server/installer to npm

(workflow already exists at .github/publish.example.yml).

• First attributable testimonials — enable GitHub Discussions; the footer

"using it? tell me how ↗" already points at Issues; publish only real, linked quotes.

• A usage signal that keeps the local-first promise — docs/usage-metrics.md

already designs it (per-path raw/*.md fetch counts, no identifiers); fold monthly counts into metrics.json when adoption justifies it.

• A fuller maintainer note — the 1–2 sentence origin story CREDIBILITY.md

asked for; still absent.

---

Report only — which fixes do you want me to make?

Nothing was changed in this pass. The ship-now, fully honest set: NF1 (rescope the "every brief" claim — one line, protects the flagship proof), NF2 (one-line analytics disclosure), NF4 (repoint the XSS citation at BUGS.md), NF5 (inspect-the-source note on the MCP line), NF6 + NF7 + NF8 (build.py sample-link fallback, hero badge slot, gallery section — all small). NF3's earning half needs you: the four CREDIBILITY.md decisions (Discussions, npm, threshold, launch). Tell me which subset to implement.