# Static Surface Verification

Status: `static_surface_verifier_draft_closed_until_human_yes`

This increment adds a read-only verifier for the Afterparty Forge 2045 proof hub. It is not a launch, post, upload, outreach action, payment action, livestream, GPU job, training run, or cron mutation. It gives the awake operator one command to prove that the static surface still points at repo-local assets and that risky public/commercial/media gates remain closed.

## Exact commands

```bash
PYTHONDONTWRITEBYTECODE=1 python3 scripts/verify_static_surface.py
PYTHONDONTWRITEBYTECODE=1 python3 scripts/verify_site.py
git diff --check
git status --short --branch
```

Expected highlight:

```text
STATIC SURFACE OK html_refs=<count> json_manifests=<count> text_files=<count> zips=<count>
VERIFY OK afterparty explainer site
```

## What the static verifier checks

- Parses local HTML and confirms repo-local `href`, `src`, and `poster` targets exist.
- Parses `docs/data/*.json` plus flyer JSON manifests.
- Rejects accidentally open risky flags for posting, outreach, spend, upload, livestream, recording, private media, GPU, paid API, model downloads, training, hackathon submission, wallet actions, secret exposure, payment links, revenue claims, affiliation claims, and cron mutation.
- Opens ZIP bundles when present, runs `testzip()`, requires a manifest-like entry, and blocks `.env`, credential files, keys, and model-weight entries.
- Scans bounded text files for common secret-looking markers while treating verifier regex literals as verifier source, not credentials.

## Proof paths

- `scripts/verify_static_surface.py`
- `docs/data/static-surface-verification.json`
- `docs/reports/STATIC_SURFACE_VERIFICATION.md`
- `docs/index.html`
- `docs/data/site-manifest.json`

## Human approval question

Do you approve using this static-surface verification receipt in the public wake report or launch handoff?

## Closed gates

- public_posting=false
- outreach=false
- paid_promotion=false
- claim_revenue=false
- claim_openai_affiliation=false
- youtube_upload=false
- publishes_stream=false
- records_audio=false
- uploads_private_media=false
- starts_gpu=false
- starts_paid_api=false
- downloads_models=false
- starts_training=false
- submits_hackathon=false
- mutates_cron=false
- wallet_actions=false
- secret_exposure=false

## Blocked without approval

Do not post, schedule, upload, stream, record, publish, collect payment, create invoices, run paid promotion, start GPU/training/model-download work, mutate cron, expose secrets, or claim OpenAI affiliation/revenue/customer results from this verifier. It is a local proof guard only.