feat: trust anchoring, in-browser x402 checkout, funnel + positioning

[vinaybhosle]

Closes the four gaps surfaced in the 2026-06-23 strategic review (trust intelligence: feature-complete but pre-revenue and self-referential).

Lag 1 — Externally-anchored trust signals (answers the core "self-report" critique)

• src/livenessProbe.js — independent 30-min probe of each agent's declared endpoint. SSRF-hardened: connect-time IP pinning (defeats DNS-rebinding) via https + pinned lookup, no redirect-follow, status-only, 30-day retention.
• reputation.js / trust.js — additive provenance {self_reported, independently_verified, independent_pct} + independent_signals on /trust/check. Numeric score formula unchanged (backward compatible).
• stamp.js /event — counterparty attestations: a relying party can co-sign an outcome about another agent (attestation_type: counterparty_confirmed, attester_wallet, monotonic sequence), with 10-min anti-spam dedupe + atomic transaction. Self-report path unchanged.

Lag 2 — Revenue funnel

• web/lib/payment.ts — in-browser x402 paid mint (viem + x402-fetch): Base chain auto-switch, per-tier USDC cap, never shows success without a backend 201, and blocks double-charge on retry.
• register/page.tsx — fixed the pricing bug (all tiers showed $0.01 → now $0.001 / $0.005 / $0.01), clickable tier badges.
• src/routes/funnel.js + web/lib/analytics.ts — cookieless, PII-stripped funnel instrumentation (POST /funnel/event, GET /funnel/summary).

Lag 3 — Distribution

• "Partner / integrate" CTA (mailto:vinay@agentstamp.org) on the footer + every registry profile.

Lag 4 — Positioning

• Hero → "Decide whether to trust an AI agent you've never met"; enterprise contrast band (vs CrowdStrike/Ceros/SailPoint); "is / is-not runtime security" boundary; ERC-8004 reframe; meta description.

Verification

• Backend unit tests: 273/273 (incl. 23 new trust + 30 funnel). Web build clean (35/35 pages).
• Two independent code reviews flagged 3 critical issues (double-charge retry, wrong per-tier payment cap, SSRF DNS-rebind) — all fixed and re-verified.
• e2e flows hit the live PM2 server on :4005 (old code) and are gated by its rate limiter, so they reflect old behavior until pm2 reload. The in-process unit suite is the authoritative signal.

Test plan

• pm2 reload agentstamp-backend (idempotent DB migrations auto-run on boot; liveness cron starts)
• Rebuild + pm2 reload agentstamp-web
• Before real money: one manual Bronze ($0.001) end-to-end wallet test on Base (x402-fetch signer compatibility can't be verified without a funded wallet + live facilitator)
• Spot-check /trust/check/:wallet returns provenance + independent_signals

Notes

• Also refreshes CLAUDE.md (stale "in progress" security notes → resolved) and adds .gitignore rules for operational artifacts.
• The branch also carries prior codex/agentstamp-audit-fix commits (dependency/security audit fixes) and bundles some pending branch doc/SEO edits.

🤖 Generated with Claude Code