docs: show the production evidence verification loop

[dkitchell]

Adds the missing lightweight proof asset to the top of the README.

What it shows

A 5-second loop of the public npm verifier run against a real production receipt: the command, a locally computed ✓ VALID, and the signed policy → authorization → decision → settlement → artifact/certificate chain.

Cut from the demo recording rather than staged. I inspected the video and chose chapter "3 THE PROOF", whose terminal header reads "your machine — no CertifiedData account, no login, no source checkout" — it makes the argument without narration. No terminal output was recreated or fabricated.

Sizing

dimensions	720×405
frame rate	10 fps
palette	64 colours, two-pass palettegen/paletteuse
duration	5.0s
size	92,300 bytes (90 KB)

Under the 100 KB target with the terminal still legible. I extracted a frame from the finished GIF and checked it: every binding line and both full sha256 digests are readable. That was the constraint that mattered more than shaving another 20 KB.

Generated with a dev-only static ffmpeg in a temp directory — nothing added to this package's dependencies, and no generation tooling committed.

Not shipped to installers

package.json files is an allowlist — ["dist/", "!dist/**/*.test.*", "README.md", "LICENSE"] — so docs/media/ is excluded automatically. No new ignore rule was needed, which avoids introducing one that could later catch runtime files.

Confirmed rather than assumed:

npm pack --dry-run
  total files: 47        (unchanged)
  package size: 37.5 kB  (unchanged)
  contains verify-demo.gif: no
  contains docs/:           no

Because the asset is not in the tarball, the README references it by absolute raw.githubusercontent.com URL. A relative path would render on GitHub and break on npmjs.com.

Copy

States what the signature establishes — issuance, immutability since, and which policy, authorization, decision, artifact and settlement were bound at signing — and explicitly what it does not: that the policy was good, that any control was effective, or that anyone is compliant with any regulation.

One thing worth flagging: the recording uses the short npx @certifieddata/verify … form, while the README's copy-paste command uses the longer npx --package @certifieddata/verify cd-verify …. That is deliberate — verify is a cmd.exe built-in, so the short form exits 1 silently on Windows (the same trap #7 fixed). The README now says so rather than leaving the difference unexplained.

Verification

• GIF visually inspected; terminal text readable
• npm test — 98 passed, 0 failed
• npm pack --dry-run — GIF absent from tarball
• git status — only README.md and docs/; no package, runtime or cryptography changes

🤖 Generated with Claude Code