docs: two strangers asked if this costs money before asking anything else

[djayamah]

What this changes, and why

Issues #9 and #14 were opened independently, a day apart, by people nobody asked. They are the only unsolicited human signal this project has, and neither is a bug report. Both ask the same three things before anything else:

does it need one of those api keys to work? i dont really want to sign up for anything or pay a monthly fee just to try it. also — does it upload my project somewhere to check it? — #9

Is this free or paid? — #14

#9 ends with "sorry if this is obvious, im not very technical", which is the tell that the document failed rather than the reader.

The answers already existed and were accurate. They were in the FAQ, about 140 lines down. That is the defect: an answer a reader has to scroll for is an answer they did not get, and on npmjs.com this README is the page — a stranger decides in the first screen.

So the three answers now appear in the first screen of the README, in the landing page hero, and in the package description. Same words in each, present tense, true of what ships.

One sentence was cut for being stronger than the truth. The GitHub About blurb first read "nothing leaves your machine". That is absolute and the shipped reality is conditional — the optional Layer 2 judge sends a redacted, length-capped excerpt if you give it a key. 200 characters has no room for the caveat, so the claim narrowed to "no telemetry by default", which is exactly true of what ships, and the full three-part answer with its exception lives where there is room for it.

The npm page keeps the old text until a release, because the tarball README is frozen at publish time. Recorded in ops/BAKED-SURFACES.md.

Also here, because these are what publish that page

pages.yml carried a second copy of a rule that had drifted. It refused every absolute URL in any attribute, so the two documentation links this page cites for its claims about someone else's product read as CDN assets. There is one implementation now — scripts/check-site-selfcontained.mjs, run by the workflow and by the suite — and it is stricter than what it replaces: zero external resource loads, rather than an allowlist of hosts. An <a href> is navigation and fetches nothing; rel="canonical" is metadata, not a stylesheet. The deploy job is fenced to the repository that actually has Pages; the content gate runs everywhere.

check-config-references.mjs checked one repository, and the same missing label was on the other one. It reads scripts/repos.txt now, and one unreadable repository does not make the rest a pass.

How it was verified

• npm test passes (774 on the source tree)
• ./scripts/verify-all.sh exits 0
• Tested against a real agent session — n/a, no runtime behaviour changes
• Sabotaged: the site checker refuses a planted script tag, off-host src, CDN link, stylesheet <link>, off-host url() and unlisted anchor, and accepts a canonical link to an owned origin. The config check was sabotaged by deleting the label from one repository only, leaving the other healthy — it failed, naming the right one. Captured under verification/run-2026-09-08b/.

Checklist

• No new runtime dependencies
• No preinstall / install / postinstall / prepare script added

🤖 Generated with Claude Code

https://claude.ai/code/session_01To6RJknDDPxY3nihw4t64k