chore: move proof to its own repository

[tonyketcham]

Proof now lives at https://github.com/FlatbreadLabs/proof. Remove the
@flatbread/proof workspace package, its Cursor skills, and monorepo
build/test/docs wiring. Re-home the cloud-agent fetch script and its AVA
test under scripts/ so pnpm run cursor:fetch-cloud-agent still works.

Co-authored-by: Cursor cursoragent@cursor.com

Depends-On: #240

[tonyketcham]

This pull request is part of a Mergify stack:

#	Pull Request	Link
1	release: prepare Flatbread 1.0	#236
2	fix: remove stale release dependencies	#237
3	fix: harden stable package payloads	#238
4	fix: make core declarations portable	#239
5	docs: record upstream release limits	#240
6	chore: move proof to its own repository	#241	👈
7	fix: retarget Cursor agents at external Proof	#242
8	feat: brand agent memory as Proof and the runner as Oven	#244

[cursor]

CI Root Cause

Status: third-party-failure

Failing checks:

• lint (22.x, ubuntu-latest): pnpm install --frozen-lockfile failed — sharp@0.31.3 download returned 503 Service Unavailable from github.com/lovell/sharp-libvips
• test (22.x, ubuntu-latest): pnpm install --frozen-lockfile failed — sharp@0.31.3 download socket hang up from the same GitHub Releases URL
• integration-nextjs (20.x, macos-latest): pnpm install --frozen-lockfile failed — sharp@0.30.7 / sharp@0.31.3 Request timed out downloading libvips from GitHub Releases

Evidence:

• Jobs never reached lint, test, or Next.js integration steps; all failed in install.
• Sibling matrix cells on the same SHA passed install (e.g. lint 20.x, test 20.x, integration-nextjs 22.x macos / 20.x ubuntu).
• Log lines: sharp: Installation error: Status 503 Service Unavailable, socket hang up, Request timed out against https://github.com/lovell/sharp-libvips/releases/download/....
• sqlite3 also hit prebuild-install warn install socket hang up / Request timed out in the same runs (secondary network flakiness).

Resolution steps:

1. Re-run the failed jobs (or the whole Pipeline workflow) on commit f7e8d824de53552f99eb7ff8d14f4bf4b29d7d60 once GitHub Releases is healthy.
2. No branch code change is required for these failures.
3. If install keeps failing after retries, check GitHub status / sharp-libvips release CDN reachability from Actions runners.

No code changes were made because this failure is not caused by the branch.

  

_{Sent by Cursor Automation: Flatbread - Fix CI}

[tonyketcham]

Revision history

#	Type	Changes	Reason	Date
1	initial	f7e8d82		2026-08-12 18:16 UTC
2	content	f7e8d82 → 2144c6a		2026-08-12 18:16 UTC

[cursor]

Stale comment

Review verdict

BLOCK — AGENTS.md / CONTRIBUTING.md now point at https://github.com/FlatbreadLabs/proof, which returns 404 with no npm/@flatbread/proof fallback, while this diff deletes the only in-repo distribution surface (rule: any BLOCKER → BLOCK).

Confirmed at review time: GitHub FlatbreadLabs/proof → 404; npm view @flatbread/proof → E404.

Blocking first

1. Ship a live Proof home before merge (or mark extract pending with a working interim path). Do not leave the canonical URL as a 404.
2. Scrub leftover in-repo Proof run/test instructions still on HEAD outside this diff’s doc edits: .cursor/agents/flatbread-code-review-orchestrator.md, flatbread-proof-runtime-skeptic.md, .cursor/skills/flatbread-major-migration/SKILL.md, flatbread-flow-agentic-workflows.md (pnpm exec proof / packages/proof/dist / pnpm -F @flatbread/proof).
3. Fix dead packages/proof links still in docs/positioning.md and docs/research/performant-context-search/README.md.
4. Prefer a thin skill stub / redirect after deleting .cursor/skills/proof/**, or document install+CLI once the external repo exists.

Coverage plan (fetch script promoted to root)

1. scripts/fetch-cloud-agent-conversation.test.js — positive — positional/URL bc-… with dummy --api-key parses ids and fails only at/before SDK (no live network).
2. Same file — positive — cursor.com query params (selectedBcId / selectedRunId) extract expected ids.
3. Same file — positive — pnpm run cursor:fetch-cloud-agent resolves via package.json script entry.
4. Same file — negative — unknown flag / empty input / missing bc-….
5. Same file — edge — --run/--api-key missing-value and explicit --run precedence.
6. Optional: scripts/publish.test.ts — negative — getMonorepoPublicPackages() excludes @flatbread/proof after extract.

Reviewer scoreboard

• correctness-and-contracts: 3 findings, 0 coverage gaps, signal:HIGH
• test-coverage-robustness: 7 findings, 7 coverage gaps, signal:HIGH
• release-discipline: 5 findings, 1 coverage gaps, signal:HIGH
• docs-and-positioning: 9 findings, 0 coverage gaps, signal:HIGH
• dx-and-examples: 11 findings, 2 coverage gaps, signal:HIGH

Models: grok-4.5 (HIGH, effort=high) / composer-2.5 (MED+LOW). Canvas: dag-review-2144c6a.canvas.tsx. Range: 571166f...2144c6a (PR #241 synchronize).

  

_{Sent by Cursor Automation: Flatbread PR Review}

[cursor]

BLOCKER (docs-and-positioning, release-discipline, dx-and-examples)

Canonical Proof home is a dead public URL: https://github.com/FlatbreadLabs/proof returns 404, and @flatbread/proof is not on npm. This line also replaced the prior enforceable loop-contract guidance with URL-only text agents cannot follow.

Minimal fix: Ship FlatbreadLabs/proof (or a live interim install) before merge—or mark extraction pending with a working path—and restore 2–3 lines covering install, proof/proof-supervisor invocation, skill/examples move, plus a one-line loop-contract summary or deep-link once external docs exist.

[cursor]

BLOCKER (docs-and-positioning, release-discipline, dx-and-examples)

After dropping in-monorepo Proof commands, the contributing guide’s only Proof pointer is the same dead https://github.com/FlatbreadLabs/proof URL (404; no npm fallback).

Minimal fix: Same destination/interim-install fix as AGENTS.md. Optionally note that historical in-monorepo @flatbread/proof was removed and link external examples/install once live.

[cursor]

MED (test-coverage-robustness, dx-and-examples)

cursor:fetch-cloud-agent is now a monorepo-root contract (node scripts/…) without success-path id-extraction / post-key failure tests, and human docs (AGENTS/CONTRIBUTING) do not surface the moved command.

Minimal fix: Add positive/edge AVA cases (dummy --api-key, no SDK network) and list pnpm run cursor:fetch-cloud-agent in the AGENTS/CONTRIBUTING command tables.

[cursor]

MED (test-coverage-robustness)

Glob correctly admits scripts/**/*.test, but the promoted root fetch CLI suite remains early-exit negatives only, so public parse/usage contracts are unguarded after the R100 move.

Minimal fix: Extend scripts/fetch-cloud-agent-conversation.test.js for positive parse and usage failure contracts (no live network).

[cursor]

Review verdict

BLOCK — Proof skill/package removal is incomplete: live agents and skills still require in-repo proof / @flatbread/proof / .cursor/skills/proof after those paths are deleted (orchestrator rule: any BLOCKER → BLOCK).

Blocking / consensus HIGH

1. .cursor/skills/proof/** deleted without a redirect stub while .cursor/agents/flatbread-code-review-orchestrator.md, flatbread-architecture-planner.md, flatbread-proof-runtime-skeptic.md, and .cursor/skills/flatbread-major-migration/SKILL.md still instruct pnpm exec proof, pnpm -F @flatbread/proof, and the deleted example DAG paths.
2. Starter DAGs removed (schema-migration, PMF-audit) but still cited by flatbread-flow-agentic-workflows.md, major-migration, and docs/experiments/**.
3. AGENTS.md / CONTRIBUTING.md only drop a bare FlatbreadLabs/proof URL — no install, env, or example-DAG guidance; dependent harness surfaces were not retargeted in this PR.
4. Root @flatbread/proof workspace dep removed with no CHANGELOG/deprecation/CLI acquisition path while agents still call pnpm exec proof.

Verified leftovers on tip 2144c6a via git grep (agents, major-migration, flow docs, positioning, experiment fixtures). External URL https://github.com/FlatbreadLabs/proof returned 404 from this environment (private or not published yet).

Deleted files cannot take GitHub inline anchors; comments below land on RIGHT-side hunks that should absorb the incomplete-extraction fix.

Coverage plan (priority)

1. scripts/leftover-proof-refs.test.js — negative: tree must not match @flatbread/proof / packages/proof / pnpm -F @flatbread/proof / .cursor/skills/proof (excluding intentional CHANGELOG archaeology).
2. scripts/fetch-cloud-agent-conversation.test.js — positive mocked Agent success JSON shape (agentId, agent, run, conversation).
3. Same test — negative missing bc- id; edge URL-param extract; --run override; SDK error; npm-script entry for cursor:fetch-cloud-agent.

Reviewer scoreboard

• correctness-and-contracts: 4 findings, signal:HIGH
• test-coverage-robustness: 3 findings, signal:MED
• release-discipline: 4 findings, signal:HIGH
• docs-and-positioning: 7 findings, signal:HIGH
• proof-extraction-residuals: 7 findings, signal:HIGH

Models: grok-4.5 (HIGH) / composer-2.5 (MED+LOW). Not a dependency-only PR — full adversarial review ran.

  

_{Sent by Cursor Automation: Flatbread PR Review}

[cursor]

BLOCKER (consensus): This one-line external URL replaces the in-repo Proof contract, but the extraction is incomplete.

Still live on this tip (not updated in the PR):

• .cursor/agents/flatbread-code-review-orchestrator.md → pnpm -F @flatbread/proof build, pnpm exec proof, packages/proof/dist/run_dag.js
• .cursor/agents/flatbread-proof-runtime-skeptic.md → pnpm -F @flatbread/proof test
• .cursor/skills/flatbread-major-migration/SKILL.md + flatbread-flow-agentic-workflows.md → .cursor/skills/proof/examples/... and pnpm exec proof --init-only

.cursor/skills/proof/** is deleted with no attachable redirect/stub. Minimal fix: land a stub skill + retarget (or delete) those agent/skill steps in this PR, and expand this bullet with install / env / where starter DAGs live.

[cursor]

MED: Contributor docs now only point at an out-of-tree URL. After removing pnpm -F @flatbread/proof test and the skill, there is no “how to install/run Proof” workflow here.

Minimal fix: short “Working with Proof” subsection (skill install, CLI, where tests/examples live). Note: https://github.com/FlatbreadLabs/proof returned 404 from this review environment.

[cursor]

HIGH (consensus): @flatbread/proof was removed from workspace deps here, but agents still teach pnpm exec proof / pnpm -F @flatbread/proof. No CHANGELOG/deprecation/CLI acquisition path lands with the drop.

Minimal fix: document the move for consumers, and stop (or retarget) in-repo proof execution instructions in the same change.

[cursor]

MED: typecheck now filters only @flatbread/explorer, so Proof TS is no longer gated by pnpm verify. That is fine if external Proof CI owns it — say so explicitly (AGENTS/CONTRIBUTING), or keep a smoke check until that gate exists.

[cursor]

MED: Root @cursor/sdk now backs scripts/fetch-cloud-agent-conversation.mjs, but tests never exercise Agent.get / run / conversation (happy + SDK-error). Minimal fix: mock Agent for one success JSON-shape assert and one failure path (export/unit-test extractFromUrl if needed).

[cursor]

LOW: This glob correctly enrolls the moved fetch test, and also newly gates pre-existing scripts/bumpVersions.test.ts / scripts/publish.test.ts via pnpm test:ava. Confirm that CI expansion is intentional (no code change if yes).