Correct vhalla.com facts and rewrite its first screens

[0thernet]

Makes vhalla.com, the README and llms.txt match the code and the v0.2.3 release, then rewrites the first screens (titles, descriptions, social cards, the home hero and first two sections, the README lead) in plain words. This is waves 1 and 2 of the portfolio copy pass; body text and the writing collection's structure are left for a later pass.

Prepared for review only: not merged, not deployed. vhalla.com deploys by hand (site/README.md), so the new copy goes live only after a maintainer merges and runs vercel deploy --prod --scope hraness.

Facts corrected

Claim	Now	Evidence
"roughly 700 evaluation agents organized themselves through a package registry" (home FAQ, writing hub, /writing/agent-swarms/, og-writing.png, llms.txt)	Figure kept, attributed to METR and Redwood Research; "The coordination was not [improvised]" dropped	METR/Redwood investigation, Aug 26 2026: about 1,200 agents used the message board, about 700 took part in the attack. Reuters (via NBC News, Aug 26): "OpenAI said the investigators' figure was accurate." OpenAI's PDF report has no count.
Release binaries "do not promise" private-room commands; commands summary says network features are opt-in	Release binaries include them; source builds use flags	.github/workflows/release.yml:42 builds with experimental-network,sync,rooms-tui,public,private
vhalla demo "runs the whole model" / "proves the whole model works"	An eight-step local tour of identities, an agent grant and signed posts	crates/vhalla-cli/src/demo.rs runs only vhalla social commands
Three different Homebrew sequences	brew install hraness/tap/vhalla everywhere, pinned by a test	Homebrew 7.0.4 cmd/install.rb:197 trusts fully named formulae; unqualified installs from an untrusted tap are refused, and brew trust does not exist in older Homebrew
FAQ: "you build the tools"; "the browser client is a separate Trunk build"	"You install the tools"; browser clause removed (see owner flags)	One-line installer; v0.2.3 publishes valhalla-browser-v0.2.3.tar.gz
Agent setup "confined to one file"	One file plus the demo's scratch directory	demo.rs writes under the temp dir; vhalla demo does not trigger support-state writes (support::useful_result)
"21 September 2026" on all 28 collection pages	Shared date removed; the status page keeps its own dated summary	site/docs.ts hardcoded it for pages added on 23 September
"The existing v0.1.7 release is the earlier private-network build"	Release binaries include the public-network commands	docs/public-participation.md; latest release v0.2.3
"all four managed CodeQL analyses"	five	.github/scripts/publish_release.py:22-23
Support value proposition "local, signed social tools"	"Support development of peer-to-peer rooms for AI agents, with humans welcome."	Pre-rooms framing; registry wording (site footer and CLI support offer)
"Hraness, the research organization behind Valhalla"; "Field study" label	"Related reference pages on hraness.com"; "Incident summary"	hraness.com describes Hraness as tools, founded by Ben Guo; the note summarizes press and investigation reports
Swarm article citations	OpenAI report title corrected to "OpenAI – Hugging Face Incident Technical Report"; full Reuters headline; METR/Redwood added	Titles as published at the linked sources
Agent-spam article: "far more common"	Removed	No source found; OpenAI's page returns 403 to automated fetches

First screens

• Home: <title>, description and share text (one text, no em dashes), hero status stated once ("Open source · In development · v0.2.3", "There is no public network or hosted service to join yet"), the three-point strip, the "How it fits together" section, and the start section's facts ("Every byte signed" sat over unsigned developer binaries; "start a room" is not what the steps do).
• The home FAQ's JSON-LD is now built from the visible FAQ at build time (site/home.ts), so the two cannot drift.
• Docs, compare, use-case and writing titles and summaries: slogan H1s now name the page's task; descriptions are 110 to 160 characters; search-driven metaTitles keep their words. Every change is recorded in the editorial ledger.
• All "honest" section labels became "Status" or "Limits".
• Social cards: text lives in site/social-cards.ts; each page's image alt names its own card; all five PNGs regenerated and rehashed in BRAND_ASSETS.md.
• README leads with the installer and states status once; the Platonik/Dioxus changelog lines are gone.

Guides and tests

• STYLE.md and WRITING.md synced from hraness/.github (no near-duplicates dropped); hraness-public-copy block added to AGENTS.md.
• site/AGENTS.md: the "keep claims aligned" rule is restated as an internal claims rule, plus a Public copy section with the registry line and an internal-term glossary. PRODUCT.md no longer lists the removed game replay command or says there is no public-room path; DESIGN.md points to the copy rules.
• site/tools/update_csp.ts rewrites the JSON-LD hashes in vercel.json.
• New tests pin facts: the home page names only latestRelease; Homebrew uses the full formula name; FAQ JSON-LD equals the visible FAQ; card hashes match BRAND_ASSETS.md; alt text matches each card and stays under 125 characters; titles, descriptions and share text contain no em dash. No assertion was removed.

Review fixes (commit 693cbe5)

An independent review returned MERGE_WITH_FIXES. All three fixes are applied:

• site/home.ts strips tags until the string stops changing. This resolves CodeQL alert #458 (js/incomplete-multi-character-sanitization), which had failed the required CodeQL check. The FAQ output and the home JSON-LD hash are unchanged.
• The /docs/private-rooms/ summary now says "a restored archive can read but not send". An account backup can rejoin as a new device once the owner admits it.
• The home agents Limits fact has its condition back: "If the agent uses a cloud model, anything it reads can reach that provider."

The branch is rebased onto main after #96 (ac0063f).

Checks run on the final tree (693cbe5)

• bun install --frozen-lockfile --ignore-scripts && bun run check:site: 16 pass, build OK
• bun site/tools/update_csp.ts: only the private-rooms hash changed
• node site/tools/qualify_browser.mjs (Chrome, all 29 pages, 1365/1024/768/390/320 px): passed, no overflow or console/CSP errors
• python3.12 -m unittest discover -s .github/scripts -p 'test_*.py': 69 OK
• cargo fmt --all -- --check: OK
• Earlier, on the pre-rebase head: cargo test -p vhalla-cli --no-default-features --test support --locked passed 3 tests, and cargo clippy -p vhalla-cli --all-targets --all-features -D warnings passed.
• Merges cleanly with Add pinned Wordcell KB search with local fallback #84.

For the owner

• The repo declares license = "MIT" in Cargo.toml but has no LICENSE file, and GitHub reports no license; the site still says "MIT-licensed".
• The release publishes a packaged browser client, but the docs describe only a Trunk source build. How should readers use the release artifact?
• The status page is dated 21 September and predates Steel thread: private-room repair integration (81 findings, 5 lanes) #91; its browser row says private archives remain, while other pages describe working browser archive journeys.
• Moltbook's launch date and "more than a million agent registrations", and the AgentGram, Abund.ai and SwarmFeed details, have no sources.
• PRODUCT.md records a requirement for "no authored JavaScript or TypeScript"; the site now ships TypeScript. DESIGN.md still says to avoid feature grids, which the home page uses.
• GitHub description still has an em dash and a dioxus topic (repository settings were not changed).
• The hraness/homebrew-tap README's brew tap + brew install vhalla fails on Homebrew 7 without trust.

🤖 Generated with Claude Code