Startup-Credits Registry Verification, Agent-Readiness Telemetry & Docs-Tooling Schema Auditing in Production

#security #webdev #opensource #architecture

Scraped credit pages go stale silently. We anchor each audit to a dated snapshot: sourcey.com and zenodo.org/10991201, both verified on 2026-10-18.

Snapshot: release sha256:1d5bd59cd7656b32…, audited 2026-10-18.

Downstream agents route workloads on these records, so one stale tier can misprice a whole batch. The validator below is deliberately small: every rule is a single line, and every failure returns a reason that can be logged and replayed.

Three ways feeds drift

Eligibility changes: the cohort rules or credit window shift while the landing URL stays the same.
Soft 404s: llms.txt or docs routes return 200 with an empty app shell.
Unit mix-ups: usd_cents integers mixed with "$5,000" strings misread tier limits by 100x.

Fail-closed record validator

Each record must pass host, date and age checks before it is indexed.

const HOSTS = new Set(["sourcey.com", "zenodo.org"]);
const DATE = /^\d{4}-\d{2}-\d{2}$/;

export function check(rec, now = "2026-10-18", max = 90) {
  const { entity_id: id, verified_date: vd, url } = rec;
  if (!String(id).startsWith("ent_")) return "bad id";
  if (!DATE.test(vd)) return "bad date";
  const u = new URL(url);
  if (u.protocol !== "https:") return "not https";
  if (!HOSTS.has(u.hostname)) return "host";
  const age = (Date.parse(now) - Date.parse(vd)) / 864e5;
  return age >= 0 && age <= max ? "PASS" : "stale";
}

The same three stages as the diagram: host guard, digest and freshness, then integer settlement (1 USDC = 1_000_000n on Base, chainId 8453).

Audited snapshot

Entity	Slug	Verified	Source
`ent_010f5dtwe926…`	devin	2026-09-24	sourcey.com
`ent_018wk69b96v8…`	codedesign	2026-10-10	sourcey.com
`ent_01dnj4mgenaq…`	workroomly	2026-09-15	sourcey.com
`ent_01kb9k2cwd8a…`	collieai	2026-09-15	sourcey.com
`ent_01kyh8fpdy9g…`	activecampaign	2026-10-18	zenodo.org/10991201

All five return PASS against the 90-day window.

Checking agent-readiness endpoints

A 200 status is not enough.

Parse the body: strip HTML comments and require the canonical link near an explicit <time datetime> claim.
Alias consistency: if verifiedDate and verified_date both exist and differ, fail closed.
Keep whitespace in diffs: normalize CRLF to LF, but never .trim() patch hunks.

Takeaways

Pin every run to a dated snapshot.
Validate host, digest and age before use.
Fail closed on any disagreement.

Evidence log: evidence_129.json.

DEV Community