// ProofPoints — the two arguments that make "we prove it" more than an adjective.
// Rendered inside ReportBand, under the headline they are evidence for.
//
// VerdictGate: every competitor ships a feature that finds things; Sekura ships
// one whose only job is to refuse. That is what turns "zero false positives"
// from a claim into an architectural fact — a named component is checkable,
// an adjective is not. It gets the diagram because it is the harder idea.
//
// The receipt: a Blake3 hash-chained audit trail an auditor can verify was not
// altered, including by us. That last clause is the whole idea. No competitor
// claims tamper-evidence, and it turns a security finding into a compliance
// artifact with a second budget behind it.

function ProofPoints() {
  const { React } = window;

  return (
    <div className="ah-proof-row">
      <figure className="ah-gate" aria-label="What VerdictGate allows through">
        <div className="ah-gate-row">
          <span className="ah-gate-lab">Agent findings</span>
          <span className="ah-gate-n">many</span>
        </div>
        <div className="ah-gate-bar">VerdictGate</div>
        <div className="ah-gate-row ah-gate-row--out">
          <span className="ah-gate-lab">Proven exploitable</span>
          <span className="ah-gate-n">the report</span>
        </div>
        <figcaption className="ah-gate-foot ah-caption">No exploit, no finding.</figcaption>
      </figure>

      <ul className="ah-proofpoints">
        <li className="ah-proofpoint">
          <h3 className="ah-proofpoint-t">Nothing is reported until it has been exploited</h3>
          <p className="ah-proofpoint-b ah-small">
            VerdictGate sits between the agents and the report. A finding that cannot produce
            a working exploit does not get past it. That is not a filter applied to the
            results — it is the gate the results have to come through, which is why there is
            no severity slider to tune and no triage queue to work.
          </p>
        </li>
        <li className="ah-proofpoint">
          <h3 className="ah-proofpoint-t">Evidence an auditor can verify — including against us</h3>
          <p className="ah-proofpoint-b ah-small">
            Every scan writes a Blake3 hash-chained record. Anyone holding the report can
            confirm it has not been altered since it was produced, by you or by us. A pentest
            report is a document somebody typed. This is a chain of custody.
          </p>
        </li>
      </ul>
    </div>
  );
}

window.ProofPoints = ProofPoints;