self-check-server: depend on published agent-receipt-verify 0.2.9, not a git commit

packages/self-check-server/README.md

@@ -22,7 +22,7 @@ Both routes share `trust-attest-server`'s module-level attester identity by defa
 
 This reverses a rule written in `src/x402-badge.ts`, which never measures live so that nobody can use this server to probe other hosts from our address. The badge keeps that rule. The live route replaces "never" with limits, all in `src/x402-check.ts`: https and port 443 only, a public domain name (no IP literals), GET and POST only with a fixed `{}` body, at most two redirects that may only stay on the pasted host or its www sibling, a 64 KB response cap (8 KB for a DID document), at most six outbound requests and a 45 second deadline per measurement with the sockets aborted when it passes, at most eight checks busy at once, a two minute result cache, at most 12 live measurements per host and 200 in total per hour, and 8 requests per 10 minutes per IP on top. Any host other than the pasted one may be asked for exactly one thing, the fixed file `/.well-known/did.json` without a query, because the party being measured chooses which did:web document its offer names. Nothing is stored; the cache lives in memory, and the server logs no URL.
 
-The library is pinned to a commit of agent-receipt-verify that passes the injected fetch on to its did:web key lookup. Before that fix the lookup, whose host the measured party chooses, used the global fetch and skipped every guard above (agent-receipt-verify#46); `x402-check.test.ts` fails if that ever comes back.
+The library is agent-receipt-verify at exactly 0.2.9, the first published version that passes the injected fetch on to its did:web key lookup. Do not go below it. Before that fix the lookup, whose host the measured party chooses, used the global fetch and skipped every guard above (agent-receipt-verify#46); `x402-check.test.ts` fails if that ever comes back.
 
 Known limits, written down because an adversarial review (ours, not independent) found them and they are not closed by code: whoever controls many IP addresses can use up the hourly global budget, after which every visitor gets a 429 until it resets, and twelve checks of one host with different query strings lock that host's owner out for an hour. A host name that sends our DNS lookup to a name server that never answers keeps a thread of the shared pool busy; the eight-at-once cap keeps that bounded, and setting `UV_THREADPOOL_SIZE=16` in the service environment gives it room. Behind a proxy, set `HOST=127.0.0.1` so nobody can reach the port directly and send their own X-Forwarded-For (the production server also has a firewall that only opens 22, 80 and 443).
 

packages/self-check-server/package.json

@@ -33,7 +33,7 @@
     "@x402/evm": "^2.28.0",
     "@x402/express": "^2.28.0",
     "@x402/extensions": "^2.28.0",
-    "agent-receipt-verify": "github:holistis/agent-receipt-verify#3423a7871a983598a3a51481fadfe96c81048864",
+    "agent-receipt-verify": "0.2.9",
     "capacity-attest": "^0.9.0",
     "cors": "^2.8.5",
     "endpoint-attest": "^0.1.0",