Point repository metadata at AgenteLabs so npm provenance verifies

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 blank_issues_enabled: true
 contact_links:
   - name: ⚡ Found the Strike preimage?
-    url: https://github.com/FlashyLabs/wdk-staking-kit/issues/new?title=%E2%9A%A1%20STRIKE
+    url: https://github.com/AgenteLabs/wdk-staking-kit/issues/new?title=%E2%9A%A1%20STRIKE
     about: Open an issue titled "⚡ STRIKE" with the recovered sentence — see the README.

README.md

@@ -11,9 +11,9 @@
 
 A reference staking primitive for wallets built on [Tether's WDK](https://github.com/tetherto/wdk) — or any wallet SDK. Lock a balance into a fixed-term tier at a published rate, without an on-chain contract and without touching a ledger's internals: a lock **earmarks** a balance a provider already credits, and only the yield, paid on close, is a real write.
 
-[![tests](https://github.com/FlashyLabs/wdk-staking-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/FlashyLabs/wdk-staking-kit/actions/workflows/ci.yml)
-[![CodeQL](https://github.com/FlashyLabs/wdk-staking-kit/actions/workflows/codeql.yml/badge.svg)](https://github.com/FlashyLabs/wdk-staking-kit/actions/workflows/codeql.yml)
-[![Scorecard](https://github.com/FlashyLabs/wdk-staking-kit/actions/workflows/scorecard.yml/badge.svg)](https://github.com/FlashyLabs/wdk-staking-kit/security/code-scanning)
+[![tests](https://github.com/AgenteLabs/wdk-staking-kit/actions/workflows/ci.yml/badge.svg)](https://github.com/AgenteLabs/wdk-staking-kit/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/AgenteLabs/wdk-staking-kit/actions/workflows/codeql.yml/badge.svg)](https://github.com/AgenteLabs/wdk-staking-kit/actions/workflows/codeql.yml)
+[![Scorecard](https://github.com/AgenteLabs/wdk-staking-kit/actions/workflows/scorecard.yml/badge.svg)](https://github.com/AgenteLabs/wdk-staking-kit/security/code-scanning)
 [![npm version](https://img.shields.io/npm/v/@flashyfinancial/wdk-staking-kit.svg)](https://www.npmjs.com/package/@flashyfinancial/wdk-staking-kit)
 [![npm downloads](https://img.shields.io/npm/dm/@flashyfinancial/wdk-staking-kit.svg)](https://www.npmjs.com/package/@flashyfinancial/wdk-staking-kit)
 [![license](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](./LICENSE)
@@ -173,4 +173,4 @@ No prize, no token, no yield. Just the ledger of who looked closely.
 
 ---
 
-Built by [Flashy Labs](https://flashyos.com), the mesh platform for organisations' agents. If something here is broken, unclear, or just interesting, [open an issue](https://github.com/FlashyLabs/wdk-staking-kit/issues) — we read them.
+Built by [Flashy Labs](https://flashyos.com), the mesh platform for organisations' agents. If something here is broken, unclear, or just interesting, [open an issue](https://github.com/AgenteLabs/wdk-staking-kit/issues) — we read them.

flashyos.roles.json

@@ -9,7 +9,7 @@
   "repositories": [
     {
       "name": "wdk-staking-kit",
-      "url": "github.com/FlashyLabs/wdk-staking-kit",
+      "url": "github.com/AgenteLabs/wdk-staking-kit",
       "default": true,
       "holds": [
         "library",

package.json

@@ -39,11 +39,11 @@
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/FlashyLabs/wdk-staking-kit.git"
+    "url": "git+https://github.com/AgenteLabs/wdk-staking-kit.git"
   },
-  "homepage": "https://github.com/FlashyLabs/wdk-staking-kit#readme",
+  "homepage": "https://github.com/AgenteLabs/wdk-staking-kit#readme",
   "bugs": {
-    "url": "https://github.com/FlashyLabs/wdk-staking-kit/issues"
+    "url": "https://github.com/AgenteLabs/wdk-staking-kit/issues"
   },
   "engines": {
     "node": ">=20"

test/charter-conformance.test.mjs

@@ -57,7 +57,7 @@ test('every worksIn names a declared repository, and every repository has an own
   const covered = new Set(c.roles.flatMap((r) => r.worksIn ?? []))
   for (const r of repos) assert.ok(covered.has(r), `no role works in "${r}"`)
   // And the declared repository is the real one this charter lives in.
-  assert.ok(c.repositories.some((r) => r.url === 'github.com/FlashyLabs/wdk-staking-kit'),
+  assert.ok(c.repositories.some((r) => r.url === 'github.com/AgenteLabs/wdk-staking-kit'),
     'the charter does not name the repository it lives in')
 })
 

test/scope.test.mjs

@@ -7,7 +7,7 @@
 //
 // Deliberately NOT asserted here: `flashyos.roles.json`'s `repositories[].url`
 // and `package.json`'s `repository`/`homepage`/`bugs` fields, which name the
-// GitHub *repository location* (`github.com/FlashyLabs/wdk-staking-kit`) —
+// GitHub *repository location* (`github.com/AgenteLabs/wdk-staking-kit`) —
 // a separate fact from the npm scope, and this is a scope rename, not a repo
 // move. CHANGELOG.md's historical entries also legitimately keep the old
 // scope, since they describe what shipped under it.
@@ -38,12 +38,18 @@ test('package.json declares a public publishConfig', () => {
   assert.equal(pkg.publishConfig?.registry, 'https://registry.npmjs.org/')
 })
 
-test('package.json\'s GitHub-facing fields are untouched by the scope rename', () => {
-  // This is a scope rename, not a repo move — the repository really does
-  // live at github.com/FlashyLabs/wdk-staking-kit.
-  assert.match(pkg.repository.url, /FlashyLabs\/wdk-staking-kit/)
-  assert.match(pkg.homepage, /FlashyLabs\/wdk-staking-kit/)
-  assert.match(pkg.bugs.url, /FlashyLabs\/wdk-staking-kit/)
+test('package.json\'s GitHub-facing fields name the repository\'s real home', () => {
+  // npm publishes with --provenance, and the registry rejects a tarball whose
+  // repository.url disagrees with the attested build source (E422, measured
+  // 2026-10-30 on the first @flashyfinancial publish). GitHub redirects the
+  // pre-rename org name; the provenance check does not. So these fields must
+  // name the org the repository actually lives in — today AgenteLabs — and
+  // move again on the day the repository itself moves, never before.
+  const HOME = /github\.com\/AgenteLabs\/wdk-staking-kit/
+  assert.match(pkg.repository.url, HOME)
+  assert.match(pkg.homepage, HOME)
+  assert.match(pkg.bugs.url, HOME)
+  assert.doesNotMatch(pkg.repository.url, /FlashyLabs/, 'the pre-rename org would fail npm provenance')
 })
 
 test('README install command and import statements use the new scope', () => {