chore(frontend): remove synthetic sample files

.gitignore

@@ -85,10 +85,8 @@ secrets.json
 
 # Artifacts that should never be tracked
 *.zip
-# ...except the public proof bundles the frontend serves. These are
-# intentionally tracked fixtures (the audit-bundle pair backs the public
-# /api/v1/proof/verify demo, including the deliberately tampered one), and
-# the bare *.zip rule above was silently covering them (#2873).
+# ...except any public bundles the frontend serves from these folders (#2873).
+# None are published at the moment.
 !frontend/public/proof/*.zip
 login_resp.json
 frontend/build_log.txt

frontend/public/sdk/verify_chain.py

@@ -17,7 +17,7 @@
     odd-node padding: duplicate the last node
 
 Usage:
-    python verify_chain.py audit-bundle.zip
+    python verify_chain.py your-bundle.zip
 
 Copyright (c) 2024-2026 RegEngine LLC
 License: Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) —
@@ -260,7 +260,7 @@ def verify_bundle(zip_path: str) -> int:
 
 def main() -> int:
     parser = argparse.ArgumentParser(description="Verify a RegEngine audit bundle (zip with manifest.json).")
-    parser.add_argument("bundle", help="Path to audit-bundle.zip")
+    parser.add_argument("bundle", help="Path to an exported audit bundle ZIP")
     args = parser.parse_args()
     return verify_bundle(args.bundle)
 

frontend/src/__tests__/pages/proof-no-sample.test.tsx

@@ -0,0 +1,19 @@
+import { render, screen } from '@testing-library/react';
+import { describe, expect, it } from 'vitest';
+import ProofPage from '@/app/proof/page';
+
+// /proof must not offer synthetic downloads or made-up hashes and sizes.
+describe('/proof without sample data', () => {
+    it('shows an empty state and no artifact downloads', () => {
+        const { container } = render(<ProofPage />);
+        const text = container.textContent ?? '';
+
+        expect(screen.getByText(/no public artifacts are published yet/i)).toBeInTheDocument();
+        expect(text).not.toMatch(/fsma-204-sample|epcis-sample|audit-bundle/i);
+        expect(text).not.toMatch(/\b[0-9a-f]{12,}\b/i);
+        expect(container.querySelector('a[download]:not([href="/sdk/verify_chain.py"])')).toBeNull();
+        expect(container.querySelector('a[href="/sdk/verify_chain.py"][download]')).not.toBeNull();
+        expect(container.querySelector('a[href^="/proof/"]')).toBeNull();
+        expect(container.querySelector('a[href="/verify"]')).not.toBeNull();
+    });
+});

frontend/src/app/docs/page.tsx

@@ -305,7 +305,7 @@ export default function DocsHomePage() {
         <footer className="flex flex-col items-start justify-between gap-4 border-t border-re-border-subtle pt-8 sm:flex-row sm:items-center">
           <div className="flex flex-wrap items-center gap-4">
             <code className="rounded-md border border-re-border-subtle bg-re-surface-inset px-4 py-2 font-mono text-[0.8125rem] text-re-text-secondary">
-              python verify_chain.py audit-bundle.zip
+              python verify_chain.py your-bundle.zip
             </code>
             <span className="text-ui text-re-text-tertiary">
               Don&apos;t trust, verify.