[AAASM-4168] 📝 (docs): Scrub claimable .io install host from verification report

[Chisanan232]

Target

• Task summary:

  Scrub the stale, attacker-claimable .io fetch-and-shell install one-liner from a committed verification-report doc so a copy-paste can't fetch-and-execute from a hijacked host.

• Task tickets:

  • Task ID: AAASM-4168 (LOW — supply-chain residue).
  • Relative task IDs:
    • AAASM-4122, AAASM-4153 — earlier files in the same .io claimable-host class.
  • Relative PRs:
    • N/A.

• Key point change (optional):

  verification-reports/AAASM-1203.md:141 quoted an outdated INSTALL_HINT snapshot still pointing at https://get.agent-assembly.io. That domain is unregistered (resolves NXDOMAIN) and attacker-claimable — anyone copy-pasting the command from the report could curl … | sh from a hijacked host.

  • As-is: curl -fsSL https://get.agent-assembly.io | sh
  • To-be: curl -fsSL https://agent-assembly.com/install.sh | sh — mirrors the exact canonical form currently in src/runtime.ts INSTALL_HINT (already scrubbed by AAASM-4153).

  This is the third file in the .io claimable-host class (after AAASM-4122 examples/python and AAASM-4153 node/go runtime). A full repo grep-sweep (grep -rn 'agent-assembly\.io' ., excluding node_modules/.git) confirms this doc was the only remaining reference and there are now zero agent-assembly.io matches left in the repo.

Effecting Scope

• Action Types:
  • 🔧 Fixing bug
  • 🍀 Improving something (performance, code quality, security, etc.)
• Scopes:
  • 📚 Documentation
• Additional description:
  Doc/text-only change; no source, build, or test impact. No broken markdown link introduced (bare command inside a fenced code block).

Description

• Replace the claimable get.agent-assembly.io install one-liner in verification-reports/AAASM-1203.md with the canonical agent-assembly.com/install.sh form.

🤖 Generated with Claude Code

https://claude.ai/code/session_01R7vqjjo5nrebYNt8WnCNbz

[Chisanan232]

Claude Code review — COMMENT

Verdict: approve-ready (comment only, no approval per review policy).

CI: Green — all required checks pass (1/1), 0 failures.

Scope vs AAASM-4168 (LOW, supply-chain residue): Matches exactly. Single-line change in verification-reports/AAASM-1203.md:141:

• curl -fsSL https://get.agent-assembly.io | sh → curl -fsSL https://agent-assembly.com/install.sh | sh
• The canonical .com form mirrors src/runtime.ts INSTALL_HINT line 42 verbatim (confirmed on-branch).
• Repo-wide sweep on the PR head (git grep 'agent-assembly\.io', excl. node_modules) returns zero matches — this was the last .io reference in node-sdk, third file closed in the claimable-host class after AAASM-4122 / AAASM-4153.

Side-effects: None. Doc/text-only; the command sits inside a fenced code block, so no broken markdown link is introduced. No source/build/test surface touched.

— Claude Code review