@coinrithm/mcp-trading 0.7.2 → 0.7.3

package/CHANGELOG.md

@@ -3,7 +3,52 @@
 All notable changes to `@coinrithm/mcp-trading` are documented here. The package
 ships two binaries — `coinrithm-mcp` (the MCP server) and `coinrithm-agent` (the
 self-host agent runner) — versioned together. The CoinRithm **API contract** is
-versioned separately (see `openapi.yaml` `info.version`, currently `1.5.0`).
+versioned separately (see `openapi.yaml` `info.version`, currently `1.6.0`).
+
+## 0.7.3
+
+Quality-engine surfaces + independent forecasts. Additive; no breaking change.
+
+- **Quality verdicts in tool responses.** `discover_pm_markets`, `pm_quote`, and
+  the `pm_data_*` tools now surface the persisted truth-engine `quality` object
+  (`decisionEligible`, warning/block reason codes, `policyVersion`, `assessedAt`).
+  Markets with critical failures stay visible but cannot drive paper opens or
+  alerts.
+- **`openBlocked` preview on `pm_quote`.** Quotes preview the open-time quality
+  gate (`openBlocked` + `openBlockReasons`), so an agent can skip a market that
+  would 422 before burning the open attempt. The self-host runner
+  (`coinrithm-agent`) does this skip automatically.
+- **Independent forecasts in the runner.** The self-host agent runner elicits the
+  model's OWN probability (judged from the question/resolution criteria/deadline,
+  never anchored to the market price) and submits it as `forecastProbability` on
+  PM opens — feeding the public calibration dataset with proper-scoring-rule
+  forecasts. Clamped to [1,99]; omitted (never faked) when the model does not
+  produce one; `HOUSE_AGENT_FORECAST_ENABLED=false` disables.
+- **`crossPlatform` on event lists** documented in the API contract: sibling
+  venues pricing the same question, on list rows.
+- **ForecastEx venue truth.** Public MCP discovery copy and registry metadata
+  now describe all 11 live venues, including ForecastEx.
+- **Contract synchronization.** Runner templates and example bundles pin the
+  served OpenAPI 1.6.0 contract; canonical scorecard paths are unambiguous.
+
+## 0.7.2
+
+Docs-truth + privacy release. No tool behavior change, no API-surface change.
+
+- **Ten venues in the public listing.** `pm_data_*` tool copy, the README, and
+  `server.json` now name all ten venues (adds Futuur and Myriad). npm `0.7.1` was
+  published before those landed, so the registry listing still advertised "eight
+  venues"; npm versions are immutable, so correcting the public listing required
+  a new release.
+- **`source` parameter description** on `pm_data_events` / `pm_data_event_detail`
+  now enumerates all ten venue slugs. Accepted values are unchanged — this is
+  description text only, which is why it is a patch and not a minor.
+- **Privacy.** Raw model output is no longer persisted, enforcing the package's
+  no-chain-of-thought promise.
+- **New tripwire.** `server.json` (the MCP-registry listing) is now guarded
+  against version and venue-count drift; it had no guard, which is how it went
+  stale in the first place.
+- Refreshed stale Arena-gate example copy.
 
 ## 0.7.1
 

package/README.md

@@ -9,8 +9,8 @@ line, with a public **Agent Arena** leaderboard ranked by realized paper PnL.
 
 **Plus a free prediction-market data surface — no key at all.** The same server
 ships four keyless `pm_data_*` tools serving CoinRithm's public cross-venue
-dataset: live odds across 10 venues (Polymarket, Kalshi, Smarkets, Limitless,
-Manifold, Metaculus, PredictIt, Rothera, Futuur, Myriad), cross-venue matches with a
+dataset: live odds across 11 venues (Polymarket, Kalshi, Smarkets, Limitless,
+Manifold, Metaculus, PredictIt, Rothera, Futuur, Myriad, ForecastEx), cross-venue matches with a
 liquidity-aware reference probability, a whale-trade tape, and market-wide
 volume stats ($60B+ all-time tracked). Point any MCP client at the hosted
 endpoint `https://mcp.coinrithm.com/mcp` and call them anonymously — the API
@@ -142,8 +142,8 @@ tool requires it. See [`DEPLOY.md`](./DEPLOY.md).
 | `pm_data_whales` | none (public) | `GET /api/prediction-markets/whales` |
 
 The four `pm_data_*` tools wrap CoinRithm's free public cross-venue dataset
-(all ten venues: Polymarket, Kalshi, Smarkets, Limitless, Manifold,
-Metaculus, PredictIt, Rothera, Futuur, Myriad). They require no API key, never attach yours, and
+(all 11 venues: Polymarket, Kalshi, Smarkets, Limitless, Manifold,
+Metaculus, PredictIt, Rothera, Futuur, Myriad, ForecastEx). They require no API key, never attach yours, and
 are research surfaces: `pm_data_events` list rows carry `referenceProbability`
 (a liquidity-aware cross-venue consensus on matched questions); `pm_data_event`
 includes `crossSourceMatches` (the same real-world question priced on other
@@ -195,9 +195,11 @@ with `runId` to export a private run-evidence bundle:
 The export includes a manifest and summary: first/last event time, venues,
 ledger statuses, quote/write/reject/replay counts, related paper-trade ids, and
 the sanitized ledger rows. It also includes `executionAssumptions`: paper
-account only, latest stored market/probability snapshots, no explicit
-commission/slippage in v1, no futures funding/fees, and worker-driven resting
-order / SL / TP / settlement timing. It is a reproducibility artifact for your
+account only, latest stored market/probability snapshots, and the versioned
+`paper_execution_v1` cost model (paper execution is **not costless** — fills
+charge a modeled taker fee plus spread + slippage on spot/PM, disclosed per fill;
+futures funding is not modeled), and worker-driven resting order / SL / TP /
+settlement timing. It is a reproducibility artifact for your
 run; it is not a full point-in-time market archive and does not expose hidden
 reasoning. Aggregate audit stats include trace coverage for `runId` and
 `decisionId`. Run exports also include `retentionPolicy`: private ledger rows

package/dist/agent/act.d.ts

@@ -1,4 +1,4 @@
-import { CoinRithmClient } from "./client.js";
+import { CoinRithmClient, ProvenanceReport } from "./client.js";
 import { ProposedAction, AgentTrace, ApiResult, Observation, QuoteEvidence } from "./types.js";
 export declare function fetchQuote(client: CoinRithmClient, action: ProposedAction, observation: Observation, trace?: AgentTrace): Promise<QuoteEvidence | undefined>;
-export declare function executeAction(client: CoinRithmClient, action: ProposedAction, observation: Observation, trace: AgentTrace, idempotencyKey: string): Promise<ApiResult>;
+export declare function executeAction(client: CoinRithmClient, action: ProposedAction, observation: Observation, trace: AgentTrace, idempotencyKey: string, provenance?: ProvenanceReport): Promise<ApiResult>;

package/dist/agent/act.js

@@ -3,7 +3,7 @@
 // idempotency key.
 import { asObj, asNum, asStr } from "./extract.js";
 function coinIdFor(observation, symbol) {
-    return observation.watch.find((w) => w.symbol.toUpperCase() === symbol.toUpperCase())?.coinId ?? undefined;
+    return (observation.watch.find((w) => w.symbol.toUpperCase() === symbol.toUpperCase())?.coinId ?? undefined);
 }
 function freshnessOf(block) {
     const fr = asObj(block.freshness);
@@ -17,7 +17,12 @@ export async function fetchQuote(client, action, observation, trace) {
         const coinId = coinIdFor(observation, action.symbol);
         if (!coinId)
             return { eligible: false, blockReasons: ["unresolved_symbol"] };
-        r = await client.futuresQuote({ coinId, side: action.side, leverage: action.leverage, marginMusd: action.marginMusd }, trace);
+        r = await client.futuresQuote({
+            coinId,
+            side: action.side,
+            leverage: action.leverage,
+            marginMusd: action.marginMusd,
+        }, trace);
     }
     else if (action.type === "spot_order") {
         const coinId = coinIdFor(observation, action.symbol);
@@ -48,9 +53,17 @@ export async function fetchQuote(client, action, observation, trace) {
         estimatedCostMusd: asNum(d.estimatedCostMusd), // spot gross notional
         // Freshness lives in the response's `observation` block (anti-look-ahead).
         freshness: freshnessOf(asObj(d.observation)),
+        // PM open-time quality-gate preview (additive; older backends omit it → the
+        // runner just doesn't early-skip and falls through to the normal path).
+        openBlocked: d.openBlocked === true,
+        openBlockReasons: d.openBlockReasons,
     };
 }
-export async function executeAction(client, action, observation, trace, idempotencyKey) {
+export async function executeAction(client, action, observation, trace, idempotencyKey, 
+// Optional SELF-REPORTED runner provenance, attached to a pm_open only (the one
+// durable-artifact write path here). Absent => the request is byte-identical to
+// pre-provenance behavior.
+provenance) {
     if (action.type === "futures_open") {
         const coinId = coinIdFor(observation, action.symbol);
         if (!coinId)
@@ -114,6 +127,14 @@ export async function executeAction(client, action, observation, trace, idempote
             outcomeExternalMarketId: action.outcomeExternalMarketId,
             stakeMusd: action.stakeMusd,
             idempotencyKey,
+            // The agent's OWN independent forecast (already clamped/omitted by the runner).
+            // Included ONLY when present, so an absent forecast leaves the request body
+            // byte-identical to pre-forecast behavior.
+            ...(action.forecastProbability != null
+                ? { forecastProbability: action.forecastProbability }
+                : {}),
+            // Attach runner provenance only when present (byte-identical to before when absent).
+            ...(provenance ? { provenance } : {}),
             agentTrace: trace,
         });
     }

package/dist/agent/cli.js

@@ -7,14 +7,14 @@
 import { mkdirSync, writeFileSync, existsSync, statSync, readFileSync, openSync, closeSync, unlinkSync, } from "node:fs";
 import { resolve as resolvePath, dirname, join, basename } from "node:path";
 import { parse as parseYaml } from "yaml";
-import { resolveAgent, ResolveError, mergeProseParts, isSkillProseSource } from "./resolve.js";
+import { resolveAgent, ResolveError, mergeProseParts, isSkillProseSource, } from "./resolve.js";
 import { buildSpec, loadAgent } from "./skill.js";
 import { validateSkill } from "./skillValidator.js";
 import { strictLint } from "./strictLint.js";
 import { checkCapabilityDrift } from "./capabilityGuard.js";
 import { buildManifest, writeManifest } from "./manifest.js";
 import { parseFrontmatter } from "./frontmatter.js";
-import { renderFolderOfOne, ejectFiles, PRESET_NAMES } from "./templates.js";
+import { renderFolderOfOne, ejectFiles, PRESET_NAMES, } from "./templates.js";
 import { COINRITHM_API } from "./version.js";
 import { stableStringify, envFlag } from "./util.js";
 import { CoinRithmClient } from "./client.js";
@@ -62,7 +62,9 @@ export function cmdNew(targetPath, opts = {}) {
     }
     const preset = (opts.preset ?? "conservative");
     if (!PRESET_NAMES.includes(preset)) {
-        return fail([`unknown preset "${preset}" (allowed: ${PRESET_NAMES.join(", ")})`]);
+        return fail([
+            `unknown preset "${preset}" (allowed: ${PRESET_NAMES.join(", ")})`,
+        ]);
     }
     const dir = resolvePath(targetPath);
     if (!dir || dir === resolvePath("."))
@@ -125,17 +127,25 @@ export function cmdLock(path) {
             ...drift.map((i) => `  [${i.code}] ${i.path ? `${i.path}: ` : ""}${i.message}`),
         ]
         : [];
-    return { ok: true, code: 0, lines: [`wrote ${out}`, `configHash ${manifest.configHash}`, ...warn] };
+    return {
+        ok: true,
+        code: 0,
+        lines: [`wrote ${out}`, `configHash ${manifest.configHash}`, ...warn],
+    };
 }
 export function cmdEject(path) {
     const agentDir = agentDirOf(path);
     const abs = resolvePath(path);
-    const keystone = existsSync(abs) && statSync(abs).isDirectory() ? join(abs, "agent.md") : abs;
+    const keystone = existsSync(abs) && statSync(abs).isDirectory()
+        ? join(abs, "agent.md")
+        : abs;
     if (!existsSync(keystone))
         return fail([`no agent.md at ${keystone}`]);
     const { data: fm, body } = parseFrontmatter(readFileSync(keystone, "utf8"));
     if (Array.isArray(fm.extends)) {
-        return fail(["agent already uses `extends` (already ejected?) — nothing to do"]);
+        return fail([
+            "agent already uses `extends` (already ejected?) — nothing to do",
+        ]);
     }
     const before = buildSpec(fm);
     const { files } = ejectFiles(fm, body);
@@ -149,13 +159,17 @@ export function cmdEject(path) {
         after = buildSpec(resolveAgent(agentDir).rawFrontmatter);
     }
     catch (e) {
-        return fail([`ejected folder failed to re-resolve: ${e.message}`]);
+        return fail([
+            `ejected folder failed to re-resolve: ${e.message}`,
+        ]);
     }
     const same = stableStringify(before) === stableStringify(after);
     const lines = [
         `ejected into ${agentDir}`,
         ...Object.keys(files).map((f) => `  + ${f}`),
-        same ? "✓ resolved spec unchanged" : "✗ WARNING: resolved spec CHANGED after eject",
+        same
+            ? "✓ resolved spec unchanged"
+            : "✗ WARNING: resolved spec CHANGED after eject",
     ];
     return { ok: same, code: same ? 0 : 1, lines };
 }
@@ -170,7 +184,10 @@ export function cmdInspect(path, json = false) {
         throw e;
     }
     const spec = buildSpec(resolved.rawFrontmatter);
-    const lint = [...strictLint(resolved.rawFrontmatter), ...checkCapabilityDrift(resolved, spec)];
+    const lint = [
+        ...strictLint(resolved.rawFrontmatter),
+        ...checkCapabilityDrift(resolved, spec),
+    ];
     const v = validateSkill({ spec, body: resolved.mergedProse, raw: resolved.rawFrontmatter }, "self-host");
     const output = {
         resolvedConfig: resolved.rawFrontmatter,
@@ -179,7 +196,12 @@ export function cmdInspect(path, json = false) {
         validation: { valid: v.valid, issues: v.issues, lint },
     };
     if (json) {
-        return { ok: v.valid, code: 0, lines: [JSON.stringify(output, null, 2)], data: output };
+        return {
+            ok: v.valid,
+            code: 0,
+            lines: [JSON.stringify(output, null, 2)],
+            data: output,
+        };
     }
     const lines = [
         `name:        ${spec.name}`,
@@ -278,7 +300,9 @@ export async function cmdRun(path, opts = {}) {
     }
     const apiKey = process.env.COINRITHM_API_KEY;
     if (!apiKey)
-        return fail(["COINRITHM_API_KEY is not set (needed to read your paper account)"]);
+        return fail([
+            "COINRITHM_API_KEY is not set (needed to read your paper account)",
+        ]);
     let provider;
     try {
         provider = selectProvider(loaded.spec, process.env, fetch);
@@ -286,11 +310,16 @@ export async function cmdRun(path, opts = {}) {
     catch (e) {
         return fail([e.message]);
     }
-    const client = new CoinRithmClient({ apiKey, baseUrl: process.env.COINRITHM_API_URL });
+    const client = new CoinRithmClient({
+        apiKey,
+        baseUrl: process.env.COINRITHM_API_URL,
+    });
     const stateFile = opts.stateFile ?? join(agentDirOf(path), ".agent.state.json");
     const release = acquireLock(stateFile);
     if (!release) {
-        return fail([`another runner holds ${stateFile}.lock — only one runner per agent at a time`]);
+        return fail([
+            `another runner holds ${stateFile}.lock — only one runner per agent at a time`,
+        ]);
     }
     // A self-host `run` is a cadence-paced loop users stop with Ctrl-C. Node exits
     // on SIGINT/SIGTERM WITHOUT unwinding the finally across the awaited loop, so
@@ -315,7 +344,9 @@ export async function cmdRun(path, opts = {}) {
             return fail([e.message]);
         }
         if (state.disabled) {
-            return fail([`agent is disabled: ${state.disabledReason ?? "kill-switch"} — clear ${stateFile} to reset`]);
+            return fail([
+                `agent is disabled: ${state.disabledReason ?? "kill-switch"} — clear ${stateFile} to reset`,
+            ]);
         }
         const live = !!opts.live;
         const lines = [
@@ -399,7 +430,10 @@ export async function main(argv) {
     let r;
     switch (cmd) {
         case "new":
-            r = cmdNew(pos[0] ?? "", { template: flags.template, preset: flags.preset });
+            r = cmdNew(pos[0] ?? "", {
+                template: flags.template,
+                preset: flags.preset,
+            });
             break;
         case "validate":
             r = cmdValidate(pos[0] ?? ".", flags.hosted ? "hosted" : "self-host");
@@ -416,7 +450,11 @@ export async function main(argv) {
         case "run": {
             // dry-run is the default; only --live (or LIVE=1) AND not --dry-run trades.
             const live = (!!flags.live || process.env.LIVE === "1") && !flags.dryRun;
-            r = await cmdRun(pos[0] ?? ".", { once: flags.once, live, stateFile: flags.state });
+            r = await cmdRun(pos[0] ?? ".", {
+                once: flags.once,
+                live,
+                stateFile: flags.state,
+            });
             break;
         }
         case undefined:
@@ -426,10 +464,13 @@ export async function main(argv) {
             r = { ok: true, code: 0, lines: usageLines() };
             break;
         default:
-            r = { ok: false, code: 1, lines: [`unknown command "${cmd}"`, ...usageLines()] };
+            r = {
+                ok: false,
+                code: 1,
+                lines: [`unknown command "${cmd}"`, ...usageLines()],
+            };
     }
     for (const line of r.lines) {
-        // eslint-disable-next-line no-console
         console.log(line);
     }
     return r.code;

package/dist/agent/client.d.ts

@@ -1,5 +1,20 @@
 import { AgentTrace, ApiResult } from "./types.js";
 export declare const DEFAULT_BASE_URL = "https://api.coinrithm.com";
+export type ProvenanceReport = {
+    runtimeKind?: "hosted_scheduler" | "self_host_runner" | "byo_api" | "mcp_tool";
+    packageVersion?: string;
+    bundleId?: string;
+    bundleVersion?: string;
+    skillVersions?: Record<string, string>;
+    promptHash?: string;
+    configHash?: string;
+    modelProvider?: string;
+    modelName?: string;
+    evidenceRef?: {
+        snapshotIds?: string[];
+        sourceCapturedAt?: string;
+    };
+};
 export interface ClientConfig {
     apiKey: string;
     baseUrl?: string;
@@ -107,8 +122,26 @@ export declare class CoinRithmClient {
         outcomeExternalMarketId: string;
         stakeMusd: number;
         idempotencyKey: string;
+        forecastProbability?: number;
+        provenance?: ProvenanceReport;
         agentTrace?: AgentTrace;
     }): Promise<ApiResult>;
+    reportPmOpportunity(body: {
+        kind: "abstained" | "forecast_only" | "quote_expired";
+        source?: string;
+        slug?: string;
+        outcomeExternalMarketId?: string;
+        forecastProbability?: number;
+        marketProbability?: number;
+        reasonCode?: string;
+        cohort?: {
+            universeSize?: number;
+            horizon?: string;
+        };
+        decisionId?: string | null;
+        runId?: string | null;
+        provenance?: ProvenanceReport;
+    }, trace?: AgentTrace): Promise<ApiResult>;
     exportRunEvidence(runId: string): Promise<ApiResult>;
 }
 export declare function isFailClosed(status: number): boolean;

package/dist/agent/client.js

@@ -64,7 +64,10 @@ export class CoinRithmClient {
                 return {
                     ok: false,
                     status: 0,
-                    data: { error: "network_error", message: err instanceof Error ? err.message : String(err) },
+                    data: {
+                        error: "network_error",
+                        message: err instanceof Error ? err.message : String(err),
+                    },
                 };
             }
             const retryAfter = Number(res.headers.get("retry-after"));
@@ -88,7 +91,9 @@ export class CoinRithmClient {
                 ok: res.ok,
                 status: res.status,
                 data,
-                retryAfterSeconds: res.status === 429 && Number.isFinite(retryAfter) ? retryAfter : undefined,
+                retryAfterSeconds: res.status === 429 && Number.isFinite(retryAfter)
+                    ? retryAfter
+                    : undefined,
                 rateLimitRemaining: Number(res.headers.get("ratelimit-remaining")) || undefined,
                 ledgerEventId: res.headers.get("x-coinrithm-ledger-event-id"),
             };
@@ -120,17 +125,24 @@ export class CoinRithmClient {
         return this.request("GET", "/api/agent/trades", { query, trace });
     }
     futuresPositions(query, trace) {
-        return this.request("GET", "/api/agent/positions/futures", { query, trace });
+        return this.request("GET", "/api/agent/positions/futures", {
+            query,
+            trace,
+        });
     }
     futuresQuote(body, trace) {
-        return this.request("POST", "/api/agent/futures/quote", { body: { ...body, agentTrace: trace } });
+        return this.request("POST", "/api/agent/futures/quote", {
+            body: { ...body, agentTrace: trace },
+        });
     }
     // ── spot ─────────────────────────────────────────────────────────────────
     openOrders(query, trace) {
         return this.request("GET", "/api/agent/orders/open", { query, trace });
     }
     spotQuote(body, trace) {
-        return this.request("POST", "/api/agent/spot/quote", { body: { ...body, agentTrace: trace } });
+        return this.request("POST", "/api/agent/spot/quote", {
+            body: { ...body, agentTrace: trace },
+        });
     }
     // ── prediction markets ───────────────────────────────────────────────────
     discoverPmMarkets(query, trace) {
@@ -149,7 +161,9 @@ export class CoinRithmClient {
         return this.request("GET", "/api/agent/positions/pm", { query, trace });
     }
     pmQuote(body, trace) {
-        return this.request("POST", "/api/agent/pm/quote", { body: { ...body, agentTrace: trace } });
+        return this.request("POST", "/api/agent/pm/quote", {
+            body: { ...body, agentTrace: trace },
+        });
     }
     // ── writes ─────────────────────────────────────────────────────────────────
     openFutures(body) {
@@ -173,9 +187,22 @@ export class CoinRithmClient {
     openPmPosition(body) {
         return this.request("POST", "/api/agent/pm/open", { body });
     }
+    // Report a NON-opened PM opportunity (abstained / forecast_only / quote_expired)
+    // so the public evaluation captures the FULL opportunity universe, not only
+    // opened trades. EVIDENCE, not a trade: needs only the read scope and does not
+    // move a wallet/position. Best-effort at the call site — a failure never affects
+    // the cycle. decisionId is the per-cycle idempotency key (server dedupes on
+    // (apiKeyId, decisionId)).
+    reportPmOpportunity(body, trace) {
+        return this.request("POST", "/api/agent/pm/opportunity", {
+            body: { ...body, agentTrace: trace },
+        });
+    }
     // Run-evidence export — runId is URL-encoded into the query.
     exportRunEvidence(runId) {
-        return this.request("GET", "/api/agent/ledger/export", { query: { runId } });
+        return this.request("GET", "/api/agent/ledger/export", {
+            query: { runId },
+        });
     }
 }
 // 401/403/409/422 are terminal, fail-closed outcomes for a cycle (auth/scope,

package/dist/agent/decision.d.ts

@@ -111,12 +111,14 @@ export declare const actionSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<
     stakeMusd: z.ZodEffects<z.ZodTypeAny, any, unknown>;
     confidence: z.ZodEffects<z.ZodOptional<z.ZodNullable<z.ZodEffects<z.ZodTypeAny, any, unknown>>>, any, unknown>;
     rationaleSummary: z.ZodOptional<z.ZodString>;
+    forecastProbability: z.ZodOptional<z.ZodEffects<z.ZodAny, number | undefined, any>>;
 }, "strict", z.ZodTypeAny, {
     type: "pm_open";
     source?: string | undefined;
     slug?: string | undefined;
     outcomeExternalMarketId?: string | undefined;
     stakeMusd?: any;
+    forecastProbability?: number | undefined;
     confidence?: any;
     rationaleSummary?: string | undefined;
     ref?: string | undefined;
@@ -126,6 +128,7 @@ export declare const actionSchema: z.ZodDiscriminatedUnion<"type", [z.ZodObject<
     slug?: string | undefined;
     outcomeExternalMarketId?: string | undefined;
     stakeMusd?: unknown;
+    forecastProbability?: any;
     confidence?: unknown;
     rationaleSummary?: string | undefined;
     ref?: string | undefined;

package/dist/agent/decision.js

@@ -8,12 +8,29 @@ import { z } from "zod";
 // validating; leave anything else untouched so genuine garbage ("abc", "pos#5")
 // still fails closed. This is why actions were being rejected with
 // "actions.0.positionId: Expected number, received string".
-const num = (inner) => z.preprocess((v) => (typeof v === "string" && v.trim() !== "" && Number.isFinite(Number(v)) ? Number(v) : v), inner);
+const num = (inner) => z.preprocess((v) => typeof v === "string" && v.trim() !== "" && Number.isFinite(Number(v))
+    ? Number(v)
+    : v, inner);
 // Optional 0..1 confidence, tolerant of stringified/null input.
 const confidence = num(z.number().min(0).max(1))
     .nullable()
     .optional()
     .transform((v) => v ?? undefined);
+// The model's OWN 0-100 forecast for the backed PM side (its independent
+// probability the side wins, decided from the question — NOT the market price).
+// Deliberately TOLERANT: a missing / null / non-numeric value becomes undefined
+// (the runner then omits the field) rather than failing the whole action. A bad
+// forecast must NEVER block an otherwise-valid trade. Out-of-range values are NOT
+// rejected here — the runner clamps them to the backend's [1,99] rail. Kept as a
+// permissive `any→number|undefined` so it can never throw inside the strict
+// discriminated union.
+const forecastProbability = z
+    .any()
+    .transform((v) => {
+    const n = typeof v === "string" && v.trim() !== "" ? Number(v) : v;
+    return typeof n === "number" && Number.isFinite(n) ? n : undefined;
+})
+    .optional();
 const futuresOpen = z
     .object({
     type: z.literal("futures_open"),
@@ -79,6 +96,7 @@ const pmOpen = z
     stakeMusd: num(z.number().positive()),
     confidence,
     rationaleSummary: z.string().optional(),
+    forecastProbability,
 })
     .strict();
 export const actionSchema = z.discriminatedUnion("type", [
@@ -164,13 +182,18 @@ export function parseDecision(text) {
         obj = normalizeDecisionVerb(coerceJson(text));
     }
     catch (err) {
-        return { ok: false, error: `model output is not valid JSON: ${err instanceof Error ? err.message : String(err)}` };
+        return {
+            ok: false,
+            error: `model output is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,
+        };
     }
     const res = decisionSchema.safeParse(obj);
     if (!res.success) {
         return {
             ok: false,
-            error: res.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; "),
+            error: res.error.issues
+                .map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`)
+                .join("; "),
         };
     }
     const d = res.data;

package/dist/agent/decisionValidator.js

@@ -21,7 +21,8 @@ export function validateAction(action, ctx) {
     // throttled (we want an active Arena), and hosted agents only when the customer sets a
     // positive cap. The risk caps below (daily loss, open margin, leverage, stops) are the
     // real guardrails and always apply regardless of the trade-count cap.
-    if (spec.limits.maxTradesPerDay > 0 && ctx.writesToday >= spec.limits.maxTradesPerDay) {
+    if (spec.limits.maxTradesPerDay > 0 &&
+        ctx.writesToday >= spec.limits.maxTradesPerDay) {
         return fail("daily_trade_cap", `maxTradesPerDay ${spec.limits.maxTradesPerDay} reached`);
     }
     // Deny-list: an open on a blocked symbol is rejected up front (deny wins over

package/dist/agent/deploymentOverlay.js

@@ -8,14 +8,34 @@
 // agent runs on a default tier and this still enforces it.)
 // Effective caps per tier. Tightenable later from config; these are the defaults.
 export const TIER_LIMITS = {
-    free_demo: { maxLlmCallsPerHour: 4, minCadenceSeconds: 3600, maxConcurrentAgents: 1 },
-    builder: { maxLlmCallsPerHour: 20, minCadenceSeconds: 900, maxConcurrentAgents: 3 },
-    pro: { maxLlmCallsPerHour: 120, minCadenceSeconds: 60, maxConcurrentAgents: 10 },
+    free_demo: {
+        maxLlmCallsPerHour: 4,
+        minCadenceSeconds: 3600,
+        maxConcurrentAgents: 1,
+    },
+    builder: {
+        maxLlmCallsPerHour: 20,
+        minCadenceSeconds: 900,
+        maxConcurrentAgents: 3,
+    },
+    pro: {
+        maxLlmCallsPerHour: 120,
+        minCadenceSeconds: 60,
+        maxConcurrentAgents: 10,
+    },
     // BYO key = the user's own model quota, so we don't cap their calls; we still
     // host + meter + verify (that's what they pay the infra fee for).
-    byok: { maxLlmCallsPerHour: 0, minCadenceSeconds: 60, maxConcurrentAgents: 5 },
+    byok: {
+        maxLlmCallsPerHour: 0,
+        minCadenceSeconds: 60,
+        maxConcurrentAgents: 5,
+    },
     // The house showcase fleet — uncapped, runs on our pooled keys.
-    house: { maxLlmCallsPerHour: 0, minCadenceSeconds: 60, maxConcurrentAgents: 0 },
+    house: {
+        maxLlmCallsPerHour: 0,
+        minCadenceSeconds: 60,
+        maxConcurrentAgents: 0,
+    },
 };
 // Tighten one numeric cap: 0 means "unlimited" on either side. The tier always wins
 // where it imposes a finite cap; it can never raise a request.

package/dist/agent/engine.d.ts

@@ -1,5 +1,5 @@
 export { runCycle, type RunnerDeps } from "./runner.js";
-export { selectProvider, type ProviderEnv, type Provider } from "./providers.js";
+export { selectProvider, type ProviderEnv, type Provider, } from "./providers.js";
 export { CoinRithmClient } from "./client.js";
 export { loadAgent, buildSpec, type LoadedAgent } from "./skill.js";
 export { resolveAgent } from "./resolve.js";
@@ -7,4 +7,5 @@ export { validateSkill, type SkillValidationMode } from "./skillValidator.js";
 export { newState, rollDay } from "./state.js";
 export { makeRunId } from "./runEvidence.js";
 export { parseCadenceMs } from "./util.js";
+export { BENCHMARK_AGENTS, BENCHMARK_STRATEGIES, decideMechanical, isBenchmarkStrategy, type BenchmarkStrategy, type BenchmarkAgentDefinition, } from "./mechanical.js";
 export type { AgentSpec, RunState, CycleResult, PlannedAction, Venue, ProviderName, ModelConfig, } from "./types.js";

package/dist/agent/engine.js

@@ -6,7 +6,7 @@
 // This barrel is the ONE import a host scheduler needs; it re-exports only the
 // stable engine pieces, never the CLI.
 export { runCycle } from "./runner.js";
-export { selectProvider } from "./providers.js";
+export { selectProvider, } from "./providers.js";
 export { CoinRithmClient } from "./client.js";
 export { loadAgent, buildSpec } from "./skill.js";
 export { resolveAgent } from "./resolve.js";
@@ -14,3 +14,6 @@ export { validateSkill } from "./skillValidator.js";
 export { newState, rollDay } from "./state.js";
 export { makeRunId } from "./runEvidence.js";
 export { parseCadenceMs } from "./util.js";
+// Mechanical BENCHMARK baseline agents (sol #7): the deterministic, non-LLM
+// reference line the scheduler seeds into agent_runtime and the runner executes.
+export { BENCHMARK_AGENTS, BENCHMARK_STRATEGIES, decideMechanical, isBenchmarkStrategy, } from "./mechanical.js";

package/dist/agent/extract.js

@@ -1,5 +1,7 @@
 // Defensive extractors for untyped API JSON.
-export const asObj = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
+export const asObj = (v) => v && typeof v === "object" && !Array.isArray(v)
+    ? v
+    : {};
 export const asArr = (v) => (Array.isArray(v) ? v : []);
 export const asNum = (v) => typeof v === "number" && Number.isFinite(v) ? v : undefined;
 export const asStr = (v) => typeof v === "string" ? v : undefined;