@jinn-network/client 0.1.9 → 0.2.0-canary.0b79cd5d

package/dist/config.js

@@ -16,9 +16,10 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { z } from 'zod';
+import { z } from 'zod/v3';
 import { TaskSchema, parseTask } from './types/task.js';
 import { canonicalHarnessName } from './harnesses/names.js';
+import { isOpenRouterModelId } from './harnesses/provider-ref.js';
 import { parseRpcUrls } from './rpc/transport.js';
 import { canonicalLocalHttpBaseUrl } from './local-provider-url.js';
 // ── Schema ──────────────────────────────────────────────────────────────────
@@ -44,17 +45,10 @@ export const JinnConfigSchema = z.object({
      */
     rpcUrl: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
     archiveRpcUrl: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
-    /**
-     * Optional L2 proof/archive RPC endpoint(s) for canonical cross-chain canaries.
-     * The daemon can use its normal rpcUrl for writes while proof construction
-     * uses this endpoint for historical eth_getProof at OP dispute-game blocks.
-     * Accepts string or array form (see rpcUrl). Env: JINN_L2_PROOF_RPC_URL.
-     */
-    l2ProofRpcUrl: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
     /**
      * Single volume-aware durable-state root. When set (env JINN_STATE_DIR or
      * this file field), `earningDir`, `dbPath`, `engine.implStateDirRoot`, and
-     * the swe-rebench-v2 pool dir derive from it as `<stateDir>/<subdir>` —
+     * `sweRebenchV2StateDir` derive from it as `<stateDir>/<subdir>` —
      * UNLESS each is individually overridden, in which case the per-key value
      * wins (derive-don't-collapse). With `stateDir` unset, every default is
      * byte-identical to the legacy `~/.jinn-client/<subdir>` paths. Hosted
@@ -67,15 +61,23 @@ export const JinnConfigSchema = z.object({
     earningDir: z.string().default(join(homedir(), '.jinn-client', 'earning')),
     /** SQLite database path */
     dbPath: z.string().default(join(homedir(), '.jinn-client', 'jinn.db')),
+    /**
+     * SWE-rebench v2 durable state (validated pool, generator ledger, harvest).
+     * Derived from `stateDir` / `JINN_STATE_DIR` as `<stateDir>/swe-rebench-v2`
+     * unless overridden by this field or `JINN_SWE_REBENCH_V2_STATE_DIR`.
+     */
+    sweRebenchV2StateDir: z
+        .string()
+        .default(join(homedir(), '.jinn-client', 'swe-rebench-v2')),
     /** Chain poll interval in ms */
     pollIntervalMs: z.number().int().positive().default(5000),
     /**
      * How often the daemon attempts stOLAS ExternalStakingDistributor.claim for each staked
-     * fleet service (ms). Default 600000 (10 min) — well under typical checkpoint liveness windows
-     * on Base while limiting RPC/gas churn. Set to 0 to disable auto-claim.
+     * fleet service (ms). Default 0 so operators claim OLAS manually from the app.
+     * Set JINN_REWARD_CLAIM_INTERVAL_MS=600000 for managed/headless auto-claim.
      * Env: JINN_REWARD_CLAIM_INTERVAL_MS
      */
-    rewardClaimIntervalMs: z.number().int().min(0).default(600_000),
+    rewardClaimIntervalMs: z.number().int().min(0).default(0),
     /**
      * How often the daemon checks agent EOA and Safe balances and tops them up from the master
      * wallet when they drop below trigger thresholds (ms). Default 300000 (5 min).
@@ -221,98 +223,12 @@ export const JinnConfigSchema = z.object({
     /** Optional Base Sepolia stOLAS deployment artifact path */
     testnetStolasDeploymentPath: z.string().optional(),
     /**
-     * Optional deployment artifact for the v0 MVI L1 stack
-     * (deployment-jinn-mvi-l1-{network}{,-fast}.json). Provides addresses for
-     * JINN, Timelock, JinnGovernor, JinnDistributor, and Messenger.
-     * When set the daemon enables the cross-chain JINN claim loop.
-     */
-    jinnMviL1DeploymentPath: z.string().optional(),
-    /**
-     * Optional deployment artifact for the v0 MVI L2 emitter
-     * (deployment-jinn-mvi-l2-{network}.json). Provides the
-     * TaskClaimEmitter address on the measurement chain (Base / Base Sepolia).
-     */
-    jinnMviL2DeploymentPath: z.string().optional(),
-    // ── Cross-chain claim loop (Phase B / jinn-mono-7x5) ─────────────────────
-    /**
-     * RPC endpoint(s) for the L1 governance chain (Ethereum / Sepolia) where
-     * the JinnDistributor lives. Accepts string or array form (see rpcUrl) and
-     * supports comma-separated env values. Testnet defaults to a public Sepolia
-     * RPC; mainnet requires an operator override when L1 submit mode is
-     * configured. Env: JINN_ETHEREUM_RPC_URL.
-     */
-    ethereumRpcUrl: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
-    /**
-     * Optional archive RPC endpoint(s) for the L1 governance chain. Used for
-     * historical block lookups when constructing canonical-mode proofs. Accepts
-     * string or array form. Env: JINN_ETHEREUM_ARCHIVE_RPC_URL.
-     */
-    ethereumArchiveRpcUrl: z.union([z.string(), z.array(z.string()).min(1)]).optional(),
-    /**
-     * L1 network used by the cross-chain claim loop. 'sepolia' tracks Base
-     * Sepolia testnet; 'ethereum' tracks Base mainnet. Defaults to 'sepolia'
-     * during Phase 1b. Env: JINN_L1_NETWORK.
-     */
-    jinnL1Network: z.enum(['sepolia', 'ethereum']).default('sepolia'),
-    /**
-     * JinnDistributor address on the L1 governance chain. Required for
-     * jinnClaimSubmissionMode='submit'. When set for submit mode, ethereumRpcUrl
-     * MUST also be set. Resolved from jinnMviL1DeploymentPath when omitted;
-     * otherwise a manual override. Env: JINN_DISTRIBUTOR_ADDRESS.
-     */
-    jinnDistributorAddress: z
-        .string()
-        .regex(/^0x[0-9a-fA-F]{40}$/, 'must be a 0x-prefixed 20-byte address')
-        .optional(),
-    /**
-     * TaskClaimEmitter address on the L2 measurement chain (Base / Base
-     * Sepolia). Resolved from jinnMviL2DeploymentPath when omitted.
-     * Env: JINN_CLAIM_EMITTER_ADDRESS.
-     */
-    jinnClaimEmitterAddress: z
-        .string()
-        .regex(/^0x[0-9a-fA-F]{40}$/, 'must be a 0x-prefixed 20-byte address')
-        .optional(),
-    /**
-     * Messenger address on the L1 governance chain. Resolved from
-     * jinnMviL1DeploymentPath when omitted.
-     * Env: JINN_MESSENGER_ADDRESS.
+     * Loop-watchdog auto-restart gate (#1043). Default OFF (the locked Option A
+     * decision): the watchdog always detects a stale loop and loud-logs + emits
+     * a `loop_watchdog_stale` event, but the non-zero process.exit recovery only
+     * fires when this is on. Env: JINN_WATCHDOG_AUTO_RESTART=1|true|yes.
      */
-    jinnMessengerAddress: z
-        .string()
-        .regex(/^0x[0-9a-fA-F]{40}$/, 'must be a 0x-prefixed 20-byte address')
-        .optional(),
-    /**
-     * Messenger mode driving proof construction. `mock` submits MockMessenger
-     * fixtures — required for automated Sepolia burn-in (`runOnce`). `canonical`
-     * builds OP-Stack storage proofs for verifier-only checks; scheduled daemon
-     * ticks **skip** canonical mode (multi-day finality) — use
-     * `tsx scripts/verify-canonical-canary.ts` after finality instead. Defaults
-     * to `canonical`.
-     * Env: JINN_MESSENGER_MODE.
-     */
-    jinnMessengerMode: z.enum(['canonical', 'mock']).default('canonical'),
-    /**
-     * Claim submission mode. `emit-only` only submits TaskClaimEmitter.emitClaim
-     * on L2 and records the resulting ticket. `submit` continues into the L1
-     * messenger/distributor path.
-     * Env: JINN_CLAIM_SUBMISSION_MODE.
-     */
-    jinnClaimSubmissionMode: z.enum(['emit-only', 'submit']).default('emit-only'),
-    /**
-     * Explicit operator gate for the cross-chain JINN claim loop. The schema
-     * default stays off for mainnet/unknown networks; loadConfig defaults this
-     * on for testnet now that the emitter and standing relayer are live.
-     * Env: JINN_CLAIM_LOOP_ENABLED=1|true|yes.
-     */
-    jinnClaimLoopEnabled: z.boolean().default(false),
-    /**
-     * How often the daemon ticks the cross-chain JINN claim loop (ms). Default
-     * 3 600 000 (1 hour) — well below mainnet challenge windows while
-     * minimising RPC/gas churn. Set to 0 to disable when the address is set.
-     * Env: JINN_CLAIM_LOOP_INTERVAL_MS.
-     */
-    jinnClaimLoopIntervalMs: z.number().int().min(0).default(60 * 60 * 1000),
+    watchdogAutoRestart: z.boolean().default(false),
     /** Staking mode: 'standard' uses stOLAS (no OLAS needed), 'self-bond' uses operator-provided OLAS. */
     stakingMode: z.enum(['standard', 'self-bond']).default('standard'),
     /** Number of services to bootstrap and run. */
@@ -347,6 +263,25 @@ export const JinnConfigSchema = z.object({
         .string()
         .regex(/^\d+$/, 'must be a non-negative integer string')
         .optional(),
+    /**
+     * Faucet top-up daily cap + cooldown (issue #560). Single source of truth
+     * for the running-mode Dashboard "Top up from faucet" batch action, shared
+     * by the daemon endpoint and surfaced to the SPA via GET /v1/setup/drip/quota.
+     *
+     * `faucetDailyTopupCap` — number of faucet drips a single operator click may
+     * issue in one batch (and the per-24h ceiling per wallet). Env:
+     * JINN_FAUCET_DAILY_TOPUP_CAP.
+     *
+     * `faucetTopupCooldownMs` — once the cap is reached, the top-up action is
+     * disabled until this window elapses since the first call of that batch.
+     * Env: JINN_FAUCET_TOPUP_COOLDOWN_MS.
+     */
+    faucetDailyTopupCap: z.number().int().positive().default(10),
+    faucetTopupCooldownMs: z
+        .number()
+        .int()
+        .min(0)
+        .default(24 * 60 * 60 * 1000),
     /**
      * Operator-controlled Harness inventory.
      */
@@ -394,6 +329,23 @@ export const JinnConfigSchema = z.object({
         mode: z.enum(['train', 'frozen']).default('train'),
     })
         .default({ mode: 'train' }),
+    /**
+     * Mineable-trace retention consent (task-creator spec §10, decision D2).
+     * Two independent, deliberate opt-in tiers:
+     *   - `consent` ('off' default) — retain contract fields (repo,
+     * The single sharing consent (mono#1714): local capture, mining, and
+     * distillation happen unconditionally (they never leave the machine), and
+     * `share` governs only whether a mined task is published off the box.
+     * Default is false — nothing derived from work leaves the machine unless
+     * the operator opts in. Env: JINN_SHARE_CONSENT. Legacy
+     * `consent`/`publishConsent` (and JINN_MINEABLE_PUBLISH_CONSENT) migrate to
+     * `share` at load time (only the old publish bit maps).
+     */
+    mineableTraces: z
+        .object({
+        share: z.boolean().default(false),
+    })
+        .default({ share: false }),
     /**
      * Manifest-keyed joined SolverNets.
      *
@@ -424,10 +376,35 @@ export const JinnConfigSchema = z.object({
             .min(1, 'each joined SolverNet must enable at least one role'),
         harness: HarnessNameSchema.optional(),
         model: z.string().optional(),
+        // Provider route (issue #1243): a named provider (string) or a custom
+        // OpenAI-compatible endpoint object. Optional — legacy `{model}`-only
+        // entries are backfilled at load time (see `backfillJoinedProviders`).
+        provider: z
+            .union([
+            z.string().trim().min(1),
+            z.object({
+                name: z.string().trim().min(1),
+                baseUrl: z.string().trim().min(1).optional(),
+                authVar: z.string().trim().min(1).optional(),
+            }),
+        ])
+            .optional(),
         plugins: z.array(z.string()).default([]),
         disabledDefaultPlugins: z.array(z.string()).default([]),
     }))
         .optional(),
+    /**
+     * Set true once the operator clicks "Enter dashboard" at the end of the
+     * #983 guided onboarding takeover. Distinct from `joinedSolverNets` being
+     * non-empty: a node can have a membership mid-onboarding (the first join
+     * populates the map) yet not have finished harness/model selection. The SPA
+     * gates the bootstrap→dashboard hand-off on this flag (see App.tsx), so the
+     * first join no longer ejects the operator before the harness step.
+     *
+     * Written by POST /v1/operator/onboarding-complete (persisted to disk AND
+     * mutated in-memory so GET /v1/bootstrap reflects it without a restart).
+     */
+    onboardingComplete: z.boolean().optional(),
     /**
      * Trusted ed25519 publishers for external harness impls. The daemon
      * refuses to load any external impl whose manifest signature is not
@@ -452,6 +429,12 @@ export const JinnConfigSchema = z.object({
         .object({
         workingDirRoot: z.string().optional(),
         implStateDirRoot: z.string().optional(),
+        /**
+         * Auto-load top-3 corpus solution records for the task's solverType
+         * into task.context.corpusKnowledge before each restoration harness
+         * spawn (#1393). Default true; env JINN_ENGINE_KNOWLEDGE_AUTOLOAD.
+         */
+        knowledgeAutoload: z.boolean().optional(),
     })
         .optional(),
     /**
@@ -511,8 +494,27 @@ export const JinnConfigSchema = z.object({
             port: z.number().int().positive().default(7342),
         })
             .default({ enabled: false, port: 7342 }),
+        /**
+         * Seller-side ML PII detection (GLiNER ONNX, in-process) applied before
+         * captures (and task trajectories) are published. **On by default** for
+         * publish lanes (#1973): free-prose names have no reliable regex shape.
+         * Set `enabled: false` explicitly to disable. When enabled, a model-load
+         * failure fails closed at the publish altitude — the trajectory is not
+         * published — while the daemon's other loops keep running. Unresolved
+         * flag dispositions also hold unattended publishes until
+         * `jinn scrub review` resolves them.
+         * Env: JINN_CAPTURES_PII_DETECTION_ENABLED=0|false|no to disable,
+         *      JINN_CAPTURES_PII_DETECTION_MODEL=<hf-model-id>
+         * Default model: urchade/gliner_multi_pii-v1 (ONNX via onnx-community).
+         */
+        piiDetection: z
+            .object({
+            enabled: z.boolean().default(true),
+            model: z.string().optional(),
+        })
+            .default({ enabled: true }),
     })
-        .default({ llmProxy: { enabled: false, port: 7342 } }),
+        .default({ llmProxy: { enabled: false, port: 7342 }, piiDetection: { enabled: true } }),
     /**
      * Run idempotent legacy migrations at daemon startup (jinn-mono-jgp:
      * backfill `agent_id` on `complete` services that pre-date j07).
@@ -578,13 +580,49 @@ export const JinnConfigSchema = z.object({
         blockedCids: z.array(z.string()).default([]),
     })
         .default({ blockedCids: [] }),
-}).refine((cfg) => cfg.jinnClaimSubmissionMode !== 'submit' ||
-    !cfg.jinnDistributorAddress ||
-    !!cfg.ethereumRpcUrl, {
-    message: 'ethereumRpcUrl must be set when jinnDistributorAddress is configured in submit mode ' +
-        '(env JINN_ETHEREUM_RPC_URL or config field). The cross-chain claim loop ' +
-        'cannot reach the L1 governance chain without it.',
-    path: ['ethereumRpcUrl'],
+    /**
+     * Commit-echo harvest loop (task-creator v0). When enabled, the daemon scans
+     * configured local git clones for fix-shaped commits and admits minted tasks.
+     *
+     * `sources` selects which harvest sources the loop mines each tick — absent
+     * ⇒ `['commits']`, so existing configs behave identically. `'sessions'`
+     * mines locally-captured task-creator sessions (local retention is
+     * unconditional per mono#1714; whether a mined task is published off the box
+     * is gated by `mineableTraces.share`, see above). Env: JINN_HARVEST_SOURCES
+     * (comma-separated).
+     */
+    harvest: z
+        .object({
+        enabled: z.boolean().default(false),
+        intervalMs: z.number().int().positive().default(60 * 60 * 1000),
+        limitPerRepo: z.number().int().positive().default(3),
+        /** Max session-echo records mined per harvest tick (sibling of limitPerRepo). */
+        limitPerTick: z.number().int().positive().default(3),
+        publish: z.boolean().default(true),
+        repos: z
+            .array(z.object({
+            path: z.string().min(1),
+            /** GitHub `owner/repo`; inferred from `git remote` when omitted. */
+            repo: z.string().min(1).optional(),
+            remote: z.string().optional(),
+            /**
+             * Operator-approved G0b recipe plus its published, attested
+             * environment binding. Parsed strictly by the harvest adapter.
+             */
+            explicitRecipe: z.unknown().optional(),
+        }))
+            .default([]),
+        sources: z.array(z.enum(['commits', 'sessions'])).default(['commits']),
+    })
+        .default({
+        enabled: false,
+        intervalMs: 60 * 60 * 1000,
+        limitPerRepo: 3,
+        limitPerTick: 3,
+        publish: true,
+        repos: [],
+        sources: ['commits'],
+    }),
 });
 const DEFAULT_ENGINE = {
     workingDirRoot: join(homedir(), '.jinn-client', 'engine', 'work'),
@@ -601,21 +639,42 @@ export const DEFAULT_CONFIG_PATH = join(DEFAULT_DIR, 'config.json');
  * historical sync — see ponder.config.ts).
  */
 export const DEFAULT_TESTNET_DISCOVERY_URL = 'https://jinn-indexer-production.up.railway.app';
-export const DEFAULT_TESTNET_ETHEREUM_RPC_URL = 'https://ethereum-sepolia-rpc.publicnode.com';
 /**
- * Default fallback chain for the L2 measurement chain (Base Sepolia) on
- * testnet. Per AC2 of issue #592:
- *   slot 0 — `https://base-sepolia.publicnode.com` (no-auth, 50k-block
- *     getLogs cap, no shared-quota cliff).
- *   slot 1 — `https://sepolia.base.org` (free public Coinbase endpoint,
- *     2k-block cap; last-resort backup).
+ * Default fallback chain for the L2 measurement chain (Base Sepolia, chain-id
+ * 84532) on testnet. Originally a two-provider chain (AC2 of issue #592);
+ * widened to ≥5 distinct free providers per issue #911 so a default-config
+ * daemon tolerates a single-provider quota cliff (the Tenderly shared-quota
+ * cliff of 2026-05-24) without an operator key.
+ *   slot 0 — `https://base-sepolia.publicnode.com` (#835 no-auth primary,
+ *     50k-block getLogs cap, no shared-quota cliff).
+ *   slot 1 — `https://base-sepolia-rpc.publicnode.com`
+ *   slot 2 — `https://base-sepolia.drpc.org`
+ *   slot 3 — `https://base-sepolia.gateway.tenderly.co`
+ *   slot 4 — `https://sepolia.base.org` (free public Coinbase endpoint,
+ *     2k-block cap; last-resort backup, stays last).
  * Operators are encouraged to prepend a paid primary key (Alchemy, Tenderly,
  * etc.) via `rpcUrl` config or `JINN_RPC_URL` / `BASE_SEPOLIA_RPC_URL` env.
+ * All five endpoints live-verified to return chain-id 84532 (#911).
  */
 export const DEFAULT_TESTNET_RPC_URLS = [
     'https://base-sepolia.publicnode.com',
+    'https://base-sepolia-rpc.publicnode.com',
+    'https://base-sepolia.drpc.org',
+    'https://base-sepolia.gateway.tenderly.co',
     'https://sepolia.base.org',
 ];
+/**
+ * Default fallback chain for the L2 measurement chain (Base mainnet, chain-id
+ * 8453). ≥5 distinct free providers per issue #911.
+ *   slot 0 — `https://mainnet.base.org` (free public Coinbase endpoint).
+ */
+export const DEFAULT_MAINNET_RPC_URLS = [
+    'https://mainnet.base.org',
+    'https://base.publicnode.com',
+    'https://base.drpc.org',
+    'https://1rpc.io/base',
+    'https://base.meowrpc.com',
+];
 export class ConfigLoadError extends Error {
     code;
     details;
@@ -702,6 +761,12 @@ export function migrateLegacySolverNets(raw) {
             roles: Array.from(new Set(roles)),
             ...(typeof entry.harness === 'string' ? { harness: entry.harness } : {}),
             ...(typeof entry.model === 'string' ? { model: entry.model } : {}),
+            // Stamp the OpenRouter provider first-class when the migrated model is
+            // OpenRouter-shaped (issue #1243) so the synthetic entry matches what a
+            // fresh join would persist and the adapter routes without inference.
+            ...(typeof entry.model === 'string' && isOpenRouterModelId(entry.model)
+                ? { provider: 'openrouter' }
+                : {}),
             plugins: Array.isArray(entry.plugins) ? entry.plugins : [],
             disabledDefaultPlugins: [],
         };
@@ -713,6 +778,35 @@ export function migrateLegacySolverNets(raw) {
     delete raw['solverNets'];
     return migrated;
 }
+/**
+ * Backfill `provider: 'openrouter'` onto legacy `joinedSolverNets` entries that
+ * carry an OpenRouter-shaped `model` id but no `provider` (issue #1243). A
+ * v0.1.6 config only persisted `{ model }` and relied on the adapter inferring
+ * the provider from the id shape at runtime; stamping it here makes the route
+ * first-class so pre-provider configs migrate silently.
+ *
+ * Mutates `merged` in place. Idempotent — entries that already carry a
+ * `provider`, or whose `model` is absent / not OpenRouter-shaped, are untouched.
+ * Returns the number of entries backfilled.
+ */
+export function backfillJoinedProviders(merged) {
+    const joined = merged['joinedSolverNets'];
+    if (!joined || typeof joined !== 'object' || Array.isArray(joined))
+        return 0;
+    let backfilled = 0;
+    for (const entry of Object.values(joined)) {
+        if (!entry || typeof entry !== 'object' || Array.isArray(entry))
+            continue;
+        const e = entry;
+        if (e['provider'] !== undefined)
+            continue;
+        if (!isOpenRouterModelId(e['model']))
+            continue;
+        e['provider'] = 'openrouter';
+        backfilled += 1;
+    }
+    return backfilled;
+}
 /**
  * Load config with resolution: env > config file > defaults.
  *
@@ -746,12 +840,13 @@ export function loadConfig(configPath) {
     const merged = { ...fileValues };
     if (env['JINN_NETWORK'])
         merged.network = env['JINN_NETWORK'];
-    if (env['JINN_L2_PROOF_RPC_URL'])
-        merged.l2ProofRpcUrl = env['JINN_L2_PROOF_RPC_URL'];
     if (env['JINN_EARNING_DIR'])
         merged.earningDir = env['JINN_EARNING_DIR'];
     if (env['JINN_DB_PATH'])
         merged.dbPath = env['JINN_DB_PATH'];
+    if (env['JINN_SWE_REBENCH_V2_STATE_DIR']) {
+        merged.sweRebenchV2StateDir = env['JINN_SWE_REBENCH_V2_STATE_DIR'];
+    }
     if (env['JINN_POLL_INTERVAL_MS'])
         merged.pollIntervalMs = parseInt(env['JINN_POLL_INTERVAL_MS'], 10);
     if (env['JINN_REWARD_CLAIM_INTERVAL_MS'] !== undefined) {
@@ -840,33 +935,9 @@ export function loadConfig(configPath) {
         merged.testnetL2TokenDeploymentPath = env['JINN_TESTNET_TOKEN_DEPLOYMENT'];
     if (env['JINN_TESTNET_MECH_DEPLOYMENT'])
         merged.testnetMechDeploymentPath = env['JINN_TESTNET_MECH_DEPLOYMENT'];
-    if (env['JINN_MVI_L1_DEPLOYMENT'])
-        merged.jinnMviL1DeploymentPath = env['JINN_MVI_L1_DEPLOYMENT'];
-    if (env['JINN_MVI_L2_DEPLOYMENT'])
-        merged.jinnMviL2DeploymentPath = env['JINN_MVI_L2_DEPLOYMENT'];
-    if (env['JINN_ETHEREUM_RPC_URL'])
-        merged.ethereumRpcUrl = env['JINN_ETHEREUM_RPC_URL'];
-    if (env['JINN_ETHEREUM_ARCHIVE_RPC_URL'])
-        merged.ethereumArchiveRpcUrl = env['JINN_ETHEREUM_ARCHIVE_RPC_URL'];
-    if (env['JINN_L1_NETWORK'])
-        merged.jinnL1Network = env['JINN_L1_NETWORK'];
-    if (env['JINN_DISTRIBUTOR_ADDRESS'])
-        merged.jinnDistributorAddress = env['JINN_DISTRIBUTOR_ADDRESS'];
-    if (env['JINN_CLAIM_EMITTER_ADDRESS'])
-        merged.jinnClaimEmitterAddress = env['JINN_CLAIM_EMITTER_ADDRESS'];
-    if (env['JINN_MESSENGER_ADDRESS'])
-        merged.jinnMessengerAddress = env['JINN_MESSENGER_ADDRESS'];
-    if (env['JINN_MESSENGER_MODE'])
-        merged.jinnMessengerMode = env['JINN_MESSENGER_MODE'];
-    if (env['JINN_CLAIM_SUBMISSION_MODE']) {
-        merged.jinnClaimSubmissionMode = env['JINN_CLAIM_SUBMISSION_MODE'];
-    }
-    if (env['JINN_CLAIM_LOOP_ENABLED'] !== undefined) {
-        const v = env['JINN_CLAIM_LOOP_ENABLED'].trim().toLowerCase();
-        merged.jinnClaimLoopEnabled = v === '1' || v === 'true' || v === 'yes';
-    }
-    if (env['JINN_CLAIM_LOOP_INTERVAL_MS'] !== undefined) {
-        merged.jinnClaimLoopIntervalMs = parseInt(env['JINN_CLAIM_LOOP_INTERVAL_MS'], 10);
+    if (env['JINN_WATCHDOG_AUTO_RESTART'] !== undefined) {
+        const v = env['JINN_WATCHDOG_AUTO_RESTART'].trim().toLowerCase();
+        merged.watchdogAutoRestart = v === '1' || v === 'true' || v === 'yes';
     }
     if (env['JINN_STAKING_MODE'])
         merged.stakingMode = env['JINN_STAKING_MODE'];
@@ -890,6 +961,56 @@ export function loadConfig(configPath) {
     if (env['JINN_MIN_SAFE_ETH_WEI']) {
         merged.minSafeEthWei = env['JINN_MIN_SAFE_ETH_WEI'].trim();
     }
+    if (env['JINN_FAUCET_DAILY_TOPUP_CAP'] !== undefined) {
+        merged.faucetDailyTopupCap = parseInt(env['JINN_FAUCET_DAILY_TOPUP_CAP'], 10);
+    }
+    if (env['JINN_FAUCET_TOPUP_COOLDOWN_MS'] !== undefined) {
+        merged.faucetTopupCooldownMs = parseInt(env['JINN_FAUCET_TOPUP_COOLDOWN_MS'], 10);
+    }
+    if (env['JINN_HARVEST_ENABLED'] !== undefined) {
+        const v = env['JINN_HARVEST_ENABLED'].trim().toLowerCase();
+        const enabled = v === '1' || v === 'true' || v === 'yes';
+        merged.harvest = {
+            ...(typeof merged.harvest === 'object' && merged.harvest ? merged.harvest : {}),
+            enabled,
+        };
+    }
+    if (env['JINN_HARVEST_REPOS']) {
+        const paths = env['JINN_HARVEST_REPOS'].split(',').map((s) => s.trim()).filter(Boolean);
+        merged.harvest = {
+            ...(typeof merged.harvest === 'object' && merged.harvest ? merged.harvest : {}),
+            repos: paths.map((path) => {
+                const [repoPath, repo] = path.split(':');
+                return repo ? { path: repoPath, repo } : { path: repoPath };
+            }),
+        };
+    }
+    if (env['JINN_HARVEST_INTERVAL_MS']) {
+        merged.harvest = {
+            ...(typeof merged.harvest === 'object' && merged.harvest ? merged.harvest : {}),
+            intervalMs: parseInt(env['JINN_HARVEST_INTERVAL_MS'], 10),
+        };
+    }
+    if (env['JINN_HARVEST_SOURCES']) {
+        const sources = env['JINN_HARVEST_SOURCES'].split(',').map((s) => s.trim()).filter(Boolean);
+        merged.harvest = {
+            ...(typeof merged.harvest === 'object' && merged.harvest ? merged.harvest : {}),
+            sources,
+        };
+    }
+    // Single sharing consent (mono#1714). JINN_SHARE_CONSENT is authoritative;
+    // the legacy JINN_MINEABLE_PUBLISH_CONSENT still maps to `share` for one
+    // release (only the old publish bit ever meant "a task may leave").
+    if (env['JINN_SHARE_CONSENT'] !== undefined || env['JINN_MINEABLE_PUBLISH_CONSENT'] !== undefined) {
+        const truthy = (v) => ['1', 'true', 'yes'].includes(v.trim().toLowerCase());
+        const share = env['JINN_SHARE_CONSENT'] !== undefined
+            ? truthy(env['JINN_SHARE_CONSENT'])
+            : truthy(env['JINN_MINEABLE_PUBLISH_CONSENT']);
+        merged.mineableTraces = {
+            ...(typeof merged.mineableTraces === 'object' && merged.mineableTraces ? merged.mineableTraces : {}),
+            share,
+        };
+    }
     // Legacy `JINN_PREDICTION_V1_*` env vars are no longer recognised. Their
     // values now live in the launched-record's generator-config block per
     // spec/2026-05-05-solvernet-creation-and-launch.md (Decision 5 + Task 14)
@@ -928,16 +1049,24 @@ export function loadConfig(configPath) {
         };
     }
     if (env['JINN_CAPTURES_LLM_PROXY_ENABLED'] !== undefined ||
-        env['JINN_CAPTURES_LLM_PROXY_PORT'] !== undefined) {
+        env['JINN_CAPTURES_LLM_PROXY_PORT'] !== undefined ||
+        env['JINN_CAPTURES_PII_DETECTION_ENABLED'] !== undefined ||
+        env['JINN_CAPTURES_PII_DETECTION_MODEL'] !== undefined) {
         const prevCaptures = typeof merged['captures'] === 'object' && merged['captures'] !== null
             ? merged['captures']
             : {};
         const prevProxy = typeof prevCaptures['llmProxy'] === 'object' && prevCaptures['llmProxy'] !== null
             ? prevCaptures['llmProxy']
             : {};
+        const prevPii = typeof prevCaptures['piiDetection'] === 'object' && prevCaptures['piiDetection'] !== null
+            ? prevCaptures['piiDetection']
+            : {};
         const enabled = env['JINN_CAPTURES_LLM_PROXY_ENABLED'] !== undefined
             ? ['1', 'true', 'yes'].includes(env['JINN_CAPTURES_LLM_PROXY_ENABLED'].trim().toLowerCase())
             : undefined;
+        const piiEnabled = env['JINN_CAPTURES_PII_DETECTION_ENABLED'] !== undefined
+            ? ['1', 'true', 'yes'].includes(env['JINN_CAPTURES_PII_DETECTION_ENABLED'].trim().toLowerCase())
+            : undefined;
         merged['captures'] = {
             ...prevCaptures,
             llmProxy: {
@@ -947,9 +1076,18 @@ export function loadConfig(configPath) {
                     ? { port: Number.parseInt(env['JINN_CAPTURES_LLM_PROXY_PORT'], 10) }
                     : {}),
             },
+            piiDetection: {
+                ...prevPii,
+                ...(piiEnabled !== undefined ? { enabled: piiEnabled } : {}),
+                ...(env['JINN_CAPTURES_PII_DETECTION_MODEL']
+                    ? { model: env['JINN_CAPTURES_PII_DETECTION_MODEL'] }
+                    : {}),
+            },
         };
     }
-    if (env['JINN_ENGINE_WORKING_DIR_ROOT'] || env['JINN_ENGINE_IMPL_STATE_DIR_ROOT']) {
+    if (env['JINN_ENGINE_WORKING_DIR_ROOT'] ||
+        env['JINN_ENGINE_IMPL_STATE_DIR_ROOT'] ||
+        env['JINN_ENGINE_KNOWLEDGE_AUTOLOAD'] !== undefined) {
         const prev = typeof merged['engine'] === 'object' && merged['engine'] !== null
             ? merged['engine']
             : {};
@@ -957,6 +1095,9 @@ export function loadConfig(configPath) {
             ...prev,
             ...(env['JINN_ENGINE_WORKING_DIR_ROOT'] ? { workingDirRoot: env['JINN_ENGINE_WORKING_DIR_ROOT'] } : {}),
             ...(env['JINN_ENGINE_IMPL_STATE_DIR_ROOT'] ? { implStateDirRoot: env['JINN_ENGINE_IMPL_STATE_DIR_ROOT'] } : {}),
+            ...(env['JINN_ENGINE_KNOWLEDGE_AUTOLOAD'] !== undefined
+                ? { knowledgeAutoload: ['1', 'true', 'yes'].includes(env['JINN_ENGINE_KNOWLEDGE_AUTOLOAD'].trim().toLowerCase()) }
+                : {}),
         };
     }
     // JINN_STATE_DIR: single volume-aware root. Runs AFTER all per-key env
@@ -973,6 +1114,9 @@ export function loadConfig(configPath) {
             merged['earningDir'] = join(stateDir, 'earning');
         if (merged['dbPath'] === undefined)
             merged['dbPath'] = join(stateDir, 'jinn.db');
+        if (merged['sweRebenchV2StateDir'] === undefined) {
+            merged['sweRebenchV2StateDir'] = join(stateDir, 'swe-rebench-v2');
+        }
         const engineObj = (typeof merged['engine'] === 'object' && merged['engine'] !== null)
             ? merged['engine']
             : {};
@@ -981,7 +1125,7 @@ export function loadConfig(configPath) {
             merged['engine'] = engineObj;
         }
     }
-    const resolvedNetwork = merged.network === 'testnet' ? 'testnet' : 'mainnet';
+    const resolvedNetwork = merged.network === 'mainnet' ? 'mainnet' : 'testnet';
     // Testnet default: point discovery at the privately-operated Ponder indexer
     // (jinn-mono-280n.4), unless the operator has set their own `discovery` block.
     //
@@ -1012,12 +1156,6 @@ export function loadConfig(configPath) {
                 : {}),
         };
     }
-    if (resolvedNetwork === 'testnet' && !merged.ethereumRpcUrl) {
-        merged.ethereumRpcUrl = DEFAULT_TESTNET_ETHEREUM_RPC_URL;
-    }
-    if (resolvedNetwork === 'testnet' && merged.jinnClaimLoopEnabled === undefined) {
-        merged.jinnClaimLoopEnabled = true;
-    }
     // Keep the legacy BASE_RPC_URL override for Base mainnet only. Testnet must
     // not silently inherit a mainnet RPC from client/.env during bootstrap.
     if (env['JINN_RPC_URL']) {
@@ -1061,6 +1199,34 @@ export function loadConfig(configPath) {
             'Open Operator > SolverNets in the dashboard to re-join via the registry ' +
             '(replaces the synthetic legacy:* keys with real manifest CIDs).');
     }
+    // Persist whenever the on-disk file carried a legacy `solverNets` block, even
+    // when every entry already had a `legacy:*` counterpart (migratedCount === 0):
+    // `migrateLegacySolverNets` deletes the block in-memory unconditionally, so
+    // gating the persist on migratedCount would leave the stale block on disk
+    // forever and re-trigger prediction code paths every boot (issue #445).
+    // Re-reads the raw file (never the env-merged object) so transient env
+    // overrides are not baked in; best-effort, and a no-op on already-clean files.
+    if ('solverNets' in fileValues) {
+        persistLegacySolverNetsMigration(filePath);
+    }
+    // Migrate legacy `mineableTraces.{consent,publishConsent}` → single `share`
+    // (mono#1714, one release). Only the old publish bit ever meant "a task may
+    // leave the machine"; the tier-1 retention bit is discarded (retention is now
+    // unconditional). Env-set `share` (above) wins over the legacy file keys.
+    if (typeof merged.mineableTraces === 'object' && merged.mineableTraces) {
+        const mt = merged.mineableTraces;
+        if (!('share' in mt) && ('publishConsent' in mt || 'consent' in mt)) {
+            merged.mineableTraces = { share: mt['publishConsent'] === true };
+        }
+        // A stray legacy `consent`/`publishConsent` alongside `share` is dropped by
+        // the schema's non-strict parse — no explicit reshape needed.
+    }
+    // Backfill `provider: 'openrouter'` onto legacy `{model}`-only joined entries
+    // whose model id is OpenRouter-shaped (issue #1243). Runs after the legacy
+    // migration so synthetic `legacy:*` entries are covered too. In-memory only —
+    // the on-disk config re-persists provider first-class on the operator's next
+    // join via the SPA; a load-time-only backfill keeps existing files loading.
+    backfillJoinedProviders(merged);
     // 3. Validate
     const result = JinnConfigSchema.safeParse(merged);
     if (!result.success) {
@@ -1079,30 +1245,22 @@ export function loadConfig(configPath) {
     // shared-quota cliff of 2026-05-24 that took out every default-config
     // daemon at once). See #554 + the NetworkSection.tsx "shared RPC" panel for
     // the operator-facing pitch to bring their own key. The sibling Ethereum L1
-    // default (DEFAULT_TESTNET_ETHEREUM_RPC_URL above) is already publicnode —
-    // this keeps the two L1/L2 defaults symmetric.
+    // default (DEFAULT_TESTNET_ETHEREUM_RPC_URLS above) is publicnode-headed —
+    // this keeps the two L1/L2 defaults symmetric. Both chains ship ≥5 free
+    // providers per issue #911.
     const parsed = result.data;
     const defaultRpcUrls = parsed.network === 'testnet'
         ? DEFAULT_TESTNET_RPC_URLS
-        : ['https://mainnet.base.org'];
+        : DEFAULT_MAINNET_RPC_URLS;
     const rpcUrlsResolved = parsed.rpcUrl !== undefined
         ? parseRpcUrls(parsed.rpcUrl)
         : [...defaultRpcUrls];
     const archiveRpcUrlsResolved = parsed.archiveRpcUrl !== undefined
         ? parseRpcUrls(parsed.archiveRpcUrl)
         : undefined;
-    const l2ProofRpcUrlsResolved = parsed.l2ProofRpcUrl !== undefined
-        ? parseRpcUrls(parsed.l2ProofRpcUrl)
-        : undefined;
-    const ethereumRpcUrlsResolved = parsed.ethereumRpcUrl !== undefined
-        ? parseRpcUrls(parsed.ethereumRpcUrl)
-        : undefined;
-    const ethereumArchiveRpcUrlsResolved = parsed.ethereumArchiveRpcUrl !== undefined
-        ? parseRpcUrls(parsed.ethereumArchiveRpcUrl)
-        : undefined;
     // Strip the union-typed (string | string[]) RPC fields from `parsed` — the
     // returned shape carries the resolved head URL plus a `*Urls` array instead.
-    const { rpcUrl: _rpcUrl, archiveRpcUrl: _archiveRpcUrl, l2ProofRpcUrl: _l2ProofRpcUrl, ethereumRpcUrl: _ethereumRpcUrl, ethereumArchiveRpcUrl: _ethereumArchiveRpcUrl, ...rest } = parsed;
+    const { rpcUrl: _rpcUrl, archiveRpcUrl: _archiveRpcUrl, ...rest } = parsed;
     return {
         ...rest,
         rpcUrl: rpcUrlsResolved[0],
@@ -1110,23 +1268,12 @@ export function loadConfig(configPath) {
         ...(archiveRpcUrlsResolved
             ? { archiveRpcUrl: archiveRpcUrlsResolved[0], archiveRpcUrls: archiveRpcUrlsResolved }
             : {}),
-        ...(l2ProofRpcUrlsResolved
-            ? { l2ProofRpcUrl: l2ProofRpcUrlsResolved[0], l2ProofRpcUrls: l2ProofRpcUrlsResolved }
-            : {}),
-        ...(ethereumRpcUrlsResolved
-            ? { ethereumRpcUrl: ethereumRpcUrlsResolved[0], ethereumRpcUrls: ethereumRpcUrlsResolved }
-            : {}),
-        ...(ethereumArchiveRpcUrlsResolved
-            ? {
-                ethereumArchiveRpcUrl: ethereumArchiveRpcUrlsResolved[0],
-                ethereumArchiveRpcUrls: ethereumArchiveRpcUrlsResolved,
-            }
-            : {}),
         // parseTask assigns a UUID to any entry missing an id
         tasks: parsed.tasks.map(parseTask),
         engine: {
             workingDirRoot: parsed.engine?.workingDirRoot ?? DEFAULT_ENGINE.workingDirRoot,
             implStateDirRoot: parsed.engine?.implStateDirRoot ?? DEFAULT_ENGINE.implStateDirRoot,
+            knowledgeAutoload: parsed.engine?.knowledgeAutoload ?? true,
         },
     };
 }
@@ -1137,6 +1284,29 @@ export function getConfigPathFromArgs(argv = process.argv) {
     const idx = argv.indexOf('--config');
     return idx >= 0 && argv[idx + 1] ? argv[idx + 1] : undefined;
 }
+/**
+ * Persist the legacy-solverNets migration to disk. Re-reads the RAW config file
+ * — never the env-merged object, which would bake transient env overrides such
+ * as JINN_RPC_URL into the file — runs migrateLegacySolverNets on that copy, and
+ * writes the pruned shape back. Best-effort. See issue #445.
+ */
+function persistLegacySolverNetsMigration(filePath) {
+    if (!existsSync(filePath))
+        return; // pure-env config, no on-disk file → nothing to prune
+    try {
+        const raw = JSON.parse(readFileSync(filePath, 'utf-8'));
+        if (raw['solverNets'] === undefined)
+            return; // already pruned → no write, keeps restarts byte-stable
+        migrateLegacySolverNets(raw); // mutates raw in place (deletes solverNets, sets joinedSolverNets)
+        writeFileSync(filePath, `${JSON.stringify(raw, null, 2)}\n`, 'utf-8');
+    }
+    catch (err) {
+        // A read-only config mount degrades to in-memory-only migration rather than
+        // crashing boot.
+        console.warn(`[config] Could not persist legacy solverNets migration to ${filePath} ` +
+            `(${err instanceof Error ? err.message : String(err)}); continuing with in-memory migration only.`);
+    }
+}
 /**
  * Merge one top-level value into the operator config file. Used by local setup
  * flows that discover a durable setting after the daemon has already started.
@@ -1192,19 +1362,7 @@ const TRACKED_ENV_VARS = [
     'JINN_TESTNET_L2_DEPLOYMENT',
     'JINN_TESTNET_TOKEN_DEPLOYMENT',
     'JINN_TESTNET_MECH_DEPLOYMENT',
-    'JINN_L2_PROOF_RPC_URL',
-    'JINN_MVI_L1_DEPLOYMENT',
-    'JINN_MVI_L2_DEPLOYMENT',
-    'JINN_ETHEREUM_RPC_URL',
-    'JINN_ETHEREUM_ARCHIVE_RPC_URL',
-    'JINN_L1_NETWORK',
-    'JINN_DISTRIBUTOR_ADDRESS',
-    'JINN_CLAIM_EMITTER_ADDRESS',
-    'JINN_MESSENGER_ADDRESS',
-    'JINN_MESSENGER_MODE',
-    'JINN_CLAIM_SUBMISSION_MODE',
-    'JINN_CLAIM_LOOP_ENABLED',
-    'JINN_CLAIM_LOOP_INTERVAL_MS',
+    'JINN_WATCHDOG_AUTO_RESTART',
     'JINN_STAKING_MODE',
     'JINN_TARGET_SERVICES',
     'JINN_DEBUG',
@@ -1212,6 +1370,8 @@ const TRACKED_ENV_VARS = [
     'JINN_MASTER_ETH_DAILY_WEI',
     'JINN_MIN_EOA_GAS_WEI',
     'JINN_MIN_SAFE_ETH_WEI',
+    'JINN_FAUCET_DAILY_TOPUP_CAP',
+    'JINN_FAUCET_TOPUP_COOLDOWN_MS',
     'JINN_IDENTITY_REGISTRY_ADDRESS',
     'JINN_VALIDATION_REGISTRY_ADDRESS',
     'JINN_REPUTATION_ENABLED',
@@ -1222,6 +1382,7 @@ const TRACKED_ENV_VARS = [
     'JINN_TASKS',
     'JINN_ENGINE_WORKING_DIR_ROOT',
     'JINN_ENGINE_IMPL_STATE_DIR_ROOT',
+    'JINN_ENGINE_KNOWLEDGE_AUTOLOAD',
     'JINN_SWE_REBENCH_V2_STATE_DIR',
     'JINN_OPERATOR_PUBLIC_ENDPOINT',
     'JINN_OPERATOR_DEFAULT_PRICE_USDC',