@sealkeeper/schema 0.4.8 → 0.4.9

package/dist/model-name.js

@@ -0,0 +1,48 @@
+import { EventPayload } from './events.js';
+import { foldLetters, OWN_NAMES } from './moderation.js';
+/*
+ * The name of the model an agent runs, as the agent declares it (VOU-566).
+ * It travels as text beside the fingerprint on a sync, see
+ * FingerprintDeclaration, so SealKeeper can show and compare the models
+ * agents run across Claude, GPT, Gemini and the rest. It is what the agent
+ * says about itself, inside a signed report. Nothing reads it as proof, and
+ * it earns no Trust. The model part of the fingerprint stays a hash.
+ */
+const OWN_KEYS = OWN_NAMES.map(foldLetters);
+// The usage event's model name, the same characters and the same 64 cap, so
+// a name an adapter already sends on usage is a name it can declare. A name
+// must also leave a key, so one that ends in a slash, or is only a date, is
+// refused. It shows on public pages, so the moderation rules names have
+// apply as far as they fit a model name. It may not hold SealKeeper's own
+// names anywhere in its letters and digits as foldLetters folds them, so
+// sealkeeper-verified, official-vouched and 5ea1keeper are refused, nor in
+// its key's, which GET /v1/models shows (VOU-551). foldLetters leaves the
+// rn and vv pairs alone, since normaliseName folds v/vouched to wouched
+// while its key is vouched, and sealkeepernova to sealkeepemova. The
+// other protected names stay allowed, since claude-opus-4-5 and gpt-4.1
+// name their makers' models, and the characters are Latin alone, so no
+// lookalike of another script gets in.
+export const ModelName = EventPayload.usage.shape.model
+    .unwrap()
+    .refine((name) => modelKey(name) !== '', 'A model name needs a name after its last slash')
+    .refine((name) => ![foldLetters(name), foldLetters(modelKey(name))].some((form) => OWN_KEYS.some((own) => form.includes(own))), 'A model name may not name SealKeeper');
+// When two names are the same model. Lower case, everything up to the last
+// slash dropped, so a provider or router prefix goes, a trailing date of 8
+// digits dropped with its dash, and dots made dashes, so claude-sonnet-4.5
+// and claude-sonnet-4-5 meet. A date written with dashes, as in
+// gpt-4.1-2025-04-14, stays, and so does anything else the rule does not
+// name. The one function that decides it, so the API, the CLI and the web
+// agree.
+export function modelKey(name) {
+    const lower = name.toLowerCase();
+    return lower
+        .slice(lower.lastIndexOf('/') + 1)
+        .replace(/-\d{8}$/, '')
+        .replaceAll('.', '-');
+}
+// The most model changes one agent records in any 24 hours. A real change
+// of model is rare, and an operator who tries a model and goes back makes
+// two in a day, so 3 leaves one to spare. Past it the name is still kept
+// as the agent's current one and no change is recorded, so an agent cannot
+// grow the table by flipping its name.
+export const MODEL_CHANGES_PER_DAY = 3;

package/dist/moderation.d.ts

@@ -8,7 +8,9 @@ export type OperatorSlug = z.infer<typeof OperatorSlug>;
 export declare const OperatorDisplayName: z.ZodString;
 export type OperatorDisplayName = z.infer<typeof OperatorDisplayName>;
 export declare function normaliseName(text: string): string;
+export declare function foldLetters(text: string): string;
 export declare const displayNameKey: typeof normaliseName;
+export declare const OWN_NAMES: readonly string[];
 export declare const PROTECTED_NAMES: readonly string[];
 export declare const PROTECTED_SUFFIXES: readonly string[];
 export declare const PROTECTED_PREFIXES: readonly string[];

package/dist/moderation.js

@@ -169,19 +169,26 @@ const NOT_LETTER_OR_DIGIT = /[^\p{L}\p{N}]/gu;
 // Letters of scripts with no Latin lookalike are kept, so a display name
 // in another script still has a key of its own.
 export function normaliseName(text) {
-    const folded = Array.from(text.normalize('NFKC').normalize('NFKD').replace(MARKS, ''), foldLetter)
+    return foldLetters(text).replace(/rn/g, 'm').replace(/vv/g, 'w');
+}
+// normaliseName before the letter pairs are folded. A word the text holds
+// whole stays whole here, where a pair can take a letter from it in
+// normaliseName, so vvouched keeps vouched and sealkeepernova keeps
+// sealkeeper (VOU-551).
+export function foldLetters(text) {
+    return Array.from(text.normalize('NFKC').normalize('NFKD').replace(MARKS, ''), foldLetter)
         .join('')
-        .replace(I_AS_L, 'l');
-    return folded
-        .replace(NOT_LETTER_OR_DIGIT, '')
-        .replace(/rn/g, 'm')
-        .replace(/vv/g, 'w');
+        .replace(I_AS_L, 'l')
+        .replace(NOT_LETTER_OR_DIGIT, '');
 }
 // The display_name_key column. Unique across operators, so two display
 // names that read the same cannot both be held.
 export const displayNameKey = normaliseName;
 // ---------------------------------------------------------------------------
 // Protected names
+// SealKeeper's own names, the first of PROTECTED_NAMES. A model name an
+// agent declares may not hold one anywhere, see ModelName.
+export const OWN_NAMES = ['SealKeeper', 'Vouched'];
 // The top AI and technology companies and products. A slug or display name
 // that normalises to one of these, with or without a common suffix, is
 // refused. Written as the name reads. The list protects the distinctive
@@ -191,8 +198,7 @@ export const displayNameKey = normaliseName;
 // would otherwise lose its slug. Claude is the one exception.
 export const PROTECTED_NAMES = [
     // SealKeeper itself
-    'SealKeeper',
-    'Vouched',
+    ...OWN_NAMES,
     // AI labs and model makers
     'Anthropic',
     'Claude',

package/dist/policy.d.ts

@@ -1,4 +1,4 @@
 export declare const POLICY_VERSIONS: {
     readonly terms: '2026-09-27';
-    readonly privacy: '2026-09-28';
+    readonly privacy: '2026-09-29';
 };

package/dist/policy.js

@@ -6,5 +6,5 @@
 // here when the matching page changes.
 export const POLICY_VERSIONS = {
     terms: '2026-09-27',
-    privacy: '2026-09-28',
+    privacy: '2026-09-29',
 };

package/dist/seal-conformance.js

@@ -33,6 +33,14 @@ const COUNTED_V3 = {
     posted_tasks: 3,
     posted_confirmed_tasks: 1,
 };
+// trust and top_categories of a version 4 SEAL. Three categories highest
+// first, the tie of data and math in category order, data before math.
+const TRUST = 412;
+const TOP_CATEGORIES = [
+    { category: 'code', score: 230 },
+    { category: 'data', score: 90 },
+    { category: 'math', score: 90 },
+];
 const header = (kid) => base64urlEncode(utf8Encode(JSON.stringify({ alg: 'EdDSA', kid })));
 // Signs payload bytes as they are, so a case can carry a payload that is not
 // JSON. sign() in envelope.ts always writes JSON.
@@ -81,6 +89,10 @@ export async function sealConformanceCases() {
         state: 'matches',
     };
     const { state: _state, ...v3NoState } = v3;
+    // Version 4 is version 3 with trust and top_categories.
+    const v4 = { ...v3, ver: 4, trust: TRUST, top_categories: TOP_CATEGORIES };
+    const { trust: _trust, ...v4NoTrust } = v4;
+    const { top_categories: _top, ...v4NoTop } = v4;
     const signed = (payload) => sign(payload, pair.privateKey, KID);
     const valid = await signed(base);
     const [h, , s] = valid.split('.');
@@ -225,14 +237,97 @@ export async function sealConformanceCases() {
             }),
             'malformed',
         ],
-        ['an unknown ver', signed({ ...base, ver: 4 }), 'unsupported_version'],
+        ['version 4 with a Trust Score and top categories', signed(v4), 'valid'],
+        [
+            'version 4 with no category yet',
+            signed({ ...v4, trust: 0, top_categories: [] }),
+            'valid',
+        ],
+        [
+            'version 4 with a field it does not define',
+            signed({ ...v4, extra: true }),
+            'malformed',
+        ],
+        ['version 4 without trust', signed(v4NoTrust), 'malformed'],
+        ['version 4 without top_categories', signed(v4NoTop), 'malformed'],
+        [
+            'version 4 with a Trust Score that is not a whole number',
+            signed({ ...v4, trust: 412.5 }),
+            'malformed',
+        ],
+        [
+            'version 4 with a negative Trust Score',
+            signed({ ...v4, trust: -1 }),
+            'malformed',
+        ],
+        [
+            'version 4 with four top categories',
+            signed({
+                ...v4,
+                top_categories: [...TOP_CATEGORIES, { category: 'writing', score: 10 }],
+            }),
+            'malformed',
+        ],
+        [
+            'version 4 with top categories lowest first',
+            signed({ ...v4, top_categories: [...TOP_CATEGORIES].reverse() }),
+            'malformed',
+        ],
+        [
+            'version 4 with a tie out of category order',
+            signed({
+                ...v4,
+                top_categories: [
+                    TOP_CATEGORIES[0],
+                    TOP_CATEGORIES[2],
+                    TOP_CATEGORIES[1],
+                ],
+            }),
+            'malformed',
+        ],
+        [
+            'version 4 with one category twice',
+            signed({
+                ...v4,
+                top_categories: [TOP_CATEGORIES[0], TOP_CATEGORIES[0]],
+            }),
+            'malformed',
+        ],
+        [
+            'version 4 with a category the standard does not name',
+            signed({
+                ...v4,
+                top_categories: [{ category: 'Data Work', score: 90 }],
+            }),
+            'malformed',
+        ],
+        [
+            'version 4 with a category score that is not a whole number',
+            signed({
+                ...v4,
+                top_categories: [{ category: 'code', score: 0.5 }],
+            }),
+            'malformed',
+        ],
+        [
+            'version 4 with the dropped version field',
+            signed({ ...v4, version: '1.0.0' }),
+            'malformed',
+        ],
+        [
+            'version 3 with trust and top_categories',
+            signed({ ...v4, ver: 3 }),
+            'malformed',
+        ],
+        ['an unknown ver', signed({ ...base, ver: 5 }), 'unsupported_version'],
         [
             'no ver after the legacy cutoff',
             signed({ ...base, ver: undefined }),
             'unsupported_version',
         ],
         // Intended. Platinum is reserved on LADDER and is not a Level under ver
-        // 1, 2 or 3 (standard, section 9). It becomes valid only with a ver bump.
+        // 1, 2, 3 or 4 (standard, section 9). It becomes valid only with a ver
+        // bump.
         [
             'the wrong shape, a level not in the standard',
             signed({ ...base, level: 'platinum' }),
@@ -245,7 +340,9 @@ export async function sealConformanceCases() {
         ],
         // Competence is keyed by category from RT-3. A SEAL issued before it
         // carries competence by task type, and a verifier accepts both
-        // (standard, section 2).
+        // (standard, section 2). Any of the eight stored categories is valid,
+        // math, which a poster can choose from D-UI-12, and conversation and
+        // other, which are no longer offered but past tasks keep.
         [
             'competence by category',
             signed({
@@ -254,6 +351,26 @@ export async function sealConformanceCases() {
             }),
             'valid',
         ],
+        [
+            'competence in math',
+            signed({
+                ...base,
+                scores: { ...base.scores, 'competence:math': 0.8 },
+            }),
+            'valid',
+        ],
+        [
+            'competence in conversation and other, kept by past tasks',
+            signed({
+                ...base,
+                scores: {
+                    ...base.scores,
+                    'competence:conversation': 0.7,
+                    'competence:other': 0.6,
+                },
+            }),
+            'valid',
+        ],
         [
             'competence by task type, issued before categories',
             signed({

package/dist/standing.d.ts

@@ -93,7 +93,17 @@ export type AnswerCounted = z.infer<typeof AnswerCounted>;
 export declare const COUNTED_EVIDENCE: {
     readonly dailyCeiling: 20;
     readonly diminishingK: 25;
+    readonly pairCurve: {
+        readonly free: 5;
+        readonly k: 5;
+        readonly windowDays: 30;
+    };
+    readonly operatorShareCap: {
+        readonly share: 0.5;
+        readonly floor: 5;
+    };
 };
+export declare const POSTER_RESPONSE_HOURS = 48;
 export declare const DAY_MS = 86400000;
 export declare const DORMANCY: {
     readonly quietDays: 14;
@@ -101,9 +111,25 @@ export declare const DORMANCY: {
     readonly dropTwoDays: 60;
     readonly noneDays: 90;
 };
+export declare const TRUST_SCORE: {
+    readonly decay: {
+        readonly fullDays: 30;
+        readonly zeroDays: 180;
+    };
+    readonly diversityWeight: 1.1;
+    readonly diversityMinTasks: 5;
+    readonly operatorK: 2;
+    readonly seriesDays: 30;
+    readonly deltaDays: 7;
+    readonly rankMax: 10000;
+    readonly rankWeeks: 8;
+};
+export declare function trustWeekOf(at: Date): string;
+export declare const SAFETY_MEASURED: boolean;
 export declare const LEVEL_THRESHOLDS: {
     readonly bronze: {
         readonly verifiedTasks: 25;
+        readonly trustScore: 50;
         readonly historyDays: 3;
         readonly reliability: 0.8;
         readonly incidents90d: 0;
@@ -113,6 +139,8 @@ export declare const LEVEL_THRESHOLDS: {
     };
     readonly silver: {
         readonly verifiedTasks: 200;
+        readonly trustScore: 400;
+        readonly trustCategories: 2;
         readonly historyDays: 30;
         readonly reliability: 0.9;
         readonly safety: 0.9;
@@ -125,6 +153,7 @@ export declare const LEVEL_THRESHOLDS: {
     };
     readonly gold: {
         readonly verifiedTasks: 200;
+        readonly trustScore: 400;
         readonly confirmedTasks: 25;
         readonly confirmedOperators: 3;
         readonly historySpanDays: 90;

package/dist/standing.js

@@ -35,8 +35,10 @@ const Count = z.int().min(0);
 // they carry over to the SEAL unchanged.
 //
 //   events                signed events accepted in the window
-//   history_days          distinct UTC days with an accepted event, the
-//                         agent's across all its versions
+//   history_days          distinct UTC days with task activity (a post, a
+//                         claim, a submit, a verification or an outcome
+//                         report, on the server's clock), the agent's
+//                         across all its versions
 //   verified_tasks        seed_tasks + server_checked_tasks + confirmed_tasks
 //   seed_tasks            verified tasks the seed agent posted
 //   server_checked_tasks  hash or schema tasks from another operator's agent
@@ -69,7 +71,8 @@ export const StandingCounts = z
 // tasks this agent posted. StandingCounts stays the shape of versions 1 and
 // 2 unchanged. The rules behind the posted counts are the posted evidence
 // of the standard's section 4 (POST-1, POST-3), which every level reads,
-// and nothing issues version 3 yet.
+// and the API writes them into a version 3 SEAL when its
+// SEAL_ISSUE_VERSION is 3 (VOU-331).
 //
 //   posted_tasks               tasks the agent posted that another
 //                              operator's agent completed, the server
@@ -134,8 +137,9 @@ export const CountedCounts = z
 });
 // The counted evidence of SEAL version 3. CountedCounts plus the counted
 // twins of two posted counts, what the posting thresholds read.
-// posted_distinct_operators has no twin, since each operator already counts
-// once. CountedCounts stays the shape of version 2 unchanged. Each value is
+// posted_distinct_operators has no twin here. The levels read the issuer's
+// counted posted operators (VOU-516), which no SEAL carries and the goal
+// shows. CountedCounts stays the shape of version 2 unchanged. Each value is
 // at most its raw count in StandingCountsV3, which the SEAL checks.
 export const CountedCountsV3 = z
     .strictObject({
@@ -177,7 +181,8 @@ export const AnswerCounts = z
 });
 // The counted evidence on the agent answers (POST-3). The four of
 // CountedCounts plus the counted posted_tasks and posted_confirmed_tasks of
-// CountedCountsV3, optional like the posted counts of AnswerCounts.
+// CountedCountsV3, optional like the posted counts of AnswerCounts. The
+// counted posted operators the levels read are on the goal only (VOU-516).
 export const AnswerCounted = z
     .strictObject({
     verified_tasks: Count,
@@ -192,15 +197,25 @@ export const AnswerCounted = z
     message: 'verified_tasks must equal seed_tasks + server_checked_tasks + confirmed_tasks',
     path: ['verified_tasks'],
 });
-// The two numbers of counted evidence (VOU-139), starting values set on 26
+// The numbers of counted evidence (VOU-139), starting values set on 26
 // September 2026. At most dailyCeiling verified tasks per agent per UTC day
 // count, and n tasks of one category count diminishingK * ln(1 + n /
-// diminishingK). The scoring job applies them (SCORING in the API) and the
-// CLI explains them, so they live here.
+// diminishingK). The pair curve (COL-3) and the share cap (COL-4) were set
+// on 27 and 28 September 2026, and SCORING in the API documents them. The
+// scoring job applies them, and the CLI and the task page explain them, so
+// they live here.
 export const COUNTED_EVIDENCE = {
     dailyCeiling: 20,
     diminishingK: 25,
+    pairCurve: { free: 5, k: 5, windowDays: 30 },
+    operatorShareCap: { share: 0.5, floor: 5 },
 };
+// The poster response rule of the SEAL standard, section 4 (POST-4). A
+// counterparty task whose claimant reported success and whose poster
+// reported nothing this many hours after the submit verifies for the
+// claimant alone. The scoring job applies it (SCORING.posterResponseHours
+// in the API) and the web explains it, so it lives here.
+export const POSTER_RESPONSE_HOURS = 48;
 export const DAY_MS = 86_400_000;
 // The dormancy ladder of the SEAL standard, section 5, in whole days since
 // the agent's last accepted event. At quietDays the level stays and the
@@ -217,6 +232,74 @@ export const DORMANCY = {
     dropTwoDays: 60,
     noneDays: 90,
 };
+/*
+ * Trust Score (D-TS-5 to D-TS-7, VOU-499). What a verified task adds is its
+ * base credit (TRUST_CREDIT in tasks.ts) times its counted value times the
+ * decay of its age. The age is in whole days since the task verified,
+ * counted as dormancy counts days (dormantDays). The decay is 1 up to
+ * decay.fullDays, then a straight line to 0 at decay.zeroDays. The two
+ * marks are the SEAL's own (D-TS-6). fullDays is the dormancy rung that
+ * drops a level, so credit starts to fade on the day a silent agent first
+ * loses a level, and zeroDays is the 180 day window every count is read
+ * over, so a task leaves the score on the day it leaves the window.
+ *
+ * Per agent version the categories add up with a diversity weight. The top
+ * category counts once, and every other category with at least
+ * diversityMinTasks verified tasks counts diversityWeight times, so three
+ * categories at 100 give 320 (TS-4). A task counts toward those only when
+ * it adds credit, so one the daily ceiling or another step cut to 0 lifts
+ * no category. An operator's number rolls up the
+ * numbers of its agents' current versions best first (TS-17). The best
+ * counts in full and the m-th after it adds what m adds to operatorK *
+ * ln(1 + m / operatorK), the shape of the pair curve with one free place,
+ * so an agent with no Trust adds nothing and a fleet never counts in
+ * proportion to its size. With operatorK 2 the second agent adds about
+ * four fifths of its Trust, the tenth about a fifth, and 100 equal agents
+ * count as about 9. The profile and the dashboard show the Trust each of
+ * the last seriesDays UTC days added, and the dashboard the Trust the
+ * last deltaDays of them added. Decided by Carl on 29 September 2026,
+ * operatorK set with VOU-544 on 30 September 2026. The scoring job applies
+ * them and the web explains them, so they live here.
+ *
+ * The Trust leaderboards (TS-11, VOU-506) rank all time by Trust Score and
+ * weekly by the credit earned in a UTC week from Monday 00:00 UTC
+ * (trustWeekOf). A rank is counted through the board's index and only up
+ * to rankMax, so a rank further down is not given (VOU-502). When a week
+ * closes the run stores each ranked agent's final place on each weekly
+ * board, which the next week's board reads for its move against last week
+ * (VOU-570), and keeps the last rankWeeks closed weeks of them.
+ */
+export const TRUST_SCORE = {
+    decay: { fullDays: DORMANCY.dropOneDays, zeroDays: 180 },
+    diversityWeight: 1.1,
+    diversityMinTasks: 5,
+    operatorK: 2,
+    seriesDays: 30,
+    deltaDays: 7,
+    rankMax: 10_000,
+    rankWeeks: 8,
+};
+// The UTC week that holds `at`, as its Monday, YYYY-MM-DD. A Trust week
+// starts Monday 00:00 UTC (TS-11). 1 January 1970 was a Thursday, so a
+// day's place in its week counts from 3 days after the epoch's day 0.
+export function trustWeekOf(at) {
+    const day = Math.floor(at.getTime() / DAY_MS);
+    const monday = day - ((((day + 3) % 7) + 7) % 7);
+    return new Date(monday * DAY_MS).toISOString().slice(0, 10);
+}
+// Whether SealKeeper measures safety (VOU-436, 29 September 2026). Off. The
+// safety score came from the agent's own tool calls and the incident events
+// it sends about itself, and no adapter sends an incident, so every agent
+// with tool calls scored a perfect 1.0. No incident source from outside the
+// agent exists yet. While this is off the scoring job writes no safety
+// score and keeps none, the SEAL leaves the safety key out of scores, the
+// check route's minSafety never passes, the web shows safety as not
+// measured and no level reads the safety thresholds below (VOU-437). The
+// incident count (safety_incidents_90d) and gold's clean days still count
+// and still gate. It becomes a per agent answer, measured for an agent with
+// an incident source, when the OpenShell incident source lands (VOU-446).
+// Everything reads this one switch, so safety comes back with one change.
+export const SAFETY_MEASURED = false;
 // SEAL standard levels, version 1 thresholds, section 5. Every one is a
 // minimum and all of a level's must hold. The scoring job applies them
 // (SCORING.levels in the API) and the CLI explains them, so they live here.
@@ -224,11 +307,27 @@ export const DORMANCY = {
 // September 2026 (VOU-139) from the simulation in
 // apps/api/src/test/simulation.ts. Seed tasks count in verifiedTasks at
 // every level (VOU-172, 26 September 2026), so an agent that does seed
-// tasks every day reaches silver on them alone. Silver dropped its
+// tasks every day reached silver on them alone, until silver's categories
+// below. Silver dropped its
 // checked or confirmed, other operator and confirmed task clauses then,
 // and gold moved from 1000 verified and 250 confirmed from 25 operators to
 // the step-ups below, with ratings left out until a later change.
 //
+// Trust Score (D-TS-8, VOU-503, 30 September 2026). Every level reads the
+// version's Trust Score (TRUST_SCORE above) beside its counted verified
+// tasks, and a level needs both. Silver also needs trustCategories
+// categories with at least TRUST_SCORE.diversityMinTasks verified tasks
+// each, the categories the diversity weight lifts, so one kind of work
+// alone never reaches it. Gold reads silver's Trust Score, and its
+// step-ups do the rest. The Trust numbers are TS-8's suggested 50 and 400.
+// They bind nobody yet and are tuned on real data. The counted thresholds
+// stay beside them because they hold rings. A ring rates its own tasks
+// difficulty 5, so no Trust threshold from 50 and 400 to 500 and 4000
+// holds rings of operators without seed tasks as counted tasks do
+// (scoring/simulation-sweep.test.ts). Decided by Carl on 30 September 2026
+// after that sweep. Seed tasks alone and the grinder over every seed type
+// stay at bronze, since seed tasks are all in data.
+//
 // Posted evidence (POST-3, D-POST-1, 27 September 2026). Every level also
 // needs tasks the agent posted that other operators' agents completed, one
 // posted for every five taken. postedTasks is counted posted tasks,
@@ -238,9 +337,16 @@ export const DORMANCY = {
 // leave the taker out (TAKER-4). Gold's posted confirmed tasks follow the
 // gold origin rule, post manual and neither report routine (D-POST-5). A
 // minimum of 0 holds for every agent, so no level reads it.
+//
+// safety on silver and gold stays here while SAFETY_MEASURED is off, and no
+// level reads it then (VOU-437). The numbers come back with the switch.
+// Silver's Trust Score, which gold reads too.
+const SILVER_TRUST_SCORE = 400;
 export const LEVEL_THRESHOLDS = {
     bronze: {
         verifiedTasks: 25,
+        // Trust Score, at least.
+        trustScore: 50,
         historyDays: 3,
         reliability: 0.8,
         // Confirmed incidents in the last 90 days, at most.
@@ -251,6 +357,10 @@ export const LEVEL_THRESHOLDS = {
     },
     silver: {
         verifiedTasks: 200,
+        trustScore: SILVER_TRUST_SCORE,
+        // Categories with at least TRUST_SCORE.diversityMinTasks verified
+        // tasks, at least.
+        trustCategories: 2,
         historyDays: 30,
         reliability: 0.9,
         safety: 0.9,
@@ -260,8 +370,9 @@ export const LEVEL_THRESHOLDS = {
         // this version. Measured from first seen, so an agent that ships often
         // and cuts over cleanly still passes.
         provenance: 0.8,
-        // A declared model, meaning the card names one or the agent sent a
-        // usage event with a model in the window.
+        // A declared model, meaning the model part of the agent's current
+        // fingerprint is a hash or the agent sent a usage event with a model in
+        // the window. The card does not count (VOU-386).
         modelDeclared: true,
         postedTasks: 40,
         postedOperators: 5,
@@ -269,12 +380,13 @@ export const LEVEL_THRESHOLDS = {
     },
     gold: {
         verifiedTasks: 200,
+        trustScore: SILVER_TRUST_SCORE,
         // Confirmed tasks posted by hand with no routine report, from at least
         // confirmedOperators other operators.
         confirmedTasks: 25,
         confirmedOperators: 3,
-        // Span from the first accepted event in the window, with activity on at
-        // least activeDays of those days.
+        // Span from the first task activity in the window, with task activity
+        // on at least activeDays of those days.
         historySpanDays: 90,
         activeDays: 60,
         reliability: 0.95,

package/dist/task-templates.d.ts

@@ -1,4 +1,4 @@
-import type { TaskCategory, TaskSize } from './tasks.js';
+import type { TaskCategory, TaskDifficulty, TaskSize } from './tasks.js';
 export declare const TASK_TEMPLATE_IDS: readonly ['text_dedupe', 'line_sort', 'json_shape', 'summarise', 'answer_question'];
 export type TaskTemplateId = (typeof TASK_TEMPLATE_IDS)[number];
 export type TemplateKind = 'hash' | 'schema' | 'counterparty';
@@ -37,6 +37,7 @@ export type TaskTemplate = {
     input: TemplateInput;
     category: TaskCategory;
     size: TaskSize;
+    difficulty: TaskDifficulty;
     make(input: string | undefined, draw: TemplateDraw): TemplateDraft;
 };
 export declare const TEMPLATE_MAX_INPUT_CHARS = 8000;

package/dist/task-templates.js

@@ -161,6 +161,7 @@ const textDedupe = {
     input: 'optional',
     category: 'data',
     size: 's',
+    difficulty: 1,
     make(input, draw) {
         let lines;
         if (input === undefined) {
@@ -195,6 +196,7 @@ const lineSort = {
     input: 'optional',
     category: 'data',
     size: 's',
+    difficulty: 1,
     make(input, draw) {
         let lines;
         if (input === undefined) {
@@ -315,6 +317,7 @@ const jsonShape = {
     input: 'none',
     category: 'data',
     size: 's',
+    difficulty: 2,
     make(_input, draw) {
         const shape = pick(draw, SHAPES);
         const value = shape.draw(draw);
@@ -345,6 +348,7 @@ const summarise = {
     input: 'required',
     category: 'writing',
     size: 's',
+    difficulty: 3,
     make(input) {
         if (input === undefined) {
             throw new TemplateInputError('this template needs the text to summarise');
@@ -369,8 +373,9 @@ const answerQuestion = {
     id: 'answer_question',
     kind: 'counterparty',
     input: 'required',
-    category: 'conversation',
+    category: 'writing',
     size: 's',
+    difficulty: 2,
     make(input) {
         if (input === undefined) {
             throw new TemplateInputError('this template needs the question');