ai-model-verifier 1.4.0 → 2.0.0

package/dist/rules/thinking-signature.js

@@ -0,0 +1,72 @@
+/**
+ * Anthropic thinking signature.
+ *
+ * Claude attaches a server-generated `signature` to every thinking block. A
+ * relay serving some other model cannot produce one, so this is the only
+ * evidence here that does not rest on asking the model who it is: identity and
+ * behaviour probes can be coached with a system prompt, a signature cannot.
+ *
+ * What it does NOT prove: which tier answered. Sonnet returns a perfectly valid
+ * signature when sold as Opus, so a pass here still needs the tier checks.
+ *
+ * The `strict` replay (hand the block back so the vendor re-validates it) was
+ * built and measured: it does not work through a relay. A genuine block and the
+ * same block with 308 bytes of random base64 in place of the signature both
+ * came back 200 from two live upstreams, because a relay re-issues the turn to
+ * its own backend rather than passing our block through. It stays off by
+ * default and only tells you the endpoint accepts a thinking block.
+ */
+import { defineRule } from "./types";
+/** Real signatures run to hundreds of chars; this only rejects a stub. */
+const SIGNATURE_MIN_LEN = 50;
+async function signatureResult(ctx) {
+    const empty = { signatureLength: 0, signaturePrefix: null, thinkingChars: 0 };
+    const reply = await ctx.evidence("thinkingReply");
+    if (!reply)
+        return { state: "skipped", ...empty, reason: "model-has-no-thinking-mode" };
+    const res = reply.res;
+    if (res.status === null || res.status >= 400)
+        return {
+            state: "skipped",
+            ...empty,
+            reason: `probe-failed:${res.status ?? "network"}`,
+        };
+    const found = ctx.wire.read.thinkingBlock?.(res.data) ?? null;
+    if (!found)
+        return { state: "no-thinking", ...empty, reason: "no-thinking-block" };
+    const sig = found.signature;
+    const base = {
+        signatureLength: sig.length,
+        signaturePrefix: sig ? sig.slice(0, 32) : null,
+        thinkingChars: found.chars,
+    };
+    if (!sig)
+        return { state: "unsigned", ...base, reason: "no-signature-field" };
+    if (sig.length < SIGNATURE_MIN_LEN)
+        return { state: "unsigned", ...base, reason: "signature-too-short" };
+    if (reply.replayAccepted === undefined)
+        return { state: "signed", ...base };
+    // A rejection is real evidence (the endpoint checked and refused); an
+    // acceptance is not, so it never upgrades the state on its own.
+    return {
+        state: reply.replayAccepted ? "signed" : "unsigned",
+        ...base,
+        replayVerified: reply.replayAccepted,
+        ...(reply.replayAccepted ? {} : { reason: "signature-rejected-on-replay" }),
+    };
+}
+export const signatureRule = defineRule({
+    id: "signature",
+    layer: "note",
+    needs: ["thinkingReply"],
+    check: "signature",
+    applies: (ctx) => ctx.wire.read.thinkingBlock !== undefined,
+    judge: async (ctx) => {
+        const r = await signatureResult(ctx);
+        return r.state === "no-thinking"
+            ? { severity: "note", reason: `signature: ${r.reason}` }
+            : null;
+    },
+    report: async (ctx) => ({ signature: await signatureResult(ctx) }),
+});
+//# sourceMappingURL=thinking-signature.js.map

package/dist/rules/thinking-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"thinking-signature.js","sourceRoot":"","sources":["../../src/rules/thinking-signature.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AA2B7B,KAAK,UAAU,eAAe,CAC5B,GAA6B;IAE7B,MAAM,KAAK,GAAG,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK;QACR,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC9E,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;QAC1C,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,GAAG,KAAK;YACR,MAAM,EAAE,gBAAgB,GAAG,CAAC,MAAM,IAAI,SAAS,EAAE;SAClD,CAAC;IACJ,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IAC9D,IAAI,CAAC,KAAK;QACR,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAEzE,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC;IAC5B,MAAM,IAAI,GAAG;QACX,eAAe,EAAE,GAAG,CAAC,MAAM;QAC3B,eAAe,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;QAC9C,aAAa,EAAE,KAAK,CAAC,KAAK;KAC3B,CAAC;IACF,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC9E,IAAI,GAAG,CAAC,MAAM,GAAG,iBAAiB;QAChC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAC5E,sEAAsE;IACtE,gEAAgE;IAChE,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU;QACnD,GAAG,IAAI;QACP,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;IACtC,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,CAAC,eAAe,CAAC;IACxB,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;IAC3D,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC,KAAK,KAAK,aAAa;YAC9B,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,MAAM,EAAE,EAAE;YACxD,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;CACnE,CAAC,CAAC"}

package/dist/{detectors → rules}/throughput.d.ts

@@ -2,16 +2,12 @@
  * Throughput metadata: tokens per second, derived from data the run already
  * collected.
  *
- * Motivation: bigger models are slower per token, so a lane billed as Opus but
- * served by Sonnet tends to run fast. That makes throughput the one tier signal
- * that survives a relay refusing to name its model.
- *
- * It is metadata, not a verdict, and deliberately has no thresholds. Rate
- * varies with load, batching, quantisation and time of day, so a single
- * measurement cannot separate "cheaper model" from "quiet hour". The useful
- * comparison is across lanes serving the SAME model, which only the caller can
- * assemble: `compareThroughput` does that part and still only describes what it
- * sees.
+ * Bigger models are slower per token, so a lane billed as Opus but served by
+ * Sonnet tends to run fast. That makes throughput the one tier signal that
+ * survives a relay refusing to name its model. It is metadata, not a verdict,
+ * and deliberately has no thresholds: rate varies with load, batching,
+ * quantisation and time of day. The useful comparison is across lanes serving
+ * the SAME model, which only the caller can assemble with `compareThroughput`.
  */
 export type ThroughputSample = {
     /** Identifies the lane in the caller's own terms. */
@@ -48,4 +44,5 @@ export type ThroughputComparison = {
 export declare function compareThroughput(samples: ThroughputSample[], opts?: {
     outlierRatio?: number;
 }): ThroughputComparison[];
+export declare const throughputRule: import("./types").Rule<"throughput", "probes", "note">;
 //# sourceMappingURL=throughput.d.ts.map

package/dist/rules/throughput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"throughput.d.ts","sourceRoot":"","sources":["../../src/rules/throughput.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACxC,SAAS,EAAE,MAAM,CAAC;CACnB,GAAG,gBAAgB,GAAG,IAAI,CAa1B;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC;KAChC,EAAE,CAAC;IACJ,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAQF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,gBAAgB,EAAE,EAC3B,IAAI,CAAC,EAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/B,oBAAoB,EAAE,CAgDxB;AAED,eAAO,MAAM,cAAc,wDAmBzB,CAAC"}

package/dist/{detectors → rules}/throughput.js

@@ -2,17 +2,16 @@
  * Throughput metadata: tokens per second, derived from data the run already
  * collected.
  *
- * Motivation: bigger models are slower per token, so a lane billed as Opus but
- * served by Sonnet tends to run fast. That makes throughput the one tier signal
- * that survives a relay refusing to name its model.
- *
- * It is metadata, not a verdict, and deliberately has no thresholds. Rate
- * varies with load, batching, quantisation and time of day, so a single
- * measurement cannot separate "cheaper model" from "quiet hour". The useful
- * comparison is across lanes serving the SAME model, which only the caller can
- * assemble: `compareThroughput` does that part and still only describes what it
- * sees.
+ * Bigger models are slower per token, so a lane billed as Opus but served by
+ * Sonnet tends to run fast. That makes throughput the one tier signal that
+ * survives a relay refusing to name its model. It is metadata, not a verdict,
+ * and deliberately has no thresholds: rate varies with load, batching,
+ * quantisation and time of day. The useful comparison is across lanes serving
+ * the SAME model, which only the caller can assemble with `compareThroughput`.
  */
+import { richestProbe } from "../engine/probe-runner";
+import { hostOf } from "../internal/utils";
+import { defineRule } from "./types";
 export function sampleThroughput(args) {
     const tokens = args.outputTokens;
     // A handful of tokens over a noisy connection says nothing; the rate is
@@ -62,7 +61,9 @@ export function compareThroughput(samples, opts) {
                 lane: s.lane,
                 tokensPerSecond: s.tokensPerSecond,
                 ratioToMedian: +(s.tokensPerSecond / med).toFixed(2),
-                direction: s.tokensPerSecond > med ? "faster" : "slower",
+                direction: s.tokensPerSecond > med
+                    ? "faster"
+                    : "slower",
             }))
                 .sort((a, b) => b.tokensPerSecond - a.tokensPerSecond)
             : [];
@@ -80,4 +81,24 @@ export function compareThroughput(samples, opts) {
     }
     return out;
 }
+export const throughputRule = defineRule({
+    id: "throughput",
+    layer: "note",
+    needs: ["probes"],
+    applies: () => true,
+    judge: async () => null,
+    report: async (ctx) => {
+        const richest = richestProbe(await ctx.evidence("probes"));
+        return richest
+            ? {
+                throughput: sampleThroughput({
+                    lane: hostOf(ctx.baseUrl),
+                    model: ctx.model,
+                    outputTokens: richest.usage?.completion ?? null,
+                    elapsedMs: richest.latencyMs,
+                }),
+            }
+            : {};
+    },
+});
 //# sourceMappingURL=throughput.js.map

package/dist/rules/throughput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"throughput.js","sourceRoot":"","sources":["../../src/rules/throughput.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAWrC,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC;IACjC,wEAAwE;IACxE,wDAAwD;IACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,YAAY,EAAE,MAAM;QACpB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,eAAe,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KAChE,CAAC;AACJ,CAAC;AAgBD,MAAM,MAAM,GAAG,CAAC,EAAY,EAAE,EAAE;IAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAE,GAAG,CAAC,CAAC,GAAG,CAAE,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA2B,EAC3B,IAAgC;IAEhC,MAAM,KAAK,GAAG,IAAI,EAAE,YAAY,IAAI,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAClB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACrC,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QACxD,MAAM,QAAQ,GACZ,KAAK,CAAC,MAAM,IAAI,CAAC;YACf,CAAC,CAAC,KAAK;iBACF,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,eAAe,IAAI,GAAG,GAAG,KAAK;gBAChC,CAAC,CAAC,eAAe,IAAI,GAAG,GAAG,KAAK,CACnC;iBACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;gBACpD,SAAS,EACP,CAAC,CAAC,eAAe,GAAG,GAAG;oBACrB,CAAC,CAAE,QAAkB;oBACrB,CAAC,CAAE,QAAkB;aAC1B,CAAC,CAAC;iBACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,eAAe,CAAC;YAC1D,CAAC,CAAC,EAAE,CAAC;QAET,GAAG,CAAC,IAAI,CAAC;YACP,KAAK;YACL,WAAW,EAAE,KAAK,CAAC,MAAM;YACzB,SAAS,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1B,QAAQ;YACR,IAAI,EACF,KAAK,CAAC,MAAM,GAAG,CAAC;gBACd,CAAC,CAAC,0BAA0B;gBAC5B,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;oBACrB,CAAC,CAAC,sCAAsC;oBACxC,CAAC,CAAC,GAAG,QAAQ,CAAC,MAAM,oHAAoH;SAC/I,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;IACvC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,CAAC,QAAQ,CAAC;IACjB,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;IACnB,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;IACvB,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC3D,OAAO,OAAO;YACZ,CAAC,CAAC;gBACE,UAAU,EAAE,gBAAgB,CAAC;oBAC3B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;oBACzB,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,YAAY,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,IAAI,IAAI;oBAC/C,SAAS,EAAE,OAAO,CAAC,SAAS;iBAC7B,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;CACF,CAAC,CAAC"}

package/dist/{detectors → rules}/token-truth.d.ts

@@ -1,9 +1,9 @@
 /**
- * Token-accounting checks for Anthropic endpoints.
+ * Token accounting.
  *
- * The signature check answers "is this really Claude". These answer a different
- * question the signature cannot: "are the numbers you are billing me true".
- * A relay can forward genuine Claude and still inflate `input_tokens` on every
+ * The signature answers "is this really Claude". This answers a different
+ * question the signature cannot: "are the numbers you are billing me true". A
+ * relay can forward genuine Claude and still inflate `input_tokens` on every
  * call, and nothing in an identity probe would notice.
  *
  * Ported from veridrop (AGPL-3.0) `token_usage.py` / `integrity.py`, whose
@@ -11,7 +11,7 @@
  * without re-measuring: the loose-looking bounds exist because real Anthropic
  * responses sat near them.
  */
-import type { TransportFn } from "../transport";
+import type { ModelFacts } from "../models/facts";
 export type TokenTruthCheck = {
     id: "usage-present" | "input-delta" | "output-bounded" | "count-tokens";
     pass: boolean;
@@ -26,15 +26,9 @@ export type TokenTruthResult = {
     countTokens: number | null;
     reason?: string;
 };
-export declare function expectedInputDelta(model: string): {
+export declare const expectedInputDelta: (facts: ModelFacts) => {
     min: number;
     max: number;
 };
-export declare function checkTokenTruth(opts: {
-    transport: TransportFn;
-    baseUrl: string;
-    apiKey: string;
-    model: string;
-    timeoutMs: number;
-}): Promise<TokenTruthResult>;
+export declare const tokenTruthRule: import("./types").Rule<"token-truth", "countTokens" | "fixedText", "note">;
 //# sourceMappingURL=token-truth.d.ts.map

package/dist/rules/token-truth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-truth.d.ts","sourceRoot":"","sources":["../../src/rules/token-truth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAelD,MAAM,MAAM,eAAe,GAAG;IAC5B,EAAE,EAAE,eAAe,GAAG,aAAa,GAAG,gBAAgB,GAAG,cAAc,CAAC;IACxE,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,0EAA0E;IAC1E,EAAE,EAAE,OAAO,GAAG,IAAI,CAAC;IACnB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,eAAO,MAAM,kBAAkB,UAAW,UAAU;;;CACK,CAAC;AAmF1D,eAAO,MAAM,cAAc,4EAazB,CAAC"}

package/dist/rules/token-truth.js

@@ -0,0 +1,112 @@
+/**
+ * Token accounting.
+ *
+ * The signature answers "is this really Claude". This answers a different
+ * question the signature cannot: "are the numbers you are billing me true". A
+ * relay can forward genuine Claude and still inflate `input_tokens` on every
+ * call, and nothing in an identity probe would notice.
+ *
+ * Ported from veridrop (AGPL-3.0) `token_usage.py` / `integrity.py`, whose
+ * tolerances were calibrated against the official API. Do not tighten them
+ * without re-measuring: the loose-looking bounds exist because real Anthropic
+ * responses sat near them.
+ */
+import { COUNT_PROBE_MAX_TOKENS as MAX_TOKENS } from "../probes/prompts";
+import { defineRule } from "./types";
+/**
+ * Expected `input_tokens` growth between the short and long prompt. Two bands
+ * because Anthropic changed tokenizer: a relay claiming a new-tokenizer model
+ * while serving an older one lands in the wrong band, which makes this a tier
+ * check as well as a billing check.
+ */
+const DELTA_OLD = { min: 45, max: 140 };
+const DELTA_NEW = { min: 90, max: 230 };
+/** `count_tokens` should agree with the billed `input_tokens` this closely. */
+const countTolerance = (n) => Math.max(4, Math.round(n * 0.2));
+export const expectedInputDelta = (facts) => facts.tokenizer === "claude-v2" ? DELTA_NEW : DELTA_OLD;
+async function tokenTruthResult(ctx) {
+    const noCounts = {
+        shortInputTokens: null,
+        longInputTokens: null,
+        countTokens: null,
+    };
+    const ft = await ctx.evidence("fixedText");
+    if (ft.short.status === null || ft.short.status >= 400)
+        return {
+            ok: null,
+            checks: [],
+            ...noCounts,
+            reason: `probe-failed:${ft.short.status ?? "network"}`,
+        };
+    const s = ctx.wire.read.meta(ft.short.data).usage;
+    const l = ctx.wire.read.meta(ft.long.data).usage;
+    const checks = [];
+    const shortIn = s?.prompt ?? null;
+    const longIn = l?.prompt ?? null;
+    const usagePresent = shortIn !== null && longIn !== null;
+    checks.push({
+        id: "usage-present",
+        pass: usagePresent,
+        detail: usagePresent
+            ? `short=${shortIn}, long=${longIn}`
+            : "endpoint reported no usage counts",
+    });
+    // Without usage there is nothing to verify; a missing field is not fraud.
+    if (shortIn === null || longIn === null)
+        return { ok: null, checks, ...noCounts, reason: "no-usage-reported" };
+    const band = expectedInputDelta(ctx.facts);
+    const delta = longIn - shortIn;
+    checks.push({
+        id: "input-delta",
+        pass: delta >= band.min && delta <= band.max,
+        detail: `delta=${delta}, expected ${band.min}-${band.max}`,
+    });
+    // Output above the cap we set means the count is invented, not merely padded.
+    const outputs = [s?.completion ?? null, l?.completion ?? null].filter((v) => v !== null);
+    checks.push({
+        id: "output-bounded",
+        pass: outputs.every((v) => v > 0 && v <= MAX_TOKENS + 4),
+        detail: `outputs=${outputs.join(",") || "none"} (cap ${MAX_TOKENS})`,
+    });
+    // The same upstream pricing the same request without generating: the
+    // strongest anti-inflation signal available, when the endpoint exposes it.
+    // A missing count endpoint is common on relays and proves nothing, so it is
+    // simply absent from the checks rather than counted as a failure.
+    let counted = null;
+    const countRes = await ctx.evidence("countTokens");
+    if (countRes && countRes.status !== null && countRes.status < 400) {
+        counted = ctx.wire.read.countedTokens?.(countRes.data) ?? null;
+        if (counted !== null) {
+            const drift = Math.abs(counted - shortIn);
+            const tol = countTolerance(shortIn);
+            checks.push({
+                id: "count-tokens",
+                pass: drift <= tol,
+                detail: `count=${counted} vs billed=${shortIn}, drift=${drift} (tolerance ${tol})`,
+            });
+        }
+    }
+    return {
+        ok: checks.every((c) => c.pass),
+        checks,
+        shortInputTokens: shortIn,
+        longInputTokens: longIn,
+        countTokens: counted,
+    };
+}
+export const tokenTruthRule = defineRule({
+    id: "token-truth",
+    layer: "note",
+    needs: ["fixedText", "countTokens"],
+    check: "tokenTruth",
+    applies: (ctx) => ctx.wire.read.countedTokens !== undefined,
+    judge: async (ctx) => {
+        const r = await tokenTruthResult(ctx);
+        if (r.ok !== false)
+            return null;
+        const failed = r.checks.filter((c) => !c.pass).map((c) => c.id);
+        return { severity: "note", reason: `token-truth: ${failed.join(", ")}` };
+    },
+    report: async (ctx) => ({ tokenTruth: await tokenTruthResult(ctx) }),
+});
+//# sourceMappingURL=token-truth.js.map

package/dist/rules/token-truth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-truth.js","sourceRoot":"","sources":["../../src/rules/token-truth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,sBAAsB,IAAI,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEzE,OAAO,EAAE,UAAU,EAAgB,MAAM,SAAS,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACxC,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAExC,+EAA+E;AAC/E,MAAM,cAAc,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;AAkBvE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,KAAiB,EAAE,EAAE,CACtD,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAE1D,KAAK,UAAU,gBAAgB,CAC7B,GAAyC;IAEzC,MAAM,QAAQ,GAAG;QACf,gBAAgB,EAAE,IAAI;QACtB,eAAe,EAAE,IAAI;QACrB,WAAW,EAAE,IAAI;KAClB,CAAC;IACF,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,GAAG;QACpD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,EAAE;YACV,GAAG,QAAQ;YACX,MAAM,EAAE,gBAAgB,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE;SACvD,CAAC;IAEJ,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;IACjD,MAAM,MAAM,GAAsB,EAAE,CAAC;IAErC,MAAM,OAAO,GAAG,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;IACjC,MAAM,YAAY,GAAG,OAAO,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC;IACzD,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,YAAY;YAClB,CAAC,CAAC,SAAS,OAAO,UAAU,MAAM,EAAE;YACpC,CAAC,CAAC,mCAAmC;KACxC,CAAC,CAAC;IACH,0EAA0E;IAC1E,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAExE,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG;QAC5C,MAAM,EAAE,SAAS,KAAK,cAAc,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE;KAC3D,CAAC,CAAC;IAEH,8EAA8E;IAC9E,MAAM,OAAO,GAAG,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,EAAE,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC,MAAM,CACnE,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAC/B,CAAC;IACF,MAAM,CAAC,IAAI,CAAC;QACV,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC;QACxD,MAAM,EAAE,WAAW,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,SAAS,UAAU,GAAG;KACrE,CAAC,CAAC;IAEH,qEAAqE;IACrE,2EAA2E;IAC3E,4EAA4E;IAC5E,kEAAkE;IAClE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAClE,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;QAC/D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC;gBACV,EAAE,EAAE,cAAc;gBAClB,IAAI,EAAE,KAAK,IAAI,GAAG;gBAClB,MAAM,EAAE,SAAS,OAAO,cAAc,OAAO,WAAW,KAAK,eAAe,GAAG,GAAG;aACnF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/B,MAAM;QACN,gBAAgB,EAAE,OAAO;QACzB,eAAe,EAAE,MAAM;QACvB,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;IACvC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC;IACnC,KAAK,EAAE,YAAY;IACnB,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,KAAK,SAAS;IAC3D,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAChC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;IAC3E,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;CACrE,CAAC,CAAC"}

package/dist/rules/tokenizer-fingerprint.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Tokenizer fingerprint: how many input tokens the endpoint bills for a fixed
+ * run of text, measured as the difference between a long and a short prompt so
+ * anything a relay injects cancels out.
+ *
+ * What it is good for: drift. The delta is deterministic per endpoint (68
+ * marketplace lanes measured twice each agreed to the token on every repeat),
+ * so a change between two measurements of the same lane means the backend
+ * changed, whatever the reply now calls itself. Keep the prior per lane and
+ * compare with `fingerprintDrifted`.
+ *
+ * What it is NOT good for: naming the tier from the number alone. Opus 4.6,
+ * Sonnet 4.6 and Haiku 4.5 share one tokenizer, so they bill the same delta on
+ * the same path, and relays count differently from each other (77, 90, 134,
+ * 160, 211 and 609 were all seen for one text on lanes echoing one model name)
+ * or invent usage outright. A signature table therefore ships EMPTY: only a
+ * caller who has calibrated a table on a specific endpoint family should pass
+ * one, and even then only between-model differences on the same endpoint are
+ * evidence.
+ */
+export type TierSignatures = Readonly<Record<string, readonly number[]>>;
+/** Empty on purpose; see the module note. Pass your own calibration. */
+export declare const DEFAULT_TIER_SIGNATURES: TierSignatures;
+export type TokenizerFingerprintState = "measured" | "unmeasured";
+export type TokenizerFingerprintResult = {
+    state: TokenizerFingerprintState;
+    /** long minus short input tokens; the fingerprint itself. */
+    delta: number | null;
+    shortInputTokens: number | null;
+    longInputTokens: number | null;
+    /** `model` echoed on the short reply, when the endpoint reported one. */
+    servedModel: string | null;
+    /** Tier whose signature the delta matched, when any did. */
+    matchedTier: string | null;
+    reason?: string;
+};
+export declare function tierForDelta(delta: number, signatures?: TierSignatures): string | null;
+/**
+ * The served tier when the fingerprint names one other than requested, or
+ * null. `tiers` is the wire's tier vocabulary (opus, sonnet, haiku, fable).
+ */
+export declare function judgeTokenizerFingerprint(requestedModel: string, result: TokenizerFingerprintResult, tiers: readonly string[]): string | null;
+/** True when two measurements of the same lane disagree: the backend changed. */
+export declare function fingerprintDrifted(prior: number | null | undefined, current: TokenizerFingerprintResult): boolean;
+export declare const tokenizerFingerprintRule: import("./types").Rule<"tokenizer-fingerprint", "fixedText", "evidence">;
+//# sourceMappingURL=tokenizer-fingerprint.d.ts.map

package/dist/rules/tokenizer-fingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenizer-fingerprint.d.ts","sourceRoot":"","sources":["../../src/rules/tokenizer-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAEzE,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,EAAE,cAAmB,CAAC;AAE1D,MAAM,MAAM,yBAAyB,GAAG,UAAU,GAAG,YAAY,CAAC;AAElE,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,EAAE,yBAAyB,CAAC;IACjC,6DAA6D;IAC7D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,yEAAyE;IACzE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4DAA4D;IAC5D,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,UAAU,GAAE,cAAwC,GACnD,MAAM,GAAG,IAAI,CAIf;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,MAAM,EACtB,MAAM,EAAE,0BAA0B,EAClC,KAAK,EAAE,SAAS,MAAM,EAAE,GACvB,MAAM,GAAG,IAAI,CAMf;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAOT;AA4CD,eAAO,MAAM,wBAAwB,0EAuBnC,CAAC"}

package/dist/rules/tokenizer-fingerprint.js

@@ -0,0 +1,110 @@
+/**
+ * Tokenizer fingerprint: how many input tokens the endpoint bills for a fixed
+ * run of text, measured as the difference between a long and a short prompt so
+ * anything a relay injects cancels out.
+ *
+ * What it is good for: drift. The delta is deterministic per endpoint (68
+ * marketplace lanes measured twice each agreed to the token on every repeat),
+ * so a change between two measurements of the same lane means the backend
+ * changed, whatever the reply now calls itself. Keep the prior per lane and
+ * compare with `fingerprintDrifted`.
+ *
+ * What it is NOT good for: naming the tier from the number alone. Opus 4.6,
+ * Sonnet 4.6 and Haiku 4.5 share one tokenizer, so they bill the same delta on
+ * the same path, and relays count differently from each other (77, 90, 134,
+ * 160, 211 and 609 were all seen for one text on lanes echoing one model name)
+ * or invent usage outright. A signature table therefore ships EMPTY: only a
+ * caller who has calibrated a table on a specific endpoint family should pass
+ * one, and even then only between-model differences on the same endpoint are
+ * evidence.
+ */
+import { defineRule } from "./types";
+/** Empty on purpose; see the module note. Pass your own calibration. */
+export const DEFAULT_TIER_SIGNATURES = {};
+export function tierForDelta(delta, signatures = DEFAULT_TIER_SIGNATURES) {
+    for (const [tier, values] of Object.entries(signatures))
+        if (values.includes(delta))
+            return tier;
+    return null;
+}
+/**
+ * The served tier when the fingerprint names one other than requested, or
+ * null. `tiers` is the wire's tier vocabulary (opus, sonnet, haiku, fable).
+ */
+export function judgeTokenizerFingerprint(requestedModel, result, tiers) {
+    if (result.state !== "measured" || result.matchedTier === null)
+        return null;
+    const req = requestedModel.toLowerCase();
+    const reqTier = tiers.filter((t) => req.includes(t));
+    if (reqTier.length !== 1)
+        return null;
+    return reqTier[0] === result.matchedTier ? null : result.matchedTier;
+}
+/** True when two measurements of the same lane disagree: the backend changed. */
+export function fingerprintDrifted(prior, current) {
+    return (typeof prior === "number" &&
+        current.state === "measured" &&
+        current.delta !== null &&
+        current.delta !== prior);
+}
+async function fingerprintResult(ctx) {
+    const ft = await ctx.evidence("fixedText");
+    const empty = {
+        delta: null,
+        shortInputTokens: null,
+        longInputTokens: null,
+        servedModel: null,
+        matchedTier: null,
+    };
+    for (const r of [ft.short, ft.long])
+        if (r.status === null || r.status >= 400)
+            return {
+                state: "unmeasured",
+                ...empty,
+                reason: `probe-failed:${r.status ?? "network"}`,
+            };
+    const shortMeta = ctx.wire.read.meta(ft.short.data);
+    const short = shortMeta.usage?.prompt ?? null;
+    const long = ctx.wire.read.meta(ft.long.data).usage?.prompt ?? null;
+    if (short === null || long === null)
+        return {
+            state: "unmeasured",
+            ...empty,
+            servedModel: shortMeta.detectedModel,
+            reason: "no-usage-reported",
+        };
+    const delta = long - short;
+    return {
+        state: "measured",
+        delta,
+        shortInputTokens: short,
+        longInputTokens: long,
+        servedModel: shortMeta.detectedModel,
+        matchedTier: tierForDelta(delta, ctx.checks.tokenizerFingerprint?.signatures),
+    };
+}
+export const tokenizerFingerprintRule = defineRule({
+    id: "tokenizer-fingerprint",
+    layer: "evidence",
+    needs: ["fixedText"],
+    check: "tokenizerFingerprint",
+    // Claude only, over either wire that carries its usage as is.
+    applies: (ctx) => ctx.facts.vendor === "anthropic" && ctx.wire.id !== "gemini",
+    judge: async (ctx) => {
+        if (!ctx.wire.tiers)
+            return null;
+        const r = await fingerprintResult(ctx);
+        const tier = judgeTokenizerFingerprint(ctx.model, r, ctx.wire.tiers);
+        return tier
+            ? {
+                severity: "fail",
+                reason: `tokenizer-fingerprint: delta ${r.delta} is the ${tier} signature, requested ${ctx.model}`,
+                data: r,
+            }
+            : null;
+    },
+    report: async (ctx) => ({
+        tokenizerFingerprint: await fingerprintResult(ctx),
+    }),
+});
+//# sourceMappingURL=tokenizer-fingerprint.js.map

package/dist/rules/tokenizer-fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenizer-fingerprint.js","sourceRoot":"","sources":["../../src/rules/tokenizer-fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,SAAS,CAAC;AAInD,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAmB,EAAE,CAAC;AAiB1D,MAAM,UAAU,YAAY,CAC1B,KAAa,EACb,UAAU,GAAmB,uBAAuB;IAEpD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,cAAsB,EACtB,MAAkC,EAClC,KAAwB;IAExB,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5E,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC;AACvE,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,kBAAkB,CAChC,KAAgC,EAChC,OAAmC;IAEnC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,CAAC,KAAK,KAAK,UAAU;QAC5B,OAAO,CAAC,KAAK,KAAK,IAAI;QACtB,OAAO,CAAC,KAAK,KAAK,KAAK,CACxB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG;QACZ,KAAK,EAAE,IAAI;QACX,gBAAgB,EAAE,IAAI;QACtB,eAAe,EAAE,IAAI;QACrB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;KAClB,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG;YACtC,OAAO;gBACL,KAAK,EAAE,YAAY;gBACnB,GAAG,KAAK;gBACR,MAAM,EAAE,gBAAgB,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE;aAChD,CAAC;IACN,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC;IACpE,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI;QACjC,OAAO;YACL,KAAK,EAAE,YAAY;YACnB,GAAG,KAAK;YACR,WAAW,EAAE,SAAS,CAAC,aAAa;YACpC,MAAM,EAAE,mBAAmB;SAC5B,CAAC;IACJ,MAAM,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;IAC3B,OAAO;QACL,KAAK,EAAE,UAAU;QACjB,KAAK;QACL,gBAAgB,EAAE,KAAK;QACvB,eAAe,EAAE,IAAI;QACrB,WAAW,EAAE,SAAS,CAAC,aAAa;QACpC,WAAW,EAAE,YAAY,CACvB,KAAK,EACL,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,UAAU,CAC5C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,UAAU,CAAC;IACjD,EAAE,EAAE,uBAAuB;IAC3B,KAAK,EAAE,UAAU;IACjB,KAAK,EAAE,CAAC,WAAW,CAAC;IACpB,KAAK,EAAE,sBAAsB;IAC7B,8DAA8D;IAC9D,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACf,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ;IAC9D,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,yBAAyB,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrE,OAAO,IAAI;YACT,CAAC,CAAC;gBACE,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,gCAAgC,CAAC,CAAC,KAAK,WAAW,IAAI,yBAAyB,GAAG,CAAC,KAAK,EAAE;gBAClG,IAAI,EAAE,CAAC;aACR;YACH,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtB,oBAAoB,EAAE,MAAM,iBAAiB,CAAC,GAAG,CAAC;KACnD,CAAC;CACH,CAAC,CAAC"}

package/dist/rules/types.d.ts

@@ -0,0 +1,57 @@
+import type { ResolvedChecks, RunCtx } from "../engine/context";
+import type { EvidenceBag, EvidenceKey } from "../engine/evidence";
+import type { ResponseMetadata } from "./response-metadata";
+import type { SignatureResult } from "./thinking-signature";
+import type { ThinkingFloorResult } from "./thinking-floor";
+import type { ThroughputSample } from "./throughput";
+import type { TokenTruthResult } from "./token-truth";
+import type { TokenizerFingerprintResult } from "./tokenizer-fingerprint";
+/**
+ * How a finding weighs on the verdict. `fail` and `suspect` both make the
+ * endpoint suspicious (kept apart so a consumer policy can demote one),
+ * `inconclusive` leaves it unverified, `note` never touches the verdict.
+ */
+export type Severity = "fail" | "suspect" | "inconclusive" | "note";
+/**
+ * Which findings outrank which: `evidence` rules read hard facts the probes
+ * cannot see and beat everything; `probe` rules read the behavioural probes and
+ * decide `versionUnverifiable`; `note` rules only report.
+ */
+export type RuleLayer = "evidence" | "probe" | "note";
+/** What a rule returns; the engine stamps the rule id and layer on. */
+export type RuleVerdict = {
+    severity: Severity;
+    reason: string;
+    data?: unknown;
+};
+export type Finding<Id extends string = string> = RuleVerdict & {
+    rule: Id;
+    layer: RuleLayer;
+};
+/** Per-rule artefacts copied onto the result, present only when the rule ran. */
+export type Reports = {
+    signature?: SignatureResult;
+    tokenTruth?: TokenTruthResult;
+    thinkingFloor?: ThinkingFloorResult;
+    tokenizerFingerprint?: TokenizerFingerprintResult;
+    responseMetadata?: ResponseMetadata;
+    throughput?: ThroughputSample | null;
+};
+export type CheckKey = keyof ResolvedChecks;
+/** A rule sees the run and only the evidence it declared in `needs`. */
+export type RuleCtx<N extends EvidenceKey = EvidenceKey> = RunCtx & {
+    evidence<K extends N>(key: K): Promise<EvidenceBag[K]>;
+};
+export type Rule<Id extends string = string, N extends EvidenceKey = EvidenceKey, L extends RuleLayer = RuleLayer> = {
+    id: Id;
+    layer: L;
+    needs: readonly N[];
+    /** Opt-in switch in `checks` that enables this rule under `verify`. */
+    check?: CheckKey;
+    /** Whether the rule has anything to say on this wire and model. */
+    applies(ctx: RunCtx): boolean;
+    judge(ctx: RuleCtx<N>): Promise<RuleVerdict | null>;
+    report?(ctx: RuleCtx<N>): Promise<Partial<Reports>>;
+};
+export declare const defineRule: <const Id extends string, const N extends EvidenceKey, const L extends RuleLayer>(rule: Rule<Id, N, L>) => Rule<Id, N, L>;
+//# sourceMappingURL=types.d.ts.map

package/dist/rules/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rules/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAE1E;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,cAAc,GAAG,MAAM,CAAC;AAEpE;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAEtD,uEAAuE;AACvE,MAAM,MAAM,WAAW,GAAG;IACxB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,OAAO,CAAC,EAAE,SAAS,MAAM,GAAG,MAAM,IAAI,WAAW,GAAG;IAC9D,IAAI,EAAE,EAAE,CAAC;IACT,KAAK,EAAE,SAAS,CAAC;CAClB,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,OAAO,GAAG;IACpB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,oBAAoB,CAAC,EAAE,0BAA0B,CAAC;IAClD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,UAAU,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC;AAE5C,wEAAwE;AACxE,MAAM,MAAM,OAAO,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,IAAI,MAAM,GAAG;IAClE,QAAQ,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;CACxD,CAAC;AAEF,MAAM,MAAM,IAAI,CACd,EAAE,SAAS,MAAM,GAAG,MAAM,EAC1B,CAAC,SAAS,WAAW,GAAG,WAAW,EACnC,CAAC,SAAS,SAAS,GAAG,SAAS,IAC7B;IACF,EAAE,EAAE,EAAE,CAAC;IACP,KAAK,EAAE,CAAC,CAAC;IACT,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;IACpB,uEAAuE;IACvE,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,mEAAmE;IACnE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;CACrD,CAAC;AAEF,eAAO,MAAM,UAAU,GACrB,KAAK,CAAC,EAAE,SAAS,MAAM,EACvB,KAAK,CAAC,CAAC,SAAS,WAAW,EAC3B,KAAK,CAAC,CAAC,SAAS,SAAS,QAEnB,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,KACnB,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAS,CAAC"}

package/dist/rules/types.js

@@ -0,0 +1,2 @@
+export const defineRule = (rule) => rule;
+//# sourceMappingURL=types.js.map

package/dist/rules/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/rules/types.ts"],"names":[],"mappings":"AAoEA,MAAM,CAAC,MAAM,UAAU,GAAG,CAKxB,IAAoB,EACJ,EAAE,CAAC,IAAI,CAAC"}

package/dist/transport.d.ts

@@ -1,4 +1,4 @@
-import type { TransportMode } from "./types";
+export type TransportMode = "direct" | "server";
 export type TransportResult = {
     status: number | null;
     data: unknown;
@@ -13,5 +13,13 @@ export type TransportArgs = {
     timeoutMs: number;
 };
 export type TransportFn = (args: TransportArgs) => Promise<TransportResult>;
-export declare function probeTransport(args: TransportArgs): Promise<TransportResult>;
+/** Plain fetch from wherever the code runs. */
+export declare const directTransport: TransportFn;
+/**
+ * From a browser through the caller's own backend, which forwards
+ * `{ url, headers, reqBody }` and answers `{ data: { status, data } }`.
+ */
+export declare function browserTransport(opts: {
+    serverProxyUrl: string;
+}): TransportFn;
 //# sourceMappingURL=transport.d.ts.map

package/dist/transport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,aAAa,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAgF5E,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAE5E"}
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,aAAa,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAsB5E,+CAA+C;AAC/C,eAAO,MAAM,eAAe,EAAE,WAuB7B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE;IACrC,cAAc,EAAE,MAAM,CAAC;CACxB,GAAG,WAAW,CAqCd"}