canli-validation-mcp 0.11.0 → 0.12.0

package/README.md

@@ -83,7 +83,7 @@ receipt. The current npm/hosted release retains the existing record-only API.
 
 | Tool | Calls | Key required |
 |---|---|---|
-| `get_key` | `POST /api/v1/keys` | no |
+| `get_key` | `POST /api/v1/keys` (listed only when no key is configured) | no |
 | `validate_deflated_sharpe` | `POST /api/v1/validate/deflated-sharpe` | yes |
 | `validate_overfitting` | `POST /api/v1/validate/overfitting` | yes |
 | `validate_paper_evidence` | `POST /api/v1/validate/paper-evidence` | yes |
@@ -93,9 +93,8 @@ receipt. The current npm/hosted release retains the existing record-only API.
 | `validate_haircut_sharpe` | `POST /api/v1/validate/haircut-sharpe` | yes |
 | `validate_luck_trials` | `POST /api/v1/validate/luck-trials` | yes |
 | `validate_reality_check` | `POST /api/v1/validate/reality-check` (a `matrix_file` is read on your machine and sent as numbers) | yes |
-| `audit_backtest` | the deflated Sharpe, track record and, with `variants`, overfitting routes, one validation each | yes |
-| `verify_receipt` | `GET /api/v1/receipts/{id}` when given an id; the checks run locally | no |
-| `get_receipt` | `GET /api/v1/receipts/{id}` | no |
+| `audit_backtest` | the deflated Sharpe and track record routes, then the headline: with `variants`, the overfitting and data-snooping routes; without, luck trials. One validation each | yes |
+| `verify_receipt` | `GET /api/v1/receipts/{id}` when given an id (`include_receipt` returns the stored receipt); the checks run locally | no |
 | `service_status` | `GET /api/v1/validate/status` | no |
 | `company_financial_history` | `GET /company-data/{cik}.json` (a ticker resolves through `GET /api/v1/company-tickers.json`) | no |
 
@@ -182,12 +181,27 @@ name the day a drawdown began.
 
 ## Auditing a backtest in one call
 
-`audit_backtest` takes one strategy's return series, the number of variants tried and their Sharpe
-dispersion, and optionally every variant's returns. It runs `validate_deflated_sharpe` on the
-series, then `validate_track_record` on the Sharpe, skew and kurtosis that check derived, then,
-with `variants`, `validate_overfitting`. Each check is exactly what its own tool returns, with its
-own receipt; the boundary sentences they share are stated once. A check that refuses (a Sharpe
-that cannot beat the benchmark has no minimum track record) is reported as that check's error.
+`audit_backtest` takes one strategy's return series and, ideally, every variant's returns
+(`variants` or `variants_file`, the dropped ones too); without them, the number of variants tried
+and their Sharpe spread. The result opens with:
+
+- `headline`: one test chosen because its false-positive rate was measured before anyone looked at
+  your numbers. Null Zoo v1 (`scripts/research/null-zoo/v1/` in the repository) drew hundreds of
+  thousands of simulated searches from nine return shapes with known ground truth; the bar and the
+  rule that picks the test were committed before the run. With variants the headline comes from
+  the data-snooping tests (`validate_reality_check`, with its receipt); without, from luck trials
+  with Lo's autocorrelation correction. Its sentence quotes the measured false-positive rate for
+  returns shaped like yours, and the worst across the nine shapes.
+- `fix_next`: at most five next steps, each `{id, why, next}` with a stable id.
+- `computed`: Lo's adjusted Sharpe, a stationary-bootstrap 95% interval for the Sharpe, the
+  haircut Sharpe, the minimum backtest length and, with variants, how many independent trials
+  they count as (Li and Ji) and the selected variant's out-of-sample decay.
+
+Then the checks: `validate_deflated_sharpe` on the series (an estimate), `validate_track_record`
+on the Sharpe, skew and kurtosis that check derived and, with variants, `validate_overfitting`.
+Each is exactly what its own tool returns, with its own receipt; the deflated Sharpe runs with the
+larger of the declared and counted trials and Sharpe spread, so a search cannot be made to look
+smaller than it was. A check that refuses or cannot be reached is reported as that check's error.
 The audit adds no grade of its own. Through the API it uses one validation per check.
 
 When the server runs on your machine, `returns_file` and `variants_file` take the path of the
@@ -327,7 +341,7 @@ equals the hosted one; it names no receipt id because none was made.
 claude mcp add canli-local --env CANLI_LOCAL=1 -- npx -y canli-validation-mcp
 ```
 
-`get_receipt`, `service_status` and `company_financial_history` still read from canlicapital.com;
+`verify_receipt` by id, `service_status` and `company_financial_history` still read from canlicapital.com;
 they send no series. In the Claude Desktop extension this is the "Private local mode" setting.
 
 ## Generic stdio client
@@ -392,20 +406,22 @@ A validation result is the answer (`data`), the sentences above except the quota
 receipt's id and URL; an error keeps its error. The rest of the API envelope (schema, endpoint,
 timestamps, claim and capital class, the human page, the source-file hashes and the quota line)
 describes the service rather than the answer, and an agent pays for every token of it on every
-call. It stays in the stored receipt, which `get_receipt` returns in full, and in `service_status`.
+call. It stays in the stored receipt, which `verify_receipt` returns in full with `include_receipt`, and in `service_status`.
 On a breadth result this is about half the text. Set `CANLI_FULL_ENVELOPE=1` to receive every field.
 
 ## Toolsets (tokens)
 
 A client sends the model the whole tool list on every turn, and it is most of each turn's prompt:
-a validation result is a few hundred tokens, the list of all nineteen tools several thousand. A
-client that needs one kind of tool can list only that kind, with `CANLI_TOOLSETS` (stdio) or
-`?toolsets=` (hosted endpoint). The default is every tool.
+a validation result is a few hundred tokens, the list of every tool several thousand. A client
+that needs one kind of tool can list only that kind, with `CANLI_TOOLSETS` (stdio) or
+`?toolsets=` (hosted endpoint). The default is every toolset except `company`, whose one tool
+canli-fundamentals-mcp does better and point in time; `all` adds it. `get_key` is listed only when
+no key is configured.
 
 | toolset | tools |
 |---|---|
 | `validate` | `get_key`, the eight validators, `audit_backtest` |
-| `receipts` | `get_receipt`, `verify_receipt` |
+| `receipts` | `verify_receipt` |
 | `company` | `company_financial_history` |
 | `status` | `service_status` |
 | `lab` | `backtest_strategy`, `summarize_series`, `stress_test`, `check_feasibility` |
@@ -415,11 +431,13 @@ tokenizers give different absolute counts), in the shape an OpenAI-style client
 
 | CANLI_TOOLSETS | tools | tokens per turn | of all |
 |---|---|---|---|
-| `all` | 19 | 5,946 | 100% |
-| `validate` | 11 | 3,685 | 62% |
-| `receipts` | 2 | 312 | 5% |
+| (default) | 17 | 5,581 | 95% |
+| (default, with CANLI_KEY) | 16 | 5,445 | 93% |
+| `all` | 18 | 5,852 | 100% |
+| `validate` | 11 | 3,708 | 63% |
+| `receipts` | 1 | 195 | 3% |
 | `company` | 1 | 273 | 5% |
-| `status` | 1 | 89 | 1% |
+| `status` | 1 | 89 | 2% |
 | `lab` | 4 | 1,595 | 27% |
 
 Providers cache a tool list that is identical from turn to turn and bill the cached part at a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "canli-validation-mcp",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "description": "Check whether a backtest is real: deflated Sharpe, CSCV probability of backtest overfitting, minimum track record and backtest length, haircut Sharpe and luck-equivalent trials, as an MCP server. Local mode, hosted endpoint, signed receipts.",
   "keywords": [
     "mcp",

package/src/lab.mjs

@@ -114,7 +114,6 @@ export const EXAMPLE_ARGS = Object.freeze({
   validate_haircut_sharpe: { observed_sharpe_annualized: 1.5, periods_per_year: 252, observations: 1260, tests: 50 },
   validate_luck_trials: { observed_sharpe_annualized: 1.5, periods_per_year: 252, observations: 1260 },
   audit_backtest: { returns_file: "backtest_returns.csv", periods_per_year: 252, effective_independent_trials: 20, cross_trial_sharpe_sd_annualized: 0.5 },
-  get_receipt: { id: "0123456789abcdef01234567" },
   verify_receipt: { id: "0123456789abcdef01234567" },
   service_status: {},
   company_financial_history: { ticker: "AAPL", concept: "Assets", limit: 8 },

package/src/local/js/audit-core.js

@@ -0,0 +1,329 @@
+// =============================================================================
+// audit-core.js
+// -----------------------------------------------------------------------------
+// The parts of audit_backtest computed from the caller's own series rather than by a stored
+// validator:
+//
+//   returnShape          lag-1 autocorrelation, volatility clustering, skew and tails of the
+//                        returns, and Lo's (2002) autocorrelation-adjusted Sharpe ratio.
+//   sharpeInterval       a stationary-bootstrap percentile interval for the annualized Sharpe.
+//   searchFromVariants   what every variant's returns say about the search: how many were tried,
+//                        how many independent ones that is (Nyholt 2004; Li and Ji 2005), how far
+//                        their Sharpe ratios spread, and how correlated they are.
+//   nullZooFamily        which Null Zoo family the shape resembles, by the rules fixed in
+//                        config/research/null-zoo-v1-prereg.json before the calibration run.
+//   neweyWestT,
+//   blockBootstrapT      the single-series tests the calibration scores (the same arithmetic as
+//                        scripts/research/null-zoo/v1/validators.mjs; a test keeps them equal).
+//   oosDecay             what the in-sample best did out of sample across CSCV splits.
+//   fixNext              at most five concrete next steps, each naming the check that raised it.
+//
+// Nothing here decides whether a strategy is good. Each number is a description of the series and
+// search exactly as sent.
+// =============================================================================
+
+import { autocorrelationFactor } from "./haircut-core.js";
+import { perPeriodMoments } from "./moments-core.js";
+import { makeRandom } from "./selection-risk-core.js";
+import { defaultBlock, stationaryIndices } from "./snooping-core.js";
+
+const mean = (xs) => { let s = 0; for (let i = 0; i < xs.length; i++) s += xs[i]; return s / xs.length; };
+
+function lagOneCorrelation(xs) {
+  const m = mean(xs);
+  let c = 0, v = 0;
+  for (let i = 0; i < xs.length; i++) { const d = xs[i] - m; v += d * d; if (i > 0) c += d * (xs[i - 1] - m); }
+  return v > 0 ? c / v : 0;
+}
+
+/** The shape of one return series: what the Null Zoo families vary, plus Lo's adjusted Sharpe. */
+export function returnShape(returns, periodsPerYear) {
+  const m = perPeriodMoments(returns);
+  const ppy = Number(periodsPerYear);
+  const xs = returns.map(Number);
+  const lag1 = lagOneCorrelation(xs);
+  const lag1Squares = lagOneCorrelation(xs.map((x) => x * x));
+  // Lo's factor needs rho strictly inside (-1, 1); a sample can sit on the edge only when it is tiny.
+  const rho = Math.max(-0.95, Math.min(0.95, lag1));
+  const sharpe = m.sharpe_per_period * Math.sqrt(ppy);
+  const factor = autocorrelationFactor(rho, ppy);
+  return {
+    observations: m.observations,
+    sharpe_annualized: sharpe,
+    skew: m.skew,
+    excess_kurtosis: m.non_excess_kurtosis - 3,
+    lag1_autocorrelation: lag1,
+    lag1_autocorrelation_of_squares: lag1Squares,
+    lo_factor: factor,
+    lo_adjusted_sharpe_annualized: sharpe * factor,
+  };
+}
+
+/**
+ * Percentile intervals for the annualized Sharpe from a stationary bootstrap (mean block n^(1/3)),
+ * and the share of resamples whose Sharpe is at or below zero.
+ */
+export function sharpeInterval(returns, { periodsPerYear, reps = 2000, block, seed = 42, levels = [0.9, 0.95] } = {}) {
+  const xs = Float64Array.from(returns, Number);
+  const n = xs.length;
+  const b = block ?? defaultBlock(n);
+  const next = makeRandom(seed);
+  const idx = new Int32Array(n);
+  const root = Math.sqrt(Number(periodsPerYear));
+  const draws = new Float64Array(reps);
+  let atOrBelowZero = 0;
+  for (let r = 0; r < reps; r++) {
+    stationaryIndices(n, b, next, idx);
+    let s = 0, q = 0;
+    for (let i = 0; i < n; i++) { const v = xs[idx[i]]; s += v; q += v * v; }
+    const m = s / n;
+    const variance = (q - n * m * m) / (n - 1);
+    // A resample with no spread has no Sharpe ratio; it counts on the side its mean falls.
+    const sharpe = variance > 0 ? (m / Math.sqrt(variance)) * root : m > 0 ? Infinity : m < 0 ? -Infinity : 0;
+    draws[r] = sharpe;
+    if (sharpe <= 0) atOrBelowZero++;
+  }
+  draws.sort();
+  const at = (q) => {
+    const h = (reps - 1) * q;
+    const lo = Math.floor(h);
+    const hi = Math.min(lo + 1, reps - 1);
+    return draws[lo] + (h - lo) * (draws[hi] - draws[lo]);
+  };
+  return {
+    method: "stationary bootstrap, percentile",
+    reps, block: b, seed,
+    intervals: Object.fromEntries(levels.map((l) => [String(l), [at((1 - l) / 2), at(1 - (1 - l) / 2)]])),
+    share_at_or_below_zero: atOrBelowZero / reps,
+  };
+}
+
+// Eigenvalues of a symmetric matrix (cyclic Jacobi), for the effective number of trials.
+function symmetricEigenvalues(a, k) {
+  const m = Float64Array.from(a);
+  for (let sweep = 0; sweep < 100; sweep++) {
+    let off = 0;
+    for (let i = 0; i < k; i++) for (let j = i + 1; j < k; j++) off += m[i * k + j] ** 2;
+    if (off < 1e-24) break;
+    for (let p = 0; p < k; p++) {
+      for (let q = p + 1; q < k; q++) {
+        const apq = m[p * k + q];
+        if (Math.abs(apq) < 1e-300) continue;
+        const theta = (m[q * k + q] - m[p * k + p]) / (2 * apq);
+        const t = Math.sign(theta || 1) / (Math.abs(theta) + Math.sqrt(theta * theta + 1));
+        const c = 1 / Math.sqrt(t * t + 1);
+        const s = t * c;
+        for (let r = 0; r < k; r++) {
+          const arp = m[r * k + p], arq = m[r * k + q];
+          m[r * k + p] = c * arp - s * arq;
+          m[r * k + q] = s * arp + c * arq;
+        }
+        for (let r = 0; r < k; r++) {
+          const apr = m[p * k + r], aqr = m[q * k + r];
+          m[p * k + r] = c * apr - s * aqr;
+          m[q * k + r] = s * apr + c * aqr;
+        }
+      }
+    }
+  }
+  return Array.from({ length: k }, (_, i) => m[i * k + i]);
+}
+
+/**
+ * What a search's variants say about it. `matrix[t][j]` is variant j's return in period t (the shape
+ * validate_overfitting takes). Constant variants are counted but left out of the correlations.
+ */
+export function searchFromVariants(matrix, periodsPerYear) {
+  const periods = matrix.length;
+  const k = matrix[0].length;
+  const root = Math.sqrt(Number(periodsPerYear));
+  const means = new Float64Array(k);
+  for (let t = 0; t < periods; t++) for (let j = 0; j < k; j++) means[j] += Number(matrix[t][j]);
+  for (let j = 0; j < k; j++) means[j] /= periods;
+  const sds = new Float64Array(k);
+  for (let t = 0; t < periods; t++) for (let j = 0; j < k; j++) sds[j] += (Number(matrix[t][j]) - means[j]) ** 2;
+  for (let j = 0; j < k; j++) sds[j] = Math.sqrt(sds[j] / (periods - 1));
+  const live = [];
+  for (let j = 0; j < k; j++) if (sds[j] > 0) live.push(j);
+  const sharpes = live.map((j) => (means[j] / sds[j]) * root);
+  const sharpeMean = sharpes.reduce((a, b) => a + b, 0) / sharpes.length;
+  const sharpeSd = sharpes.length > 1 ? Math.sqrt(sharpes.reduce((a, b) => a + (b - sharpeMean) ** 2, 0) / (sharpes.length - 1)) : 0;
+  const L = live.length;
+  const corr = new Float64Array(L * L);
+  const pair = [];
+  for (let a = 0; a < L; a++) {
+    corr[a * L + a] = 1;
+    for (let b = a + 1; b < L; b++) {
+      const ja = live[a], jb = live[b];
+      let c = 0;
+      for (let t = 0; t < periods; t++) c += (Number(matrix[t][ja]) - means[ja]) * (Number(matrix[t][jb]) - means[jb]);
+      const r = c / ((periods - 1) * sds[ja] * sds[jb]);
+      corr[a * L + b] = corr[b * L + a] = r;
+      pair.push(r);
+    }
+  }
+  const pairMean = pair.length ? pair.reduce((a, b) => a + b, 0) / pair.length : 0;
+  const pairSd = pair.length > 1 ? Math.sqrt(pair.reduce((a, b) => a + (b - pairMean) ** 2, 0) / (pair.length - 1)) : 0;
+  let nyholt = L, liJi = L;
+  if (L > 1) {
+    const lambdas = symmetricEigenvalues(corr, L);
+    const lm = lambdas.reduce((a, b) => a + b, 0) / L;
+    const lv = lambdas.reduce((a, b) => a + (b - lm) ** 2, 0) / (L - 1);
+    nyholt = 1 + (L - 1) * (1 - lv / L);
+    liJi = lambdas.reduce((a, l) => { const x = Math.abs(l); return a + (x >= 1 ? 1 : 0) + (x - Math.floor(x)); }, 0);
+  }
+  let best = 0;
+  for (let i = 1; i < sharpes.length; i++) if (sharpes[i] > sharpes[best]) best = i;
+  return {
+    variants: k,
+    periods,
+    constant_variants: k - L,
+    best_variant: live.length ? live[best] : null,
+    best_sharpe_annualized: live.length ? sharpes[best] : null,
+    cross_trial_sharpe_sd_annualized: sharpeSd,
+    mean_pairwise_correlation: pairMean,
+    sd_pairwise_correlation: pairSd,
+    // Rounded up with a tolerance (a sum of eigenvalues equal to 12 can arrive as 12.000000000000014),
+    // never more than the variants that vary, and at least 2, the smallest count the DSR accepts.
+    effective_trials: { nyholt, li_ji: liJi, used: Math.max(2, Math.min(L, Math.ceil(liJi - 1e-9))), method: "Li and Ji (2005), rounded up, at most the variants sent, at least 2" },
+  };
+}
+
+/**
+ * The Null Zoo family whose measured size an audit quotes for this shape. The rules and their order
+ * are the ones pre-registered in config/research/null-zoo-v1-prereg.json; a test keeps them equal.
+ */
+export function nullZooFamily(shape, search = null) {
+  if (search && search.mean_pairwise_correlation >= 0.3) return search.sd_pairwise_correlation >= 0.15 ? "block_cluster" : "correlated_trials";
+  if (Math.abs(shape.lag1_autocorrelation) >= 0.1) return "ar1";
+  if (shape.skew <= -0.5) return "skew_negative";
+  if (shape.skew >= 0.5) return "skew_positive";
+  if (shape.excess_kurtosis >= 2 && shape.lag1_autocorrelation_of_squares >= 0.1) return "garch";
+  if (shape.excess_kurtosis >= 2) return "student_t4";
+  if (shape.lag1_autocorrelation_of_squares >= 0.1) return "regimes";
+  return "iid_normal";
+}
+
+/** The t-statistic of a series' mean with a Newey-West (Bartlett, lag floor(4 (T/100)^(2/9))) variance. */
+export function neweyWestT(xs) {
+  const n = xs.length;
+  const m = mean(xs);
+  const lag = Math.floor(4 * Math.pow(n / 100, 2 / 9));
+  let lrv = 0;
+  for (let i = 0; i < n; i++) { const d = xs[i] - m; lrv += d * d; }
+  for (let l = 1; l <= lag; l++) {
+    let g = 0;
+    for (let i = l; i < n; i++) g += (xs[i] - m) * (xs[i - l] - m);
+    lrv += 2 * (1 - l / (lag + 1)) * g;
+  }
+  lrv /= n;
+  return lrv > 0 ? m / Math.sqrt(lrv / n) : 0;
+}
+
+/** One-sided p-value of "the mean is above zero" from a stationary-bootstrap t (see the header). */
+export function blockBootstrapT(xs, { reps, block = defaultBlock(xs.length), seed }) {
+  const n = xs.length;
+  let sum = 0, sq = 0;
+  for (let i = 0; i < n; i++) { sum += xs[i]; sq += xs[i] * xs[i]; }
+  const m0 = sum / n;
+  const sd = Math.sqrt(Math.max((sq - n * m0 * m0) / (n - 1), 0));
+  if (!(sd > 0)) return 1;
+  const observed = m0 / (sd / Math.sqrt(n));
+  const next = makeRandom(seed);
+  const idx = new Int32Array(n);
+  let hits = 0;
+  for (let b = 0; b < reps; b++) {
+    stationaryIndices(n, block, next, idx);
+    let s = 0, q = 0;
+    for (let i = 0; i < n; i++) { const v = xs[idx[i]]; s += v; q += v * v; }
+    const m = s / n;
+    const v = (q - n * m * m) / (n - 1);
+    if (!(v > 0)) { hits++; continue; }
+    if ((m - m0) / Math.sqrt(v / n) >= observed) hits++;
+  }
+  return (hits + 1) / (reps + 1);
+}
+
+const quantileSorted = (sorted, q) => {
+  const h = (sorted.length - 1) * q;
+  const lo = Math.floor(h);
+  const hi = Math.min(lo + 1, sorted.length - 1);
+  return sorted[lo] + (h - lo) * (sorted[hi] - sorted[lo]);
+};
+
+/**
+ * Out-of-sample decay from CSCV's in-sample-best pairs ([in-sample Sharpe, out-of-sample Sharpe],
+ * per period, as js/pbo-core.js returns them): the distribution of the selected variant's
+ * out-of-sample Sharpe, and the least-squares line of out-of-sample on in-sample. With
+ * periodsPerYear 1 the Sharpe ratios stay per period, as validate_overfitting reports them.
+ */
+export function oosDecay(isOosPairs, periodsPerYear = 1) {
+  const root = Math.sqrt(Number(periodsPerYear));
+  const pairs = isOosPairs.map(([a, b]) => [a * root, b * root]);
+  const oos = pairs.map((p) => p[1]).sort((a, b) => a - b);
+  const n = pairs.length;
+  const mx = pairs.reduce((a, p) => a + p[0], 0) / n;
+  const my = pairs.reduce((a, p) => a + p[1], 0) / n;
+  let sxy = 0, sxx = 0, syy = 0;
+  for (const [x, y] of pairs) { sxy += (x - mx) * (y - my); sxx += (x - mx) ** 2; syy += (y - my) ** 2; }
+  const slope = sxx > 0 ? sxy / sxx : 0;
+  return {
+    splits: n,
+    unit: Number(periodsPerYear) === 1 ? "per period" : "annualized",
+    oos_sharpe: {
+      median: quantileSorted(oos, 0.5), p10: quantileSorted(oos, 0.1), p90: quantileSorted(oos, 0.9),
+      prob_below_zero: oos.filter((v) => v < 0).length / n,
+    },
+    degradation: { slope, intercept: my - slope * mx, r2: sxx > 0 && syy > 0 ? (sxy * sxy) / (sxx * syy) : 0 },
+  };
+}
+
+/** A per-period oosDecay result in annualized Sharpe units; the slope, r2 and shares do not change. */
+export function annualizeDecay(decay, periodsPerYear) {
+  const root = Math.sqrt(Number(periodsPerYear));
+  const o = decay.oos_sharpe;
+  return {
+    ...decay,
+    unit: "annualized",
+    oos_sharpe: { median: o.median * root, p10: o.p10 * root, p90: o.p90 * root, prob_below_zero: o.prob_below_zero },
+    degradation: { ...decay.degradation, intercept: decay.degradation.intercept * root },
+  };
+}
+
+// The ids are stable: an agent can act on them, and a changelog can name them.
+export const FIX_IDS = Object.freeze([
+  "count_every_variant", "declared_trials_below_counted", "not_distinguishable_from_luck", "interval_includes_zero",
+  "autocorrelated_returns", "track_record_too_short", "overfit_selection", "expected_live_sharpe_below_zero",
+  "stress_and_capacity_next",
+]);
+
+/**
+ * At most five next steps, most decisive first. `context` carries what the audit found; each step
+ * is {id, why, next}: the finding with its numbers, and the change or call to make next.
+ */
+export function fixNext(context) {
+  const steps = [];
+  const add = (id, why, next) => steps.push({ id, why, next });
+  const { headline, shape, interval, search, declaredTrials, trackRecord, overfitting, decay } = context;
+  const f2 = (x) => x.toFixed(2);
+  if (headline && headline.p > headline.level) {
+    add("not_distinguishable_from_luck", `p ${headline.p.toFixed(3)} > ${headline.level}.`, search ? "Pre-declare a smaller grid (backtest_strategy), then audit again." : "Try fewer variants or add out-of-sample data.");
+  }
+  if (search && declaredTrials !== undefined && declaredTrials < search.effective_trials.used) {
+    add("declared_trials_below_counted", `Declared ${declaredTrials} trials; the variants count as ${search.effective_trials.used}.`, "Already applied: the counted number was used.");
+  }
+  if (!search) add("count_every_variant", "Only declared trials counted.", "Send every variant's returns (variants_file).");
+  if (Math.abs(shape.lag1_autocorrelation) >= 0.1) {
+    add("autocorrelated_returns", `Lag-1 autocorrelation ${f2(shape.lag1_autocorrelation)}; Lo-adjusted Sharpe ${f2(shape.lo_adjusted_sharpe_annualized)}.`,
+      "Check for stale or smoothed prices (summarize_series); quote the adjusted Sharpe.");
+  }
+  if (interval && interval.intervals["0.95"][0] <= 0) {
+    add("interval_includes_zero", `95% Sharpe interval ${f2(interval.intervals["0.95"][0])} to ${f2(interval.intervals["0.95"][1])}.`, "Needs a longer history (validate_backtest_length).");
+  }
+  if (overfitting && overfitting.pbo >= 0.5) add("overfit_selection", `Overfitting probability ${f2(overfitting.pbo)}.`, "Shrink the grid or fix the selection rule in advance.");
+  if (decay && decay.oos_sharpe.median <= 0) add("expected_live_sharpe_below_zero", `Median out-of-sample Sharpe of the pick ${f2(decay.oos_sharpe.median)}.`, "Expect no live edge from this selection.");
+  if (trackRecord && trackRecord.short) add("track_record_too_short", trackRecord.finding, "Keep it running before scaling (validate_track_record).");
+  // Nothing to fix and luck rejected: the next hurdles are bad markets and a real broker.
+  if (!steps.length && headline && headline.p <= headline.level) add("stress_and_capacity_next", `p ${headline.p.toFixed(3)} <= ${headline.level}.`, "Run stress_test and check_feasibility before trading it.");
+  return steps.slice(0, 5);
+}

package/src/local/js/null-zoo-v1-sizes.js

@@ -0,0 +1,40 @@
+// Generated by scripts/research/null-zoo/v1/evaluate.mjs from the Null Zoo v1 run. Do not edit.
+// The measured false-positive rate (size) of audit_backtest's headline tests on each return family.
+export const NULL_ZOO_V1 = Object.freeze({
+  "source": "https://github.com/arhancanli/canlicapital/blob/main/config/research/null-zoo-v1b-evaluation.json (10,000 searches per cell; bar pre-registered in config/research/null-zoo-v1b-prereg.json)",
+  "level": 0.05,
+  "with_variants": {
+    "test": "reality_check",
+    "size_by_family": {
+      "iid_normal": 0.0538,
+      "student_t4": 0.0494,
+      "skew_negative": 0.0535,
+      "skew_positive": 0.0521,
+      "garch": 0.0446,
+      "ar1": 0.0637,
+      "regimes": 0.0507,
+      "correlated_trials": 0.0553,
+      "block_cluster": 0.0565
+    },
+    "worst": "ar1",
+    "meets_every_bar": false,
+    "power_iid_skill_2": 0.5346
+  },
+  "single_series": {
+    "test": "luck_trials_lo",
+    "size_by_family": {
+      "iid_normal": 0.0551,
+      "student_t4": 0.0561,
+      "skew_negative": 0.0877,
+      "skew_positive": 0.0317,
+      "garch": 0.0487,
+      "ar1": 0.0549,
+      "regimes": 0.0551,
+      "correlated_trials": 0.0358,
+      "block_cluster": 0.0356
+    },
+    "worst": "skew_negative",
+    "meets_every_bar": false,
+    "power_iid_skill_2": 0.5276
+  }
+});

package/src/local/js/validate/overfitting.js

@@ -3,6 +3,7 @@
 // MCP package's local mode (mcp/src/local mirrors it byte for byte), so the two cannot disagree.
 import { finiteNumbers } from "../moments-core.js";
 import { pboCscv } from "../pbo-core.js";
+import { oosDecay } from "../audit-core.js";
 import { LIMITS } from "../../api/_lib/limits.js";
 
 const mean = (xs) => xs.reduce((a, b) => a + (Number.isFinite(b) ? b : 0), 0) / xs.length;
@@ -30,6 +31,8 @@ export function compute(body) {
     block_length: out.block_length,
     lambda_quantiles: { p05: q(0.05), p25: q(0.25), p50: q(0.5), p75: q(0.75), p95: q(0.95) },
     is_oos_summary: { mean_is_sharpe_of_selected: mean(out.is_oos_pairs.map((p) => p[0])), mean_oos_sharpe_of_selected: mean(out.is_oos_pairs.map((p) => p[1])), share_oos_below_is: degraded },
+    // What the in-sample best did out of sample across the splits, per period like is_oos_summary.
+    oos_decay: oosDecay(out.is_oos_pairs),
     plain_reading: `In ${(out.pbo * 100).toFixed(1)} percent of the ${out.n_combinations} in-sample and out-of-sample splits, the variant that looked best in sample ranked in the worse half out of sample. That share is the probability of backtest overfitting for this set of variants as submitted.`,
   };
 }

package/src/schemas.mjs

@@ -40,7 +40,7 @@ export const FIELD_DESCRIPTIONS = Object.freeze({
   record_observations: "Record length so far, for its probabilistic Sharpe.",
   label: "Name for the key.",
   receipt_id: "Receipt id from a validation result.",
-  receipt_object: "A receipt as get_receipt returns it, to verify without fetching.",
+  receipt_object: "A receipt object, to verify without fetching.",
   cik: "SEC CIK; send cik or ticker.",
   ticker: "Ticker such as AAPL; send ticker or cik.",
   concept: "us-gaap concept such as Assets; omit to list them.",
@@ -238,8 +238,8 @@ export const auditBacktestToolShape = z
     returns_file: z.string().min(1).max(4096).optional().describe(d.returns_file),
     returns_column: z.union([z.string().min(1).max(200), z.number().int().min(1)]).optional().describe(d.returns_column),
     periods_per_year: z.number().min(1).max(10000).describe(d.periods_per_year),
-    effective_independent_trials: z.number().int().min(2).max(10000000).describe(d.effective_independent_trials),
-    cross_trial_sharpe_sd_annualized: z.number().min(0).max(10).describe(d.cross_trial_sharpe_sd_annualized),
+    effective_independent_trials: z.number().int().min(2).max(10000000).optional().describe(`${d.effective_independent_trials} Optional with variants: counted from them, and the larger number is used.`),
+    cross_trial_sharpe_sd_annualized: z.number().min(0).max(10).optional().describe(`${d.cross_trial_sharpe_sd_annualized} Optional with variants: measured from them, and the larger is used.`),
     benchmark_sharpe_annualized: z.number().min(-10).max(10).optional().describe(d.benchmark_sharpe_annualized),
     confidence: z.number().gt(0).lt(1).optional().describe(d.confidence),
     variants: z.array(z.array(z.number()).max(200)).min(2).max(20000).optional().describe(d.variants),
@@ -253,7 +253,9 @@ export const auditBacktestToolShape = z
 export const auditBacktestInput = auditBacktestToolShape
   .refine((v) => (v.returns === undefined) !== (v.returns_file === undefined), "Send exactly one of returns or returns_file")
   .refine((v) => v.variants === undefined || v.variants_file === undefined, "Send variants or variants_file, not both")
-  .refine((v) => v.returns_column === undefined || v.returns_file !== undefined, "returns_column applies only to returns_file");
+  .refine((v) => v.returns_column === undefined || v.returns_file !== undefined, "returns_column applies only to returns_file")
+  .refine((v) => v.variants !== undefined || v.variants_file !== undefined || (v.effective_independent_trials !== undefined && v.cross_trial_sharpe_sd_annualized !== undefined),
+    "Send variants or variants_file, or declare effective_independent_trials and cross_trial_sharpe_sd_annualized");
 
 // ---------------------------------------------------------------------------------------------
 // get_key / get_receipt
@@ -273,12 +275,13 @@ export const getReceiptInput = z
 
 export const emptyInput = z.object({}).strict();
 
-// verify_receipt: a receipt id to fetch, or a receipt already fetched (get_receipt's data), to check
+// verify_receipt: a receipt id to fetch, or a receipt already fetched, to check
 // offline. Advertised flat; the handler enforces exactly one.
 export const verifyReceiptToolShape = z
   .object({
     id: z.string().regex(/^[0-9a-f]{24}$/, "A receipt id is 24 hex characters").optional().describe(d.receipt_id),
     receipt: z.record(z.string(), z.unknown()).optional().describe(d.receipt_object),
+    include_receipt: z.boolean().optional().describe("With id: also return the stored receipt."),
   })
   .strict();
 
@@ -334,7 +337,7 @@ export const REGISTRY_DESCRIPTION_MAX = 100;
 export const TOOL_DESCRIPTIONS = Object.freeze({
   get_key: `Issue a free validation key for this session. Rarely needed: the first validation issues one itself unless CANLI_KEY or local mode is set, and the read tools need none. ${LIMITS_SENTENCES.quotas}`,
   validate_deflated_sharpe: `Deflated Sharpe ratio: the probability (0 to 1) that the selected strategy's Sharpe beats the best that luck gives across the variants tried, with the probabilistic Sharpe and that luck benchmark. Send the seven statistics or a return series. With every variant's returns use validate_overfitting; luck as a trial count, validate_luck_trials; a multiple-testing haircut, validate_haircut_sharpe. ${LIMITS_SENTENCES.notAdmission}`,
-  audit_backtest: `One-call audit of a strategy's returns: deflated Sharpe, minimum track record and, with every variant's returns, the probability of backtest overfitting, each the matching validator's result with its own receipt. Point returns_file at the backtest's CSV or JSON instead of pasting long series. Prefer it to calling the validators one by one; one validation per check. ${LIMITS_SENTENCES.notAdmission}`,
+  audit_backtest: `One-call audit of a strategy's returns. Headline: one test whose false-positive rate was measured on nine return shapes (Hansen's SPA with variants). Then deflated Sharpe, minimum track record and, with variants, overfitting and out-of-sample decay, each with its receipt, plus fix_next. Send every variant tried (variants_file) so trials are counted; point returns_file at a CSV instead of pasting. ${LIMITS_SENTENCES.notAdmission}`,
   validate_overfitting: `Probability of backtest overfitting (0 to 1) by CSCV: how often the in-sample best variant falls below the out-of-sample median. Needs every variant's returns (periods by variants); with summary statistics only, use validate_deflated_sharpe. ${LIMITS_SENTENCES.notAdmission}`,
   validate_reality_check: `Data-snooping tests on every variant a search tried: Hansen's SPA p-value that the best beat the benchmark only by luck, White's Reality Check, and the variants Romano-Wolf StepM finds better. Send all variants tried, not only the winners. ${LIMITS_SENTENCES.notAdmission}`,
   validate_paper_evidence: `Checks paper-evidence.v0 structure and disclosures. With CANLI_LOCAL=1, record_file reads an export bundle and journal_file verifies signatures, source hashes and recomputed claims. Without a journal, source facts and signatures are unchecked. Local files are never uploaded. ${LIMITS_SENTENCES.scope}`,
@@ -344,7 +347,6 @@ export const TOOL_DESCRIPTIONS = Object.freeze({
   validate_track_record: `Minimum track record length (observations and years) for an observed Sharpe to beat a benchmark at a confidence level; with observations, the record's probabilistic Sharpe so far. For live or paper records; to size a backtest for its trials, use validate_backtest_length. ${LIMITS_SENTENCES.notAdmission}`,
   validate_breadth: `Book Sharpe ceiling from adding sleeves of this quality and correlation, the Sharpe at a sleeve count, and the sleeves a target needs. For portfolio construction; it validates no single strategy. ${LIMITS_SENTENCES.scope}`,
   verify_receipt: `Verify a receipt offline: its Ed25519 signature against the bundled canlicapital.com key, its output hash and its id. Send an id to fetch it first, or the receipt itself. ${LIMITS_SENTENCES.unsigned}`,
-  get_receipt: `Fetch a stored verdict by receipt id to re-read it. No key; verify_receipt checks it is genuine. ${LIMITS_SENTENCES.unsigned}`,
   service_status: `Whether the validation API is up, with its quotas; check after a timeout before resubmitting. No key. ${LIMITS_SENTENCES.scope}`,
   company_financial_history: `SEC-reported financial history for one company in the canlicapital.com reference, by cik or ticker: without a concept, the histories available; with one, observations newest first with accession, form, filed date and unit, plus the source's SHA-256. For point-in-time values use canli-fundamentals-mcp. ${COMPANY_REFERENCE_BOUNDARY}`,
 });

package/src/server.mjs

@@ -15,6 +15,12 @@ import { validateLocalJournalEvidence } from "./journal-evidence.mjs";
 import { readMatrixFile, readSeriesFile } from "./series-file.mjs";
 import { LAB_TOOLS, labToolSpecs, registerCodeResources, registerLabPrompts } from "./lab.mjs";
 import { verifyReceipt } from "./local/js/receipt-statement.js";
+import { annualizeDecay, blockBootstrapT, fixNext, neweyWestT, nullZooFamily, returnShape, searchFromVariants, sharpeInterval } from "./local/js/audit-core.js";
+import { NULL_ZOO_V1 } from "./local/js/null-zoo-v1-sizes.js";
+import { haircutSharpe } from "./local/js/haircut-core.js";
+import { bestOfTrialsProbability } from "./local/js/luck-core.js";
+import { minimumBacktestLength } from "./local/js/dsr-core.js";
+import { studentTUpper } from "./local/js/student-t.js";
 import { StdioServerTransport } from "@modelcontextprotocol/server/stdio";
 import { breadthInput, trackRecordInput, auditBacktestInput, verifyReceiptToolShape, backtestLengthInput, haircutSharpeInput, luckTrialsInput, auditBacktestToolShape, companyHistoryInput, companyHistoryToolShape, deflatedSharpeInput, deflatedSharpeToolShape, emptyInput, getKeyInput, getReceiptInput, overfittingInput, realityCheckInput, realityCheckToolShape, LIMITS_SENTENCES, paperEvidenceInput, paperEvidenceToolShape, TOOL_DESCRIPTIONS, validationOutput, auditOutput, keyOutput, receiptOutput, verifyReceiptOutput, statusOutput, companyHistoryOutput } from "./schemas.mjs";
 
@@ -66,21 +72,24 @@ export function configuredLocal(value) {
 
 // Toolsets: which tools the server lists. The tool list is re-sent to the model on every turn and
 // is most of each turn's prompt (README, "Toolsets"; bench/tool_list_tokens.py measures it), so a
-// client that needs one kind of tool can load only that kind. Default: all.
+// client that needs one kind of tool can load only that kind. Default: every toolset except
+// company, whose one tool canli-fundamentals-mcp does better and point in time; "all" adds it.
 export const TOOLSETS = Object.freeze({
   validate: Object.freeze(["get_key", "validate_deflated_sharpe", "validate_overfitting", "validate_paper_evidence", "validate_breadth", "validate_track_record", "validate_backtest_length", "validate_haircut_sharpe", "validate_luck_trials", "validate_reality_check", "audit_backtest"]),
-  receipts: Object.freeze(["get_receipt", "verify_receipt"]),
+  receipts: Object.freeze(["verify_receipt"]),
   company: Object.freeze(["company_financial_history"]),
   status: Object.freeze(["service_status"]),
   lab: Object.freeze([...LAB_TOOLS]),
 });
 
 // CANLI_TOOLSETS=validate,company (or ?toolsets= on the hosted endpoint): a comma-separated list of
-// TOOLSETS names, or "all". Empty or unsubstituted means all; an unknown name is refused, so a typo
-// never silently leaves a client without the tools it asked for.
+// TOOLSETS names, or "all". Empty or unsubstituted means the default; an unknown name is refused, so
+// a typo never silently leaves a client without the tools it asked for.
+export const DEFAULT_TOOLSETS = Object.freeze(Object.keys(TOOLSETS).filter((name) => name !== "company"));
 export function configuredToolsets(value) {
   const v = configuredKey(value);
-  if (!v || v.trim().toLowerCase() === "all") return Object.keys(TOOLSETS);
+  if (!v) return [...DEFAULT_TOOLSETS];
+  if (v.trim().toLowerCase() === "all") return Object.keys(TOOLSETS);
   const names = [...new Set(v.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean))];
   const unknown = names.filter((n) => !Object.hasOwn(TOOLSETS, n));
   if (unknown.length || !names.length) throw new Error(`Unknown toolset ${unknown.join(", ") || "(none)"}; choose from ${Object.keys(TOOLSETS).join(", ")} or all`);
@@ -169,7 +178,7 @@ const asText = (envelope, failed = false) => ({
 // A validation result as the model reads it: the answer, the sentences saying what it does not
 // establish, and the receipt that holds the rest. Metadata (schema, endpoint, timestamps, claim and
 // capital class, human page), the source hashes and the quota sentence are about the service, not
-// the answer; they stay in the stored receipt (get_receipt) and service_status, and
+// the answer; they stay in the stored receipt (verify_receipt with include_receipt) and service_status, and
 // CANLI_FULL_ENVELOPE=1 returns every field. On a result this cuts the text roughly in half.
 const QUOTA_SENTENCE = /^Quotas:/;
 
@@ -329,11 +338,58 @@ async function runValidator(session, tool, path, body) {
 
 const sameJson = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 
-// audit_backtest: deflated Sharpe from the series, then the minimum track record length from the
-// Sharpe, skew and kurtosis that check derived, then (with variants) CSCV overfitting. Each check
-// keeps its envelope and receipt; the limits every envelope repeats are stated once at the top.
-// A refused later check (for example a Sharpe that does not exceed the benchmark) is reported as
-// that check's error, not as a failed audit; the audit fails only when the first check does.
+// audit_backtest: one calibrated test first, then the checks behind it.
+//   headline  with every variant's returns, Hansen's SPA (validate_reality_check, with its receipt);
+//             with one series, the single-series test Null Zoo v1 chose. Either way the result quotes
+//             that test's measured false-positive rate on returns shaped like these
+//             (local/js/null-zoo-v1-sizes.js) and the worst across the nine families.
+//   checks    the deflated Sharpe (an estimate), the minimum track record and, with variants, CSCV
+//             overfitting with out-of-sample decay: each the validator's own result and receipt.
+//   computed  in this process from the series sent: its shape, Lo's adjusted Sharpe, a bootstrap
+//             interval for the Sharpe, the haircut Sharpe, the minimum backtest length, and what the
+//             variants say about the search. Trials and their spread are the larger of declared and
+//             counted, so a search cannot be made to look smaller than it was.
+// A refused later check is reported as that check's error, not as a failed audit; the audit fails
+// only when the first check does.
+export const AUDIT_SPA_REPS = 2000;
+
+function singleSeriesHeadline(test, returns, trials) {
+  const xs = Float64Array.from(returns, Number);
+  if (test === "hac_t_sidak") return { p: bestOfTrialsProbability(studentTUpper(neweyWestT(xs), xs.length - 1), trials) };
+  if (test === "bootstrap_t_sidak") {
+    // Enough resamples that the smallest attainable p-value sits well inside the Sidak level for
+    // this many trials, up to a cap; beyond it the floor is stated.
+    const perTest = -Math.expm1(Math.log1p(-0.05) / trials);
+    const reps = Math.min(200000, Math.max(4999, Math.ceil(5 / perTest)));
+    const p = bestOfTrialsProbability(blockBootstrapT(xs, { reps, seed: 42 }), trials);
+    const floor = bestOfTrialsProbability(1 / (reps + 1), trials);
+    return { p, reps, ...(floor > 0.01 ? { resolution_floor: floor } : {}) };
+  }
+  if (test === "luck_trials_lo") return null; // run through validate_luck_trials below, for its receipt
+  throw new Error(`audit_backtest: no single-series headline test named ${test}`);
+}
+
+function headlineResult({ path, test, p, shape, search, receipt, extra, full }) {
+  const sizes = NULL_ZOO_V1[path];
+  const family = nullZooFamily(shape, search);
+  const size = sizes.size_by_family[family];
+  const worstSize = sizes.size_by_family[sizes.worst];
+  const pct = (x) => `${(x * 100).toFixed(1)}%`;
+  const rejects = p <= NULL_ZOO_V1.level;
+  return {
+    test,
+    p,
+    rejects_luck: rejects,
+    measured_size: { family, here: size, worst: worstSize, ...(full ? { worst_family: sizes.worst, source: NULL_ZOO_V1.source } : {}) },
+    sentence: `${rejects ? "Rejects" : "Cannot reject"} luck at ${pct(NULL_ZOO_V1.level)} (p ${p.toFixed(3)}); measured false-positive rate ${pct(size)} on ${family}-like returns, ${pct(worstSize)} worst.`,
+    ...(receipt ? { receipt } : {}),
+    ...(full ? { level: NULL_ZOO_V1.level, ...(extra ?? {}) } : {}),
+  };
+}
+
+const round = (x, digits = 4) => (Number.isFinite(x) ? Number(x.toPrecision(digits)) : x);
+const roundAll = (o, digits = 4) => (typeof o === "number" ? round(o, digits) : Array.isArray(o) ? o.map((v) => roundAll(v, digits)) : o && typeof o === "object" ? Object.fromEntries(Object.entries(o).map(([k, v]) => [k, roundAll(v, digits)])) : o);
+
 export async function toolAuditBacktest(session, args) {
   const input = parseOrThrow(auditBacktestInput, args, "audit_backtest");
   if ((input.returns_file || input.variants_file) && session.hosted) {
@@ -343,9 +399,16 @@ export async function toolAuditBacktest(session, args) {
   const variantsRead = input.variants_file ? readMatrixFile(input.variants_file) : null;
   const returns = input.returns ?? returnsRead.values;
   const variants = input.variants ?? variantsRead?.matrix;
-  const { periods_per_year, effective_independent_trials, cross_trial_sharpe_sd_annualized } = input;
+  const { periods_per_year } = input;
+
+  const shape = returnShape(returns, periods_per_year);
+  const search = variants ? searchFromVariants(variants, periods_per_year) : null;
+  const declaredTrials = input.effective_independent_trials;
+  const trials = Math.max(declaredTrials ?? 0, search?.effective_trials.used ?? 0);
+  const crossSd = Math.max(input.cross_trial_sharpe_sd_annualized ?? 0, search?.cross_trial_sharpe_sd_annualized ?? 0);
+
   const dsr = await runValidator(session, "validate_deflated_sharpe", "/api/v1/validate/deflated-sharpe", {
-    returns, periods_per_year, effective_independent_trials, cross_trial_sharpe_sd_annualized,
+    returns, periods_per_year, effective_independent_trials: trials, cross_trial_sharpe_sd_annualized: crossSd,
   });
   if (dsr.failed) return validationText(session, { envelope: dsr.envelope, failed: true });
   const derived = dsr.envelope?.data?.derived_inputs ?? {};
@@ -365,20 +428,102 @@ export async function toolAuditBacktest(session, args) {
         ...(input.n_splits !== undefined ? { n_splits: input.n_splits } : {}),
       })
     : null;
-  const shape = (e) => (session.fullEnvelope ? e : compactEnvelope(e));
-  const envelopes = { deflated_sharpe: shape(dsr.envelope), track_record: shape(track.envelope), ...(overfit ? { overfitting: shape(overfit.envelope) } : {}) };
+
+  // The headline test.
+  let headline;
+  if (variants) {
+    // One stationary bootstrap gives the Reality Check and the three SPA p-values; the headline is
+    // whichever of them Null Zoo selected, and the result names it.
+    const test = NULL_ZOO_V1.with_variants.test;
+    // A later check that cannot run is that check's error, not a failed audit.
+    const rc = await runValidator(session, "validate_reality_check", "/api/v1/validate/reality-check", { matrix: variants, reps: AUDIT_SPA_REPS, seed: 42 })
+      .catch((e) => ({ failed: true, envelope: { error: { code: "unreachable", message: e.message } } }));
+    const data = rc.envelope?.data;
+    const p = { reality_check: data?.reality_check?.p_value, spa_consistent: data?.spa?.p_value, spa_upper: data?.spa?.p_value_upper }[test];
+    headline = rc.failed || typeof p !== "number"
+      ? { test, error: rc.envelope?.error?.message ?? "the data-snooping check returned no p-value" }
+      : headlineResult({ path: "with_variants", test, p, shape, search, receipt: compactEnvelope(rc.envelope).receipt ?? null, extra: { spa_consistent: data.spa?.p_value, reality_check: data.reality_check?.p_value, monte_carlo_se: Math.sqrt((p * (1 - p)) / AUDIT_SPA_REPS) }, full: session.fullEnvelope });
+  } else {
+    const test = NULL_ZOO_V1.single_series.test;
+    const local = singleSeriesHeadline(test, returns, trials);
+    if (local) {
+      headline = headlineResult({ path: "single_series", test, p: local.p, shape, search, extra: { trials, computed: "in this process", ...(local.reps ? { reps: local.reps } : {}) }, full: session.fullEnvelope });
+      if (local.resolution_floor) headline.resolution_floor = local.resolution_floor;
+    } else {
+      const luck = await runValidator(session, "validate_luck_trials", "/api/v1/validate/luck-trials", {
+        observed_sharpe_annualized: shape.sharpe_annualized, observations: shape.observations, periods_per_year, effective_independent_trials: trials, autocorrelation: Math.max(-0.95, Math.min(0.95, shape.lag1_autocorrelation)),
+      }).catch((e) => ({ failed: true, envelope: { error: { code: "unreachable", message: e.message } } }));
+      const p = luck.envelope?.data?.result?.best_of_trials_probability;
+      headline = luck.failed || typeof p !== "number"
+        ? { test, error: luck.envelope?.error?.message ?? "the luck-trials check returned no probability" }
+        : headlineResult({ path: "single_series", test, p, shape, search, receipt: compactEnvelope(luck.envelope).receipt ?? null, extra: { trials }, full: session.fullEnvelope });
+    }
+  }
+
+  const interval = sharpeInterval(returns, { periodsPerYear: periods_per_year });
+  const haircut = shape.sharpe_annualized > 0
+    ? haircutSharpe({ sharpeAnnualized: shape.sharpe_annualized, periodsPerYear: periods_per_year, observations: shape.observations, tests: trials, autocorrelation: Math.max(-0.95, Math.min(0.95, shape.lag1_autocorrelation)) })
+    : null;
+  const years = shape.observations / periods_per_year;
+  const minBtl = shape.sharpe_annualized > 0 ? minimumBacktestLength({ trials, targetSharpe: shape.sharpe_annualized }) : null;
+  const decayPerPeriod = overfit && !overfit.failed ? overfit.envelope?.data?.oos_decay : null;
+  const decay = decayPerPeriod ? annualizeDecay(decayPerPeriod, periods_per_year) : null;
+  const trackResult = track.failed ? null : track.envelope?.data?.result;
+  const fix = fixNext({
+    headline: headline.error ? null : { ...headline, level: NULL_ZOO_V1.level },
+    shape, interval, search, declaredTrials,
+    overfitting: overfit && !overfit.failed ? { pbo: overfit.envelope?.data?.pbo } : null,
+    decay,
+    trackRecord: trackResult?.record && !trackResult.record.long_enough
+      ? { short: true, finding: `The minimum track record for this Sharpe is ${trackResult.minimum_observations} periods; the series has ${trackResult.record.observations}.` }
+      : null,
+  });
+
+  // Compact: each check's plain reading is stated once, in readings, not again inside the check.
+  const dropReading = (e) => (e?.data && typeof e.data === "object" && "plain_reading" in e.data ? { ...e, data: Object.fromEntries(Object.entries(e.data).filter(([k]) => k !== "plain_reading")) } : e);
+  // Local mode: the same "computed locally" note on every check is stated once at the top.
+  const localNote = !session.fullEnvelope && dsr.envelope?.computed ? { computed: dsr.envelope.computed, note: dsr.envelope.note } : null;
+  const dropLocal = (e) => (localNote && e?.computed === localNote.computed && e?.note === localNote.note ? Object.fromEntries(Object.entries(e).filter(([k]) => k !== "computed" && k !== "note")) : e);
+  const shapeEnv = (e) => (session.fullEnvelope ? e : dropLocal(dropReading(compactEnvelope(e))));
+  const envelopes = { deflated_sharpe: shapeEnv(dsr.envelope), track_record: shapeEnv(track.envelope), ...(overfit ? { overfitting: shapeEnv(overfit.envelope) } : {}) };
   const limits = envelopes.deflated_sharpe?.limits;
   const shared = Object.values(envelopes).every((e) => sameJson(e?.limits, limits));
   const checks = Object.fromEntries(
     Object.entries(envelopes).map(([name, e]) => [name, shared ? Object.fromEntries(Object.entries(e).filter(([k]) => k !== "limits")) : e]),
   );
   const readings = Object.fromEntries(
-    Object.entries(envelopes).map(([name, e]) => [name, e?.data?.plain_reading ?? e?.error?.message ?? null]),
+    Object.entries({ deflated_sharpe: dsr.envelope, track_record: track.envelope, ...(overfit ? { overfitting: overfit.envelope } : {}) })
+      .map(([name, e]) => [name, e?.data?.plain_reading ?? e?.error?.message ?? null]),
   );
   return asText({
-    schema: "canli.audit.v1",
-    note: "Each check is its validator's own result and receipt, side by side. The audit does not grade the strategy.",
+    schema: "canli.audit.v2",
+    headline: roundAll(headline),
+    fix_next: fix,
+    note: "One measured test, then each check's own result and receipt. No grade.",
+    ...(localNote ? { local: localNote } : {}),
     ...(shared ? { limits } : {}),
+    computed: {
+      // Exact: these are the inputs the deflated Sharpe check ran with, so they must reproduce it.
+      // Without variants they are the declared ones, which the check's derived inputs already show.
+      ...(search || session.fullEnvelope ? { trials: { used: trials, ...(declaredTrials !== undefined ? { declared: declaredTrials } : {}), ...(search ? { counted: search.effective_trials.used } : {}), cross_trial_sharpe_sd_annualized: crossSd } } : {}),
+      ...roundAll(session.fullEnvelope ? {
+        shape,
+        sharpe_interval: interval,
+        ...(haircut ? { haircut_sharpe_bonferroni: haircut.bonferroni.haircut_sharpe_annualized } : {}),
+        ...(minBtl ? { minimum_backtest_length_years: minBtl.years, years_available: years } : {}),
+        ...(search ? { search } : {}),
+        ...(decay ? { oos_decay: decay } : {}),
+      } : {
+        // Skew and kurtosis are in the deflated Sharpe check's derived inputs; not repeated here.
+        lag1_autocorrelation: shape.lag1_autocorrelation,
+        lo_adjusted_sharpe: shape.lo_adjusted_sharpe_annualized,
+        sharpe_95: interval.intervals["0.95"],
+        ...(haircut ? { haircut_sharpe: haircut.bonferroni.haircut_sharpe_annualized } : {}),
+        ...(minBtl ? { min_backtest_years: minBtl.years, years } : {}),
+        ...(search ? { variants: search.variants, mean_correlation: search.mean_pairwise_correlation, li_ji_trials: search.effective_trials.li_ji } : {}),
+        ...(decay ? { oos_sharpe_median: decay.oos_sharpe.median, oos_below_zero: decay.oos_sharpe.prob_below_zero, oos_on_is_slope: decay.degradation.slope } : {}),
+      }, 3),
+    },
     readings,
     checks,
     ...(input.returns_file || input.variants_file
@@ -387,7 +532,7 @@ export async function toolAuditBacktest(session, args) {
           ...(variantsRead ? { variants_file: input.variants_file, variants: variants[0].length, periods: variants.length, ...(variantsRead.skipped.length ? { skipped_variant_row_counter_columns: variantsRead.skipped } : {}) } : {}),
         } }
       : {}),
-    ...(variants ? {} : { not_run: { overfitting: "Send variants or variants_file (every variant's returns) to add the overfitting check." } }),
+    ...(variants ? {} : { not_run: { overfitting: "Send variants for overfitting and SPA." } }),
   });
 }
 
@@ -418,7 +563,7 @@ export async function toolVerifyReceipt(session, args) {
       valid: false,
       checks: { well_formed: false, id_matches_content: false, signature_valid: false, key_published: false },
       key_id: data?.signature?.key_id ?? null,
-      meaning: `The receipt is not well formed${missing.length ? `: it has no ${missing.join(", ")}` : ""}, so it cannot be checked. Send the whole receipt object as get_receipt or the validation result returned it, or send its id.`,
+      meaning: `The receipt is not well formed${missing.length ? `: it has no ${missing.join(", ")}` : ""}, so it cannot be checked. Send the whole receipt object as the validation result returned it, or send its id.`,
     });
   }
   return asText({
@@ -430,6 +575,8 @@ export async function toolVerifyReceipt(session, args) {
     meaning: result.valid
       ? "canlicapital.com signed this exact output for this exact input, computed by the source files whose hashes the receipt lists. It says nothing about how the input series was built."
       : "At least one check failed: do not treat this receipt as issued by canlicapital.com for this content.",
+    // With an id and include_receipt, the stored receipt itself: what get_receipt returned before 0.12.0.
+    ...(input.include_receipt && input.id !== undefined ? { receipt: data } : {}),
   });
 }
 
@@ -552,7 +699,11 @@ const WRITES_RECEIPT = { readOnlyHint: false, destructiveHint: false, openWorldH
 // Registers the enabled tools and returns what it registered, by name: { description, inputSchema,
 // outputSchema }, which the code-generation resources (canli://schemas/{tool}) serve.
 export function registerTools(server, session) {
-  const enabled = new Set((session.toolsets ?? Object.keys(TOOLSETS)).flatMap((name) => TOOLSETS[name]));
+  const enabled = new Set((session.toolsets ?? DEFAULT_TOOLSETS).flatMap((name) => TOOLSETS[name]));
+  // get_key only helps a session with no key: with CANLI_KEY set, or a caller's or the shared key on
+  // the hosted endpoint, it would issue nothing, so it is not listed and costs no tokens.
+  const keyed = Boolean(session.envKey) || Boolean(session.hosted && session.hosted.keySource !== "none");
+  if (keyed) enabled.delete("get_key");
   const catalog = {};
   const register = (name, config, handler) => {
     if (!enabled.has(name)) return;
@@ -614,11 +765,6 @@ export function registerTools(server, session) {
     { title: "Audit a backtest", annotations: { title: "Audit a backtest", ...WRITES_RECEIPT }, description: TOOL_DESCRIPTIONS.audit_backtest, inputSchema: auditBacktestToolShape, outputSchema: auditOutput },
     (args) => toolAuditBacktest(session, args),
   );
-  register(
-    "get_receipt",
-    { title: "Get a receipt", annotations: { title: "Get a receipt", ...READ_ONLY }, description: TOOL_DESCRIPTIONS.get_receipt, inputSchema: getReceiptInput, outputSchema: receiptOutput },
-    (args) => toolGetReceipt(session, args),
-  );
   register(
     "verify_receipt",
     { title: "Verify a receipt", annotations: { title: "Verify a receipt", ...READ_ONLY }, description: TOOL_DESCRIPTIONS.verify_receipt, inputSchema: verifyReceiptToolShape, outputSchema: verifyReceiptOutput },