mycomesh-consumer 0.4.0 → 0.5.0

package/networks/mycomesh-v11-sepolia.json

@@ -6,6 +6,7 @@
   "stablecoin": "0xbce27efad4191277167fe76819581a97959048cf",
   "registry": "0x0ff3210e8e8abf5f5bfa73a39e60db7416b6c8c7",
   "relay_directory": "0xa0aaad9393f51cb5786c69f152133a174588bdab",
+  "probe_ledger": "0x30055eae6645cce8754f834a17689d20a3795ca3",
   "deployment_block": 11809185,
   "rpc_urls": [
     "https://ethereum-sepolia-rpc.publicnode.com",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mycomesh-consumer",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "MycoMesh V11 Consumer: a custodied deposit, relay-blind encrypted requests to any Provider, and a local OpenAI-compatible endpoint.",
   "repository": {
     "type": "git",

package/src/account.mjs

@@ -84,7 +84,7 @@ export async function dispute(network, ownerPrivate, record, { reasonCode, state
   const accepted = [];
   for (const relay of relays) {
     try {
-      const reply = await httpJson(`${relay.url}/v11/evidence`, { method: "POST", body: evidence, ca: network.tls_ca, timeoutMs: 30_000 });
+      const reply = await httpJson(`${relay.url}/v11/evidence`, { method: "POST", body: evidence, ca: network.tls_ca, pin: relay.pin, timeoutMs: 30_000 });
       if (reply.status === 200) accepted.push(relay.url);
     } catch {}
   }

package/src/cli.mjs

@@ -11,6 +11,9 @@ import { completeWithdrawal, dispute, faucet, requestWithdrawal, setup, walletSt
 import { Consumer, loadNetwork, serveConsumer } from "./consumer.mjs";
 import { createWallet, ownerAddress, ownerKey, walletAddress } from "./wallet.mjs";
 import { loadRequest } from "./disputes.mjs";
+import { addTenant, loadTenants, revokeTenant, setBudget, tenantKey, tenantStatus } from "./tenants.mjs";
+import { spawn } from "node:child_process";
+import { statSync } from "node:fs";
 
 const DEFAULT_NETWORK = join(dirname(fileURLToPath(import.meta.url)), "../networks/mycomesh-v11-sepolia.json");
 
@@ -28,6 +31,9 @@ const USAGE = `Usage: mycomesh-consumer <command> [options]
   request "prompt" [--stream]
                            send one request and print the verified answer
   serve [--port 8110]      run the local web console and OpenAI-compatible endpoint (default)
+  tenant add NAME [--budget UNITS] [--max-per-request UNITS]
+                           multi-tenant accounts: a payment key and API key per tenant, capped on-chain
+  tenant list | tenant budget NAME UNITS | tenant revoke NAME
   dispute <settlement-key|last> [--reason CODE] [--statement TEXT]
                            reveal a recorded request and response to a Provider-AI jury
                            (within 24 hours; the reporter bond is returned if fraud is confirmed)
@@ -68,7 +74,8 @@ export async function main(argv = process.argv.slice(2), { stdout = process.stdo
       port: { type: "string", default: "8110" }, host: { type: "string", default: "127.0.0.1" },
       "max-output-tokens": { type: "string", default: "4096" }, help: { type: "boolean" },
       reason: { type: "string", default: "unrelated_response" }, faucet: { type: "boolean" }, provider: { type: "string" },
-      statement: { type: "string", default: "" }, stream: { type: "boolean" },
+      statement: { type: "string", default: "" }, stream: { type: "boolean" }, budget: { type: "string" },
+      "no-browser": { type: "boolean" },
     },
   });
   const [command = "serve", ...rest] = positionals;
@@ -136,7 +143,23 @@ export async function main(argv = process.argv.slice(2), { stdout = process.stdo
     stdout.write(`${JSON.stringify(result)}\n`);
     return result.relays_accepted.length ? 0 : 2;
   }
-  const keyPrivate = paymentKey(dir);
+  if (command === "tenant") {
+    const [action, name, amount] = rest;
+    if (action === "list") { stdout.write(`${JSON.stringify(await tenantStatus(network, dir), null, 2)}\n`); return 0; }
+    const owner = await ownerKey(values["owner-key-file"], dir);
+    if (action === "add") {
+      const created = await addTenant(network, dir, owner, name, {
+        maxPerRequest: BigInt(values["max-per-request"] || values["max-fee"]), budget: BigInt(values.budget || 0) });
+      stdout.write(`${JSON.stringify(created)}\nThe API key is shown once; give it to the tenant (Authorization: Bearer ...).\n`);
+      return 0;
+    }
+    const tenant = loadTenants(dir)[name];
+    if (!tenant) throw new Error(`no tenant ${name}`);
+    if (action === "budget") { await setBudget(network, owner, tenant.key, BigInt(amount)); stdout.write(`budget of ${name} set to ${amount}\n`); return 0; }
+    if (action === "revoke") { await revokeTenant(network, dir, owner, name); stdout.write(`revoked ${name}\n`); return 0; }
+    throw new Error("tenant add | list | budget | revoke");
+  }
+  const keyPrivate = paymentKey(dir, command === "serve");
   const consumer = new Consumer({ network, keyPrivate, maxFee: Number(values["max-fee"]), journalDir: dir });
   if (command === "request") {
     const { response, receipt } = await consumer.request({
@@ -151,11 +174,32 @@ export async function main(argv = process.argv.slice(2), { stdout = process.stdo
     return 0;
   }
   if (command === "serve") {
+    // Tenants are reloaded when tenants.json changes, so `tenant add` works while serving.
+    let cache = { mtime: -1, byHash: {} };
+    const tenants = () => {
+      const path = join(dir, "tenants.json");
+      const mtime = existsSync(path) ? statSync(path).mtimeMs : 0;
+      if (mtime !== cache.mtime) {
+        const byHash = {};
+        for (const [name, tenant] of Object.entries(loadTenants(dir))) {
+          if (tenant.revoked) continue;
+          byHash[tenant.api_key_sha256] = new Consumer({ network, keyPrivate: tenantKey(dir, name), maxFee: Number(tenant.max_per_request),
+            journalDir: join(dir, "tenants", name) });
+        }
+        cache = { mtime, byHash };
+      }
+      return cache.byHash;
+    };
     const server = await serveConsumer(consumer, { host: values.host, port: Number(values.port),
-      apiKey: process.env.MYCOMESH_CONSUMER_API_KEY, dataDir: dir });
+      apiKey: process.env.MYCOMESH_CONSUMER_API_KEY, dataDir: dir, tenants });
     const { port } = server.address();
+    const url = `http://127.0.0.1:${port}/`;
     stdout.write(`MycoMesh V11 Consumer on http://${values.host}:${port}/v1 (payment key ${consumer.key})\n`);
-    stdout.write(`Web console: http://127.0.0.1:${port}/\n`);
+    stdout.write(`Web console: ${url}\n`);
+    if (!values["no-browser"] && process.stdout.isTTY && !process.env.CI) {
+      const opener = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", ["/c", "start", "", url]] : ["xdg-open", [url]];
+      spawn(opener[0], opener[1], { stdio: "ignore", detached: true }).on("error", () => {}).unref();
+    }
     return new Promise(() => {});
   }
   throw new Error(`unknown command ${command}\n${USAGE}`);

package/src/console.mjs

@@ -6,6 +6,7 @@ import { completeWithdrawal, dispute, faucet, requestWithdrawal, settlementStatu
 import { listRequests, loadRequest } from "./disputes.mjs";
 import { outputText } from "./protocol.mjs";
 import { createWallet, ownerAddress, unlockWallet, walletAddress } from "./wallet.mjs";
+import { addTenant, loadTenants, revokeTenant, setBudget, tenantStatus } from "./tenants.mjs";
 
 const PAGE = new URL("./web/console.html", import.meta.url);
 
@@ -42,11 +43,13 @@ export function consoleRoutes({ consumer, dataDir }) {
       const relays = [];
       for (const relay of await consumer.relays()) {
         let health = null; let providers = [];
-        try { health = (await consumer.fetchJson(`${relay.url}/health`, { ca: network.tls_ca, timeoutMs: 5_000 })).body; } catch {}
+        try { health = (await consumer.fetchJson(`${relay.url}/health`, { ca: network.tls_ca, pin: relay.pin, timeoutMs: 5_000 })).body; } catch {}
         try { providers = await consumer.providers(relay); } catch {}
-        relays.push({ url: relay.url, signer: relay.signer, healthy: Boolean(health?.ok), providers: providers.map((p) => ({
+        relays.push({ url: relay.url, signer: relay.signer, pinned: Boolean(relay.pin), healthy: Boolean(health?.ok), providers: providers.map((p) => ({
           signer: p.provider_signer, models: p.models, prices: p.prices, capacity: p.capacity })) });
       }
+      const records = await consumer.reputations().catch(() => ({}));
+      for (const relay of relays) for (const provider of relay.providers) provider.reputation = records[provider.signer] || null;
       return { relays };
     },
     "GET /api/history": async () => {
@@ -80,6 +83,21 @@ export function consoleRoutes({ consumer, dataDir }) {
       await requestWithdrawal(network, ownerPrivate, amount);
       return { requested: amount.toString() };
     },
+    "GET /api/tenants": async () => ({ tenants: await tenantStatus(network, dataDir) }),
+    "POST /api/tenants": async (body) => addTenant(network, dataDir, withWallet(body), String(body.name || ""), {
+      maxPerRequest: units(body.max_per_request ?? consumer.maxFee, "max_per_request"),
+      budget: body.budget ? units(body.budget, "budget") : 0n,
+    }),
+    "POST /api/tenants/budget": async (body) => {
+      const tenant = loadTenants(dataDir)[String(body.name)];
+      if (!tenant) throw Object.assign(new Error("no such tenant"), { status: 404 });
+      await setBudget(network, withWallet(body), tenant.key, units(body.budget, "budget"));
+      return { name: body.name, budget: String(body.budget) };
+    },
+    "POST /api/tenants/revoke": async (body) => {
+      await revokeTenant(network, dataDir, withWallet(body), String(body.name));
+      return { revoked: body.name };
+    },
     "POST /api/dispute": async (body) => dispute(network, withWallet(body), loadRequest(dataDir, String(body.settlement_key)),
       { reasonCode: String(body.reason_code || "unrelated_response"), statement: String(body.statement || "") }),
   };

package/src/consumer.mjs

@@ -10,9 +10,13 @@ import { openDelta, openResponse, outputText, prepareRequest, verifiedProvider }
 import { recordRequest } from "./disputes.mjs";
 import { chatStream, responseStream } from "./sse.mjs";
 import { consoleRoutes, localRequestAllowed } from "./console.mjs";
+import { pinnedOptions, splitPin } from "./tlspin.mjs";
+import { compareRank, rankKey, reputation } from "./reputation.mjs";
+import { hashApiKey } from "./tenants.mjs";
 
 const PROVIDER_CACHE_MS = 30_000;
 const RELAY_CACHE_MS = 300_000;
+const REPUTATION_CACHE_MS = 600_000;
 const MAX_BODY = 16 * 1024 * 1024;
 
 export function loadNetwork(path) {
@@ -22,14 +26,21 @@ export function loadNetwork(path) {
   return network;
 }
 
-export function httpJson(url, { method = "GET", body, ca, timeoutMs = 330_000 } = {}) {
+async function tlsOptions(target, ca, pin) {
+  if (target.protocol !== "https:") return {};
+  if (pin) return pinnedOptions(target.href, pin);
+  return ca ? { ca: [...rootCertificates, ca] } : {};
+}
+
+export async function httpJson(url, { method = "GET", body, ca, pin, timeoutMs = 330_000 } = {}) {
   const target = new URL(url);
   const data = body === undefined ? undefined : Buffer.from(JSON.stringify(body));
   const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+  const tls = await tlsOptions(target, ca, pin);
   return new Promise((resolvePromise, reject) => {
     const req = send(target, {
       method, headers: { accept: "application/json", ...(data ? { "content-type": "application/json", "content-length": data.length } : {}) },
-      ...(target.protocol === "https:" && ca ? { ca: [...rootCertificates, ca] } : {}),
+      ...tls,
     }, (res) => {
       const chunks = [];
       let size = 0;
@@ -51,15 +62,16 @@ export function httpJson(url, { method = "GET", body, ca, timeoutMs = 330_000 }
 }
 
 /** POST expecting NDJSON; each line goes to onLine. Non-streamed replies resolve as JSON. */
-export function httpNdjson(url, { body, ca, timeoutMs = 340_000, onLine }) {
+export async function httpNdjson(url, { body, ca, pin, timeoutMs = 340_000, onLine }) {
   const target = new URL(url);
   const data = Buffer.from(JSON.stringify(body));
   const send = target.protocol === "https:" ? httpsRequest : httpRequest;
+  const tls = await tlsOptions(target, ca, pin);
   return new Promise((resolvePromise, reject) => {
     const req = send(target, {
       method: "POST",
       headers: { accept: "application/x-ndjson", "content-type": "application/json", "content-length": data.length },
-      ...(target.protocol === "https:" && ca ? { ca: [...rootCertificates, ca] } : {}),
+      ...tls,
     }, (res) => {
       const streaming = res.statusCode === 200 && String(res.headers["content-type"] || "").includes("ndjson");
       let buffered = "";
@@ -104,10 +116,9 @@ export async function directoryRelays(network) {
     const base = Number(BigInt(`0x${raw.slice(0, 64)}`));
     if (!Number(BigInt(`0x${raw.slice(64, 128)}`))) continue;
     const entry = raw.slice(base * 2);
-    relays.push({
-      signer: `0x${entry.slice(64 + 24, 128)}`.toLowerCase(),
-      url: decodeString(entry, Number(BigInt(`0x${entry.slice(128, 192)}`))).replace(/\/+$/, ""),
-    });
+    const [url, pin] = splitPin(decodeString(entry, Number(BigInt(`0x${entry.slice(128, 192)}`))));
+    relays.push({ owner: `0x${entry.slice(24, 64)}`.toLowerCase(), signer: `0x${entry.slice(64 + 24, 128)}`.toLowerCase(),
+      url: url.replace(/\/+$/, ""), pin });
   }
   return relays;
 }
@@ -127,6 +138,25 @@ export class Consumer {
     this.relayCache = null;
   }
 
+  /** On-chain reputation and verified probe verdicts for every Provider in view, cached. */
+  async reputations() {
+    if (this.reputationCache && Date.now() - this.reputationCache.at < REPUTATION_CACHE_MS) return this.reputationCache.value;
+    const descriptors = new Map();
+    const relaysByOwner = {};
+    for (const relay of await this.relays()) {
+      try {
+        const owner = relay.owner || `0x${(await rpcCall(this.network.rpc_urls, "eth_call", [{ to: this.network.settlement,
+          data: encodeCall("relaySignerOwner(address)", [["address", relay.signer]]) }, "latest"])).slice(26)}`;
+        relaysByOwner[owner.toLowerCase()] = relay;
+      } catch {}
+      try { for (const descriptor of await this.providers(relay)) descriptors.set(descriptor.provider_signer, descriptor); } catch {}
+    }
+    let value = {};
+    try { value = await reputation(this, [...descriptors.values()], relaysByOwner); } catch {}
+    this.reputationCache = { at: Date.now(), value };
+    return value;
+  }
+
   /** Manifest Relays first, then directory Relays whose /health proves the announced signer. */
   async relays() {
     if (this.relayCache && Date.now() - this.relayCache.at < RELAY_CACHE_MS) return this.relayCache.relays;
@@ -136,7 +166,7 @@ export class Consumer {
       for (const relay of await directoryRelays(this.network)) {
         if (known.has(relay.signer)) continue;
         try {
-          const { status, body } = await this.fetchJson(`${relay.url}/health`, { ca: this.network.tls_ca, timeoutMs: 5_000 });
+          const { status, body } = await this.fetchJson(`${relay.url}/health`, { ca: this.network.tls_ca, pin: relay.pin, timeoutMs: 5_000 });
           if (status === 200 && String(body.relay_signer).toLowerCase() === relay.signer
               && String(body.settlement).toLowerCase() === this.deployment.settlement) {
             relays.push(relay);
@@ -152,7 +182,7 @@ export class Consumer {
   async providers(relay) {
     const cached = this.cache.get(relay.url);
     if (cached && Date.now() - cached.at < PROVIDER_CACHE_MS) return cached.providers;
-    const { status, body } = await this.fetchJson(`${relay.url}/providers`, { ca: this.network.tls_ca, timeoutMs: 10_000 });
+    const { status, body } = await this.fetchJson(`${relay.url}/providers`, { ca: this.network.tls_ca, pin: relay.pin, timeoutMs: 10_000 });
     if (status !== 200) throw new Error(`Relay ${relay.url} /providers returned ${status}`);
     const now = this.now();
     const providers = (body.providers || []).filter((descriptor) => {
@@ -180,7 +210,9 @@ export class Consumer {
           && (!provider || descriptor.provider_signer === provider.toLowerCase()));
       }
       catch (error) { lastError = error; continue; }
-      candidates.sort((a, b) => (a.prices.output_per_1k - b.prices.output_per_1k) || (a.prices.input_per_1k - b.prices.input_per_1k));
+      // What the chain proves ranks first: recent fraud, verified probe failures, reputation; then price.
+      const records = await this.reputations().catch(() => ({}));
+      candidates.sort((a, b) => compareRank(rankKey(a, records[a.provider_signer]), rankKey(b, records[b.provider_signer])));
       for (const descriptor of candidates) {
         const prepared = prepareRequest({
           descriptor, deployment: this.deployment, keyPrivate: this.keyPrivate, relaySigner: relay.signer,
@@ -191,7 +223,7 @@ export class Consumer {
         let final = null;
         try {
           reply = onDelta
-            ? await this.streamJson(`${relay.url}/v11/requests`, { body: prepared.payload, ca: this.network.tls_ca, onLine: (line) => {
+            ? await this.streamJson(`${relay.url}/v11/requests`, { body: prepared.payload, ca: this.network.tls_ca, pin: relay.pin, onLine: (line) => {
               if (line.type === "delta") {
                 streamed.push(openDelta(prepared, line.sealed, streamed.length, this.now()));
                 onDelta(streamed.at(-1));
@@ -199,7 +231,7 @@ export class Consumer {
                 final = line;
               }
             } })
-            : await this.fetchJson(`${relay.url}/v11/requests`, { method: "POST", body: prepared.payload, ca: this.network.tls_ca });
+            : await this.fetchJson(`${relay.url}/v11/requests`, { method: "POST", body: prepared.payload, ca: this.network.tls_ca, pin: relay.pin });
         } catch (error) {
           // The request may have reached the Relay: never replay it elsewhere.
           throw Object.assign(new Error(`request outcome unknown: ${error.message}`), { code: "outcome_unknown", requestId: prepared.authorization.request_id });
@@ -242,8 +274,9 @@ async function readJson(req) {
 }
 
 /** Local OpenAI-compatible endpoint; nothing leaves this machine unsealed except pricing and routing. */
-export function serveConsumer(consumer, { host = "127.0.0.1", port = 8110, apiKey, dataDir } = {}) {
+export function serveConsumer(consumer, { host = "127.0.0.1", port = 8110, apiKey, dataDir, tenants = () => ({}) } = {}) {
   const routes = dataDir ? consoleRoutes({ consumer, dataDir }) : {};
+  const bearer = (req) => /^Bearer (.+)$/.exec(String(req.headers.authorization || ""))?.[1];
   const server = createServer(async (req, res) => {
     let writer = null;
     const send = (status, body, type = "application/json") => {
@@ -251,8 +284,13 @@ export function serveConsumer(consumer, { host = "127.0.0.1", port = 8110, apiKe
       res.end(type === "application/json" ? JSON.stringify(body) : body);
     };
     try {
-      if (!localRequestAllowed(req, server.address().port)) return send(403, openaiError("only this machine may use the local node", "forbidden"));
       const path = new URL(req.url, "http://localhost").pathname.replace(/^\/v1\/v1\//, "/v1/");
+      // A tenant's API key selects its own payment key and budget; tenants may call from anywhere.
+      const tenant = path.startsWith("/v1/") && bearer(req) ? tenants()[hashApiKey(bearer(req))] : undefined;
+      if (!tenant && !localRequestAllowed(req, server.address().port)) {
+        return send(403, openaiError("only this machine may use the local node", "forbidden"));
+      }
+      const active = tenant || consumer;
       const route = routes[`${req.method} ${path}`];
       if (route) {
         if (req.method === "POST" && !String(req.headers["content-type"] || "").startsWith("application/json")) {
@@ -261,10 +299,11 @@ export function serveConsumer(consumer, { host = "127.0.0.1", port = 8110, apiKe
         const result = await route(req.method === "POST" ? await readJson(req) : {});
         return result?.type ? send(200, result.body, result.type) : send(200, result);
       }
-      if (apiKey && req.headers.authorization !== `Bearer ${apiKey}`) return send(401, openaiError("invalid API key", "unauthorized"));
+      if (!tenant && bearer(req) && bearer(req) !== apiKey) return send(401, openaiError("invalid API key", "unauthorized"));
+      if (!tenant && apiKey && bearer(req) !== apiKey) return send(401, openaiError("invalid API key", "unauthorized"));
       if (req.method === "GET" && path === "/health") return send(200, { ok: true, protocol: 11, key: consumer.key });
       if (req.method === "GET" && path === "/v1/models") {
-        return send(200, { object: "list", data: (await consumer.models()).map((id) => ({ id, object: "model", owned_by: "mycomesh" })) });
+        return send(200, { object: "list", data: (await active.models()).map((id) => ({ id, object: "model", owned_by: "mycomesh" })) });
       }
       if (req.method !== "POST" || !["/v1/responses", "/v1/chat/completions", "/responses", "/chat/completions"].includes(path)) {
         return send(404, openaiError("not found", "not_found"));
@@ -280,7 +319,7 @@ export function serveConsumer(consumer, { host = "127.0.0.1", port = 8110, apiKe
       delete rest.max_tokens;
       delete rest.max_completion_tokens;
       if (!stream) {
-        const { response } = await consumer.request({ endpoint: chat ? "chat" : "responses", model, content, maxOutputTokens, options: rest });
+        const { response } = await active.request({ endpoint: chat ? "chat" : "responses", model, content, maxOutputTokens, options: rest });
         return send(200, response.output);
       }
       // Headers go out with the first delta, so a request that fails before dispatch still gets an HTTP error.
@@ -289,7 +328,7 @@ export function serveConsumer(consumer, { host = "127.0.0.1", port = 8110, apiKe
         res.write(text);
       };
       writer = chat ? chatStream(write, { model }, { includeUsage: streamOptions?.include_usage === true }) : responseStream(write, { model });
-      const { response } = await consumer.request({ endpoint: chat ? "chat" : "responses", model, content, maxOutputTokens,
+      const { response } = await active.request({ endpoint: chat ? "chat" : "responses", model, content, maxOutputTokens,
         options: rest, onDelta: (text) => writer.delta(text) });
       writer.finish(response.output);
       return res.end();

package/src/probes.mjs

@@ -0,0 +1,70 @@
+// Re-grading Relay probe verdicts (mirrors mycomesh/relay/probes.py and mycomesh/probe_evidence.py).
+import { sha256Hex, outputText } from "./protocol.mjs";
+import { verifySignedReceipt } from "./eip712.mjs";
+
+export const PROBE_EVIDENCE_SCHEMA = "mycomesh.v11.probe-evidence.v1";
+const WEEKDAYS = ["Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", "Sunday"];
+const numbers = (text) => (text.match(/\d{1,3}(?:[,\s_]\d{3})+(?!\d)|\d+/g) || []).map((match) => match.replace(/[,\s_]/g, ""));
+
+export function buildTask(kind, params) {
+  if (kind === "multiply") return { kind, question: `What is ${params.a} multiplied by ${params.b}?`, reference: String(BigInt(params.a) * BigInt(params.b)), numeric: true };
+  if (kind === "sum") {
+    return { kind, question: `What is the sum of ${params.values.join(", ")}?`, reference: String(params.values.reduce((a, b) => a + Number(b), 0)), numeric: true };
+  }
+  if (kind === "count") {
+    return { kind, question: `How many times does the letter "${params.target}" appear in "${params.letters}"?`,
+      reference: String(params.letters.split(params.target).length - 1), numeric: true };
+  }
+  if (kind === "reverse") return { kind, question: `Write the string "${params.word}" backwards, letter by letter.`, reference: [...params.word].reverse().join(""), numeric: false };
+  if (kind === "sort") return { kind, question: `Sort these words alphabetically: ${params.words.join(", ")}.`, reference: [...params.words].sort().join(", "), numeric: false };
+  if (kind === "weekday") {
+    const day = new Date(`${params.start}T00:00:00Z`);
+    day.setUTCDate(day.getUTCDate() + Number(params.offset));
+    return { kind, question: `What day of the week is ${params.offset} days after ${params.start}?`, reference: WEEKDAYS[(day.getUTCDay() + 6) % 7], numeric: false };
+  }
+  throw new Error(`unknown probe kind ${kind}`);
+}
+
+export function grade(task, answer) {
+  const text = String(answer).trim();
+  if (!text) return "unrelated";
+  if (task.numeric) {
+    const found = numbers(text);
+    return found.length ? (found.includes(task.reference) ? "pass" : "wrong") : "unrelated";
+  }
+  const lower = text.toLowerCase();
+  if (task.kind === "reverse") return lower.includes(task.reference) ? "pass" : "wrong";
+  if (task.kind === "sort") {
+    const positions = task.reference.split(", ").map((word) => lower.indexOf(word));
+    if (positions.every((position) => position < 0)) return "unrelated";
+    return positions.every((p, i) => p >= 0 && (i === 0 || p >= positions[i - 1])) ? "pass" : "wrong";
+  }
+  const named = WEEKDAYS.filter((day) => lower.includes(day.toLowerCase()));
+  if (!named.length) return "unrelated";
+  return named.length === 1 && named[0] === task.reference ? "pass" : "wrong";
+}
+
+function* strings(value) {
+  if (typeof value === "string") yield value;
+  else if (Array.isArray(value)) for (const item of value) yield* strings(item);
+  else if (value && typeof value === "object") for (const item of Object.values(value)) yield* strings(item);
+}
+
+/** Returns { provider, verdict } after re-grading the Provider's own signed answer; throws otherwise. */
+export function verifyProbeEvidence(evidence, deployment) {
+  if (evidence?.schema !== PROBE_EVIDENCE_SCHEMA) throw new Error("not probe evidence");
+  const signed = evidence.signed_receipt;
+  verifySignedReceipt(signed, deployment);
+  const request = Buffer.from(evidence.request, "base64");
+  const response = Buffer.from(evidence.response, "base64");
+  if (sha256Hex(request) !== signed.authorization.request_hash || sha256Hex(response) !== signed.receipt.response_hash) {
+    throw new Error("plaintexts do not match the Provider-signed receipt");
+  }
+  const task = buildTask(evidence.task.kind, evidence.task.params);
+  if (![...strings(JSON.parse(request.toString("utf8")))].some((text) => text.includes(task.question))) {
+    throw new Error("the request does not ask the stated question");
+  }
+  const verdict = grade(task, outputText(JSON.parse(response.toString("utf8")).output));
+  if (verdict !== evidence.verdict || verdict === "unrelated") throw new Error(`re-grading gives ${verdict}`);
+  return { provider: signed.authorization.provider_signer, verdict };
+}

package/src/reputation.mjs

@@ -0,0 +1,86 @@
+// Provider ranking from what the chain and the probe ledger prove, not from what anyone claims.
+import { encodeCall, keccak, hex } from "./eip712.mjs";
+import { rpcCall } from "./chain.mjs";
+import { evidenceHash } from "./disputes.mjs";
+import { verifyProbeEvidence } from "./probes.mjs";
+
+const PROBE_RECORDED = hex(keccak(Buffer.from("ProbeRecorded(address,address,bytes32,bytes32,uint8)")));
+const LOOKBACK_BLOCKS = 50_400n; // about 7 days of 12-second blocks
+const LOG_CHUNK = 10_000n;
+const FRAUD_COOLDOWN = 30 * 86_400;
+const MAX_VERIFIED = 20; // evidence downloads per refresh
+
+const word = (raw, index) => BigInt(`0x${raw.slice(2 + index * 64, 2 + (index + 1) * 64)}`);
+const address = (topic) => `0x${topic.slice(26)}`.toLowerCase();
+
+async function providerRecord(network, signer) {
+  const owner = address((await rpcCall(network.rpc_urls, "eth_call", [{ to: network.settlement,
+    data: encodeCall("providerSignerOwner(address)", [["address", signer]]) }, "latest"])).slice(0, 66));
+  const raw = await rpcCall(network.rpc_urls, "eth_call", [{ to: network.registry,
+    data: encodeCall("providerOf(address)", [["address", owner]]) }, "latest"]);
+  return { owner, counted_volume: word(raw, 10).toString(), counterparties: Number(word(raw, 8)),
+    last_fraud_at: Number(word(raw, 9)), registered_at: Number(word(raw, 5)) };
+}
+
+async function ledgerEvents(network) {
+  if (!network.probe_ledger) return [];
+  const head = BigInt(await rpcCall(network.rpc_urls, "eth_blockNumber", []));
+  const events = [];
+  for (let from = head > LOOKBACK_BLOCKS ? head - LOOKBACK_BLOCKS : 0n; from <= head; from += LOG_CHUNK) {
+    const to = from + LOG_CHUNK - 1n < head ? from + LOG_CHUNK - 1n : head;
+    for (const log of await rpcCall(network.rpc_urls, "eth_getLogs", [{ address: network.probe_ledger, topics: [PROBE_RECORDED],
+      fromBlock: `0x${from.toString(16)}`, toBlock: `0x${to.toString(16)}` }])) {
+      events.push({ provider: address(log.topics[1]), relay: address(log.topics[2]), key: log.topics[3],
+        evidence: `0x${log.data.slice(2, 66)}`, verdict: Number(BigInt(`0x${log.data.slice(66, 130)}`)) === 1 ? "pass" : "wrong" });
+    }
+  }
+  return events;
+}
+
+/**
+ * Per Provider owner: on-chain reputation plus probe verdicts. Passes are counted as reported;
+ * failures count only after this machine re-grades the published evidence, so no Relay can frame anyone.
+ */
+export async function reputation(consumer, descriptors, relaysByOwner) {
+  const network = consumer.network;
+  const records = {};
+  for (const descriptor of descriptors) {
+    try { records[descriptor.provider_signer] = await providerRecord(network, descriptor.provider_signer); } catch {}
+  }
+  let events = [];
+  try { events = await ledgerEvents(network); } catch {}
+  const byOwner = {};
+  for (const record of Object.values(records)) byOwner[record.owner] = { ...record, probes_passed: 0, probes_failed_verified: 0 };
+  let verified = 0;
+  for (const event of events) {
+    const entry = byOwner[event.provider];
+    if (!entry) continue;
+    if (event.verdict === "pass") { entry.probes_passed += 1; continue; }
+    const relay = relaysByOwner[event.relay];
+    if (!relay || verified >= MAX_VERIFIED) continue;
+    verified += 1;
+    try {
+      const { status, body } = await consumer.fetchJson(`${relay.url}/v11/evidence/${event.evidence}`,
+        { ca: network.tls_ca, pin: relay.pin, timeoutMs: 8_000 });
+      if (status === 200 && evidenceHash(body) === event.evidence && verifyProbeEvidence(body, consumer.deployment).verdict === "wrong") {
+        entry.probes_failed_verified += 1;
+      }
+    } catch {}
+  }
+  return Object.fromEntries(Object.entries(records).map(([signer, record]) => [signer, byOwner[record.owner]]));
+}
+
+/** Lower is better: recent confirmed fraud last, then verified probe failure rate, then reputation, then price. */
+export function rankKey(descriptor, record, now = Math.floor(Date.now() / 1000)) {
+  const fraud = record && record.last_fraud_at && now < record.last_fraud_at + FRAUD_COOLDOWN ? 1 : 0;
+  const probes = record ? record.probes_passed + record.probes_failed_verified : 0;
+  const failure = record && probes ? Math.round((10 * record.probes_failed_verified) / probes) : 0;
+  const volume = record ? -Number(BigInt(record.counted_volume) / 1000n) : 0;
+  const price = descriptor.prices.output_per_1k * 1e6 + descriptor.prices.input_per_1k;
+  return [fraud, failure, volume, price];
+}
+
+export function compareRank(a, b) {
+  for (let i = 0; i < a.length; i += 1) if (a[i] !== b[i]) return a[i] - b[i];
+  return 0;
+}

package/src/tenants.mjs

@@ -0,0 +1,69 @@
+// Multi-tenant accounts: one owner deposit, one payment key per tenant with an on-chain budget.
+// A custodial service (or any team) gives each end user an API key; the chain caps what each key can spend.
+import { createHash, randomBytes } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { addressOf, encodeCall } from "./eip712.mjs";
+import { rpcCall, sendTransaction } from "./chain.mjs";
+
+const NAME = /^[a-zA-Z0-9_.-]{1,64}$/;
+const file = (dir) => join(dir, "tenants.json");
+export const hashApiKey = (apiKey) => createHash("sha256").update(String(apiKey)).digest("hex");
+
+export function loadTenants(dir) {
+  return existsSync(file(dir)) ? JSON.parse(readFileSync(file(dir), "utf8")).tenants : {};
+}
+
+function saveTenants(dir, tenants) {
+  writeFileSync(file(dir), `${JSON.stringify({ schema: "mycomesh.v11.tenants.v1", tenants }, null, 2)}\n`, { mode: 0o600 });
+  chmodSync(file(dir), 0o600);
+}
+
+export function tenantKey(dir, name) {
+  const value = readFileSync(join(dir, "tenants", `${name}.key`), "utf8").trim();
+  return value.startsWith("0x") ? value : `0x${value}`;
+}
+
+/** Create a tenant: a fresh payment key granted on-chain with a per-request cap and a total budget. */
+export async function addTenant(network, dir, ownerPrivate, name, { maxPerRequest, budget = 0n }) {
+  if (!NAME.test(name)) throw new Error("tenant names use letters, digits, '.', '_' and '-'");
+  const tenants = loadTenants(dir);
+  if (tenants[name]) throw new Error(`tenant ${name} already exists`);
+  mkdirSync(join(dir, "tenants"), { recursive: true, mode: 0o700 });
+  const keyPrivate = `0x${randomBytes(32).toString("hex")}`;
+  writeFileSync(join(dir, "tenants", `${name}.key`), `${keyPrivate}\n`, { mode: 0o600 });
+  const key = addressOf(keyPrivate);
+  await sendTransaction(network.rpc_urls, ownerPrivate, { to: network.settlement,
+    data: encodeCall("registerKey(address,uint256,uint64)", [["address", key], ["uint", maxPerRequest], ["uint", 0]]) });
+  if (budget > 0n) await setBudget(network, ownerPrivate, key, budget);
+  const apiKey = `mcm_${randomBytes(24).toString("hex")}`;
+  tenants[name] = { key, max_per_request: String(maxPerRequest), api_key_sha256: hashApiKey(apiKey),
+    created_at: Math.floor(Date.now() / 1000), revoked: false };
+  saveTenants(dir, tenants);
+  return { name, key, api_key: apiKey };
+}
+
+export async function setBudget(network, ownerPrivate, key, budget) {
+  await sendTransaction(network.rpc_urls, ownerPrivate, { to: network.settlement,
+    data: encodeCall("setKeyBudget(address,uint128)", [["address", key], ["uint", budget]]) });
+}
+
+export async function revokeTenant(network, dir, ownerPrivate, name) {
+  const tenants = loadTenants(dir);
+  if (!tenants[name]) throw new Error(`no tenant ${name}`);
+  await sendTransaction(network.rpc_urls, ownerPrivate, { to: network.settlement,
+    data: encodeCall("revokeKey(address)", [["address", tenants[name].key]]) });
+  tenants[name].revoked = true;
+  saveTenants(dir, tenants);
+}
+
+/** Every tenant with its on-chain budget and spend. */
+export async function tenantStatus(network, dir) {
+  const tenants = loadTenants(dir);
+  return Promise.all(Object.entries(tenants).map(async ([name, tenant]) => {
+    const raw = (await rpcCall(network.rpc_urls, "eth_call", [{ to: network.settlement,
+      data: encodeCall("keyBudgets(address)", [["address", tenant.key]]) }, "latest"])).slice(2);
+    return { name, key: tenant.key, max_per_request: tenant.max_per_request, revoked: tenant.revoked,
+      budget: BigInt(`0x${raw.slice(0, 64)}`).toString(), spent: BigInt(`0x${raw.slice(64, 128)}`).toString() };
+  }));
+}

package/src/tlspin.mjs

@@ -0,0 +1,36 @@
+// TLS without certificate authorities: a Relay pins its self-signed certificate on-chain
+// (https://IP:PORT#sha256=<hex> in the RelayDirectoryV11); mirrors mycomesh/tlspin.py.
+import { createHash } from "node:crypto";
+import { connect } from "node:tls";
+
+const PIN_PREFIX = "#sha256=";
+const trusted = new Map(); // pin -> PEM of the certificate that matched it
+
+export function splitPin(endpoint) {
+  const index = String(endpoint).indexOf(PIN_PREFIX);
+  return index < 0 ? [String(endpoint), null] : [endpoint.slice(0, index), endpoint.slice(index + PIN_PREFIX.length).toLowerCase()];
+}
+
+/**
+ * Fetch the Relay's certificate once, check it against the pin, and return
+ * TLS options that trust exactly that certificate (no CA, no host name).
+ */
+export async function pinnedOptions(url, pin) {
+  if (!trusted.has(pin)) {
+    const target = new URL(url);
+    const pem = await new Promise((resolve, reject) => {
+      const socket = connect({ host: target.hostname, port: Number(target.port || 443), rejectUnauthorized: false }, () => {
+        const der = socket.getPeerCertificate(true).raw;
+        socket.end();
+        if (!der || createHash("sha256").update(der).digest("hex") !== pin) {
+          return reject(new Error(`Relay ${target.host} certificate does not match its on-chain pin`));
+        }
+        resolve(`-----BEGIN CERTIFICATE-----\n${der.toString("base64").match(/.{1,64}/g).join("\n")}\n-----END CERTIFICATE-----\n`);
+      });
+      socket.setTimeout(10_000, () => socket.destroy(new Error("TLS handshake timed out")));
+      socket.on("error", reject);
+    });
+    trusted.set(pin, pem);
+  }
+  return { ca: [trusted.get(pin)], checkServerIdentity: () => undefined };
+}

package/src/web/console.html

@@ -56,10 +56,20 @@
   <button data-tab="wallet">钱包</button>
   <button data-tab="history">记录</button>
   <button data-tab="network">网络</button>
+  <button data-tab="tenants">租户</button>
 </nav>
 <main>
   <section id="tab-chat" class="active">
+    <div class="card" id="welcome" style="display:none; margin-bottom:18px">
+      <h2 style="margin-top:0">欢迎使用 MycoMesh</h2>
+      <p class="muted">两步就能开始：在本机创建一个加密钱包，然后一键领取测试币并存入押金。之后每个请求都在本机签名、加密，Relay 看不到内容。</p>
+      <div id="welcome-create" class="row"><input type="password" id="w-pw" placeholder="设置钱包密码（至少 8 位）">
+        <input type="password" id="w-pw2" placeholder="再输入一次"><button class="primary" id="w-create">① 创建钱包</button></div>
+      <div id="welcome-fund" class="row" style="display:none"><input type="password" id="w-fund-pw" placeholder="钱包密码">
+        <button class="primary" id="w-fund">② 领取测试币并存入 20 tUSDC</button><span class="muted">约 1 分钟，需要几笔链上交易。</span></div>
+    </div>
     <div class="row"><label class="muted">模型</label><select id="model"></select>
+      <label class="muted">模式</label><select id="speed"><option value="low">快速</option><option value="medium">均衡</option><option value="high">深度</option></select>
       <button class="ghost" id="clear">新对话</button><span class="muted" id="chat-hint"></span></div>
     <div id="chat"></div>
     <textarea id="prompt" placeholder="输入问题，Enter 发送，Shift+Enter 换行。请求在本机加密，Relay 看不到内容。"></textarea>
@@ -98,8 +108,18 @@
     <table><thead><tr><th>时间</th><th>问题</th><th>回答</th><th>费用</th><th>状态</th><th></th></tr></thead><tbody id="history"></tbody></table>
   </section>
 
+  <section id="tab-tenants">
+    <p class="muted">多租户：一笔押金服务多个用户或团队。每个租户有自己的付款 key 和 API key，链上限定单次上限和总预算，花完即停，互不影响。
+      租户用 API key 调用本机的 <span class="mono">/v1</span> 接口（可以用 <span class="mono">--host 0.0.0.0</span> 对外提供）。</p>
+    <div class="row"><input id="t-name" placeholder="租户名称" size="14"><input id="t-budget" placeholder="总预算（tUSDC）" size="14" value="10">
+      <input id="t-limit" placeholder="单次上限（tUSDC）" size="14" value="1"><button class="primary" id="t-add">添加租户</button></div>
+    <p class="mono" id="t-created" style="display:none"></p>
+    <table><thead><tr><th>租户</th><th>付款 key</th><th>已用 / 预算</th><th>单次上限</th><th>状态</th><th></th></tr></thead><tbody id="tenants"></tbody></table>
+  </section>
+
   <section id="tab-network">
-    <p class="muted">Relay 来自内置清单和链上 Relay 目录，本机逐个核对签名身份。价格单位：每 1000 个 token 的 tUSDC。</p>
+    <p class="muted">Relay 来自内置清单和链上 Relay 目录，本机逐个核对签名身份；自签证书的 Relay 按链上登记的指纹核验，不依赖证书机构。
+      选择 Provider 时先看链上能证明的：近期是否被确认欺诈、经本机重新判分的探针失败率、累计干净成交，最后才看价格。价格单位：每 1000 个 token 的 tUSDC。</p>
     <div id="network"></div>
   </section>
 </main>
@@ -146,7 +166,7 @@ document.querySelectorAll("nav button").forEach((button) => button.onclick = ()
   history.replaceState(null, "", `#${button.dataset.tab}`);
   document.querySelectorAll("nav button").forEach((b) => b.classList.toggle("active", b === button));
   document.querySelectorAll("section").forEach((s) => s.classList.toggle("active", s.id === `tab-${button.dataset.tab}`));
-  ({ wallet: refreshWallet, history: refreshHistory, network: refreshNetwork })[button.dataset.tab]?.();
+  ({ wallet: refreshWallet, history: refreshHistory, network: refreshNetwork, tenants: refreshTenants })[button.dataset.tab]?.();
 });
 
 // ---------------- wallet ----------------
@@ -164,8 +184,62 @@ async function refreshWallet() {
   $("withdraw-hint").textContent = pending > 0n
     ? (w.withdrawal.available_at * 1000 > Date.now() ? `已申请取回 ${fmt(w.withdrawal.amount)}，${new Date(w.withdrawal.available_at * 1000).toLocaleString()} 之后可到账。`
       : `已申请的 ${fmt(w.withdrawal.amount)} 可以到账了，点击“取回”。`) : "先申请，等待期结束后再次点击即可到账。";
-  $("chat-hint").textContent = BigInt(w.deposit) === 0n || !w.grant?.active ? "还没有押金：先到“钱包”存入。" : `押金 ${fmt(w.deposit)} tUSDC`;
+  $("chat-hint").textContent = BigInt(w.deposit) === 0n || !w.grant?.active ? "还没有押金。" : `押金 ${fmt(w.deposit)} tUSDC`;
+}
+function renderWelcome() {
+  const ready = status?.wallet && BigInt(status.wallet.deposit) > 0n && status.wallet.grant?.active;
+  $("welcome").style.display = ready ? "none" : "block";
+  $("welcome-create").style.display = status?.wallet ? "none" : "flex";
+  $("welcome-fund").style.display = status?.wallet && !ready ? "flex" : "none";
+}
+$("w-create").onclick = () => busy($("w-create"), async () => {
+  if ($("w-pw").value !== $("w-pw2").value) throw new Error("两次输入的密码不一致");
+  await api("/api/wallet", { password: $("w-pw").value }); $("w-fund-pw").value = $("w-pw").value;
+  await refreshWallet(); renderWelcome(); toast("钱包已创建，下一步：领取测试币并存入押金");
+});
+$("w-fund").onclick = () => busy($("w-fund"), async () => {
+  await api("/api/setup", { password: $("w-fund-pw").value, deposit: toUnits(20), max_per_request: toUnits(2) });
+  $("w-fund-pw").value = ""; await refreshWallet(); renderWelcome(); toast("准备好了，开始提问吧"); $("prompt").focus();
+});
+
+// ---------------- tenants ----------------
+async function refreshTenants() {
+  const { tenants } = await api("/api/tenants");
+  $("tenants").innerHTML = tenants.length ? "" : `<tr><td colspan="6" class="muted">还没有租户。</td></tr>`;
+  for (const t of tenants) {
+    const row = document.createElement("tr");
+    row.innerHTML = `<td>${t.name}</td><td class="mono">${short(t.key)}</td>
+      <td>${fmt(t.spent)} / ${BigInt(t.budget) === 0n ? "不限" : fmt(t.budget)}</td><td>${fmt(t.max_per_request)}</td>
+      <td><span class="chip ${t.revoked ? "disputed" : "released"}">${t.revoked ? "已撤销" : "有效"}</span></td><td></td>`;
+    if (!t.revoked) {
+      const cell = row.lastElementChild;
+      for (const [label, action] of [["调整预算", "budget"], ["撤销", "revoke"]]) {
+        const button = document.createElement("button"); button.className = "ghost"; button.textContent = label; button.style.marginRight = "6px";
+        button.onclick = async () => {
+          const answer = await ask(`${label}：${t.name}`, action === "budget" ? `<label>新的总预算（tUSDC）</label><input id="new-budget" value="${fmt(t.budget)}">` : "");
+          if (!answer) return;
+          await busy(button, async () => {
+            await api(`/api/tenants/${action}`, { password: answer.password, name: t.name,
+              ...(action === "budget" ? { budget: toUnits(answer.form.querySelector("#new-budget").value) } : {}) });
+            toast("已更新"); await refreshTenants();
+          });
+        };
+        cell.append(button);
+      }
+    }
+    $("tenants").append(row);
+  }
 }
+$("t-add").onclick = async () => {
+  const answer = await ask(`添加租户 ${$("t-name").value}`); if (!answer) return;
+  await busy($("t-add"), async () => {
+    const created = await api("/api/tenants", { password: answer.password, name: $("t-name").value.trim(),
+      budget: toUnits($("t-budget").value), max_per_request: toUnits($("t-limit").value) });
+    $("t-created").style.display = "block";
+    $("t-created").textContent = `租户 ${created.name} 的 API key（只显示这一次）：${created.api_key}`;
+    await refreshTenants();
+  });
+};
 $("create-wallet").onclick = () => busy($("create-wallet"), async () => {
   if ($("new-pw").value !== $("new-pw2").value) throw new Error("两次输入的密码不一致");
   await api("/api/wallet", { password: $("new-pw").value }); toast("钱包已创建"); await refreshWallet();
@@ -199,7 +273,7 @@ $("send").onclick = async () => {
   const out = bubble("assistant", "…"); let answer = ""; $("send").disabled = true;
   try {
     const response = await fetch("/v1/chat/completions", { method: "POST", headers: { "content-type": "application/json" },
-      body: JSON.stringify({ model: $("model").value, stream: true, messages: conversation }) });
+      body: JSON.stringify({ model: $("model").value, stream: true, messages: conversation, reasoning_effort: $("speed").value }) });
     if (!response.ok) { const data = await response.json().catch(() => ({})); throw new Error(data.error?.message || `HTTP ${response.status}`); }
     const reader = response.body.getReader(); const decoder = new TextDecoder(); let buffer = "";
     for (;;) {
@@ -264,16 +338,20 @@ async function refreshNetwork() {
   $("network").innerHTML = "";
   for (const relay of relays) {
     const card = document.createElement("div"); card.className = "card"; card.style.marginBottom = "12px";
+    const reputation = (r) => r ? `${fmt(r.counted_volume)} · ${r.counterparties} 个付款方` : "—";
+    const probes = (r) => r ? `通过 ${r.probes_passed} · 验证失败 ${r.probes_failed_verified}` : "—";
+    const fraud = (r) => r && r.last_fraud_at && Date.now() / 1000 < r.last_fraud_at + 30 * 86400 ? `<span class="chip disputed">近期欺诈</span>` : "无";
     card.innerHTML = `<div class="row" style="margin:0"><strong>${relay.url}</strong><span class="chip ${relay.healthy ? "released" : "disputed"}">${relay.healthy ? "在线" : "离线"}</span>
-      <span class="muted mono">签名 ${short(relay.signer)}</span></div>
-      <table style="margin-top:8px"><thead><tr><th>Provider</th><th>模型</th><th>输入</th><th>输出</th><th>最低</th></tr></thead><tbody>${relay.providers.map((p) =>
-        `<tr><td class="mono">${short(p.signer)}</td><td>${p.models.join(", ")}</td><td>${fmt(p.prices.input_per_1k)}</td><td>${fmt(p.prices.output_per_1k)}</td><td>${fmt(p.prices.minimum_fee)}</td></tr>`).join("")
-        || `<tr><td colspan="5" class="muted">没有已连接的 Provider</td></tr>`}</tbody></table>`;
+      <span class="muted mono">签名 ${short(relay.signer)}</span>${relay.pinned ? `<span class="chip">证书指纹已上链</span>` : ""}</div>
+      <table style="margin-top:8px"><thead><tr><th>Provider</th><th>模型</th><th>输入</th><th>输出</th><th>最低</th><th>信誉（计入成交）</th><th>探针</th><th>欺诈</th></tr></thead><tbody>${relay.providers.map((p) =>
+        `<tr><td class="mono">${short(p.signer)}</td><td>${p.models.join(", ")}</td><td>${fmt(p.prices.input_per_1k)}</td><td>${fmt(p.prices.output_per_1k)}</td><td>${fmt(p.prices.minimum_fee)}</td>
+         <td>${reputation(p.reputation)}</td><td>${probes(p.reputation)}</td><td>${fraud(p.reputation)}</td></tr>`).join("")
+        || `<tr><td colspan="8" class="muted">没有已连接的 Provider</td></tr>`}</tbody></table>`;
     $("network").append(card);
   }
 }
 
-refreshWallet().catch((error) => toast(error.message, true));
+refreshWallet().then(renderWelcome).catch((error) => toast(error.message, true));
 refreshNetwork().catch(() => {});
 loadModels().catch(() => {});
 document.querySelector(`nav button[data-tab="${location.hash.slice(1)}"]`)?.click();