sigrank 0.0.178 → 0.0.179

package/keystore.mjs

@@ -1,242 +1 @@
-// keystore.mjs — local ed25519 device identity for SigRank signed submit (D7 §4.5).
-//
-// Persists a per-device keypair at ~/.sigrank-mcp/identity.json (dir 0700, file 0600).
-// The PRIVATE key never leaves this machine; only the raw 32-byte public key (as
-// "ed25519:<base64>") is sent to the server at enroll time. The device_id (uuid) is
-// generated once and is the immutable binding target server-side.
-//
-// Public-key export MUST match the server's publicKeyFromAgent: generateKeyPairSync
-// exports SPKI DER with a 12-byte prefix; we strip it to the raw 32 bytes, base64 it,
-// and prefix "ed25519:". The server re-adds the SPKI prefix to verify. Round-trip is
-// locked by sign.test.mjs + the canon-parity fixture.
-
-import { homedir } from "node:os";
-import { join } from "node:path";
-import {
-  mkdirSync,
-  readFileSync,
-  writeFileSync,
-  existsSync,
-  chmodSync,
-  unlinkSync,
-  readdirSync,
-  copyFileSync,
-} from "node:fs";
-import { generateKeyPairSync, randomUUID } from "node:crypto";
-
-const DIR = join(homedir(), ".sigrank-mcp");
-const PATH = join(DIR, "identity.json");
-const BACKUP_PREFIX = "identity.json.bak-";
-const MAX_BACKUPS = 5;
-
-/** SPKI DER prefix length for an ed25519 public key (12 bytes before the raw 32). */
-const SPKI_PREFIX_LEN = 12;
-
-/** Resolve this package's version for the agent_version stamp (best-effort). */
-function agentVersion() {
-  try {
-    const pkg = JSON.parse(
-      readFileSync(new URL("./package.json", import.meta.url), "utf-8"),
-    );
-    return `sigrank-mcp/${pkg.version}`;
-  } catch {
-    return "sigrank-mcp";
-  }
-}
-
-export function keystorePath() {
-  return PATH;
-}
-
-/** Read the stored identity, or null if absent/corrupt. */
-export function loadIdentity() {
-  if (!existsSync(PATH)) return null;
-  try {
-    return JSON.parse(readFileSync(PATH, "utf-8"));
-  } catch {
-    return null;
-  }
-}
-
-/** Write the identity with strict perms (dir 0700, file 0600). Backs up the existing
- * file before overwriting so a corrupt write or accidental reset can be recovered. */
-export function persistIdentity(identity) {
-  mkdirSync(DIR, { recursive: true });
-  try {
-    chmodSync(DIR, 0o700);
-  } catch {
-    /* best-effort on platforms without chmod */
-  }
-  // Back up the existing identity before overwriting (resilience: if the write
-  // fails or the file is later lost, the backup carries the binding + keys).
-  if (existsSync(PATH)) {
-    try {
-      const stamp = Date.now();
-      copyFileSync(PATH, join(DIR, `${BACKUP_PREFIX}${stamp}`));
-      pruneBackups();
-    } catch {
-      /* best-effort — don't block the write */
-    }
-  }
-  writeFileSync(PATH, `${JSON.stringify(identity, null, 2)}\n`, {
-    mode: 0o600,
-  });
-  try {
-    chmodSync(PATH, 0o600);
-  } catch {
-    /* best-effort */
-  }
-  return identity;
-}
-
-/** Build a fresh keypair record (pure — no fs). Exposed for tests. */
-export function generateIdentity({ device_id } = {}) {
-  const { publicKey, privateKey } = generateKeyPairSync("ed25519");
-  const spki = publicKey.export({ type: "spki", format: "der" });
-  const rawPub = Buffer.from(spki).subarray(SPKI_PREFIX_LEN); // the raw 32 bytes
-  const pkcs8 = privateKey.export({ type: "pkcs8", format: "der" });
-  return {
-    device_id: device_id || randomUUID(),
-    codename: null,
-    operator_id: null,
-    public_key: `ed25519:${rawPub.toString("base64")}`,
-    private_key_pkcs8_b64: Buffer.from(pkcs8).toString("base64"),
-    agent_version: agentVersion(),
-    enrolled_at: null,
-  };
-}
-
-/**
- * Decide the binding (codename/operator_id/enrolled_at) to carry onto a freshly
- * generated identity. The binding is tied to device_id: if device_id is CHANGING
- * (a new device, e.g. after a reset/re-enroll where the old file was deleted), the
- * old binding is INVALIDATED — never preserve a stale codename/operator onto a
- * different device. That mismatch is the "Frankenstein identity" root cause: a new
- * device_id + an old codename → the server sees a mismatch → tags submissions
- * `unverified` → never ranks, yet `isSignedIn` reads the local codename as present.
- * Only reuse the binding when the SAME device_id is being kept. Pure — exposed for
- * tests (no fs, so the owner's live identity is never at risk during a test run).
- */
-export function bindingForFreshIdentity(existing, fresh) {
-  if (!existing)
-    return { codename: null, operator_id: null, enrolled_at: null };
-  if (existing.device_id && fresh.device_id === existing.device_id) {
-    return {
-      codename: existing.codename ?? null,
-      operator_id: existing.operator_id ?? null,
-      enrolled_at: existing.enrolled_at ?? null,
-    };
-  }
-  // device_id changed → the old binding belongs to a different device; drop it.
-  return { codename: null, operator_id: null, enrolled_at: null };
-}
-
-/**
- * Load the existing identity, or generate + persist a fresh one. Idempotent: a
- * complete existing identity is returned untouched (never rotates a live key).
- * Self-healing: if the identity has keys + device_id but no codename (binding
- * lost via partial write / version transition), scans backups for a matching
- * device_id and restores the binding before returning.
- */
-export function ensureIdentity() {
-  const existing = loadIdentity();
-  if (
-    existing?.private_key_pkcs8_b64 &&
-    existing?.public_key &&
-    existing?.device_id
-  ) {
-    // Self-healing: keys present but binding lost → try to restore from backups.
-    if (!existing.codename || !existing.operator_id) {
-      const restored = restoreBindingFromBackups(existing.device_id);
-      if (restored) {
-        existing.codename = restored.codename;
-        existing.operator_id = restored.operator_id;
-        existing.enrolled_at = restored.enrolled_at;
-        return persistIdentity(existing);
-      }
-    }
-    return existing;
-  }
-  // Regeneration path: a partial/corrupt record. The binding is tied to device_id —
-  // if a new device_id is generated, the old codename/operator MUST NOT carry over
-  // (bindingForFreshIdentity drops them). Only a reused device_id keeps its binding.
-  const fresh = generateIdentity({ device_id: existing?.device_id });
-  const binding = bindingForFreshIdentity(existing, fresh);
-  fresh.codename = binding.codename;
-  fresh.operator_id = binding.operator_id;
-  fresh.enrolled_at = binding.enrolled_at;
-  return persistIdentity(fresh);
-}
-
-/** Record a successful enrollment (codename/operator_id + enrolled_at) into the keystore. */
-export function recordEnrollment({ codename, operator_id }) {
-  const id = ensureIdentity();
-  // OVERWRITE from the server's enroll response — a new enroll is a new binding, full
-  // stop. Never `??`-preserve a stale codename/operator onto this device (the other
-  // half of the Frankenstein bug: a re-enroll used to keep the old codename when the
-  // new one was absent). A 201 enrolled always carries both.
-  id.codename = codename ?? null;
-  id.operator_id = operator_id ?? null;
-  id.enrolled_at = new Date().toISOString();
-  return persistIdentity(id);
-}
-
-/** Clear the local identity (sign out). Next enroll provisions a fresh device_id. */
-export function clearIdentity() {
-  try {
-    if (existsSync(PATH)) unlinkSync(PATH);
-  } catch {
-    /* best-effort */
-  }
-}
-
-/** Keep at most MAX_BACKUPS backup files (oldest deleted first). */
-function pruneBackups() {
-  try {
-    const files = readdirSync(DIR)
-      .filter((f) => f.startsWith(BACKUP_PREFIX))
-      .sort(); // timestamp-suffixed → lexicographic = chronological
-    while (files.length > MAX_BACKUPS) {
-      unlinkSync(join(DIR, files.shift()));
-    }
-  } catch {
-    /* best-effort */
-  }
-}
-
-/** Scan backup files for one with the same device_id that carries a codename +
- * operator_id binding. Returns { codename, operator_id, enrolled_at } or null.
- * Used by ensureIdentity() to self-heal when the live file lost its binding
- * (e.g. a partial write or version transition that preserved keys but dropped
- * the binding metadata). Only restores from a backup with the SAME device_id —
- * never crosses device boundaries (Frankenstein-identity guard). */
-export function restoreBindingFromBackups(device_id) {
-  if (!device_id) return null;
-  try {
-    const files = readdirSync(DIR)
-      .filter((f) => f.startsWith(BACKUP_PREFIX))
-      .sort()
-      .reverse(); // newest first — prefer the most recent binding
-    for (const f of files) {
-      try {
-        const bak = JSON.parse(readFileSync(join(DIR, f), "utf-8"));
-        if (
-          bak.device_id === device_id &&
-          bak.codename &&
-          bak.operator_id
-        ) {
-          return {
-            codename: bak.codename,
-            operator_id: bak.operator_id,
-            enrolled_at: bak.enrolled_at ?? null,
-          };
-        }
-      } catch {
-        /* skip corrupt backups */
-      }
-    }
-  } catch {
-    /* best-effort */
-  }
-  return null;
-}
+export * from './identity/keystore.mjs';

package/narrate.mjs

@@ -1,77 +1 @@
-/**
- * narrate.mjs — deterministic prose "card" for a cascade result.
- *
- * Port of _template() from ~/Desktop/moses-sigrank/narrate.py. The model path
- * (MiniCPM4-0.5B) is intentionally SKIPPED: the template is the trustworthy,
- * instant, auditable fallback — same numbers in → same card out, and it can never
- * emit a metric the cascade didn't produce. A model hook can layer behind this same
- * narrate() interface later without a rewrite.
- *
- * Token-only. No network, no randomness.
- */
-
-// Safe formatters: never emit NaN/Infinity/undefined into the card.
-const safeNum = (n) => (Number.isFinite(Number(n)) ? Number(n) : null);
-const comma = (n, dec) => {
-  const v = safeNum(n);
-  return v !== null
-    ? v.toLocaleString("en-US", {
-        minimumFractionDigits: dec,
-        maximumFractionDigits: dec,
-      })
-    : "—";
-};
-const plain = (n, dec) => {
-  const v = safeNum(n);
-  return v !== null ? v.toFixed(dec) : "—";
-};
-
-/**
- * Given a cascade result ({ velocity, leverage, dev10x, pillars, class }) and an
- * optional subject name, return "**CLASS.** <one or two sentences>". Deterministic.
- */
-export function narrate(cascade, name = "This operator") {
-  const klass = cascade.class || cascade.klass || "UNCLASSED";
-  const v = safeNum(cascade.velocity);
-  const l = safeNum(cascade.leverage);
-
-  // "non-compounding" = a stateless pipe: no cache commits, so the cascade can't
-  // form. cascade.mjs leaves dev10x null when cacheCreate is 0 (the cw/o term
-  // collapses), which is exactly metrics.py's non_compounding flag.
-  // Also catches zero-input sessions where velocity/leverage are null.
-  const cw = cascade.pillars ? Number(cascade.pillars.cacheCreate) : NaN;
-  const nonCompounding =
-    cascade.dev10x == null || !(cw > 0) || v === null || l === null;
-
-  let body;
-  if (nonCompounding) {
-    const leverageStr =
-      l !== null
-        ? `Leverage ${comma(l, 1)}x comes from reuse alone.`
-        : "Leverage is undefined (no fresh input recorded).";
-    const dev10xNote =
-      cascade.dev10x == null
-        ? " 10xDEV is undefined — the compounding loop has not formed yet."
-        : "";
-    body =
-      `${name} runs a stateless pipe — no cache commits, so the cascade can't form. ` +
-      `High read volume, but nothing is being built forward. ${leverageStr}${dev10xNote}`;
-  } else if (v >= 1 && l >= 100) {
-    body =
-      `${name} holds both axes at once: ${plain(v, 1)}x generation AND ${comma(l, 0)}x memory leverage. ` +
-      `A closed kinetic loop — the rare operator the leverage/generation tradeoff says shouldn't exist.`;
-  } else if (l >= 10 && v < 1) {
-    body =
-      `${name} is an archival sponge — ${comma(l, 0)}x reuse but only ${plain(v, 2)}x generation. ` +
-      `Holds context beautifully, executes little with it. The reuse number is inflated by a weak commitment stage.`;
-  } else if (v >= 0.8 && l < 2) {
-    body =
-      `${name} is a volatile ingestor — ${plain(v, 2)}x generation but ${plain(l, 1)}x leverage. ` +
-      `Fast on single shots, resets between turns. Memory doesn't persist into a compounding loop.`;
-  } else {
-    body =
-      `${name} sits low on both axes: ${plain(v, 2)}x generation, ${plain(l, 1)}x leverage. ` +
-      `A transient profile — neither building state nor converting input to output efficiently.`;
-  }
-  return `**${klass}.** ${body}`;
-}
+export * from './presentation/narrate.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "0.0.178",
+  "version": "0.0.179",
   "author": "SunrisesIllNeverSee (https://github.com/SunrisesIllNeverSee)",
   "description": "SigRank MCP server — the yield cascade + live leaderboard as MCP tools any agent can call",
   "mcpName": "io.github.SunrisesIllNeverSee/sigrank-mcp",
@@ -24,26 +24,39 @@
   },
   "scripts": {
     "start": "node index.mjs",
-    "test": "node test.mjs && node sign.test.mjs && node --test __tests__/cascade.test.mjs __tests__/badges.test.mjs",
-    "sync:platforms": "node scripts/sync-platforms.mjs"
+    "test": "node test.mjs && node __tests__/sign.test.mjs && node --test __tests__/cascade.test.mjs __tests__/badges.test.mjs __tests__/tui-input.test.mjs",
+    "sync:platforms": "node scripts/sync-platforms.mjs",
+    "sync:spine": "node scripts/sync-spine.mjs",
+    "spine:check": "node scripts/sync-spine.mjs --check",
+    "spine:diff": "node scripts/sync-spine.mjs --dry-run"
   },
   "files": [
     "index.mjs",
-    "cli.mjs",
-    "tui.mjs",
-    "tools.mjs",
+    "tools/",
+    "analytics/",
+    "identity/",
+    "submit/",
+    "adapters/",
+    "presentation/",
+    "resources/",
+    "prompts/",
+    "badges.mjs",
+    "review.mjs",
     "cascade.mjs",
-    "narrate.mjs",
-    "tokenpull.mjs",
-    "adapters.mjs",
-    "sign.mjs",
     "keystore.mjs",
-    "submit.mjs",
+    "sign.mjs",
     "connect.mjs",
-    "badges.mjs",
+    "submit.mjs",
     "preflight.mjs",
-    "banner.svg",
+    "adapters.mjs",
+    "tokenpull.mjs",
+    "tui.mjs",
+    "cli.mjs",
+    "narrate.mjs",
+    "tools.mjs",
     "README.md",
+    "CHANGELOG.md",
+    "MCP_SERVER_DESCRIPTION.md",
     "LICENSE"
   ],
   "keywords": [
@@ -67,5 +80,8 @@
     "@modelcontextprotocol/sdk": "^1.0.0",
     "ccusage": "^20.0.17",
     "tokscale": "^4.5.2"
+  },
+  "overrides": {
+    "@hono/node-server": "^2.0.5"
   }
 }

package/preflight.mjs

@@ -1,191 +1 @@
-/**
- * preflight.mjs — local plausibility pre-checks for the MCP submit path.
- *
- * Mirrors ONLY the server's public plausibility gate (gates.ts:86-137) —
- * totals consistency, turns/sessions ratios, output rate, cache ratio,
- * cadence. These are integrity guards labeled "NOT the proprietary RS.xx"
- * and are safe to replicate in an open agent.
- *
- * The proprietary battery (Benford / cadence / contamination) is SERVER-ONLY
- * and must NOT be shipped in the agent. The server always runs its own
- * battery after the POST — this preflight is a client-side preview of the
- * public plausibility checks only, not a replacement for the full gate chain.
- *
- * If preflight flags, the operator sees WHY their submission would be
- * rejected or flagged, and can fix the issue or submit anyway.
- *
- * Source of truth: lib/ingest/gates.ts (plausibilityGate). This port must
- * stay in sync with the plausibility gate ONLY.
- */
-
-// ── plausibility checks (from gates.ts:86-137) ──────────────────────────────
-
-const GATE_LIMITS = {
-  TOTALS_TOLERANCE_FRAC: 0.01,
-  MAX_OUTPUT_TOKENS_PER_MIN: 20_000,
-  // Tightened range-plausibility bounds (deviewreview3)
-  MAX_CACHE_REUSE_RATIO: 35,
-  MIN_CACHE_WRITE_RATIO: 0.5,
-  MIN_INPUT_SHARE_FRAC: 0.0003,
-  MAX_CADENCE_PER_MIN: 15,
-};
-
-/**
- * Run plausibility checks against a payload's raw_telemetry.
- * Returns array of issues: { severity, code, detail }
- */
-export function plausibilityCheck(rt, window) {
-  const out = [];
-  const pillars =
-    rt.tokens_input_fresh +
-    rt.tokens_output +
-    rt.tokens_cache_read +
-    rt.tokens_cache_creation;
-
-  if (rt.tokens_total > 0) {
-    const tol = Math.max(
-      1,
-      rt.tokens_total * GATE_LIMITS.TOTALS_TOLERANCE_FRAC,
-    );
-    if (Math.abs(pillars - rt.tokens_total) > tol) {
-      out.push({
-        severity: "reject",
-        code: "totals_inconsistent",
-        detail: `Σ4 pillars (${pillars}) ≠ tokens_total (${rt.tokens_total})`,
-      });
-    }
-    if (rt.sessions_count === 0) {
-      out.push({
-        severity: "reject",
-        code: "tokens_without_sessions",
-        detail: `tokens_total ${rt.tokens_total} with sessions_count 0`,
-      });
-    }
-  }
-  if (rt.turns_total < rt.sessions_count) {
-    out.push({
-      severity: "reject",
-      code: "turns_lt_sessions",
-      detail: `turns_total ${rt.turns_total} < sessions_count ${rt.sessions_count}`,
-    });
-  }
-  if (rt.tokens_output > 0 && rt.turns_total === 0) {
-    out.push({
-      severity: "reject",
-      code: "output_without_turns",
-      detail: `tokens_output ${rt.tokens_output} with turns_total 0`,
-    });
-  }
-
-  if (window) {
-    const spanMin =
-      (Date.parse(window.end) - Date.parse(window.start)) / 60_000;
-    if (Number.isFinite(spanMin) && rt.active_minutes_est > spanMin + 1) {
-      out.push({
-        severity: "flag",
-        code: "active_exceeds_window",
-        detail: `active_minutes_est ${rt.active_minutes_est} > window span ${Math.round(spanMin)}m`,
-      });
-    }
-  }
-
-  const outPerMin = rt.tokens_output / Math.max(rt.active_minutes_est, 1);
-  if (outPerMin > GATE_LIMITS.MAX_OUTPUT_TOKENS_PER_MIN) {
-    out.push({
-      severity: "flag",
-      code: "implausible_output_rate",
-      detail: `${Math.round(outPerMin)} output tok/min > ${GATE_LIMITS.MAX_OUTPUT_TOKENS_PER_MIN}`,
-    });
-  }
-
-  // Cross-field ratio checks (defense-in-depth — also in the plausibility gate)
-  // Bounds tightened (deviewreview3): original 100:1 + 50/min were too loose.
-  if (rt.tokens_cache_read > 1_000 && rt.tokens_cache_creation === 0) {
-    out.push({
-      severity: "flag",
-      code: "cache_without_creation",
-      detail: `${rt.tokens_cache_read} cache_read with 0 cache_creation (impossible cascade)`,
-    });
-  }
-  if (
-    rt.tokens_cache_creation > 0 &&
-    rt.tokens_cache_read / rt.tokens_cache_creation >
-      GATE_LIMITS.MAX_CACHE_REUSE_RATIO
-  ) {
-    out.push({
-      severity: "flag",
-      code: "extreme_cache_ratio",
-      detail: `cache_read/cache_creation = ${(rt.tokens_cache_read / rt.tokens_cache_creation).toFixed(1)}:1 (real max ~30:1)`,
-    });
-  }
-  if (
-    rt.tokens_output > 1_000 &&
-    rt.tokens_cache_creation / rt.tokens_output <
-      GATE_LIMITS.MIN_CACHE_WRITE_RATIO
-  ) {
-    out.push({
-      severity: "flag",
-      code: "low_cache_write_ratio",
-      detail: `cache_creation/output = ${(rt.tokens_cache_creation / rt.tokens_output).toFixed(2)}:1 (real min ~1.5:1)`,
-    });
-  }
-  if (
-    pillars > 10_000 &&
-    rt.tokens_input_fresh / pillars < GATE_LIMITS.MIN_INPUT_SHARE_FRAC
-  ) {
-    out.push({
-      severity: "flag",
-      code: "implausible_input_share",
-      detail: `input is ${((rt.tokens_input_fresh / pillars) * 100).toFixed(3)}% of total (real min ~0.3%)`,
-    });
-  }
-  if (
-    rt.active_minutes_est > 0 &&
-    rt.turns_total / rt.active_minutes_est > GATE_LIMITS.MAX_CADENCE_PER_MIN
-  ) {
-    out.push({
-      severity: "flag",
-      code: "implausible_cadence",
-      detail: `${(rt.turns_total / rt.active_minutes_est).toFixed(1)} turns/min (real: 0.5-10)`,
-    });
-  }
-
-  return out;
-}
-
-// ── full preflight (plausibility only — NO battery) ─────────────────────────
-
-/**
- * Run preflight plausibility checks against a payload. Returns:
- *   { pass: true, issues: [] }                    — clean submission
- *   { pass: false, issues: [...], wouldDowngrade } — would be flagged/rejected
- *
- * NOTE: this only mirrors the PUBLIC plausibility gate. The server runs
- * additional proprietary checks (the battery) that this preflight does NOT
- * replicate. A "pass" here means "passes the plausibility gate," not
- * "guaranteed to pass all server gates."
- */
-export function preflight(payload) {
-  const issues = plausibilityCheck(payload.raw_telemetry, payload.window);
-
-  const hasReject = issues.some((i) => i.severity === "reject");
-  const hasFlag = issues.some((i) => i.severity === "flag");
-
-  return {
-    pass: issues.length === 0,
-    wouldReject: hasReject,
-    wouldDowngrade: hasFlag,
-    issues,
-    summary: hasReject
-      ? `REJECT: ${issues
-          .filter((i) => i.severity === "reject")
-          .map((i) => i.code)
-          .join(", ")}`
-      : hasFlag
-        ? `FLAG (verified → flagged, not ranked): ${issues
-            .filter((i) => i.severity === "flag")
-            .map((i) => i.code)
-            .join(", ")}`
-        : "clean — passes plausibility gate (server runs additional proprietary checks)",
-  };
-}
+export * from './submit/preflight.mjs';