sigrank 0.15.4 → 0.16.0

package/README.md

@@ -12,10 +12,14 @@ For all builders, burners and 10xers.
 
 [![npm version](https://img.shields.io/npm/v/sigrank.svg?style=flat-square&color=gold)](https://www.npmjs.com/package/sigrank)
 [![CI](https://github.com/SunrisesIllNeverSee/sigrank-mcp/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/SunrisesIllNeverSee/sigrank-mcp/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/SunrisesIllNeverSee/sigrank-mcp/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/SunrisesIllNeverSee/sigrank-mcp/actions/workflows/codeql.yml)
+[![audit](https://github.com/SunrisesIllNeverSee/sigrank-mcp/actions/workflows/dependency-audit.yml/badge.svg?branch=main)](https://github.com/SunrisesIllNeverSee/sigrank-mcp/actions/workflows/dependency-audit.yml)
+[![Dependabot](https://img.shields.io/badge/Dependabot-enabled-025E8C?style=flat-square&logo=dependabot)](https://github.com/SunrisesIllNeverSee/sigrank-mcp/network/dependencies)
 [![license](https://img.shields.io/badge/license-MIT-green.svg?style=flat-square)](./LICENSE)
 [![platform](https://img.shields.io/badge/platform-node-grey.svg?style=flat-square)](https://nodejs.org)
 [![live](https://img.shields.io/badge/board-signalaf.com-gold.svg?style=flat-square)](https://signalaf.com)
 [![SunrisesIllNeverSee/sigrank-mcp MCP server](https://glama.ai/mcp/servers/SunrisesIllNeverSee/sigrank-mcp/badges/score.svg)](https://glama.ai/mcp/servers/SunrisesIllNeverSee/sigrank-mcp)
+[![Smithery](https://smithery.ai/badge/burnmydays/sigrank-mcp)](https://smithery.ai/servers/burnmydays/sigrank-mcp)
 
 </div>
 
@@ -72,13 +76,44 @@ sigrank
 **Repo:** [`SunrisesIllNeverSee/sigrank-mcp`](https://github.com/SunrisesIllNeverSee/sigrank-mcp)
 **Site:** [signalaf.com](https://signalaf.com)
 **npm:** [sigrank](https://www.npmjs.com/package/sigrank)
+**Smithery:** [smithery.ai/servers/burnmydays/sigrank-mcp](https://smithery.ai/servers/burnmydays/sigrank-mcp)
+**Glama:** [glama.ai/mcp/servers/SunrisesIllNeverSee/sigrank-mcp](https://glama.ai/mcp/servers/SunrisesIllNeverSee/sigrank-mcp)
+
+---
+
+## Install via Smithery
+
+SigRank is available on [Smithery](https://smithery.ai/servers/burnmydays/sigrank-mcp) as a stdio MCP bundle — one-click install for Claude Desktop, Cursor, and other MCP clients.
+
+### Smithery CLI
+
+```bash
+# Install Smithery CLI
+npm install -g smithery
+
+# Connect to SigRank (downloads the MCPB bundle locally)
+smithery mcp add burnmydays/sigrank-mcp --id sigrank
+
+# List available tools
+smithery tool list sigrank
+
+# Call a tool
+smithery tool call sigrank get_leaderboard '{}'
+smithery tool call sigrank rank_paste '{"text": "1000000 500000 50000 800000"}'
+```
+
+### Claude Desktop (via Smithery)
+
+1. Go to [smithery.ai/servers/burnmydays/sigrank-mcp](https://smithery.ai/servers/burnmydays/sigrank-mcp)
+2. Click **Install**
+3. Smithery handles the rest — no manual config editing
 
 ---
 
 ## Commands
 
 ```
-⊙ SigRank CLI  v0.14.2
+⊙ SigRank CLI  v0.15.5
 
 Default (no args)
   sigrank              unified dashboard: cascade + token pillars + board
@@ -93,11 +128,12 @@ Commands
   compare --platform codex compare for a specific platform
   tui                      full tabbed TUI: Dashboard / Trends / Compare / Board / Watch / Connect
   tui --platform codex     TUI with a different default platform
-  watch                    live tune meter — re-reads local logs every 30s
-  watch --window 7d        watch a specific window
+  watch                    live tune meter — ALL active platforms × all windows, every 30s
+  watch --platform codex   watch only one platform (optional filter)
+  watch --window 7d        watch only one window (optional filter)
 
 Options
-  --window    7d · 30d · 90d · all  (default: 30d for board, 7d for watch)
+  --window    7d · 30d · 90d · all  (default: 30d for board; all windows for watch)
   --platform  claude · codex · amp · gemini · opencode · goose · …
   --refresh   poll interval in seconds (default: 30)
   --once      print once and exit (board only)
@@ -188,6 +224,10 @@ Or if installed globally:
 | `watch_tokenpull` | `{platform?, interval_s?}` | One cascade snapshot per call (interval_s advisory) |
 | `submit_verified` | `{window?, platform?, dry_run?}` | THE ranked path: builds + ed25519-signs Schema 1.0 snapshots and POSTs them. `platform:'multi'` sums all active platforms. `dry_run:true` returns the exact payload unsent |
 | `enroll` | `{code, device_label?}` | Bind this device with a connect code from signalaf.com → Settings |
+| `diagnose_cascade` | `{text?}` | Diagnoses where your token cascade is leaking efficiency — ranked findings with severity + estimated Υ impact |
+| `simulate_change` | `{text?, changes}` | Prescriptive "what if" — test proposed pillar changes and see the exact Υ delta + class change before committing |
+| `suggest_improvements` | `{text?}` | Generates ranked, simulated improvement suggestions — tests strategies and returns them sorted by Υ yield impact |
+| `self_improve` | `{text?}` | One-click optimize: diagnoses, suggests, and simulates the best change in a single call |
 
 ---
 
@@ -277,11 +317,12 @@ All adapters are token-only (no message content, no cost fields, no credentials)
 ## Dev / test
 
 ```bash
-node test.mjs          # 29 unit tests (no network, no fs writes)
+node test.mjs          # 13 test groups, 200 assertions (no network, no fs writes)
+node sign.test.mjs     # ed25519 signing + canon parity
 node index.mjs         # stdio MCP server directly (pipe to MCP client)
 ```
 
-Tests verify (29 assertions):
+Tests verify (13 groups, 200 assertions):
 - `rank_paste` canon: MO§ES `(1251211, 11296121, 128196310, 2555179769)` → Υ 18436.98 · TRANSMITTER
 - `submit_paste` preview (no codename) + POST shape (injected fetch, no live writes)
 - `tokenpull` dedup, window slicing, 4-window pillars (mock adapter)
@@ -289,8 +330,12 @@ Tests verify (29 assertions):
 - `tokenpullCodex` io_ratio conversion per-window
 - Adapter registry (15 platforms) + per-adapter shape contracts
 - `rank_windows` 4-window paste scoring, partial input, no-network
-- `watch_tokenpull` cascade snapshot, interval_s, TODO(AUTH.WIRE) stub
+- `watch_tokenpull` cascade snapshot, interval_s, submit path
+- `enroll` posts identity (public key only), maps 201 enrolled + 410 code_invalid
+- `submit_verified` signs Schema 1.0, server-verifiable
+- `simulate_change` relative + absolute deltas, quadratic penalty, JSON input
 - Hardening: div-by-zero guards, parsePillars warnings, fetch timeout, EXCLUDE_TOOLING regex, narrate safety
+- `sign.test.mjs` ed25519 round-trip + canonical 926-byte payload parity
 
 ---
 
@@ -310,4 +355,6 @@ Tests verify (29 assertions):
 | `submit.mjs` | Verified submit flow (signs + POSTs to board) |
 | `sign.mjs` | Schema 1.0 signing (X-Agent-Signature) |
 | `narrate.mjs` | Deterministic prose narration card |
+| `preflight.mjs` | Plausibility checks (Benford, bounds, anomaly detection) |
 | `test.mjs` | Unit tests (no external deps) |
+| `sign.test.mjs` | ed25519 signing + canon parity test |

package/adapters.mjs

@@ -33,7 +33,7 @@
  */
 
 import { readdir, readFile } from 'node:fs/promises'
-import { join, extname } from 'node:path'
+import { join, dirname } from 'node:path'
 import { homedir } from 'node:os'
 import { execFile as execFileCb } from 'node:child_process'
 import { promisify } from 'node:util'
@@ -212,10 +212,6 @@ export const openclawAdapter = {
   defaultRoot: () => {
     const env = process.env.OPENCLAW_DIR
     if (env) return env.split(',')[0].trim()
-    for (const d of ['.openclaw', '.clawdbot', '.moltbot', '.moldbot']) {
-      const p = join(homedir(), d)
-      return p // return first; walkFiles silently skips missing
-    }
     return join(homedir(), '.openclaw')
   },
   async *messages(root) {
@@ -245,6 +241,9 @@ export const openclawAdapter = {
 // ~/.factory/sessions/**/*.settings.json
 // Fields: input_tokens, output_tokens, cache_creation_tokens, cache_read_tokens, thinking_tokens
 // Thinking tokens → output. Per-settings-file (session-level granularity).
+// CUMULATIVE-COLUMN GUARD: settings files contain session-level totals. If the same session
+// appears in multiple files, summing double-counts. We set both id and sid to the session id
+// so tokenpull()'s (sid|id) keep-last dedup collapses duplicates to the latest values.
 export const droidAdapter = {
   platform: 'droid',
   defaultRoot: () => join(homedir(), '.factory', 'sessions'),
@@ -260,7 +259,8 @@ export const droidAdapter = {
         const cacheCreate = Number(s.cache_creation_tokens || 0)
         const cacheRead   = Number(s.cache_read_tokens     || 0)
         if (input + output + cacheCreate + cacheRead === 0) continue
-        yield { id: null, sid: s.session_id || s.id || null, ts: s.updated_at || s.created_at || null, input, output, cacheCreate, cacheRead, file: path }
+        const sessionId = String(s.session_id || s.id || '')
+        yield { id: sessionId, sid: sessionId, ts: s.updated_at || s.created_at || null, input, output, cacheCreate, cacheRead, file: path }
       }
     }
   },
@@ -345,7 +345,7 @@ export const copilotAdapter = {
   defaultRoot: () => join(homedir(), '.copilot', 'otel'),
   async *messages(root) {
     const dir = process.env.COPILOT_OTEL_FILE_EXPORTER_PATH
-      ? require('node:path').dirname(process.env.COPILOT_OTEL_FILE_EXPORTER_PATH)
+      ? dirname(process.env.COPILOT_OTEL_FILE_EXPORTER_PATH)
       : root
     for await (const path of walkFiles(dir, isJsonl)) {
       const text = await readUtf8(path)
@@ -387,6 +387,10 @@ export const opencodeAdapter = {
 // SQLite: sessions.db at standard Goose data roots or $GOOSE_PATH_ROOT/data/sessions/sessions.db
 // Columns: accumulated_input_tokens (or input_tokens), accumulated_output_tokens (or output_tokens),
 //          accumulated_total_tokens (or total_tokens). NO cache fields. Reasoning = total-input-output.
+// CUMULATIVE-COLUMN GUARD: accumulated_* columns are per-session running totals. If the sessions
+// table has multiple rows per session id, summing them downstream double-counts. We set both sid
+// and id to the session id and ORDER BY updated_at so tokenpull()'s (sid|id) keep-last dedup
+// collapses duplicate session rows to the latest (max accumulated) values.
 export const gooseAdapter = {
   platform: 'goose',
   estimated: true, // no cacheCreate or cacheRead
@@ -405,14 +409,17 @@ export const gooseAdapter = {
           join(homedir(), '.local', 'share', 'Block', 'goose', 'sessions', 'sessions.db'),
         ]
     for (const db of dbCandidates) {
-      const rows = await sqliteJson(db, 'SELECT * FROM sessions')
+      // ORDER BY updated_at so the latest cumulative row per session is yielded last
+      // (tokenpull keep-last dedup picks the final row = max accumulated values).
+      const rows = await sqliteJson(db, 'SELECT * FROM sessions ORDER BY updated_at')
       for (const row of rows) {
         const input  = Number(row.accumulated_input_tokens  || row.input_tokens  || 0)
         const output = Number(row.accumulated_output_tokens || row.output_tokens || 0)
         const total  = Number(row.accumulated_total_tokens  || row.total_tokens  || 0)
         const reasoning = Math.max(0, total - input - output) // folded into output
         if (input + output === 0) continue
-        yield { id: String(row.id || ''), sid: null, ts: row.created_at || row.updated_at || null, input, output: output + reasoning, cacheCreate: 0, cacheRead: 0, file: db }
+        const sessionId = String(row.id || row.session_id || '')
+        yield { id: sessionId, sid: sessionId, ts: row.created_at || row.updated_at || null, input, output: output + reasoning, cacheCreate: 0, cacheRead: 0, file: db }
       }
     }
   },
@@ -441,13 +448,18 @@ export const kiloAdapter = {
 // ── 13. Hermes Agent ─────────────────────────────────────────────────────────
 // SQLite: ~/.hermes/state.db
 // Per-session rows: input, output, cache_read, cache_write (=cacheCreate), reasoning_tokens → output
+// CUMULATIVE-COLUMN GUARD: session rows may contain cumulative totals. If the same session
+// appears in multiple rows, summing double-counts. We set both id and sid to the session id
+// and ORDER BY updated_at so tokenpull()'s (sid|id) keep-last dedup collapses duplicates
+// to the latest values.
 export const hermesAdapter = {
   platform: 'hermes',
   defaultRoot: () => join(homedir(), '.hermes'),
   async *messages(root) {
     for (const r of roots('HERMES_HOME', root)) {
       const dbPath = join(r, 'state.db')
-      const rows = await sqliteJson(dbPath, 'SELECT * FROM sessions')
+      // ORDER BY updated_at so the latest cumulative row per session is yielded last.
+      const rows = await sqliteJson(dbPath, 'SELECT * FROM sessions ORDER BY updated_at')
       for (const row of rows) {
         const input     = Number(row.input    || 0)
         const reasoning = Number(row.reasoning_tokens || 0)
@@ -455,7 +467,8 @@ export const hermesAdapter = {
         const cacheCreate = Number(row.cache_write || row.cache_creation || 0)
         const cacheRead   = Number(row.cache_read  || 0)
         if (input + output + cacheCreate + cacheRead === 0) continue
-        yield { id: String(row.id || ''), sid: null, ts: row.created_at || row.updated_at || null, input, output, cacheCreate, cacheRead, file: dbPath }
+        const sessionId = String(row.id || row.session_id || '')
+        yield { id: sessionId, sid: sessionId, ts: row.created_at || row.updated_at || null, input, output, cacheCreate, cacheRead, file: dbPath }
       }
     }
   },

package/badges.mjs

@@ -0,0 +1,163 @@
+/**
+ * badges.mjs — pure badge computation for the Cascade Report System.
+ *
+ * 8 launch badges. Pure functions — take history + current pillars, return
+ * badge collection + progress. No deps, no transport, no network.
+ *
+ * Badge types:
+ *   Permanent — once earned, always earned (First Spark, Cascade Engine, etc.)
+ *   Current   — must be maintained (Cascade Streak, Top 10)
+ *
+ * Badge states:
+ *   earned     — condition met, badge is in the collection
+ *   in_progress — condition not yet met, but progress is trackable
+ *   locked     — condition not met, no progress to show (not returned)
+ */
+
+/**
+ * Compute all 8 launch badges.
+ *
+ * @param {object} params
+ * @param {object} params.pillars — current { input, output, cacheCreate, cacheRead }
+ * @param {object} params.cascade — current cascade result (from cascade())
+ * @param {array}  params.history — array of daily snapshots { date, mode, yield, pillars }
+ * @param {boolean} params.isVerified — whether the operator submitted via signed agent
+ * @param {number|null} params.rank — current leaderboard rank (null if not ranked)
+ * @returns {object} { earned_this_week, in_progress, collection }
+ */
+export function computeBadges({ pillars, cascade: cas, history = [], isVerified = false, rank = null }) {
+  const cr = Number(pillars?.cacheRead || 0)
+  const i = Number(pillars?.input || 0)
+  const leverage = cas?.leverage ?? (i > 0 ? cr / i : 0)
+
+  const earned = []
+  const inProgress = []
+  const collection = []
+
+  // 1. First Spark — cacheRead > input (1× leverage)
+  if (leverage > 1) {
+    earned.push({ id: 'first_spark', label: 'First Spark', icon: '◈', condition: '1× cache leverage', date_earned: _latestDate(history) })
+    collection.push('first_spark')
+  } else if (cr > 0) {
+    inProgress.push({ id: 'first_spark', label: 'First Spark', icon: '◈', progress: Math.min(leverage, 1), target: 1, display: `${leverage.toFixed(1)}× / 1×` })
+  }
+
+  // 2. Cascade Engine — cacheRead > 10× input
+  if (leverage > 10) {
+    earned.push({ id: 'cascade_engine', label: 'Cascade Engine', icon: '⚡', condition: '10× cache leverage', date_earned: _latestDate(history) })
+    collection.push('cascade_engine')
+  } else if (leverage > 1) {
+    inProgress.push({ id: 'cascade_engine', label: 'Cascade Engine', icon: '⚡', progress: Math.min(leverage, 10), target: 10, display: `${leverage.toFixed(1)}× / 10×` })
+  }
+
+  // 3. Chain Reaction — cacheRead > 100× input
+  if (leverage > 100) {
+    earned.push({ id: 'chain_reaction', label: 'Chain Reaction', icon: '⚡', condition: '100× cache leverage', date_earned: _latestDate(history) })
+    collection.push('chain_reaction')
+  } else if (leverage > 10) {
+    inProgress.push({ id: 'chain_reaction', label: 'Chain Reaction', icon: '⚡', progress: Math.min(leverage, 100), target: 100, display: `${leverage.toFixed(1)}× / 100×` })
+  }
+
+  // 4. Foundation — 3 completed BUILD→MAINTAIN arcs
+  const arcs = _countBuildMaintainArcs(history)
+  if (arcs >= 3) {
+    earned.push({ id: 'foundation', label: 'Foundation', icon: '🏗️', condition: '3 BUILD→MAINTAIN arcs', date_earned: _latestDate(history) })
+    collection.push('foundation')
+  } else {
+    inProgress.push({ id: 'foundation', label: 'Foundation', icon: '🏗️', progress: arcs, target: 3, display: `${arcs}/3 arcs` })
+  }
+
+  // 5. Phoenix — returned to MAINTAIN within 1 day of disruption, 5×
+  const phoenixCount = _countPhoenixReturns(history)
+  if (phoenixCount >= 5) {
+    earned.push({ id: 'phoenix', label: 'Phoenix', icon: '🔥', condition: '5× MAINTAIN recovery within 1 day', date_earned: _latestDate(history) })
+    collection.push('phoenix')
+  } else {
+    inProgress.push({ id: 'phoenix', label: 'Phoenix', icon: '🔥', progress: phoenixCount, target: 5, display: `${phoenixCount}/5 recoveries` })
+  }
+
+  // 6. Verified — submitted via signed agent
+  if (isVerified) {
+    earned.push({ id: 'verified', label: 'Verified', icon: '✓', condition: 'Submitted via signed agent', date_earned: _latestDate(history) })
+    collection.push('verified')
+  }
+  // No in-progress for verified — it's binary
+
+  // 7. Cascade Streak 🔥 — 7 consecutive days MAINTAIN (current badge)
+  const streak = _countMaintainStreak(history)
+  if (streak >= 7) {
+    earned.push({ id: 'cascade_streak', label: 'Cascade Streak', icon: '🔥', condition: '7 consecutive days MAINTAIN', date_earned: _latestDate(history), current: true })
+    collection.push('cascade_streak')
+  } else {
+    inProgress.push({ id: 'cascade_streak', label: 'Cascade Streak', icon: '🔥', progress: streak, target: 7, display: `${streak}/7 days` })
+  }
+
+  // 8. Top 10 🏆 — currently in top 10 (server-side, but we include it if rank is provided)
+  if (rank !== null && rank <= 10) {
+    earned.push({ id: 'top_10', label: 'Top 10', icon: '🏆', condition: `Currently #${rank}`, date_earned: _latestDate(history), current: true })
+    collection.push('top_10')
+  }
+  // No in-progress for top 10 — it's a live position, not a progress badge
+
+  return {
+    earned_this_week: earned.map(b => b.id),
+    in_progress: inProgress,
+    collection,
+  }
+}
+
+// ── Helpers ─────────────────────────────────────────────────────────────────
+
+function _latestDate(history) {
+  if (!history || history.length === 0) return null
+  return history[history.length - 1]?.date || null
+}
+
+/**
+ * Count completed BUILD→MAINTAIN arcs in history.
+ * An arc = a BUILD phase followed by a MAINTAIN phase.
+ */
+function _countBuildMaintainArcs(history) {
+  if (!history || history.length < 2) return 0
+  let arcs = 0
+  let wasBuild = false
+  for (const h of history) {
+    if (h.mode === 'BUILD') {
+      wasBuild = true
+    } else if (h.mode === 'MAINTAIN' && wasBuild) {
+      arcs++
+      wasBuild = false
+    }
+  }
+  return arcs
+}
+
+/**
+ * Count Phoenix returns — MAINTAIN within 1 day of a non-MAINTAIN day.
+ */
+function _countPhoenixReturns(history) {
+  if (!history || history.length < 2) return 0
+  let count = 0
+  for (let idx = 1; idx < history.length; idx++) {
+    if (history[idx].mode === 'MAINTAIN' && history[idx - 1].mode !== 'MAINTAIN') {
+      count++
+    }
+  }
+  return count
+}
+
+/**
+ * Count current consecutive MAINTAIN days (ending at the last entry).
+ */
+function _countMaintainStreak(history) {
+  if (!history || history.length === 0) return 0
+  let streak = 0
+  for (let idx = history.length - 1; idx >= 0; idx--) {
+    if (history[idx].mode === 'MAINTAIN') {
+      streak++
+    } else {
+      break
+    }
+  }
+  return streak
+}

package/cascade.mjs

@@ -57,6 +57,7 @@ export function cascade({ input, output, cacheCreate, cacheRead }) {
     velocity: round(velocity, 3),
     dev10x: round(dev10x, 2),
     class: classify(yield_, dev10x),
+    mode: detectMode({ input: i, output: o, cacheCreate: cw, cacheRead: cr }),
   }
   if (warnings.length > 0) result.warnings = warnings
   return result
@@ -75,6 +76,74 @@ export function classify(yieldVal, dev10x) {
   return 'IGNITER'
 }
 
+/**
+ * detectMode — classify an operator's current working mode from 4 token pillars.
+ *
+ * Pure ratio math, first-match-wins (same pattern as classify() — descending
+ * cuts preserve edge semantics). MAINTAIN checked first (high leverage is
+ * strongest signal), then DEBUG (low velocity is distinctive), then EDIT,
+ * then BUILD as fallback.
+ *
+ * Modes:
+ *   BUILD    — high input, low/zero cacheRead, output rising (greenfield)
+ *   EDIT     — high input, low cacheRead, high output (polishing)
+ *   DEBUG    — high input, low output, low cacheRead (investigating)
+ *   MAINTAIN — low input, high cacheRead, high output (compounding)
+ *   IDLE     — near-zero tokens (not working)
+ *
+ * Returns { mode, confidence }.
+ */
+export function detectMode({ input, output, cacheCreate, cacheRead }) {
+  const i = Number(input), o = Number(output), cw = Number(cacheCreate), cr = Number(cacheRead)
+  const total = i + o + cw + cr
+
+  // IDLE: near-zero tokens
+  if (total < 1000) return { mode: 'IDLE', confidence: 1.0 }
+
+  const leverage    = i > 0 ? cr / i : 0
+  const velocity    = i > 0 ? o / i : 0
+  const input_share = total > 0 ? i / total : 0
+
+  // MAINTAIN: high leverage + high velocity (the cascade is compounding)
+  if (leverage > 10 && velocity > 1)  return { mode: 'MAINTAIN', confidence: 0.9 }
+  if (leverage > 3  && velocity > 0.5) return { mode: 'MAINTAIN', confidence: 0.7 }
+
+  // DEBUG: low velocity + high input share (reading, not producing)
+  if (velocity < 0.3 && input_share > 0.5) return { mode: 'DEBUG', confidence: 0.8 }
+
+  // EDIT: high input share + high velocity (fresh input but producing)
+  if (input_share > 0.4 && velocity > 0.5) return { mode: 'EDIT', confidence: 0.7 }
+
+  // DEBUG (secondary): high input share + low velocity
+  if (input_share > 0.4 && velocity < 0.5) return { mode: 'DEBUG', confidence: 0.6 }
+
+  // BUILD: fallback (high input, no cache reuse yet)
+  return { mode: 'BUILD', confidence: 0.6 }
+}
+
+/**
+ * Expected yield per mode — global defaults used before personal baselines
+ * exist (needs 7+ days of history). Used by the quality score computation.
+ */
+export const MODE_EXPECTED_YIELD = {
+  BUILD: 15,
+  EDIT: 45,
+  DEBUG: 10,
+  MAINTAIN: 5000,
+  IDLE: 0,
+}
+
+/**
+ * qualityScore — actual yield relative to mode expectation.
+ * Fixes the "debug is bad" problem: a DEBUG session at 80% quality is good.
+ * Returns a number 0+ (can exceed 1.0 if outperforming the expected yield).
+ */
+export function qualityScore(actualYield, mode) {
+  const expected = MODE_EXPECTED_YIELD[mode] ?? 1
+  if (expected === 0) return actualYield === 0 ? 1.0 : 0
+  return actualYield / expected
+}
+
 /**
  * Extract the 4 pillars from pasted text: JSON object OR 4 whitespace numbers.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "0.15.4",
+  "version": "0.16.0",
   "description": "SigRank MCP server — the yield cascade + live leaderboard as MCP tools any agent can call",
   "mcpName": "io.github.SunrisesIllNeverSee/sigrank-mcp",
   "type": "module",
@@ -23,7 +23,7 @@
   },
   "scripts": {
     "start": "node index.mjs",
-    "test": "node test.mjs && node sign.test.mjs"
+    "test": "node test.mjs && node sign.test.mjs && node --test __tests__/cascade.test.mjs __tests__/badges.test.mjs"
   },
   "files": [
     "index.mjs",
@@ -38,6 +38,8 @@
     "keystore.mjs",
     "submit.mjs",
     "connect.mjs",
+    "badges.mjs",
+    "preflight.mjs",
     "banner.svg",
     "README.md",
     "LICENSE"

package/preflight.mjs

@@ -0,0 +1,119 @@
+/**
+ * preflight.mjs — local plausibility pre-checks for the MCP submit path.
+ *
+ * Mirrors ONLY the server's public plausibility gate (gates.ts:86-137) —
+ * totals consistency, turns/sessions ratios, output rate, cache ratio,
+ * cadence. These are integrity guards labeled "NOT the proprietary RS.xx"
+ * and are safe to replicate in an open agent.
+ *
+ * The proprietary battery (Benford / cadence / contamination) is SERVER-ONLY
+ * and must NOT be shipped in the agent. The server always runs its own
+ * battery after the POST — this preflight is a client-side preview of the
+ * public plausibility checks only, not a replacement for the full gate chain.
+ *
+ * If preflight flags, the operator sees WHY their submission would be
+ * rejected or flagged, and can fix the issue or submit anyway.
+ *
+ * Source of truth: lib/ingest/gates.ts (plausibilityGate). This port must
+ * stay in sync with the plausibility gate ONLY.
+ */
+
+// ── plausibility checks (from gates.ts:86-137) ──────────────────────────────
+
+const GATE_LIMITS = {
+  TOTALS_TOLERANCE_FRAC: 0.01,
+  MAX_OUTPUT_TOKENS_PER_MIN: 20_000,
+  // Tightened range-plausibility bounds (deviewreview3)
+  MAX_CACHE_REUSE_RATIO: 35,
+  MIN_CACHE_WRITE_RATIO: 0.5,
+  MIN_INPUT_SHARE_FRAC: 0.0003,
+  MAX_CADENCE_PER_MIN: 15,
+}
+
+/**
+ * Run plausibility checks against a payload's raw_telemetry.
+ * Returns array of issues: { severity, code, detail }
+ */
+export function plausibilityCheck(rt, window) {
+  const out = []
+  const pillars = rt.tokens_input_fresh + rt.tokens_output + rt.tokens_cache_read + rt.tokens_cache_creation
+
+  if (rt.tokens_total > 0) {
+    const tol = Math.max(1, rt.tokens_total * GATE_LIMITS.TOTALS_TOLERANCE_FRAC)
+    if (Math.abs(pillars - rt.tokens_total) > tol) {
+      out.push({ severity: 'reject', code: 'totals_inconsistent', detail: `Σ4 pillars (${pillars}) ≠ tokens_total (${rt.tokens_total})` })
+    }
+    if (rt.sessions_count === 0) {
+      out.push({ severity: 'reject', code: 'tokens_without_sessions', detail: `tokens_total ${rt.tokens_total} with sessions_count 0` })
+    }
+  }
+  if (rt.turns_total < rt.sessions_count) {
+    out.push({ severity: 'reject', code: 'turns_lt_sessions', detail: `turns_total ${rt.turns_total} < sessions_count ${rt.sessions_count}` })
+  }
+  if (rt.tokens_output > 0 && rt.turns_total === 0) {
+    out.push({ severity: 'reject', code: 'output_without_turns', detail: `tokens_output ${rt.tokens_output} with turns_total 0` })
+  }
+
+  if (window) {
+    const spanMin = (Date.parse(window.end) - Date.parse(window.start)) / 60_000
+    if (Number.isFinite(spanMin) && rt.active_minutes_est > spanMin + 1) {
+      out.push({ severity: 'flag', code: 'active_exceeds_window', detail: `active_minutes_est ${rt.active_minutes_est} > window span ${Math.round(spanMin)}m` })
+    }
+  }
+
+  const outPerMin = rt.tokens_output / Math.max(rt.active_minutes_est, 1)
+  if (outPerMin > GATE_LIMITS.MAX_OUTPUT_TOKENS_PER_MIN) {
+    out.push({ severity: 'flag', code: 'implausible_output_rate', detail: `${Math.round(outPerMin)} output tok/min > ${GATE_LIMITS.MAX_OUTPUT_TOKENS_PER_MIN}` })
+  }
+
+  // Cross-field ratio checks (defense-in-depth — also in the plausibility gate)
+  // Bounds tightened (deviewreview3): original 100:1 + 50/min were too loose.
+  if (rt.tokens_cache_read > 1_000 && rt.tokens_cache_creation === 0) {
+    out.push({ severity: 'flag', code: 'cache_without_creation', detail: `${rt.tokens_cache_read} cache_read with 0 cache_creation (impossible cascade)` })
+  }
+  if (rt.tokens_cache_creation > 0 && rt.tokens_cache_read / rt.tokens_cache_creation > GATE_LIMITS.MAX_CACHE_REUSE_RATIO) {
+    out.push({ severity: 'flag', code: 'extreme_cache_ratio', detail: `cache_read/cache_creation = ${(rt.tokens_cache_read / rt.tokens_cache_creation).toFixed(1)}:1 (real max ~30:1)` })
+  }
+  if (rt.tokens_output > 1_000 && rt.tokens_cache_creation / rt.tokens_output < GATE_LIMITS.MIN_CACHE_WRITE_RATIO) {
+    out.push({ severity: 'flag', code: 'low_cache_write_ratio', detail: `cache_creation/output = ${(rt.tokens_cache_creation / rt.tokens_output).toFixed(2)}:1 (real min ~1.5:1)` })
+  }
+  if (pillars > 10_000 && rt.tokens_input_fresh / pillars < GATE_LIMITS.MIN_INPUT_SHARE_FRAC) {
+    out.push({ severity: 'flag', code: 'implausible_input_share', detail: `input is ${(rt.tokens_input_fresh / pillars * 100).toFixed(3)}% of total (real min ~0.3%)` })
+  }
+  if (rt.active_minutes_est > 0 && rt.turns_total / rt.active_minutes_est > GATE_LIMITS.MAX_CADENCE_PER_MIN) {
+    out.push({ severity: 'flag', code: 'implausible_cadence', detail: `${(rt.turns_total / rt.active_minutes_est).toFixed(1)} turns/min (real: 0.5-10)` })
+  }
+
+  return out
+}
+
+// ── full preflight (plausibility only — NO battery) ─────────────────────────
+
+/**
+ * Run preflight plausibility checks against a payload. Returns:
+ *   { pass: true, issues: [] }                    — clean submission
+ *   { pass: false, issues: [...], wouldDowngrade } — would be flagged/rejected
+ *
+ * NOTE: this only mirrors the PUBLIC plausibility gate. The server runs
+ * additional proprietary checks (the battery) that this preflight does NOT
+ * replicate. A "pass" here means "passes the plausibility gate," not
+ * "guaranteed to pass all server gates."
+ */
+export function preflight(payload) {
+  const issues = plausibilityCheck(payload.raw_telemetry, payload.window)
+
+  const hasReject = issues.some((i) => i.severity === 'reject')
+  const hasFlag = issues.some((i) => i.severity === 'flag')
+
+  return {
+    pass: issues.length === 0,
+    wouldReject: hasReject,
+    wouldDowngrade: hasFlag,
+    issues,
+    summary: hasReject
+      ? `REJECT: ${issues.filter((i) => i.severity === 'reject').map((i) => i.code).join(', ')}`
+      : hasFlag
+        ? `FLAG (verified → flagged, not ranked): ${issues.filter((i) => i.severity === 'flag').map((i) => i.code).join(', ')}`
+        : 'clean — passes plausibility gate (server runs additional proprietary checks)',
+  }
+}