sigrank 1.0.44 → 1.0.45

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [1.0.44](https://github.com/SunrisesIllNeverSee/sigrank-mcp/releases/tag/v1.0.44) (2026-10-05)
+
+### Features
+
+* MCP: explicit opt-in support for protocol revision 2026-07-28 via `serveStdio` — a `server/discover` probe with the modern `_meta` envelope pins the connection to the modern era; `initialize` openings keep the 2025-era protocol unchanged (dual-era serving, `legacy: 'serve'`)
+* Docs: `docs/PROTOCOL-COMPATIBILITY.md` — served eras, negotiation rules, host/client matrix
+
+### Tests
+
+* stdio characterization suite 15 → 24: 9 modern-era tests (discover negotiation, era parity, envelope-claim requirement, `-32022` late-initialize, probe→initialize fallback, modern stdout purity + EOF)
+
+## [1.0.43](https://github.com/SunrisesIllNeverSee/sigrank-mcp/releases/tag/v1.0.43) (2026-10-05)
+
+### Breaking Changes
+
+* Node.js >= 20 required (was >= 18)
+
+### Features
+
+* MCP: migrated `@modelcontextprotocol/sdk` v1 → official v2 packages (`@modelcontextprotocol/server` 2.3.0); zero v1 imports remain
+* `sigrank standard --json`: `sigrank/0.1-draft` now correctly labeled `legacy_alias` under TTEOP authority (`tteop-spec@0.1.5-draft`)
+
+### Fixes
+
+* Release workflow: explicit releases only — no auto-publish after CI; real npm OIDC trusted publishing (dead NPM_TOKEN path removed); `--dry-run` + collision pre-gates; `--provenance`
+
+### Tests
+
+* 15-test SDK-agnostic stdio behavior freeze locked identical across v1 → v2 (tools/prompts/resources, error classes, stdout purity, routing, EOF) on Node 20/22/26
+
 ## [1.0.37](https://github.com/SunrisesIllNeverSee/sigrank-mcp/releases/tag/v1.0.37) (2026-09-08)
 
 ### Fixes

package/MCP_SERVER_DESCRIPTION.md

@@ -1,6 +1,6 @@
 # SigRank MCP Server
 
-> Operator leaderboard measuring users, not models — 24 tools, TUI, signed submit, privacy-first.
+> Operator leaderboard measuring users, not models — 25 tools, TUI, signed submit, privacy-first.
 
 SigRank is the first leaderboard that ranks **AI operators** — the humans — by token cascade efficiency, not the models. The yield metric (Υ = cache_read × output / input²) turns raw token telemetry into a competitive ranking on [signalaf.com](https://signalaf.com).
 
@@ -64,7 +64,7 @@ npx sigrank diagnose            # Diagnose cascade inefficiencies
 npx sigrank improve             # Get improvement suggestions
 ```
 
-## The 24 MCP Tools
+## The 25 MCP Tools
 
 ### Read-only — pure math (no auth, no filesystem)
 
@@ -81,39 +81,40 @@ npx sigrank improve             # Get improvement suggestions
 
 | # | Tool | What it does |
 |---|------|-------------|
-| 7 | `get_leaderboard` | Fetch the live public leaderboard from signalaf.com. Returns all ranked operators sorted by yield, with codename, Υ, leverage, velocity, class, and rank position. |
-| 8 | `get_operator` | Get any operator's full profile by codename. Returns detailed metrics + per-window breakdowns (7d/30d/90d/all-time) with the four token pillars per window. |
-| 9 | `discover_peers` | Find mentors, peers, and complementary operators for your operator on the leaderboard. |
+| 7 | `get_sigrank_standard_record` | Build the portable `sigrank/0.1-draft` compatibility record (legacy alias under TTEOP authority) from token telemetry. Computes the canonical cascade locally — no network. |
+| 8 | `get_leaderboard` | Fetch the live public leaderboard from signalaf.com. Returns all ranked operators sorted by yield, with codename, Υ, leverage, velocity, class, and rank position. |
+| 9 | `get_operator` | Get any operator's full profile by codename. Returns detailed metrics + per-window breakdowns (7d/30d/90d/all-time) with the four token pillars per window. |
+| 10 | `discover_peers` | Find mentors, peers, and complementary operators for your operator on the leaderboard. |
 
 ### Read-only — local filesystem (no auth, no network)
 
 | # | Tool | What it does |
 |---|------|-------------|
-| 10 | `tokenpull` | Pull your LOCAL token usage from session logs and rank it across all four windows — zero paste. Reads token counts, not message content. Numbers stay on your machine. 17 platform adapters. |
-| 11 | `tokenpull_compare` | Pull token usage from ALL four local sources in parallel (JSONL canon, ccusage CLI, token-dashboard SQLite, tokscale) and compare side-by-side with delta % vs baseline. |
-| 12 | `watch_tokenpull` | One poll per call — pulls local token logs and returns current cascade for the watched window. Re-call at your desired cadence to monitor. With `submit:true`, signs + publishes (rate-limited to once per 5 min). |
+| 11 | `tokenpull` | Pull your LOCAL token usage from session logs and rank it across all four windows — zero paste. Reads token counts, not message content. Numbers stay on your machine. 17 platform adapters. |
+| 12 | `tokenpull_compare` | Pull token usage from ALL four local sources in parallel (JSONL canon, ccusage CLI, token-dashboard SQLite, tokscale) and compare side-by-side with delta % vs baseline. |
+| 13 | `watch_tokenpull` | One poll per call — pulls local token logs and returns current cascade for the watched window. Re-call at your desired cadence to monitor. With `submit:true`, signs + publishes (rate-limited to once per 5 min). |
 
 ### Write — submit to board (needs enrolled identity)
 
 | # | Tool | What it does |
 |---|------|-------------|
-| 13 | `submit_paste` | Ranks a paste of token counts AND publishes to the live board in one call. Computes local preview, then submits to server for authoritative scoring. Returns both local + server results. |
-| 14 | `tokenpull_submit` | Pull your LOCAL token usage AND publish to the board in one call — the zero-paste flow. Reads pillars per window, computes cascade, submits each window server-side. Token-only, no prompt content. |
-| 15 | `submit_verified` | Publish your LOCAL token runs as a VERIFIED operator — the enrolled, signed path. Reads pillars, builds Schema 1.0 snapshot, ed25519-signs with your device key, POSTs to board. Requires `enroll` first. |
-| 16 | `enroll` | Bind THIS device to your SigRank operator. Paste the key from signalaf.com → Settings → "New key". Generates + stores a local ed25519 keypair. Only the PUBLIC key is ever sent. |
+| 14 | `submit_paste` | Ranks a paste of token counts AND publishes to the live board in one call. Computes local preview, then submits to server for authoritative scoring. Returns both local + server results. |
+| 15 | `tokenpull_submit` | Pull your LOCAL token usage AND publish to the board in one call — the zero-paste flow. Reads pillars per window, computes cascade, submits each window server-side. Token-only, no prompt content. |
+| 16 | `submit_verified` | Publish your LOCAL token runs as a VERIFIED operator — the enrolled, signed path. Reads pillars, builds Schema 1.0 snapshot, ed25519-signs with your device key, POSTs to board. Requires `enroll` first. |
+| 17 | `enroll` | Bind THIS device to your SigRank operator. Paste the key from signalaf.com → Settings → "New key". Generates + stores a local ed25519 keypair. Only the PUBLIC key is ever sent. |
 
 ### Tokscale analytics — local tokscale data (no auth, no network)
 
 | # | Tool | What it does |
 |---|------|-------------|
-| 17 | `tokscale_breakdown` | Per-model token breakdown across platforms (models under threshold → "other"). |
-| 18 | `tokscale_market_share` | AI tool market share: each tool's % of tokens/cost/messages, ranked. From local tokscale data. |
-| 19 | `tokscale_developer_profile` | Per-developer usage profile across all detected tools: model mix, pillars, sessions, workspaces. Paths redacted. |
-| 20 | `tokscale_model_trends` | Model adoption over time: per-model first/last seen, active days, month-by-month adoption curve. |
-| 21 | `tokscale_cost_analysis` | Cost per developer per model: cost_per_million_tokens, cost_per_message, share_cost, client rollup. |
-| 22 | `tokscale_device_profile` | Device fingerprinting: installed tools, session counts, active days, day-of-week distribution, concurrency. Paths redacted. |
-| 23 | `tokscale_mcp_usage` | MCP server usage: detected servers, detection window, active days. |
-| 24 | `tokscale_competitive_intel` | Competitive intelligence for any AI tool: rank, model mix, cost efficiency, share vs all competitors. |
+| 18 | `tokscale_breakdown` | Per-model token breakdown across platforms (models under threshold → "other"). |
+| 19 | `tokscale_market_share` | AI tool market share: each tool's % of tokens/cost/messages, ranked. From local tokscale data. |
+| 20 | `tokscale_developer_profile` | Per-developer usage profile across all detected tools: model mix, pillars, sessions, workspaces. Paths redacted. |
+| 21 | `tokscale_model_trends` | Model adoption over time: per-model first/last seen, active days, month-by-month adoption curve. |
+| 22 | `tokscale_cost_analysis` | Cost per developer per model: cost_per_million_tokens, cost_per_message, share_cost, client rollup. |
+| 23 | `tokscale_device_profile` | Device fingerprinting: installed tools, session counts, active days, day-of-week distribution, concurrency. Paths redacted. |
+| 24 | `tokscale_mcp_usage` | MCP server usage: detected servers, detection window, active days. |
+| 25 | `tokscale_competitive_intel` | Competitive intelligence for any AI tool: rank, model mix, cost efficiency, share vs all competitors. |
 
 ### Moved to bestuser-router-mcp (5 intent tools)
 
@@ -160,7 +161,7 @@ The intent-based tools (in bestuser-router-mcp) are designed to map natural-lang
 | Transport | stdio |
 | Platform | Cross-platform (Node.js) |
 | Language | JavaScript |
-| Tools | 24 |
+| Tools | 25 |
 | Auth | None for reads; Supabase anon key for submits |
 | Category | Developer Tools |
 

package/README.md

@@ -303,6 +303,8 @@ Or if installed globally:
 | `tokenpull_submit(codename, window?)` | `{codename?, window?}`                                                           | `tokenpull` → publish to board. Omit codename for preview                                                                                                                  |
 | `tokenpull_compare(platform?)`        | `{platform?}`                                                                    | All four sources side-by-side: tokenpull + ccusage + token-dash + tokscale. Returns pillars, cascade metrics, and delta % vs tokenpull per window                          |
 | `rank_windows`                        | `{platform?, window?}`                                                           | Multi-window cascade from local logs                                                                                                                                       |
+| `get_sigrank_standard_record`         | `{input, output, cache_write?, cache_read?}`                                     | Builds the portable `sigrank/0.1-draft` compatibility record (legacy alias under TTEOP authority) — canonical cascade, computed locally                                   |
+| `discover_peers`                      | `{codename?}`                                                                    | Find mentors, peers, and complementary operators on the leaderboard                                                                                                        |
 | `watch_tokenpull`                     | `{platform?, interval_s?}`                                                       | One cascade snapshot per call (interval_s advisory)                                                                                                                        |
 | `submit_verified`                     | `{window?, platform?, dry_run?}`                                                 | THE ranked path: builds + ed25519-signs Schema 1.0 snapshots and POSTs them. `platform:'multi'` sums all active platforms. `dry_run:true` returns the exact payload unsent |
 | `enroll`                              | `{code, device_label?}`                                                          | Bind this device with a connect code from signalaf.com → Settings                                                                                                          |
@@ -310,11 +312,6 @@ Or if installed globally:
 | `simulate_change`                     | `{text?, changes}`                                                               | Prescriptive "what if" — test proposed pillar changes and see the exact Υ delta + class change before committing                                                           |
 | `suggest_improvements`                | `{text?}`                                                                        | Generates ranked, simulated improvement suggestions — tests strategies and returns them sorted by Υ yield impact                                                           |
 | `self_improve`                        | `{text?}`                                                                        | One-click optimize: diagnoses, suggests, and simulates the best change in a single call                                                                                    |
-| `get_best_operator(n?)`               | `{n?}`                                                                           | Top N operators with behavioral framing in power-user language. Intent: "who is the best AI user?"                                                                         |
-| `compare_self(codename? \| text?)`    | `{codename?}` or `{text?}`                                                       | Your metrics vs board averages + power-user assessment + percentile + suggestion. Intent: "how do I measure up?"                                                           |
-| `compare_operators(a, b)`             | `{codename_a, codename_b}`                                                       | Side-by-side comparison with behavioral verdict. Intent: "compare operator X vs Y"                                                                                         |
-| `describe_power_user()`               | `{}`                                                                             | Static explanation of AI power user archetype + metrics explained. Intent: "what is an AI power user?"                                                                     |
-| `optimize_efficiency(codename? \| text?)` | `{codename?}` or `{text?}`                                                   | Ranked efficiency suggestions tied to your cascade shape. Intent: "how can I use AI more efficiently?"                                                                     |
 | `tokscale_breakdown(threshold?)`       | `{threshold?}`                                                                   | Per-model token breakdown across platforms (models under threshold → "other")                                                                                              |
 | `tokscale_market_share()`              | `{}`                                                                             | AI tool market share: each tool's % of tokens/cost/messages, ranked. From local tokscale data                                                                              |
 | `tokscale_developer_profile()`         | `{}`                                                                             | Per-developer usage profile across all detected tools: model mix, pillars, sessions, workspaces. Paths redacted                             |
@@ -324,6 +321,8 @@ Or if installed globally:
 | `tokscale_mcp_usage()`                 | `{}`                                                                             | MCP server usage: detected servers, detection window, active days                                                                                                         |
 | `tokscale_competitive_intel(target)`   | `{target}`                                                                       | Competitive intelligence for any AI tool: rank, model mix, cost efficiency, share vs all competitors                                                                      |
 
+Intent tools (`get_best_operator`, `compare_self`, `compare_operators`, `describe_power_user`, `optimize_efficiency`) moved to [bestuser-router-mcp](https://github.com/SunrisesIllNeverSee/bestuser-router-mcp) — `npx bestuser-router-mcp`.
+
 ---
 
 ## Cascade math

package/adapters/tokenpull.mjs

@@ -22,7 +22,10 @@ import { join, dirname, delimiter } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { ADAPTERS, walkFiles } from "./index.mjs";
-import { TOKSCALE_CLIENT_MAP } from "../lib/constants.mjs";
+import {
+  TOKSCALE_CLIENT_MAP,
+  TOKSCALE_SCAN_TIMEOUT_MS,
+} from "../lib/constants.mjs";
 
 const DAY_MS = 86_400_000;
 
@@ -516,7 +519,11 @@ async function _freshTokendash(platform = "claude") {
 // Now uses execFile (async) so the TUI stays responsive.
 async function _freshTokscale(platform = "claude") {
   try {
-    const raw = await execFileAsync("tokscale", ["models", "--json"], 60000);
+    const raw = await execFileAsync(
+      "tokscale",
+      ["models", "--json"],
+      TOKSCALE_SCAN_TIMEOUT_MS,
+    );
     const data = JSON.parse(raw);
     const entries = Array.isArray(data?.entries)
       ? data.entries

package/lib/constants.mjs

@@ -115,6 +115,18 @@ export const TOKSCALE_CLIENT_MAP = {
  */
 export const TOKSCALE_BLIND_PLATFORMS = [];
 
+/**
+ * Timeout for `tokscale` CLI invocations (models/clients/graph/report scans).
+ * The scan walks every session log on the machine; on heavy machines it runs
+ * ~55–60s and GROWS with log volume, so the old hardcoded 60s ceiling flaked —
+ * the subprocess was killed mid-scan and the caller silently got null
+ * (TUI Compare showed "no data from tokscale"). 180s gives 3x headroom and
+ * stays under tokscale's own nativeTimeoutMs default (300s).
+ * Override via SIGRANK_TOKSCALE_TIMEOUT_MS.
+ */
+export const TOKSCALE_SCAN_TIMEOUT_MS =
+  Number(process.env.SIGRANK_TOKSCALE_TIMEOUT_MS) || 180_000;
+
 /**
  * The "actually on the board" predicate. A submission is ranked only when the
  * server returns HTTP ok AND verification_tier === "verified" AND persisted

package/manifest.json

@@ -2,7 +2,7 @@
   "$schema": "https://raw.githubusercontent.com/anthropics/mcpb/main/schemas/mcpb-manifest-v0.4.schema.json",
   "manifest_version": "0.4",
   "name": "sigrank",
-  "version": "1.0.43",
+  "version": "1.0.45",
   "description": "Ranks AI coding operators by token cascade efficiency (Yield = cache_read \u00d7 output / input\u00b2). 25 tools including SigRank Standard record, yield calculation, local token usage pulls, signed submission, and tokscale-powered analytics (market share, developer profiles, model trends, cost analysis, device profiles, MCP usage, competitive intelligence). Privacy-first: runs locally, only four token counts leave the machine.",
   "author": {
     "name": "SunrisesIllNeverSee",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sigrank",
-  "version": "1.0.44",
+  "version": "1.0.45",
   "author": "SunrisesIllNeverSee (https://github.com/SunrisesIllNeverSee)",
   "description": "Upsilon measurement engine distributed through the sigrank CLI/MCP compatibility package, with SigRank public leaderboard tools.",
   "mcpName": "io.github.SunrisesIllNeverSee/sigrank-mcp",
@@ -81,10 +81,10 @@
     "on-device"
   ],
   "dependencies": {
-    "token-cascade": "^0.2.1",
+    "token-cascade": "0.2.1",
     "ccusage": "^20.0.19",
     "tokscale": "^4.7.0",
-    "@modelcontextprotocol/server": "^2.3.0"
+    "@modelcontextprotocol/server": "2.3.0"
   },
   "devDependencies": {
     "@resvg/resvg-js": "^2.6.2",

package/presentation/cli.mjs

@@ -29,7 +29,11 @@ import { cascade, classify, CLASS_TIERS, UNCLASSED, tierOf } from "../cascade.mj
 import { ALL_PLATFORMS } from "../adapters.mjs";
 import { ensureIdentity, keystorePath } from "../keystore.mjs";
 import { submitSignedWindow } from "../submit.mjs";
-import { LEADERBOARD_METRIC, TOKSCALE_CLIENT_MAP } from "../lib/constants.mjs";
+import {
+  LEADERBOARD_METRIC,
+  TOKSCALE_CLIENT_MAP,
+  TOKSCALE_SCAN_TIMEOUT_MS,
+} from "../lib/constants.mjs";
 import { execFile } from "child_process";
 import { existsSync, readFileSync } from "fs";
 import os from "os";
@@ -422,7 +426,11 @@ async function ccusagePillars(platform = "claude") {
 async function tokscalePillars(platform = "claude") {
   // Try the bundled tokscale CLI first (fresh data), fall back to saved report file.
   try {
-    const raw = await execFileAsync("tokscale", ["models", "--json"], 60000);
+    const raw = await execFileAsync(
+      "tokscale",
+      ["models", "--json"],
+      TOKSCALE_SCAN_TIMEOUT_MS,
+    );
     const data = JSON.parse(raw);
     const entries = Array.isArray(data?.entries)
       ? data.entries

package/presentation/tui.mjs

@@ -1444,7 +1444,7 @@ function renderCompare(data) {
   const missing = [];
   if (!cc) missing.push("ccusage (npm i -g ccusage)");
   if (!td) missing.push("token-dashboard (~/.claude/token-dashboard.db)");
-  if (!ts) missing.push("tokscale (npm i -g tokscale)");
+  if (!ts) missing.push("tokscale (not installed, or scan timed out)");
   if (missing.length)
     for (const ln of wrapDim(`no data from: ${missing.join(" · ")}`)) emit(ln);
   emit();

package/tokscale_analytics.mjs

@@ -33,7 +33,10 @@ import { existsSync, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { fileURLToPath } from "node:url";
-import { TOKSCALE_CLIENT_MAP } from "./lib/constants.mjs";
+import {
+  TOKSCALE_CLIENT_MAP,
+  TOKSCALE_SCAN_TIMEOUT_MS,
+} from "./lib/constants.mjs";
 
 // Resolve local node_modules/.bin for the bundled tokscale binary.
 const _pkgRoot = path.dirname(fileURLToPath(import.meta.url));
@@ -61,13 +64,14 @@ function execFileAsync(cmd, args, timeoutMs) {
   });
 }
 
-// tokscale subcommand timeouts. `models` is fast (~5s); `graph` and `report`
-// walk every session log and can take ~30s on a heavy machine. 60s ceiling.
-const T_MODELS = 60_000;
-const T_MONTHLY = 60_000;
-const T_CLIENTS = 30_000;
-const T_GRAPH = 60_000;
-const T_REPORT = 60_000;
+// tokscale subcommand timeouts. `models`/`clients`/`graph`/`report` all walk the
+// session logs — on a heavy machine the scan runs ~55-60s and grows with log
+// volume, so they share TOKSCALE_SCAN_TIMEOUT_MS (was a flat 60s that flaked).
+const T_MODELS = TOKSCALE_SCAN_TIMEOUT_MS;
+const T_MONTHLY = TOKSCALE_SCAN_TIMEOUT_MS;
+const T_CLIENTS = TOKSCALE_SCAN_TIMEOUT_MS;
+const T_GRAPH = TOKSCALE_SCAN_TIMEOUT_MS;
+const T_REPORT = TOKSCALE_SCAN_TIMEOUT_MS;
 
 const HOME = os.homedir();
 

package/tools/_verifiers.mjs

@@ -10,6 +10,7 @@ import { existsSync, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { execFileAsync } from "./_helpers.mjs";
+import { TOKSCALE_SCAN_TIMEOUT_MS } from "../lib/constants.mjs";
 
 async function _ccusagePillars(platform = "claude") {
   try {
@@ -87,7 +88,11 @@ async function _tokenDashPillars() {
 async function _tokscalePillars(platform = "claude") {
   // Try the bundled tokscale CLI first (fresh data), fall back to saved report file.
   try {
-    const raw = await execFileAsync("tokscale", ["models", "--json"], 60000);
+    const raw = await execFileAsync(
+      "tokscale",
+      ["models", "--json"],
+      TOKSCALE_SCAN_TIMEOUT_MS,
+    );
     const data = JSON.parse(raw);
     const entries = Array.isArray(data?.entries)
       ? data.entries

package/tools/index.mjs

@@ -12,6 +12,7 @@ import { buildFetch, DEFAULT_API_BASE, DEFAULT_FETCH_TIMEOUT } from "./_helpers.
 import {
   TOKSCALE_CLIENT_MAP,
   TOKSCALE_BLIND_PLATFORMS,
+  TOKSCALE_SCAN_TIMEOUT_MS,
 } from "../lib/constants.mjs";
 
 import { TOOL_DEF as rankPasteTool, handleRankPaste } from "./rank-paste.mjs";
@@ -83,7 +84,11 @@ export const TOOLS = [
 
 /** Run `tokscale models --json` and return the list of our platform names. */
 async function _tokscaleDetectClients() {
-  const raw = await execFileAsync("tokscale", ["models", "--json"], 60000);
+  const raw = await execFileAsync(
+    "tokscale",
+    ["models", "--json"],
+    TOKSCALE_SCAN_TIMEOUT_MS,
+  );
   const data = JSON.parse(raw);
   const entries = Array.isArray(data?.entries)
     ? data.entries

package/tools/tokscale-breakdown.mjs

@@ -4,7 +4,10 @@
 
 import { execFileAsync } from "./_helpers.mjs";
 import { ANNOTATIONS } from "./_schemas.mjs";
-import { TOKSCALE_CLIENT_MAP } from "../lib/constants.mjs";
+import {
+  TOKSCALE_CLIENT_MAP,
+  TOKSCALE_SCAN_TIMEOUT_MS,
+} from "../lib/constants.mjs";
 
 export const TOOL_DEF = {
   name: "tokscale_breakdown",
@@ -47,7 +50,11 @@ export const TOOL_DEF = {
  * Returns: { platform: [{ model, input, output, cacheRead, cacheCreate, pct }] }
  */
 export async function tokscaleModelBreakdown(threshold = 0.01) {
-  const raw = await execFileAsync("tokscale", ["models", "--json"], 60000);
+  const raw = await execFileAsync(
+    "tokscale",
+    ["models", "--json"],
+    TOKSCALE_SCAN_TIMEOUT_MS,
+  );
   const data = JSON.parse(raw);
   const entries = Array.isArray(data?.entries)
     ? data.entries