xytara 3.1.11 → 3.1.12

package/RELEASE_NOTES.md

@@ -1,11 +1,5 @@
-`xytara` 3.1.11 hardens the open provider network's money ledger and the hosted executor, and tightens repository hygiene. No API is removed; the public provider directory now lists active providers only.
+`xytara` 3.1.12 makes the public adapter-depth surface report open-network providers truthfully.
 
-Highlights:
-
-- **Settled-amount reconciliation** — a provider's revenue share accrues on min(quote, the amount actually settled on-chain) for x402 calls; an unrecognised settlement asset accrues nothing and is flagged. Every ledger row records its settlement basis (quoted vs. settled).
-- **Registration-scoped ledgers** — ledger rows and payouts belong to one registration of a `provider_id`. A removed and re-registered id never sees, inherits, or is credited by a previous owner's rows, and removal cancels that registration's pending payouts.
-- **In-flight payout guard** — a payout being sent by the external signer cannot be cancelled mid-dispatch (so no freed reservation can ever be re-sent); a payout cancelled before a late tx report is reinstated for reconciliation instead of being lost.
-- **One execution budget per call** — cold-start ride-out retries and failover candidates share a single wall-clock budget inside the x402 authorization window, and per-target timeouts are capped at 30s, so a routed call can always still settle.
-- **Provider endpoint policy** — on hosted deploys, provider endpoints must be public `https` (loopback, private, link-local and metadata hosts are refused and re-checked by DNS at dispatch); redirects are never followed. Providers receive only a sanitized payment context — never the buyer's signed authorization.
-- The MCP executor's bearer check is timing-safe and fails closed on a hosted deploy; adapter execution truth counts only enabled targets; rate-limit identity compares are timing-safe.
-- Repository hygiene: a complete `.gitignore`, the publish workflow waits for the live deploy before registry publication, and `.env.example` documents every runtime knob.
+- `/v1/adapter-depth` and `/v1/adapter-depth/summary` now count ACTIVE open-network providers that declared an adapter task as provider-live paths, alongside operator env targets. Each is labelled `routing: open_provider_registry`, and the pack lists its `depth_sources`. A pending provider never counts, and a provider is shown as shadowed (not counted) when an operator env target pins the whole lane, because env targets are routed first.
+- Previously the surface only looked at env targets, so it reported `provider_wiring_required` even while paid MCP calls were being served by the live registry provider. It now reports `initial_provider_live_path` for the task that provider serves.
+- Internal callers without runtime state keep the env-only view, so no other surface changes.

package/lib/adapter_depth_contract.js

@@ -3,6 +3,7 @@
 const packageJson = require("../package.json");
 const { catalog } = require("../fixtures/catalog");
 const { loadExecutionTargetRegistry } = require("./external_execution_runtime");
+const { listProviders } = require("./provider_registry");
 
 function normalizeString(value, fallback = "") {
   const raw = typeof value === "string" ? value.trim() : "";
@@ -59,10 +60,60 @@ function summarizeTarget(target) {
   };
 }
 
-function summarizeAdapterTaskDepth(task) {
-  const targets = listTargetsForTask(task.task_ref).map(summarizeTarget);
+// ACTIVE open-network providers that declared this task_ref. Env targets resolve before the
+// registry at call time, so a provider is shadowed (not routed) when an enabled env target pins
+// the WHOLE lane (task_ref with no tool/integration selector); it is then listed but not counted.
+function listRegistryProvidersForTask(state, taskRef, envTargets) {
+  if (!state) return [];
+  const normalizedTaskRef = normalizeString(taskRef);
+  const wholeLanePinned = envTargets.some((target) =>
+    target.enabled !== false
+    && normalizeString(target.task_ref) === normalizedTaskRef
+    && !normalizeString(target.tool_name)
+    && !normalizeString(target.integration_id)
+  );
+  return listProviders(state, { status: "active" })
+    .filter((provider) => Array.isArray(provider.task_refs) && provider.task_refs.includes(normalizedTaskRef))
+    .map((provider) => {
+      const health = (provider.health && provider.health.status) || "healthy";
+      return {
+        target_id: `registry:${provider.provider_id}`,
+        provider: provider.provider_id,
+        routing: "open_provider_registry",
+        task_ref: normalizedTaskRef,
+        tool_name: null,
+        tool_names: Array.isArray(provider.tool_names) ? provider.tool_names.slice() : [],
+        integration_id: null,
+        enabled: !wholeLanePinned,
+        shadowed_by_env_target: wholeLanePinned,
+        health_status: health,
+        timeout_ms: provider.timeout_ms,
+        endpoint_configured: Boolean(normalizeString(provider.endpoint_url)),
+        auth_configured: Boolean(normalizeString(provider.auth_token)),
+        operational_coverage: {
+          execute_endpoint: Boolean(normalizeString(provider.endpoint_url)),
+          bearer_auth: Boolean(normalizeString(provider.auth_token)),
+          bounded_timeout: Number(provider.timeout_ms || 0) >= 500,
+          // The provider-network execution contract fixes the deliverable shape
+          // (result.output / output_payload), and activation is operator-vetted against it.
+          proof_fact_compatible: true,
+          deterministic_retry_surface: true,
+          tool_level_binding: Array.isArray(provider.tool_names) && provider.tool_names.length > 0,
+          operator_health_surface: "runtime_tracked_provider_health",
+          operator_tool_catalog_surface: null
+        }
+      };
+    });
+}
+
+function summarizeAdapterTaskDepth(task, state) {
+  const envTargets = listTargetsForTask(task.task_ref).map(summarizeTarget);
+  const registryTargets = listRegistryProvidersForTask(state, task.task_ref, loadExecutionTargetRegistry());
+  const targets = envTargets.concat(registryTargets);
   const enabledTargets = targets.filter((target) => target.enabled);
-  const toolNames = Array.from(new Set(enabledTargets.map((target) => target.tool_name).filter(Boolean))).sort();
+  const toolNames = Array.from(new Set(enabledTargets
+    .flatMap((target) => [target.tool_name].concat(target.tool_names || []))
+    .filter(Boolean))).sort();
   const allTargetsCovered = enabledTargets.length > 0 && enabledTargets.every((target) =>
     target.operational_coverage.execute_endpoint
     && target.operational_coverage.bounded_timeout
@@ -80,6 +131,8 @@ function summarizeAdapterTaskDepth(task) {
     provider_live: enabledTargets.length > 0,
     configured_target_count: targets.length,
     enabled_target_count: enabledTargets.length,
+    env_target_count: envTargets.length,
+    registry_provider_count: registryTargets.filter((target) => target.enabled).length,
     configured_tool_count: toolNames.length,
     configured_tools: toolNames,
     execution_targets: targets,
@@ -89,11 +142,17 @@ function summarizeAdapterTaskDepth(task) {
   };
 }
 
-function buildAdapterDepthPack() {
-  const adapterTasks = listAdapterTasks().map(summarizeAdapterTaskDepth);
+// `state` (optional): the live runtime state. When given, ACTIVE open-network providers count as
+// provider-live paths alongside operator env targets (each labelled routing:open_provider_registry).
+// Without it the pack is env-target-only, exactly as before.
+function buildAdapterDepthPack(state) {
+  const adapterTasks = listAdapterTasks().map((task) => summarizeAdapterTaskDepth(task, state));
   const providerLiveTasks = adapterTasks.filter((task) => task.provider_live);
   const deepenedTasks = adapterTasks.filter((task) => task.provider_depth_state === "provider_live_path_deepened");
   const configuredTargets = loadExecutionTargetRegistry().filter((target) => target && target.enabled !== false);
+  const registryProviderIds = new Set(adapterTasks.flatMap((task) =>
+    task.execution_targets.filter((target) => target.routing === "open_provider_registry" && target.enabled).map((target) => target.provider)
+  ));
   return {
     ok: true,
     product: packageJson.name,
@@ -110,8 +169,10 @@ function buildAdapterDepthPack() {
       deepened_provider_live_task_count: deepenedTasks.length,
       configured_execution_target_count: configuredTargets.length,
       configured_provider_count: new Set(configuredTargets.map((target) => normalizeString(target.provider))).size,
-      configured_tool_count: new Set(configuredTargets.map((target) => normalizeString(target.tool_name)).filter(Boolean)).size
+      configured_tool_count: new Set(configuredTargets.map((target) => normalizeString(target.tool_name)).filter(Boolean)).size,
+      registry_provider_count: registryProviderIds.size
     },
+    depth_sources: state ? ["operator_env_targets", "open_provider_registry"] : ["operator_env_targets"],
     adapter_tasks: adapterTasks,
     production_depth_requirements: [
       "at_least_one_enabled_execution_target_for_provider_backed_task",
@@ -136,8 +197,8 @@ function buildAdapterDepthPack() {
   };
 }
 
-function summarizeAdapterDepthPack() {
-  const pack = buildAdapterDepthPack();
+function summarizeAdapterDepthPack(state) {
+  const pack = buildAdapterDepthPack(state);
   return {
     ok: true,
     product: pack.product,
@@ -145,6 +206,7 @@ function summarizeAdapterDepthPack() {
     summary_version: "xytara-adapter-depth-summary-v1",
     adapter_depth_state: pack.adapter_depth_state,
     counts: pack.counts,
+    depth_sources: pack.depth_sources,
     public_claim_boundary: pack.public_claim_boundary,
     linked_surfaces: pack.linked_surfaces
   };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xytara",
-  "version": "3.1.11",
+  "version": "3.1.12",
   "description": "x402 pay-per-call agent-commerce runtime: gasless USDC on Base, an open settling provider network with a ledger-reconciled revenue split and automated on-chain payouts (key-less runtime, delegated signer), and bounded cryptographic delegated spend. Proven live on Base mainnet.",
   "main": "index.js",
   "bin": {

package/scripts/verify_provider_network.js

@@ -769,7 +769,38 @@ async function hardeningChecks() {
   } finally {
     global.fetch = orig;
   }
-  console.log("  hardening: epoch-isolation | in-flight guard | timeout cap | settlement basis | endpoint policy | budget");
+  // 19. ADAPTER DEPTH counts active open-network providers (labelled registry-routed) when given
+  //     state; without state it stays env-target-only; a whole-lane env pin shadows the registry.
+  const { buildAdapterDepthPack, summarizeAdapterDepthPack } = require("../lib/adapter_depth_contract");
+  const prevTargets = process.env.XYTARA_EXECUTION_TARGETS_JSON;
+  delete process.env.XYTARA_EXECUTION_TARGETS_JSON;
+  try {
+    const ad = {};
+    assert.strictEqual(summarizeAdapterDepthPack(ad).adapter_depth_state, "provider_wiring_required", "no env targets + no providers -> wiring required");
+    reg.registerProvider(ad, { provider_id: "ad_mcp", endpoint_url: "https://ad.example/execute", task_refs: ["adapter.mcp.invoke"], tool_names: ["keccak256"], revenue_share_bps: 7000, auth_token: "t" });
+    assert.strictEqual(summarizeAdapterDepthPack(ad).adapter_depth_state, "provider_wiring_required", "a PENDING provider is not a live path");
+    reg.setProviderStatus(ad, "ad_mcp", "active");
+    let pack = buildAdapterDepthPack(ad);
+    assert.strictEqual(pack.adapter_depth_state, "initial_provider_live_path", "one active registry provider -> initial live path");
+    const invoke = pack.adapter_tasks.find((t) => t.task_ref === "adapter.mcp.invoke");
+    assert.strictEqual(invoke.registry_provider_count, 1, "registry provider counted on its declared task");
+    assert.strictEqual(invoke.execution_targets[0].routing, "open_provider_registry", "labelled registry-routed");
+    assert.strictEqual(invoke.execution_targets[0].auth_token, undefined, "no auth_token leaks into the depth pack");
+    assert.deepStrictEqual(pack.public_claim_boundary.live_task_refs, ["adapter.mcp.invoke"], "claim limited to the declared task");
+    assert.strictEqual(buildAdapterDepthPack().adapter_depth_state, "provider_wiring_required", "no state -> env-only (unchanged for internal callers)");
+    reg.registerProvider(ad, { provider_id: "ad_mcp2", endpoint_url: "https://ad2.example/execute", task_refs: ["adapter.mcp.invoke"], revenue_share_bps: 7000 });
+    reg.setProviderStatus(ad, "ad_mcp2", "active");
+    assert.strictEqual(summarizeAdapterDepthPack(ad).adapter_depth_state, "provider_live_path_deepened", "two covered live paths -> deepened");
+    process.env.XYTARA_EXECUTION_TARGETS_JSON = JSON.stringify([{ target_id: "pin", task_ref: "adapter.mcp.invoke", endpoint_url: "https://pin.example/execute", provider: "pin_provider", enabled: true }]);
+    pack = buildAdapterDepthPack(ad);
+    const pinned = pack.adapter_tasks.find((t) => t.task_ref === "adapter.mcp.invoke");
+    assert.ok(pinned.execution_targets.filter((t) => t.routing === "open_provider_registry").every((t) => t.shadowed_by_env_target && !t.enabled), "whole-lane env pin shadows registry providers");
+    assert.strictEqual(pinned.registry_provider_count, 0, "shadowed providers are not counted");
+  } finally {
+    if (prevTargets === undefined) delete process.env.XYTARA_EXECUTION_TARGETS_JSON; else process.env.XYTARA_EXECUTION_TARGETS_JSON = prevTargets;
+  }
+
+  console.log("  hardening: epoch-isolation | in-flight guard | timeout cap | settlement basis | endpoint policy | budget | adapter-depth registry");
 }
 
 async function main() {

package/server.js

@@ -4945,12 +4945,12 @@ async function routeRequest(req, res) {
   }
 
   if (req.method === "GET" && url.pathname === "/v1/adapter-depth") {
-    sendJson(res, 200, buildAdapterDepthPack());
+    sendJson(res, 200, buildAdapterDepthPack(state));
     return;
   }
 
   if (req.method === "GET" && url.pathname === "/v1/adapter-depth/summary") {
-    sendJson(res, 200, summarizeAdapterDepthPack());
+    sendJson(res, 200, summarizeAdapterDepthPack(state));
     return;
   }