xytara 3.7.0 → 3.8.0

package/RELEASE_NOTES.md

@@ -1,6 +1,7 @@
-`xytara` 3.7.0 puts open-network provider tools in front of every MCP client.
+`xytara` 3.8.0 lets a provider prove its endpoint before asking for traffic, and ships the server it can copy.
 
-- **Provider tools on the MCP server** — the MCP executor lists each active provider's offered tool (`provider_offers` with a `tool_name`) in `tools/list` after its built-in tools (a colliding name is skipped; built-in tools win) and proxies a `tools/call` for it to the runtime's paid execute route. The runtime quotes at the provider's price, challenges / verifies / settles the x402 payment (or debits the spend key's credits equivalent), routes the job to the provider, attributes the revenue share and issues the delivery receipt. The MCP result carries the provider's output as `structuredContent`, `_meta["naxytra.com/provider"]` (provider, price, runtime transaction and receipt ids), the runtime's settlement in `_meta["x402/payment-response"]` (and the `PAYMENT-RESPONSE` header), and the runtime's signed delivery receipt. Provider tools are never covered by the free allowance; `MCP_EXECUTOR_PROVIDER_TOOLS=0` hides them; `/health` reports `provider_tools`.
-- **Payout sweep preview** — `POST /v1/provider-network/payouts/sweep { dry_run: true }` returns the payable providers, the total and whether a signer is configured, without creating or sending anything.
-- The provider contract (`/v1/provider-network/contract`) states the MCP distribution.
+- **Provider self-test** — `POST /v1/provider-network/providers/:id/self-test` (the provider with its `owner_secret`, or the operator): the runtime POSTs a synthetic, unpaid job (`command: provider.self_test`, `body.self_test: true`, zero quote) to the registered endpoint exactly the way a paid job travels — same endpoint policy, same bearer, same deliverable rule — and records the outcome on the provider (`last_self_test`: ok, reason, latency, time), visible on the public record. An empty 2xx or an error fails it; nothing is quoted, charged or attributed. The daily report's pending-provider table shows the self-test outcome next to the payout-address check.
+- **Reference `/execute` server** — `services/mcp-execution-target/buyer-demo/provider-execute-reference.mjs` (Node 20+, no dependencies): bearer check, `GET /health`, the self-test answer, idempotency per `quote.quote_id`, the `{ result: { output } }` deliverable shape, 429 + Retry-After when overloaded, 4xx for bad input. The verifier runs it. Published at `https://www.naxytra.com/providers/execute-reference.mjs`; the walkthrough is `https://www.naxytra.com/providers/quickstart`.
+- **Anchoring record** — `scripts/record_delegation_checkpoint.js` appends the live delegation-log checkpoint (id, `attestation_sha256`, head, binding tag) as one JSONL line to the chronology drop directory, only when the checkpoint carries a `ctp/1` binding.
+- The provider contract documents the self-test.
 - Client package (thin): unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "xytara",
-  "version": "3.7.0",
+  "version": "3.8.0",
   "description": "Client for the hosted naxytra runtime: discover a capability, pay per call with x402 (gasless USDC on Base) or credits, get the deliverable and a signed delivery receipt you can verify offline. The runtime is a hosted service; this package is the client.",
   "main": "client.js",
   "exports": {