aimarket-oracle-core 0.2.0__tar.gz

aimarket_oracle_core-0.2.0/.gitignore

@@ -0,0 +1,36 @@
+# Python
+.venv/
+**/.venv/
+**/__pycache__/
+**/.pytest_cache/
+.coverage
+coverage.json
+**/coverage.json
+*.pyc
+*.egg-info/
+dist/
+build/
+
+# Node / frontend
+**/node_modules/
+**/frontend/dist/
+**/test-results/
+**/playwright-report/
+
+# Secrets & runtime data (any location)
+data/
+**/data/
+**/*_signing_key
+**/*_signing_key_mldsa
+**/*_mldsa
+**/test_key
+.env
+.env.*
+!.env.example
+
+# OS / IDE
+.DS_Store
+*.swp
+*.log
+.idea/
+.vscode/

aimarket_oracle_core-0.2.0/PKG-INFO

@@ -0,0 +1,79 @@
+Metadata-Version: 2.4
+Name: aimarket-oracle-core
+Version: 0.2.0
+Summary: Shared AIMarket v2 infrastructure for the oracle family
+License-Expression: Apache-2.0
+Requires-Python: >=3.11
+Requires-Dist: cryptography>=44.0.0
+Requires-Dist: fastapi>=0.115.0
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: pydantic>=2.9.0
+Requires-Dist: uvicorn[standard]>=0.32.0
+Provides-Extra: dev
+Requires-Dist: httpx>=0.27.0; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.24.0; extra == 'dev'
+Requires-Dist: pytest>=8.3.0; extra == 'dev'
+Provides-Extra: pqc
+Requires-Dist: dilithium-py>=1.4.0; extra == 'pqc'
+Description-Content-Type: text/markdown
+
+# aimarket-oracle-core
+
+Shared infrastructure for the [alexar76 oracle family](https://github.com/alexar76/oracles) —
+the layer that turns a pure function into a sellable, verifiable capability on
+**AIMarket Protocol v2**.
+
+An oracle written on top of this declares its capabilities and its maths. Everything else —
+the HTTP surface, the signed manifest, priced invoke, Ed25519 receipts, measured latency and
+success metrics, rate limiting, and hub federation — comes from here.
+
+```python
+from oracle_core import Capability, OracleSpec
+
+SPEC = OracleSpec(
+    name="Example Oracle",
+    product_id="prod-example",
+    description="What it sells, in a sentence an agent can choose on.",
+    capabilities=[
+        Capability(
+            capability_id="example.double@v1",
+            product_id="prod-example",
+            description="Return twice the input.",
+            handler=lambda d: {"result": 2 * float(d["value"])},
+            input_schema={"type": "object", "required": ["value"],
+                          "properties": {"value": {"type": "number"}}},
+            output_schema={"type": "object", "required": ["result"],
+                           "properties": {"result": {"type": "number"}}},
+            price_per_call_usd=0.001,
+        ),
+    ],
+)
+```
+
+## Install
+
+```bash
+pip install aimarket-oracle-core
+```
+
+The distribution is `aimarket-oracle-core`; the import is `oracle_core`. The unprefixed
+name `oracle-core` on PyPI is an **unrelated project** that installs a module of the same
+name — installing it in place of this one fails at
+`ImportError: cannot import name 'Capability' from 'oracle_core'`.
+
+## What you get
+
+| | |
+|---|---|
+| **Protocol** | `.well-known/ai-market.json` discovery, v2 manifest, priced `invoke` |
+| **Signing** | Ed25519 manifest signatures and 7-field receipts, canonical form shared with the hub; optional hybrid post-quantum via the `pqc` extra |
+| **Metrics** | measured `p50_latency_ms` and `success_rate_30d`, not declared constants |
+| **Safety** | handler exceptions become named refusals (`{"ok": false, "error": …}`) rather than opaque 500s |
+| **Federation** | manifests a hub can verify byte-for-byte and re-list |
+
+## Extras
+
+- `pqc` — hybrid post-quantum signatures (`dilithium-py`)
+- `dev` — pytest, pytest-asyncio, httpx
+
+Apache-2.0.

aimarket_oracle_core-0.2.0/README.md

@@ -0,0 +1,60 @@
+# aimarket-oracle-core
+
+Shared infrastructure for the [alexar76 oracle family](https://github.com/alexar76/oracles) —
+the layer that turns a pure function into a sellable, verifiable capability on
+**AIMarket Protocol v2**.
+
+An oracle written on top of this declares its capabilities and its maths. Everything else —
+the HTTP surface, the signed manifest, priced invoke, Ed25519 receipts, measured latency and
+success metrics, rate limiting, and hub federation — comes from here.
+
+```python
+from oracle_core import Capability, OracleSpec
+
+SPEC = OracleSpec(
+    name="Example Oracle",
+    product_id="prod-example",
+    description="What it sells, in a sentence an agent can choose on.",
+    capabilities=[
+        Capability(
+            capability_id="example.double@v1",
+            product_id="prod-example",
+            description="Return twice the input.",
+            handler=lambda d: {"result": 2 * float(d["value"])},
+            input_schema={"type": "object", "required": ["value"],
+                          "properties": {"value": {"type": "number"}}},
+            output_schema={"type": "object", "required": ["result"],
+                           "properties": {"result": {"type": "number"}}},
+            price_per_call_usd=0.001,
+        ),
+    ],
+)
+```
+
+## Install
+
+```bash
+pip install aimarket-oracle-core
+```
+
+The distribution is `aimarket-oracle-core`; the import is `oracle_core`. The unprefixed
+name `oracle-core` on PyPI is an **unrelated project** that installs a module of the same
+name — installing it in place of this one fails at
+`ImportError: cannot import name 'Capability' from 'oracle_core'`.
+
+## What you get
+
+| | |
+|---|---|
+| **Protocol** | `.well-known/ai-market.json` discovery, v2 manifest, priced `invoke` |
+| **Signing** | Ed25519 manifest signatures and 7-field receipts, canonical form shared with the hub; optional hybrid post-quantum via the `pqc` extra |
+| **Metrics** | measured `p50_latency_ms` and `success_rate_30d`, not declared constants |
+| **Safety** | handler exceptions become named refusals (`{"ok": false, "error": …}`) rather than opaque 500s |
+| **Federation** | manifests a hub can verify byte-for-byte and re-list |
+
+## Extras
+
+- `pqc` — hybrid post-quantum signatures (`dilithium-py`)
+- `dev` — pytest, pytest-asyncio, httpx
+
+Apache-2.0.

aimarket_oracle_core-0.2.0/docs/SIGNING.md

@@ -0,0 +1,100 @@
+# oracle-core signing — implementation note
+
+This document describes **what the code does today**. It is **not** a normative protocol spec,
+an external audit, or a proof of correctness. For ecosystem-level honesty see
+[`docs/crypto-maturity.en.md`](../../docs/crypto-maturity.en.md).
+
+Implementation: [`oracle_core/signing.py`](../oracle_core/signing.py).
+
+---
+
+## Ed25519 (default, always on)
+
+**Manifest canonical string** (4 fields + tools hash):
+
+```
+capabilities_count:{n}|generated_at:{iso}|protocol_version:{v}|tools_hash:{sha256}
+```
+
+`tools_hash = SHA-256(JSON.dumps(tools, sort_keys=True))`.
+
+**Receipt canonical string** (7 fields):
+
+```
+nonce:{n}|product_id:{id}|capability_id:{cap}|price_usd:{p}|timestamp:{iso}|success:{0|1}|latency_ms:{ms}
+```
+
+**Signature object** on manifests (via `sign_payload`):
+
+```json
+{
+  "algorithm": "ed25519",
+  "public_key": "<base64 32-byte pubkey>",
+  "value": "<base64 64-byte sig>"
+}
+```
+
+Receipts embed `signature.algorithm` + `signature.value` only (legacy 7-field receipt shape).
+
+Verification uses `cryptography` Ed25519 over the UTF-8 canonical string.
+
+---
+
+## Hybrid ML-DSA-65 (optional, off by default)
+
+Enable: `ORACLE_PQC=1` or `Signer(..., pqc=True)` **and** install `dilithium-py`.
+
+When enabled, `sign_payload` **adds** (does not replace Ed25519):
+
+```json
+{
+  "pq_algorithm": "ml-dsa-65",
+  "pq_public_key": "<base64 ML-DSA-65 public key>",
+  "pq_value": "<base64 ML-DSA-65 signature>"
+}
+```
+
+**Verification policy** (`verify_signature_object`):
+
+1. Ed25519 **must** verify.
+2. If `pq_value` is present, ML-DSA-65 **must also** verify (both required).
+3. If `pq_value` is absent, Ed25519 alone suffices.
+
+**Rationale (informal):** dual signatures — safe if either primitive holds during migration.
+This is a common hybrid pattern but **has not been independently reviewed** for this codebase.
+
+---
+
+## Key material
+
+| Key | Storage | Notes |
+|-----|---------|-------|
+| Ed25519 | `{key_path}` — 64 B seed‖pub | Or `ORACLE_SIGNING_SEED_B64` env (32 B seed) |
+| ML-DSA-65 | `{key_path}_mldsa` — hex pk/sk lines | Generated on first use when PQC enabled |
+
+File permissions attempted `0600`. **No HSM integration** in-tree.
+
+---
+
+## Hub integration gap
+
+The AIMarket Hub verifies **Ed25519 manifest/receipt signatures** on its hot path. PQ fields are
+**ignored** unless a consumer calls `Signer.verify_signature_object` locally.
+
+Until protocol v2.x freezes PQ fields and the Hub enforces both layers, treat hybrid PQC as
+**operator opt-in**, not ecosystem-wide post-quantum readiness.
+
+---
+
+## Test coverage
+
+- `core/tests/test_core.py` — Ed25519 round-trip; hybrid when `dilithium-py` installed.
+- `oracles/platon/backend/tests/test_signing.py` — hybrid tamper cases.
+
+**Missing for production hardening:**
+
+- Negative test vectors published in `aimarket-protocol`
+- Cross-language verifiers (TypeScript, Solidity) for PQ extension
+- External audit of canonical string choices and key-binding policy
+
+See [KI-6](https://github.com/alexar76/aicom/blob/main/docs/known-issues.md#ki-6--oracle-family-cryptographic-maturity-not-production-hardened).

aimarket_oracle_core-0.2.0/oracle_core/__init__.py

@@ -0,0 +1,37 @@
+"""oracle-core — shared AIMarket v2 infrastructure for the oracle family.
+
+Build an oracle by declaring capabilities and handing them to ``create_app``:
+
+    from oracle_core import Capability, OracleSpec, create_app
+
+    spec = OracleSpec(
+        name="My Oracle", product_id="prod-x", description="...",
+        public_url="http://localhost:9300", categories=["..."],
+        capabilities=[Capability("x.do@v1", "does x", handler=lambda d: {...})],
+    )
+    app = create_app(spec)
+
+You get signed manifest + invoke (with receipts + measured metrics) + .well-known
++ rate-limiting + (optional) hybrid PQC for free.
+"""
+
+from oracle_core.app import create_app
+from oracle_core.hub_client import HubClient
+from oracle_core.metrics import Metrics
+from oracle_core.protocol import Capability, OracleSpec, Protocol, input_hash, utc_now_z
+from oracle_core.ratelimit import RateLimiter
+from oracle_core.signing import Signer, pqc_available
+
+__all__ = [
+    "Capability",
+    "OracleSpec",
+    "Protocol",
+    "create_app",
+    "HubClient",
+    "Metrics",
+    "RateLimiter",
+    "Signer",
+    "pqc_available",
+    "input_hash",
+    "utc_now_z",
+]

aimarket_oracle_core-0.2.0/oracle_core/app.py

@@ -0,0 +1,108 @@
+"""FastAPI app factory — every oracle gets a compliant AIMarket v2 surface for free."""
+
+from __future__ import annotations
+
+import logging
+from typing import Any, Callable, Optional
+
+from fastapi import FastAPI, HTTPException, Request
+from fastapi.middleware.cors import CORSMiddleware
+from pydantic import BaseModel, Field
+
+from oracle_core.protocol import OracleSpec, Protocol
+from oracle_core.ratelimit import RateLimiter
+
+
+logger = logging.getLogger(__name__)
+
+
+class InvokeRequest(BaseModel):
+    capability_id: str
+    input: dict[str, Any] = Field(default_factory=dict)
+
+
+def client_key(request: Request) -> str:
+    """Per-client rate-limit key — the real client IP behind the reverse proxy.
+
+    Behind nginx the socket peer is always 127.0.0.1, so trust the proxy-set
+    ``X-Real-IP`` / first ``X-Forwarded-For`` hop. This is only spoofable by a
+    client that can reach the app directly; the service binds to loopback and is
+    published solely through nginx, so that path is closed.
+    """
+    xri = (request.headers.get("x-real-ip") or "").strip()
+    if xri:
+        return xri
+    xff = (request.headers.get("x-forwarded-for") or "").strip()
+    if xff:
+        return xff.split(",")[0].strip()
+    return request.client.host if request.client else "*"
+
+
+def create_app(
+    spec: OracleSpec,
+    cors_origins: str = "*",
+    invoke_rate_limit: int = 120,
+    extra: Optional[Callable[[FastAPI, Protocol], None]] = None,
+) -> FastAPI:
+    proto = Protocol(spec)
+    limiter = RateLimiter(invoke_rate_limit)
+
+    app = FastAPI(title=spec.name, description=spec.description, version=spec.version)
+    app.state.protocol = proto  # exposed for tests / extra routes
+
+    origins = [o.strip() for o in cors_origins.split(",") if o.strip()] or ["*"]
+    allow_all = origins == ["*"]
+    app.add_middleware(
+        CORSMiddleware,
+        allow_origins=origins,
+        allow_credentials=not allow_all,  # "*" + credentials is invalid per the CORS spec
+        allow_methods=["*"],
+        allow_headers=["*"],
+    )
+
+    @app.get("/api/health")
+    async def health() -> dict[str, Any]:
+        return {"status": "ok", "oracle": spec.product_id, "capabilities": len(spec.capabilities)}
+
+    @app.get("/.well-known/ai-market.json")
+    async def well_known() -> dict[str, Any]:
+        return proto.well_known()
+
+    @app.get("/ai-market/v2/manifest")
+    async def manifest() -> dict[str, Any]:
+        return proto.manifest()
+
+    @app.post("/ai-market/v2/invoke")
+    async def invoke(req: InvokeRequest, request: Request) -> dict[str, Any]:
+        if not limiter.allow(client_key(request)):
+            raise HTTPException(status_code=429, detail="rate limited")
+        try:
+            result = await proto.invoke(req.capability_id, req.input)
+            return {"ok": True, **result}
+        except ValueError as exc:
+            # A handler rejecting its input, e.g. "points must be a list of [x, y] pairs".
+            return {"ok": False, "error": str(exc)}
+        except KeyError as exc:
+            # A required field was simply absent. Only ValueError used to be translated, so
+            # `lumen.score` without `target_node` answered a bare 500 Internal Server Error
+            # — a caller that read the schema and mistyped one field learned nothing and had
+            # nothing to correct. KeyError stringifies to a quoted name, hence the strip.
+            return {"ok": False, "error": f"missing required input field: {str(exc).strip(chr(39))}"}
+        except RuntimeError as exc:
+            # A federated upstream refused. The oracle-family proxy raises this carrying the
+            # upstream's own message ("Unknown capability: …"), which is exactly what the
+            # caller needs and exactly what the 500 was swallowing.
+            return {"ok": False, "error": str(exc)}
+        except Exception as exc:  # noqa: BLE001 — deliberate catch-all, see below
+            # Anything else is a real fault, not a refusal, so it stays a 5xx. But it says
+            # what broke: an empty "Internal Server Error" is indistinguishable from a dead
+            # process, and callers retry it forever. Full traceback goes to the log.
+            logger.exception("invoke %s failed unexpectedly", req.capability_id)
+            raise HTTPException(
+                status_code=500, detail=f"{type(exc).__name__}: {exc}"
+            ) from exc
+
+    if extra is not None:
+        extra(app, proto)
+
+    return app

aimarket_oracle_core-0.2.0/oracle_core/hub_client.py

@@ -0,0 +1,89 @@
+"""Generic AIMarket hub federation client (shared by every oracle)."""
+
+from __future__ import annotations
+
+from typing import Any, Optional
+
+import httpx
+
+from oracle_core.protocol import Protocol
+
+
+def announce_canonical(hub_url: str, well_known_url: str, capabilities_count: int) -> str:
+    return f"hub_url:{hub_url}|well_known_url:{well_known_url}|capabilities_count:{capabilities_count}"
+
+
+class HubClient:
+    def __init__(self, proto: Protocol, hub_url: str):
+        self.proto = proto
+        self.hub_url = hub_url.rstrip("/")
+
+    def self_verify_manifest(self) -> dict[str, Any]:
+        man = self.proto.manifest()
+        return {
+            "ok": self.proto.signer.verify_manifest_signature(man),
+            "capabilities": [t["capability_id"] for t in man["tools"]],
+            "signer_public_key": self.proto.signer.public_key_b64,
+        }
+
+    def announce_body(self) -> dict[str, Any]:
+        base = self.proto.spec.public_url.rstrip("/")
+        wk = f"{base}/.well-known/ai-market.json"
+        count = len(self.proto.spec.capabilities)
+        canonical = announce_canonical(base, wk, count)
+        return {
+            "hub_url": base,
+            "well_known_url": wk,
+            "capabilities_count": count,
+            "hub_name": self.proto.spec.name,
+            "signer_public_key": self.proto.signer.public_key_b64,
+            "signature": {"algorithm": "ed25519", "value": self.proto.signer.sign_canonical(canonical)},
+        }
+
+    async def hub_info(self) -> dict[str, Any]:
+        try:
+            async with httpx.AsyncClient(timeout=15.0) as c:
+                r = await c.get(f"{self.hub_url}/.well-known/ai-market.json")
+                if r.status_code == 200:
+                    d = r.json()
+                    return {"reachable": True, "name": d.get("name"), "hub_version": d.get("hub_version")}
+                return {"reachable": False, "status": r.status_code}
+        except httpx.HTTPError as exc:
+            return {"reachable": False, "error": str(exc)}
+
+    async def announce(self, admin_token: str = "") -> dict[str, Any]:
+        params = {"authorization": admin_token} if admin_token else {}
+        try:
+            async with httpx.AsyncClient(timeout=20.0) as c:
+                r = await c.post(f"{self.hub_url}/ai-market/v2/federation/announce", params=params, json=self.announce_body())
+                body: Any
+                try:
+                    body = r.json()
+                except ValueError:
+                    body = r.text
+                return {"registered": r.status_code == 200, "status": r.status_code, "response": body}
+        except httpx.HTTPError as exc:
+            return {"registered": False, "error": str(exc)}
+
+    async def open_channel(self, deposit_usd: float = 1.0, token: str = "USDT", chain: str = "base") -> dict[str, Any]:
+        try:
+            async with httpx.AsyncClient(timeout=20.0) as c:
+                r = await c.post(f"{self.hub_url}/ai-market/v2/channel/open", json={"deposit_usd": deposit_usd, "token": token, "chain": chain})
+                return {"status": r.status_code, "response": _json_or_text(r)}
+        except httpx.HTTPError as exc:
+            return {"error": str(exc)}
+
+    async def search(self, intent: str, budget: float = 0.05, limit: int = 10) -> dict[str, Any]:
+        try:
+            async with httpx.AsyncClient(timeout=20.0) as c:
+                r = await c.get(f"{self.hub_url}/ai-market/v2/search", params={"intent": intent, "budget": budget, "limit": limit})
+                return {"status": r.status_code, "response": _json_or_text(r)}
+        except httpx.HTTPError as exc:
+            return {"error": str(exc)}
+
+
+def _json_or_text(r: "httpx.Response") -> Any:
+    try:
+        return r.json()
+    except ValueError:
+        return r.text

aimarket_oracle_core-0.2.0/oracle_core/metrics.py

@@ -0,0 +1,37 @@
+"""Rolling per-capability metrics — real measured latency and success rate."""
+
+from __future__ import annotations
+
+from collections import defaultdict, deque
+from typing import Optional
+
+
+class Metrics:
+    def __init__(self, window: int = 200) -> None:
+        self._window = window
+        self._latency: dict[str, deque] = defaultdict(lambda: deque(maxlen=window))
+        self._success: dict[str, deque] = defaultdict(lambda: deque(maxlen=window))
+
+    def record(self, capability_id: str, latency_ms: float, success: bool) -> None:
+        self._latency[capability_id].append(float(latency_ms))
+        self._success[capability_id].append(1 if success else 0)
+
+    def count(self, capability_id: str) -> int:
+        return len(self._success.get(capability_id, ()))
+
+    def p50_latency_ms(self, capability_id: str) -> Optional[float]:
+        samples = self._latency.get(capability_id)
+        if not samples:
+            return None
+        ordered = sorted(samples)
+        return ordered[len(ordered) // 2]
+
+    def success_rate(self, capability_id: str) -> Optional[float]:
+        samples = self._success.get(capability_id)
+        if not samples:
+            return None
+        return sum(samples) / len(samples)
+
+    def reset(self) -> None:
+        self._latency.clear()
+        self._success.clear()

aimarket_oracle_core-0.2.0/oracle_core/protocol.py

@@ -0,0 +1,193 @@
+"""AIMarket Protocol v2 — shared by every oracle in the family.
+
+An oracle declares an :class:`OracleSpec` (name, product, priced capabilities with
+handlers); this module turns it into a compliant ``.well-known`` doc, a signed
+manifest (measured metrics overlaid), and an ``invoke`` that wraps every result in
+a signed 7-field receipt + provenance. No per-oracle protocol code needed.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import inspect
+import json
+import secrets
+import time
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Any, Callable
+
+from oracle_core.metrics import Metrics
+from oracle_core.signing import Signer
+
+
+def utc_now_z() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def input_hash(input_data: dict[str, Any]) -> str:
+    return hashlib.sha256(
+        json.dumps(input_data, sort_keys=True, ensure_ascii=False).encode()
+    ).hexdigest()
+
+
+@dataclass
+class Capability:
+    capability_id: str  # e.g. "platon.random@v1"
+    description: str
+    handler: Callable[[dict[str, Any]], Any]  # sync or async; receives the input dict
+    product_id: str = "prod-oracle"
+    input_schema: dict[str, Any] = field(default_factory=lambda: {"type": "object", "properties": {}})
+    output_schema: dict[str, Any] = field(default_factory=lambda: {"type": "object"})
+    price_per_call_usd: float = 0.001
+    p50_latency_ms: float = 10
+    success_rate_30d: float = 0.999
+
+    @property
+    def name(self) -> str:
+        return self.capability_id.split("@", 1)[0]
+
+    def tool(self) -> dict[str, Any]:
+        return {
+            "name": self.name,
+            "capability_id": self.capability_id,
+            "product_id": self.product_id,
+            "description": self.description,
+            "input_schema": self.input_schema,
+            "output_schema": self.output_schema,
+            "price_per_call_usd": self.price_per_call_usd,
+            # Coerced for the same reason as the measured value in _tool_with_metrics: the
+            # field is declared `integer`, and a spec author writing 10.5 would silently
+            # make this oracle unfederatable.
+            "p50_latency_ms": int(round(self.p50_latency_ms)),
+            "success_rate_30d": self.success_rate_30d,
+        }
+
+
+@dataclass
+class OracleSpec:
+    name: str
+    product_id: str
+    description: str
+    public_url: str
+    categories: list[str]
+    capabilities: list[Capability]
+    signing_key_path: str = "data/signing_key"
+    version: str = "0.1.0"
+    related: list[str] = field(default_factory=list)
+
+    def capability(self, capability_id: str) -> Capability:
+        for c in self.capabilities:
+            if c.capability_id == capability_id:
+                return c
+        raise ValueError(f"Unknown capability: {capability_id}")
+
+
+class Protocol:
+    """Binds an OracleSpec to a Signer + Metrics and serves the v2 surface."""
+
+    def __init__(self, spec: OracleSpec, signer: Signer | None = None, metrics: Metrics | None = None):
+        self.spec = spec
+        self.signer = signer or Signer(spec.signing_key_path)
+        self.metrics = metrics or Metrics()
+
+    def well_known(self) -> dict[str, Any]:
+        base = self.spec.public_url.rstrip("/")
+        return {
+            "name": self.spec.name,
+            "protocol_versions": ["v2"],
+            "hub_version": self.spec.version,
+            "manifest_url": f"{base}/ai-market/v2/manifest",
+            "mcp_endpoint": f"{base}/ai-market/v2/invoke",
+            "capabilities_count": len(self.spec.capabilities),
+            "signer_public_key": self.signer.public_key_b64,
+            "description": self.spec.description,
+            "categories": self.spec.categories,
+            "protocol_version": "v2",
+            "hub_name": self.spec.name,
+            "hub_url": base,
+            "ecosystem": {"product": self.spec.product_id, "related": self.spec.related},
+        }
+
+    def _tool_with_metrics(self, cap: Capability) -> dict[str, Any]:
+        tool = cap.tool()
+        cid = cap.capability_id
+        observed = self.metrics.count(cid)
+        p50 = self.metrics.p50_latency_ms(cid)
+        sr = self.metrics.success_rate(cid)
+        if p50 is not None:
+            # int, not round(p50, 2): aimarket-protocol/schemas/manifest.json declares
+            # p50_latency_ms as {"type": "integer"}, so a measured 2261.84 made the hub
+            # reject the WHOLE manifest — "2261.84 is not of type 'integer'" — and index
+            # zero of the family's 22 capabilities. Sub-millisecond precision in a
+            # catalogue listing buys nothing; interoperating with the published schema
+            # buys federation.
+            tool["p50_latency_ms"] = int(round(p50))
+        if sr is not None:
+            tool["success_rate_30d"] = round(sr, 4)
+        tool["calls_observed"] = observed
+        tool["metrics_source"] = "measured" if observed else "declared"
+        return tool
+
+    def manifest(self) -> dict[str, Any]:
+        tools = [self._tool_with_metrics(c) for c in self.spec.capabilities]
+        body = {
+            "protocol_version": "v2",
+            "release_version": self.spec.version,
+            "generated_at": utc_now_z(),
+            "base_url": self.spec.public_url,
+            "products_count": 1,
+            "capabilities_count": len(tools),
+            "total_capabilities": len(tools),
+            "local_capabilities": len(tools),
+            "federated_capabilities": 0,
+            "hubs_indexed": 0,
+            "tools": tools,
+        }
+        body["signature"] = self.signer.sign_manifest(body)
+        return body
+
+    async def invoke(self, capability_id: str, input_data: dict[str, Any]) -> dict[str, Any]:
+        cap = self.spec.capability(capability_id)  # ValueError -> caller maps to {ok:false}
+        start = time.perf_counter()
+        success = True
+        try:
+            if inspect.iscoroutinefunction(cap.handler):
+                output = await cap.handler(input_data)
+            else:
+                # Sync handlers can be CPU-bound (e.g. Chronos VDF: T sequential
+                # squarings over an RSA-2048 modulus). Running them inline would
+                # block the event loop and stall every other request — a trivial
+                # DoS. Offload to a worker thread so one expensive call is isolated.
+                output = await asyncio.to_thread(cap.handler, input_data)
+                if inspect.isawaitable(output):
+                    output = await output
+        except Exception:
+            success = False
+            raise
+        finally:
+            latency_ms = (time.perf_counter() - start) * 1000.0
+            self.metrics.record(capability_id, latency_ms, success)
+        return self._envelope(cap, capability_id, input_data, output, latency_ms)
+
+    def _envelope(self, cap, capability_id, input_data, output, latency_ms) -> dict[str, Any]:
+        timestamp = utc_now_z()
+        receipt = self.signer.sign_receipt(
+            {
+                "nonce": secrets.token_hex(8),
+                "product_id": cap.product_id,
+                "capability_id": capability_id,
+                "price_usd": cap.price_per_call_usd,
+                "timestamp": timestamp,
+                "success": True,
+                "latency_ms": round(latency_ms, 2),
+            }
+        )
+        return {
+            "capability_id": capability_id,
+            "output": output,
+            "price_usd": cap.price_per_call_usd,
+            "provenance": {"source": self.spec.product_id, "timestamp": timestamp, "input_hash": input_hash(input_data)},
+            "receipt": receipt,
+        }

aimarket_oracle_core-0.2.0/oracle_core/ratelimit.py

@@ -0,0 +1,41 @@
+"""Tiny fixed-window rate limiter — bounds DoS / cost on open endpoints.
+
+Keyed per client (typically the real client IP supplied by the reverse proxy)
+so a single noisy client cannot exhaust the budget for everyone. An unkeyed
+``allow()`` falls back to a shared bucket for backwards compatibility.
+"""
+
+from __future__ import annotations
+
+import time
+from collections import defaultdict, deque
+
+
+class RateLimiter:
+    def __init__(self, limit: int, window_s: float = 60.0, *, max_keys: int = 8192) -> None:
+        self.limit = limit
+        self.window = window_s
+        self.max_keys = max_keys
+        self._buckets: dict[str, deque[float]] = defaultdict(deque)
+
+    def allow(self, key: str = "*") -> bool:
+        now = time.monotonic()
+        # Opportunistic eviction so idle/one-shot keys (e.g. spoofed source IPs)
+        # cannot grow the bucket map without bound.
+        if len(self._buckets) > self.max_keys:
+            self._evict_stale(now)
+        hits = self._buckets[key]
+        while hits and now - hits[0] > self.window:
+            hits.popleft()
+        if len(hits) >= self.limit:
+            return False
+        hits.append(now)
+        return True
+
+    def _evict_stale(self, now: float) -> None:
+        stale = [k for k, h in self._buckets.items() if not h or now - h[-1] > self.window]
+        for k in stale:
+            del self._buckets[k]
+
+    def reset(self) -> None:
+        self._buckets.clear()

aimarket_oracle_core-0.2.0/oracle_core/signing.py

@@ -0,0 +1,208 @@
+"""Ed25519 signing (+ optional hybrid ML-DSA-65) for the oracle family.
+
+Canonical forms for manifest (4-field, with tools_hash) and receipts (7-field)
+match the AIMarket hub exactly, so signatures verify against the live hub. PQC is
+additive: when enabled, an ML-DSA-65 (FIPS 204) signature is attached alongside
+Ed25519 — verifiers that understand it require both; the hub keeps checking Ed25519.
+
+Decoupled from any single oracle's config: the seed may come from
+``ORACLE_SIGNING_SEED_B64`` (secrets manager / KMS) and PQC from ``ORACLE_PQC=1``
+or the constructor flag.
+"""
+
+from __future__ import annotations
+
+import base64
+import contextlib
+import hashlib
+import json
+import os
+from pathlib import Path
+from typing import Any
+
+try:
+    from dilithium_py.ml_dsa import ML_DSA_65 as _MLDSA
+
+    _PQ_LIB = True
+except Exception:  # pragma: no cover
+    _MLDSA = None
+    _PQ_LIB = False
+
+
+def pqc_available() -> bool:
+    return _PQ_LIB
+
+
+def _ensure_keypair(path: Path) -> tuple[bytes, bytes]:
+    from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+    if path.exists():
+        raw = path.read_bytes()
+        if len(raw) == 64:
+            return raw[:32], raw[32:]
+        raise RuntimeError(f"Ed25519 key file {path} is corrupted (size={len(raw)})")
+    path.parent.mkdir(parents=True, exist_ok=True)
+    priv = Ed25519PrivateKey.generate()
+    seed = priv.private_bytes_raw()
+    pub = priv.public_key().public_bytes_raw()
+    path.write_bytes(seed + pub)
+    with contextlib.suppress(OSError):
+        os.chmod(path, 0o600)
+    return seed, pub
+
+
+def _seed_from_env() -> bytes | None:
+    raw = os.environ.get("ORACLE_SIGNING_SEED_B64")
+    if not raw:
+        return None
+    seed = base64.b64decode(raw)
+    if len(seed) != 32:
+        raise RuntimeError("ORACLE_SIGNING_SEED_B64 must decode to a 32-byte seed")
+    return seed
+
+
+def _load_or_make_pq(path: Path) -> tuple[bytes, bytes]:
+    if path.exists():
+        pk_hex, sk_hex = path.read_text().split("\n")[:2]
+        return bytes.fromhex(pk_hex), bytes.fromhex(sk_hex)
+    pk, sk = _MLDSA.keygen()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(f"{pk.hex()}\n{sk.hex()}\n")
+    with contextlib.suppress(OSError):
+        os.chmod(path, 0o600)
+    return pk, sk
+
+
+class Signer:
+    def __init__(self, key_path: str | Path = "data/oracle_signing_key", pqc: bool | None = None) -> None:
+        self.key_path = Path(key_path)
+        env_seed = _seed_from_env()
+        if env_seed is not None:
+            from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+            self._seed = env_seed
+            self._pub_bytes = (
+                Ed25519PrivateKey.from_private_bytes(env_seed).public_key().public_bytes_raw()
+            )
+        else:
+            self._seed, self._pub_bytes = _ensure_keypair(self.key_path)
+        self._public_key_b64 = base64.b64encode(self._pub_bytes).decode()
+
+        if pqc is None:
+            pqc = os.environ.get("ORACLE_PQC", "").lower() in ("1", "true", "yes")
+        self._pq: tuple[bytes, bytes] | None = None
+        if pqc and _PQ_LIB:
+            self._pq = _load_or_make_pq(Path(f"{self.key_path}_mldsa"))
+
+    @property
+    def public_key_b64(self) -> str:
+        return self._public_key_b64
+
+    def sign_canonical(self, canonical: str) -> str:
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+        sig = Ed25519PrivateKey.from_private_bytes(self._seed).sign(canonical.encode())
+        return base64.b64encode(sig).decode()
+
+    def sign_payload(self, canonical: str) -> dict[str, str]:
+        obj: dict[str, str] = {
+            "algorithm": "ed25519",
+            "public_key": self._public_key_b64,
+            "value": self.sign_canonical(canonical),
+        }
+        if self._pq is not None:
+            pk, sk = self._pq
+            obj["pq_algorithm"] = "ml-dsa-65"
+            obj["pq_public_key"] = base64.b64encode(pk).decode()
+            obj["pq_value"] = base64.b64encode(_MLDSA.sign(sk, canonical.encode())).decode()
+        return obj
+
+    @staticmethod
+    def verify(canonical: str, value_b64: str, public_key_b64: str) -> bool:
+        from cryptography.exceptions import InvalidSignature
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+        try:
+            pub = Ed25519PublicKey.from_public_bytes(base64.b64decode(public_key_b64))
+            pub.verify(base64.b64decode(value_b64), canonical.encode())
+            return True
+        except (InvalidSignature, ValueError):
+            return False
+
+    @staticmethod
+    def verify_signature_object(canonical: str, sig: dict[str, Any], ed_public_key_b64: str | None = None) -> bool:
+        ed_key = ed_public_key_b64 or sig.get("public_key")
+        if not ed_key or not Signer.verify(canonical, sig.get("value", ""), ed_key):
+            return False
+        if sig.get("pq_value"):
+            if not _PQ_LIB:
+                return False
+            try:
+                pk = base64.b64decode(sig.get("pq_public_key", ""))
+                return bool(_MLDSA.verify(pk, canonical.encode(), base64.b64decode(sig["pq_value"])))
+            except Exception:
+                return False
+        return True
+
+    # --- manifest / receipt canonicals (match the AIMarket hub) ---
+    def manifest_canonical(self, manifest: dict[str, Any]) -> str:
+        """Byte-identical to aimarket_hub.signing.Signer.manifest_canonical.
+
+        `by_hub_hash` is the fifth field and was missing here. The hub added it so a relay
+        cannot tamper with per-peer trust_score and routing metadata under a valid
+        signature — and since the hub verifies with ITS canonical, every oracle manifest
+        failed with "Invalid manifest signature" and no oracle could federate at all. An
+        oracle serves no `by_hub`, so this hashes `{}`, which is exactly what the hub
+        computes for the absent key: the two agree without the oracle inventing a field.
+
+        If the hub's canonical gains a sixth field, this must follow the same day.
+        """
+        tools = manifest.get("tools", [])
+        tools_hash = hashlib.sha256(
+            json.dumps(tools, sort_keys=True, ensure_ascii=False).encode()
+        ).hexdigest()
+        by_hub_hash = hashlib.sha256(
+            json.dumps(manifest.get("by_hub", {}), sort_keys=True, ensure_ascii=False).encode()
+        ).hexdigest()
+        return (
+            f"capabilities_count:{manifest.get('capabilities_count', 0)}"
+            f"|generated_at:{manifest.get('generated_at', '')}"
+            f"|protocol_version:{manifest.get('protocol_version', 'v1')}"
+            f"|tools_hash:{tools_hash}"
+            f"|by_hub_hash:{by_hub_hash}"
+        )
+
+    def sign_manifest(self, manifest: dict[str, Any]) -> dict[str, str]:
+        return self.sign_payload(self.manifest_canonical(manifest))
+
+    def verify_manifest_signature(self, manifest: dict[str, Any], public_key_b64: str | None = None) -> bool:
+        sig = manifest.get("signature") or {}
+        key = public_key_b64 or sig.get("public_key") or self._public_key_b64
+        return self.verify(self.manifest_canonical(manifest), sig.get("value", ""), key)
+
+    @staticmethod
+    def receipt_canonical(receipt: dict[str, Any]) -> str:
+        success = 1 if receipt.get("success", True) else 0
+        return (
+            f"nonce:{receipt.get('nonce', '')}"
+            f"|product_id:{receipt.get('product_id', '')}"
+            f"|capability_id:{receipt.get('capability_id', '')}"
+            f"|price_usd:{receipt.get('price_usd', 0)}"
+            f"|timestamp:{receipt.get('timestamp', '')}"
+            f"|success:{success}"
+            f"|latency_ms:{receipt.get('latency_ms', 0)}"
+        )
+
+    def sign_receipt(self, receipt: dict[str, Any]) -> dict[str, Any]:
+        signed = dict(receipt)
+        signed["signature"] = {
+            "algorithm": "ed25519",
+            "value": self.sign_canonical(self.receipt_canonical(receipt)),
+        }
+        return signed
+
+    def verify_receipt(self, receipt: dict[str, Any], public_key_b64: str | None = None) -> bool:
+        sig = receipt.get("signature") or {}
+        key = public_key_b64 or self._public_key_b64
+        body = {k: v for k, v in receipt.items() if k != "signature"}
+        return self.verify(self.receipt_canonical(body), sig.get("value", ""), key)

aimarket_oracle_core-0.2.0/pyproject.toml

@@ -0,0 +1,39 @@
+[project]
+# `aimarket-oracle-core`, NOT `oracle-core`. The short name belongs to somebody else on
+# PyPI — an unrelated "personal prediction engine" that happens to install the same
+# top-level `oracle_core` module. Every oracle here declared `dependencies =
+# ["oracle-core"]` unpinned, so `pip install oracles/chronos` in a clean environment
+# resolved that name from the index and installed a stranger's package (plus flask,
+# pandas and scikit-learn) instead of this one, ending in
+# `ImportError: cannot import name 'Capability' from 'oracle_core'`. Verified 2026-07-28.
+# The family image survived only because it installs core and all oracles in one pip
+# invocation, where the local project satisfies the requirement before the index is
+# consulted. Do not shorten this name back.
+name = "aimarket-oracle-core"
+version = "0.2.0"
+description = "Shared AIMarket v2 infrastructure for the oracle family"
+readme = "README.md"
+license = "Apache-2.0"
+requires-python = ">=3.11"
+dependencies = [
+    "fastapi>=0.115.0",
+    "uvicorn[standard]>=0.32.0",
+    "httpx>=0.27.0",
+    "pydantic>=2.9.0",
+    "cryptography>=44.0.0",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8.3.0", "pytest-asyncio>=0.24.0", "httpx>=0.27.0"]
+pqc = ["dilithium-py>=1.4.0"]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["oracle_core"]
+
+[tool.pytest.ini_options]
+asyncio_mode = "auto"
+testpaths = ["tests"]

aimarket_oracle_core-0.2.0/tests/test_core.py

@@ -0,0 +1,216 @@
+import pytest
+from httpx import ASGITransport, AsyncClient
+
+from oracle_core import Capability, OracleSpec, Signer, create_app
+from oracle_core.protocol import Protocol
+
+
+def _spec(tmp_path):
+    return OracleSpec(
+        name="Test Oracle",
+        product_id="prod-test",
+        description="test",
+        public_url="http://localhost:9999",
+        categories=["test"],
+        signing_key_path=str(tmp_path / "key"),
+        capabilities=[
+            Capability("test.echo@v1", "echo", handler=lambda d: {"echo": d.get("msg", "")}, price_per_call_usd=0.002),
+            Capability("test.async@v1", "async", handler=_async_handler),
+        ],
+    )
+
+
+async def _async_handler(d):
+    return {"doubled": d.get("n", 0) * 2}
+
+
+class TestProtocol:
+    def test_manifest_self_verifies(self, tmp_path):
+        proto = Protocol(_spec(tmp_path))
+        m = proto.manifest()
+        assert m["capabilities_count"] == 2
+        assert proto.signer.verify_manifest_signature(m) is True
+
+    @pytest.mark.asyncio
+    async def test_invoke_envelope_and_receipt(self, tmp_path):
+        proto = Protocol(_spec(tmp_path))
+        r = await proto.invoke("test.echo@v1", {"msg": "hi"})
+        assert r["output"] == {"echo": "hi"}
+        assert r["price_usd"] == 0.002
+        assert len(r["provenance"]["input_hash"]) == 64
+        assert proto.signer.verify_receipt(r["receipt"]) is True
+
+    @pytest.mark.asyncio
+    async def test_async_handler(self, tmp_path):
+        proto = Protocol(_spec(tmp_path))
+        r = await proto.invoke("test.async@v1", {"n": 21})
+        assert r["output"] == {"doubled": 42}
+
+    def test_unknown_capability_raises(self, tmp_path):
+        with pytest.raises(ValueError):
+            Protocol(_spec(tmp_path)).spec.capability("nope@v1")
+
+    @pytest.mark.asyncio
+    async def test_measured_metrics_after_invoke(self, tmp_path):
+        proto = Protocol(_spec(tmp_path))
+        await proto.invoke("test.echo@v1", {"msg": "x"})
+        tool = next(t for t in proto.manifest()["tools"] if t["capability_id"] == "test.echo@v1")
+        assert tool["metrics_source"] == "measured" and tool["calls_observed"] >= 1
+
+
+class TestApp:
+    @pytest.mark.asyncio
+    async def test_endpoints(self, tmp_path):
+        app = create_app(_spec(tmp_path))
+        transport = ASGITransport(app=app)
+        async with AsyncClient(transport=transport, base_url="http://t") as c:
+            assert (await c.get("/api/health")).json()["status"] == "ok"
+            wk = (await c.get("/.well-known/ai-market.json")).json()
+            assert wk["protocol_version"] == "v2" and wk["signer_public_key"]
+            inv = (await c.post("/ai-market/v2/invoke", json={"capability_id": "test.echo@v1", "input": {"msg": "yo"}})).json()
+            assert inv["ok"] is True and inv["output"] == {"echo": "yo"}
+            bad = (await c.post("/ai-market/v2/invoke", json={"capability_id": "x@v1", "input": {}})).json()
+            assert bad["ok"] is False
+
+
+class TestSigningPQC:
+    def test_hybrid_when_enabled(self, tmp_path):
+        from oracle_core.signing import pqc_available
+
+        if not pqc_available():
+            pytest.skip("dilithium-py not installed")
+        s = Signer(tmp_path / "k", pqc=True)
+        sig = s.sign_payload("a|b")
+        assert sig.get("pq_algorithm") == "ml-dsa-65"
+        assert Signer.verify_signature_object("a|b", sig) is True
+        bad = dict(sig)
+        bad["pq_value"] = "AA" + sig["pq_value"][2:]
+        assert Signer.verify_signature_object("a|b", bad) is False
+
+
+# ── Invoke error translation ─────────────────────────────────────
+# Only ValueError used to become {"ok": false, "error": …}; every other way a handler can
+# say "no" escaped as a bare 500 Internal Server Error with an empty body. A caller that
+# read the schema and mistyped one field got nothing to correct, and a federated refusal
+# ("Unknown capability: platon.verify@v1") was replaced by silence.
+
+def _err_spec(tmp_path):
+    def missing_field(d):
+        return {"v": d["required_field"]}          # KeyError
+
+    def bad_input(d):
+        raise ValueError("points must be a list of [x, y] pairs")
+
+    def upstream_refused(d):
+        raise RuntimeError("Unknown capability: platon.verify@v1")
+
+    def genuine_fault(d):
+        return 1 / 0                                # ZeroDivisionError
+
+    return OracleSpec(
+        name="Err Oracle", product_id="prod-err", description="err",
+        public_url="http://localhost:9999", categories=["test"],
+        signing_key_path=str(tmp_path / "errkey"),
+        capabilities=[
+            Capability("err.missing@v1", "missing", handler=missing_field),
+            Capability("err.bad@v1", "bad", handler=bad_input),
+            Capability("err.upstream@v1", "upstream", handler=upstream_refused),
+            Capability("err.fault@v1", "fault", handler=genuine_fault),
+        ],
+    )
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "cap,needle",
+    [
+        ("err.missing@v1", "missing required input field: required_field"),
+        ("err.bad@v1", "points must be a list of [x, y] pairs"),
+        ("err.upstream@v1", "Unknown capability: platon.verify@v1"),
+    ],
+)
+async def test_refusals_reach_the_caller_with_their_reason(tmp_path, cap, needle):
+    app = create_app(_err_spec(tmp_path))
+    async with AsyncClient(transport=ASGITransport(app=app), base_url="http://t") as c:
+        r = await c.post("/ai-market/v2/invoke", json={"capability_id": cap, "input": {}})
+    assert r.status_code == 200, r.text
+    body = r.json()
+    assert body["ok"] is False
+    assert needle in body["error"], body
+
+
+@pytest.mark.asyncio
+async def test_a_real_fault_stays_a_5xx_but_says_what_broke(tmp_path):
+    """A crash must not be laundered into a 200 — but an empty body is indistinguishable
+    from a dead process, so the type and message travel with the 500."""
+    app = create_app(_err_spec(tmp_path))
+    async with AsyncClient(transport=ASGITransport(app=app), base_url="http://t") as c:
+        r = await c.post("/ai-market/v2/invoke", json={"capability_id": "err.fault@v1", "input": {}})
+    assert r.status_code == 500
+    assert "ZeroDivisionError" in r.text
+
+
+@pytest.mark.asyncio
+async def test_manifest_validates_against_the_published_protocol_schema(tmp_path):
+    """The whole point of a manifest is that a hub will accept it.
+
+    `p50_latency_ms` is declared `integer` in aimarket-protocol/schemas/manifest.json.
+    oracle_core emitted `round(p50, 2)`, so once a capability had been called and its
+    measured latency was fractional (2261.84), every hub rejected the entire manifest and
+    federated none of the oracle's capabilities.
+    """
+    import json
+    from pathlib import Path
+
+    import jsonschema
+
+    schema_path = (
+        Path(__file__).resolve().parents[3] / "aimarket-protocol" / "schemas" / "manifest.json"
+    )
+    if not schema_path.is_file():
+        pytest.skip(f"protocol schema not present at {schema_path}")
+
+    app = create_app(_spec(tmp_path))
+    async with AsyncClient(transport=ASGITransport(app=app), base_url="http://t") as c:
+        # Call one capability first so the metrics path (not just the declared default)
+        # is what gets serialised — that is the shape that actually broke.
+        await c.post("/ai-market/v2/invoke", json={"capability_id": "test.echo@v1", "input": {"msg": "x"}})
+        manifest = (await c.get("/ai-market/v2/manifest")).json()
+
+    for tool in manifest.get("tools") or []:
+        assert isinstance(tool["p50_latency_ms"], int), tool
+    jsonschema.validate(manifest, json.loads(schema_path.read_text()))
+
+
+@pytest.mark.asyncio
+async def test_the_hub_can_verify_an_oracle_manifest_signature(tmp_path):
+    """Cross-implementation check: the hub's verifier against an oracle's signature.
+
+    These are two separate codebases signing the same canonical string, and they had
+    drifted — the hub added a fifth field (`by_hub_hash`) to stop a relay tampering with
+    peer trust, oracle_core kept signing four, and so EVERY oracle manifest was rejected
+    with "Invalid manifest signature". Federation was silently dead; the only federated
+    rows in the live catalogue predated the hub's change. A unit test inside either
+    package would have passed — only checking one against the other catches this.
+    """
+    import sys
+    from pathlib import Path
+
+    hub_pkg = Path(__file__).resolve().parents[3] / "aimarket-hub"
+    if not (hub_pkg / "aimarket_hub" / "signing.py").is_file():
+        pytest.skip("aimarket-hub not available in this checkout")
+    sys.path.insert(0, str(hub_pkg))
+    try:
+        from aimarket_hub.signing import Signer as HubSigner
+    except Exception as exc:  # noqa: BLE001 — hub deps may be absent in the oracle venv
+        pytest.skip(f"aimarket_hub not importable: {exc}")
+
+    app = create_app(_spec(tmp_path))
+    async with AsyncClient(transport=ASGITransport(app=app), base_url="http://t") as c:
+        manifest = (await c.get("/ai-market/v2/manifest")).json()
+
+    oracle_key = manifest["signature"]["public_key"]
+    hub_signer = HubSigner(str(tmp_path / "hubkey"))
+    assert hub_signer.verify_manifest_signature(manifest, oracle_key), (
+        "the hub rejects this oracle's manifest — the canonical forms have diverged again"
+    )

aimarket_oracle_core-0.2.0/tests/test_packaging.py

@@ -0,0 +1,72 @@
+"""Every oracle must depend on the shared library by the name this repo actually builds.
+
+On 2026-07-28 all 17 oracles declared `dependencies = ["oracle-core"]`, unpinned. That name
+belongs to an unrelated project on PyPI which installs the same top-level `oracle_core`
+module, so `pip install oracles/chronos` in a clean environment resolved it from the index
+and installed a stranger's package — flask, pandas and scikit-learn came with it — ending in
+`ImportError: cannot import name 'Capability' from 'oracle_core'`. The family image never
+noticed: it installs core and every oracle in one pip invocation, where the local project
+satisfies the requirement before the index is consulted.
+
+That is the whole failure mode — a dependency name nothing in the repo provides is not an
+error at declaration time, only at install time, and only outside the one environment we
+routinely build. So the check is static and needs no network: the name the oracles ask for
+must be the name core publishes.
+"""
+
+from __future__ import annotations
+
+import pathlib
+import re
+
+import pytest
+
+ORACLES = pathlib.Path(__file__).resolve().parents[2] / "oracles"
+CORE_PYPROJECT = pathlib.Path(__file__).resolve().parents[1] / "pyproject.toml"
+
+_NAME = re.compile(r'^\s*name\s*=\s*["\']([^"\']+)["\']', re.M)
+_DEPS = re.compile(r"^dependencies\s*=\s*\[(.*?)\]", re.M | re.S)
+# "aimarket-oracle-core>=0.2" -> "aimarket-oracle-core"
+_REQ = re.compile(r'["\']\s*([A-Za-z0-9._-]+)')
+
+
+def _dist_name(pyproject: pathlib.Path) -> str:
+    m = _NAME.search(pyproject.read_text())
+    assert m, f"{pyproject} declares no [project] name"
+    return m.group(1).lower().replace("_", "-")
+
+
+def _dependency_names(pyproject: pathlib.Path) -> list[str]:
+    m = _DEPS.search(pyproject.read_text())
+    if not m:
+        return []
+    return [r.lower().replace("_", "-") for r in _REQ.findall(m.group(1))]
+
+
+CORE_DIST = _dist_name(CORE_PYPROJECT)
+ORACLE_PYPROJECTS = sorted(ORACLES.glob("*/pyproject.toml"))
+
+
+def test_the_oracle_tree_was_found():
+    """A bad glob is how gaia slipped through the first sweep of this same fix."""
+    assert len(ORACLE_PYPROJECTS) >= 17, f"only found {len(ORACLE_PYPROJECTS)} oracles under {ORACLES}"
+
+
+def test_core_is_namespaced():
+    assert CORE_DIST.startswith("aimarket-"), (
+        f"core publishes as {CORE_DIST!r}. Unprefixed names collide with strangers on PyPI; "
+        "keep the shared library inside the namespace this project owns."
+    )
+
+
+@pytest.mark.parametrize("pyproject", ORACLE_PYPROJECTS, ids=lambda p: p.parent.name)
+def test_oracle_depends_on_core_by_the_name_core_publishes(pyproject):
+    deps = _dependency_names(pyproject)
+    if CORE_DIST in deps:
+        return
+    stale = [d for d in deps if "oracle-core" in d or d == "oracle_core"]
+    pytest.fail(
+        f"{pyproject.parent.name} depends on {stale or deps} but core publishes as "
+        f"{CORE_DIST!r}. An unresolvable-locally name is fetched from PyPI, where "
+        f"`oracle-core` is somebody else's project."
+    )