From c34ffa302a2e05104749779eb2a407e104d1863f Mon Sep 17 00:00:00 2001 From: Sean Goodwin Date: Thu, 10 Sep 2026 12:11:18 -0700 Subject: [PATCH 1/5] docs(living): mirror TODAY + AGENT_RESTART_CHECKLIST + CLAIM_PATH Operating-log parity with E:\dev\living-docs. CLAIM_PATH names the claim-path stall (pending tasks assigned_to non-running agents; claim path proven healthy via an 11s open-pool probe claim). No secrets; project ref only (public per canon). Co-Authored-By: Claude Opus 4.8 (1M context) # Conflicts: # docs/living/TODAY.md --- docs/living/AGENT_RESTART_CHECKLIST.md | 50 ++++++++++ docs/living/CLAIM_PATH.md | 48 ++++++++++ docs/living/TODAY.md | 121 ++++++++++++++++++------- 3 files changed, 188 insertions(+), 31 deletions(-) create mode 100644 docs/living/AGENT_RESTART_CHECKLIST.md create mode 100644 docs/living/CLAIM_PATH.md diff --git a/docs/living/AGENT_RESTART_CHECKLIST.md b/docs/living/AGENT_RESTART_CHECKLIST.md new file mode 100644 index 0000000..7a62121 --- /dev/null +++ b/docs/living/AGENT_RESTART_CHECKLIST.md @@ -0,0 +1,50 @@ +# AGENT RESTART CHECKLIST — Sean-only (G6) +**Written** 2026-09-10 by CC (Loop 4). **CC does not press restart — this is a Sean action.** +**Mirror to GitHub** `repid-engine/docs/living/` in the same hour it lands here (parity rule). + +> ⚠️ **Read this first — the framing changed on live evidence.** The `agent_heartbeat` table froze 2026-07-17, which *looks* like 12 dead agents. It is not. The live probe feed (`v_agent_liveness`, from `agent_health_probes`) shows **all 12 loops ADVANCING right now** (iterated 2–3 min ago, loop_count ~4100). The real defect is **throughput, not liveness**: none has **claimed a task in >24h** (`not_claiming_24h = true` for all 12; last claims range 8–83 days ago). So a blind "restart the dead swarm" can *restart healthy loops and still not fix the thing that's broken.* Diagnose the claim path first. + +## Step 0 — Query the honest instrument before touching Railway +```sql +SELECT agent_name, loop_state, min_since_iteration, loop_count, + hrs_since_task_claim, not_claiming_24h, probe_feed_stale +FROM v_agent_liveness ORDER BY loop_state, hrs_since_task_claim DESC; +``` +- If `probe_feed_stale = true` → the prober itself is down; fix that first (the view is blind, don't trust it). +- `loop_state = advancing` + `not_claiming_24h = true` → **do NOT restart for liveness.** The loop is fine; the claim path or task supply is the problem (see Step 3). +- `loop_state = down` or `hung` → that specific service is a restart candidate (Step 2). + +## Step 1 — Per-service readout (print BEFORE any restart) +For each of the 12 `trinity-*` services, capture from the Railway dashboard / `GET /health`: +| Field | Where | Healthy looks like | +|---|---|---| +| `HEARTBEAT_MODE` | service env var | `throttled` or `off` — **never `full`** (full = ~8.6M writes/day storm) | +| `loopCount` | `/health` body | advancing between two reads 5 min apart | +| `lastIterationAt` | `/health` body | < 15 min old | +| last `llm_call_log` | DB `llm_call_log` for that agent | a row in the last hour if it's meant to be working | +| `RAILWAY_GIT_COMMIT_SHA` | service env / deploy | matches `main` HEAD; a stale SHA = running old code | + +**Restart ONLY a service that is both frozen (loopCount not advancing / `lastIterationAt` stale) AND unhealthy.** A service whose loop advances does not get restarted — you would be clearing the one piece of evidence that says where the real fault is. + +## Step 2 — If (and only if) a service is genuinely frozen +1. Confirm the commit SHA it will boot (must be `main` HEAD, not a stale build). +2. Restart it. +3. **It comes back `HEARTBEAT_MODE=throttled`, NEVER `full`.** Full mode is the write-storm that got presence-writes switched off in the first place. +4. Watch `loopCount` advance and `lastIterationAt` refresh within one probe cycle (~5 min). + +## Step 3 — First-claim success criteria (this is what "fixed" means) +A restart is successful only when work actually flows — not when `/health` says 200: +- **One real task claim within 30 minutes** (`trinity_tasks.claimed_by = ''` with a fresh `claimed_at`), on a real task — not a diagnostic. +- **No write storm** — `agent_heartbeat` / presence writes stay bounded (throttled mode), not the ~8.6M/day pattern. +- If loops advance but still no claim in 30 min → the fault is **task supply or the claim gate**, not the process. Only 5 tasks sit `pending`; check the open pool has claimable work and the claim filter isn't excluding it. + +## Step 4 — Keep the peer-verify producer behind a churn filter +Before/while reviving anything that writes to `peer_verification_queue` (already 140k rows, drain stalled): +- **Drop `EVERGREEN_AUDIT`, `diag_probe`, and `SHADOW_REJECT`** from what the producer enqueues — these are the churn that inflated the queue without moving verification forward. +- A revived agent must not re-flood the queue faster than the drain can clear it. + +## Hard stops (from TODAY.md "Night forbidden") +`MODE=full` · `column rename` · `SECURITY DEFINER revoke` · `npm publish` · `new product folder` · `public launch language` · `spend`. None of these are part of a restart. + +--- +**Bottom line for Sean:** run Step 0 + Step 1. If every agent reads `advancing`, the restart is likely the wrong lever — the claim path is — and it can wait for morning. Restart only a service that is provably frozen, throttled not full, and judge success by a real claim in 30 min. diff --git a/docs/living/CLAIM_PATH.md b/docs/living/CLAIM_PATH.md new file mode 100644 index 0000000..c4839a7 --- /dev/null +++ b/docs/living/CLAIM_PATH.md @@ -0,0 +1,48 @@ +# CLAIM_PATH — why 12 advancing loops claimed 0 tasks in 8–83 days +**Diagnosed** 2026-09-10 (CC, standing order Loop 1). Live evidence against Trinity prod `qnnpjhlxljtqyigedwkb`. +**Verdict:** the claim-path CODE is healthy. The queue is **mis-targeted** — every pending row is `assigned_to` an agent that is not in the running fleet. Loops idle *correctly*. + +## The paradox +`v_agent_liveness`: 12/12 loops advancing (loop_count ~4100, iterated mins ago). Yet `trinity_tasks`: last claim 2026-09-02, **0 claims in 7d**, 5 `pending`. Queue not empty. So why no claim? + +## Falsification, in order +| H | Hypothesis | Verdict | Evidence | +|---|---|---|---| +| **H1** | runLoop increments health without calling `claim()` | ❌ **refuted** | `runLoop` (ConstitutionalAgentV4.js:964) calls `getNextTask()` every iteration; idle branch only runs when it returns null. | +| **H2** | purpose/capability gate rejects the 5 as junk | ⚠️ **secondary/latent** | `checkCapability` (:1121) `knownTypes` = research/code/docs/artifact/review/meta/critique/peer_verify — the 5 types (remediation/e2e_loop/a2a_work/verification/tuning) are NOT listed, AND the getNextTask `CAPABILITY_FILTER` allow-list `AGENT_TASK_TYPES` default excludes them too. **But this only bites if the tasks were candidates at all — they are not (see root cause). Latent second wall.** | +| **H3** | claim UPDATE fails silently | ❌ **refuted** | `getNextTask` (:1868) is `UPDATE…WHERE id=(SELECT…LIMIT 1 FOR UPDATE SKIP LOCKED) RETURNING`; errors are logged + return null. `claim_count = 0` on all 5 → never even attempted, not a swallowed failure. | +| **H4** | last-claim window reads the wrong table | ❌ **refuted** | `trinity_tasks.claimed_by` is the real claim surface; `v_agent_liveness` reads it correctly. No shadow claim table. | +| **H5** | FIND_TASK takes a LIMIT 1 unclaimable row and idles | ✅ **root cause (variant)** | The single-row claim SELECT finds **no row matching the fleet's candidate predicate**, returns null, agent idles. NOT because of the durable `claim_count >= MAX_CLAIM_RETRIES(3)` cap (claim_count=0), but because **every pending row is `assigned_to` a non-running agent.** | + +## Root cause (named) +The claim candidate predicate (ConstitutionalAgentV4.js:1874): +```sql +WHERE (assigned_to = $1 OR (assigned_to IS NULL AND (agent_assigned = $1 OR agent_assigned IS NULL))) +``` +All 5 pending rows have `assigned_to` set to agents **not in the running 12**: + +| id | task_type | assigned_to | claim_count | +|---|---|---|---| +| 435104 | remediation | `trinity-gemini-antigravity` | 0 | +| 435111 | e2e_loop | `trinity-grok-code` | 0 | +| 435096 | a2a_work | `trinity-gemini-antigravity` | 0 | +| 435097 | verification | `trinity-grok-code` | 0 | +| 435099 | tuning | `trinity-cowork-executor` | 0 | + +Running fleet = apm, chesed, gcm, hdm, mel, nexus, orch, shofet, sophia, torch, veritas, w3c. For any of them as `$1`, a row with a non-NULL `assigned_to` that isn't their own name matches **neither** predicate branch → excluded. So the open pool is **empty for the running fleet**; the work is directed at external CLI agents (Gemini Antigravity, Grok Code, Cowork) that aren't running. `insert_source='cowork-cl-session'` corroborates: a Cowork CLI session created and hand-assigned them. + +**This is a routing/targeting mismatch, not a claim-path bug.** No code fix is warranted; the two conflict markers currently sitting unresolved in the on-disk `ConstitutionalAgentV4.js` (REAPER select + getNextTask cap) are a separate dirty-checkout hazard, not the cause here. + +## Smallest reversible fix + the 30-min proof +Dispatched ONE benign open-pool probe (the `/dispatch` pattern, rule 17), claimable by the fleet regardless of `CAPABILITY_FILTER` (type `meta` is in both allow-lists): +- **task 435116** · `meta` · priority 95 · `assigned_to=NULL, agent_assigned=NULL` · no external side effects · safe to cancel. +- **Success = a running agent's name appears in `claimed_by` on 435116 within 30 min.** +- ✅ **PROVEN [V 2026-09-10 18:35 UTC].** `trinity-gcm` claimed 435116 at 18:35:29 — **11 seconds** after insert — and drove it to `status=done` (`result`: "Probe complete. Artifact saved. Liveness: CONFIRMED — one claim received"). **The claim path is healthy end-to-end.** The stall was entirely the mis-targeted queue; the instant a fleet-claimable row existed, it was claimed and completed. + +No cleanup needed — the probe self-completed. Reversible if ever wanted: `UPDATE trinity_tasks SET status='cancelled' WHERE id=435116;`. + +## The 5 real tasks — NOT touched (Sean decision) +I did **not** null their `assigned_to`. "PURGE proof counts from public surfaces" and "produce the A2A dataset" are specialized and were deliberately assigned to the CLI agents. Handing them to an autonomous trinity worker risks unintended public-surface edits (forbidden). **Options for Sean:** (a) run the assigned CLI agents (Gemini Antigravity / Grok Code / Cowork); or (b) explicitly release specific rows to the fleet with `assigned_to=NULL` after confirming a trinity worker should own them. + +## Re-arm note (deferred until probe proves the path) +Only after 435116 is claimed will I re-arm a SMALL evergreen set behind a churn filter (drop `EVERGREEN_AUDIT`/`diag_probe`/`SHADOW_REJECT`) — per TODAY.md Loop 4 §5. Not before: arming evergreens before the path is proven would just re-flood a queue whose real problem was targeting. diff --git a/docs/living/TODAY.md b/docs/living/TODAY.md index 6f7544d..811d09d 100644 --- a/docs/living/TODAY.md +++ b/docs/living/TODAY.md @@ -1,43 +1,102 @@ -# TODAY 2026-09-10 +# TODAY — 2026-09-10 +**Derived from:** TRUE_NORTH + STATE LAST_VERIFIED 2026-09-10 + Linear HYP-6 +**Expires:** 2026-09-11 00:00 PT +**Cast:** CC + T12. Grok/Claude agree on unheld merges. Sean-only items listed at the bottom, not blocking the day. +**Inherit rule:** tomorrow AM starts here. No new sweep. -LAST_WRITTEN: 2026-09-10 -INHERITS: HYP-6 + CC live verification + TRUE_NORTH -OVERNIGHT: CC + T12 only -FORBIDDEN: publish, Railway restart, MODE=full, new surface, MVP launched, HOLD merge +**PROGRESS 2026-09-10 (CC):** ✅ Loop 1 DONE — G3 (`/state` false-positive fixed) + G1 (`v_agent_liveness` applied to prod, wraps `deriveLoopHealth` over `agent_health_probes`, proof run; `/state` skill + STATE generator repointed). Verified truth: **loops advancing ×12, but not_claiming ×12 (8–83d)** — live loops / zero throughput, not dead. ✅ Loop 2 — #710 conflict resolved → **MERGEABLE**, CI re-running on merge commit; awaiting Sean `merge` (verified #710 still needed: contracts stuck `fulfilled` since 09-05, #707 didn't close it). ✅ Loop 4 — `AGENT_RESTART_CHECKLIST.md` written (living-docs; mirror to GitHub). Reports in `E:\dev\reports\2026-09-10\`. -## VITAL (cannot fall off) +Night forbidden (repeat): npm publish · Railway restart · MODE=full · column rename · new product folder · PHI · SECURITY DEFINER revoke · HOLD merge · public launch language · spend · Gemini/ChatGPT inventories. -### V1 Money path — Ready -Land repid-engine#710. Done-when: next daily living-proof reaches `settled`, not fulfilled-never-settled. -Owner: CC. Sean `merge` if CI green. +--- -### V2 Honesty close — HOLD Sean -trustshell#121. Done-when: README/npm do not advertise `evaluate()` or HAL 6/6. Do not publish 1.4.0. -Owner: CC fixes; Sean `merge`. +## Vital-never-miss -### V3 Liveness instrument — Ready -G3 now (fix `/state` `artifact_url IS NULL` query), then G1 WRAP existing `src/observability/agent-liveness.ts` `deriveLiveness` / `agent_health_probes`. No second oracle. -Done-when: a SELECT shows 10/12 `status=online` vs actually-dead from recency. -Owner: CC. +| Vital | Status now | Done-when | +|---|---|---| +| Money-path settlement beat | #707 merged; **#710 MERGEABLE, CI re-running, awaiting Sean `merge`** | Next living-proof captures USDC (or testnet USDC) after `/satisfy` accepts criterion ratings — i.e. a `service_contracts` row reaches `settled` again (stuck `fulfilled` since 09-05) | +| Honesty claim=code | #121 APPROVE-HOLD | README three-state table matches live HAL 2/6; no unpublished npx pin; no `evaluate()` as live on 1.3.0 | +| Live instrument health | ✅ **DONE** — `v_agent_liveness` live + `/state`/generator repointed; `artifact_url` false-positive fixed | met: view returns honest advancing/hung/down + not_claiming_24h; `/state` no longer uses bare `artifact_url IS NULL` | +| Next Ready under HYP-6 | HYP-5 CALLSITES 13→0 is Backlog | Only after the three rows above move or are Sean-blocked | -### V4 Lockstep — Ready -TRUE_NORTH + STATE + TODAY identical on `E:\\dev\\living-docs\\` AND `DealAppSeo/hyperdag-protocol/docs/living/`. -Done-when: hashes match. -Owner: Sean copies to E:\\ ; GitHub side landed 2026-09-10. +--- -## THEN IF TOKENS +## Loops (≤4) -- HYP-5 egress ratchet (shadow only) -- Railway restart CHECKLIST only: print HEARTBEAT_MODE, loopCount, lastIterationAt, last llm_call_log per agent. Sean presses G6 later. MODE=throttled. -- SECURITY DEFINER 58+15+73: read-only caller map. No revoke. +### Loop 1 — G3 + G1 · Owner: CC · Ready +Fix the lying instruments. Do not invent a second liveness definition. -## BLOCKED_SEAN +- **G3:** one-line `/state` fix. Read `result` / `requires_external_artifact`, not `artifact_url IS NULL`. +- **G1:** additive `v_agent_liveness` that **wraps** existing `deriveLiveness` / `agent_health_probes`. Recency + last claim + loopCount. Never read `agent_heartbeat.status`. +- Prove with a SELECT that shows 10/12 “online” vs actually-dead. +- Point `/state` and the STATE generator at the view. -- `merge` #710 -- `merge` #121 -- G6 Railway (checklist first) -- `publish` 1.4.0 +**Done-when:** a live query returns honest dead/stale/live and the `/state` false-positive is gone. +**Forbidden:** G2 column rename. G4 session hook. G6 restart. -## NEXT +### Loop 2 — Money path #710 · Owner: CC review + Sean merge · Ready for review +`/satisfy` must settle. This is traction. -If tokens remain: execute V3, then stay on V1. Do not start a new sweep. +**Done-when:** CI still green on #710 AND Sean types `merge` on the PR / Linear AND the next daily living-proof leaves a settlement row that is not stuck `authorized`. +**Sean-only step:** merge. +**If held:** write the restart-checklist is NOT this loop. Stay on settle. + +### Loop 3 — Honesty close #121 · Owner: CC must-fixes + Sean HOLD · HOLD that branch +Four must-fixes. Then Sean `merge` for docs only. + +**Done-when:** #121 merged. **1.4.0 stays unpublished** until HAL/claim parity. +**Forbidden:** npm publish. Marketplace copy. “MVP launched.” + +### Loop 4 — Railway checklist, not restart · Owner: CC writes / Sean reads · Ready +0 claims/24h makes restart **justified**, not automatic. + +Write one page: + +1. Per service: `HEARTBEAT_MODE`, `loopCount`, `lastIterationAt`, last `llm_call_log`, `RAILWAY_GIT_COMMIT_SHA` +2. Restart **only** frozen+unhealthy +3. Revived services start `HEARTBEAT_MODE=throttled` — never `full` +4. First-claim success criteria (one real claim in 30 min, no 8.6M/day write storm) +5. Peer-verify producer stays behind a churn filter (drop `EVERGREEN_AUDIT` / `diag_probe` / `SHADOW_REJECT`) + +**Done-when:** checklist exists on both living-docs and GitHub. +**Forbidden:** CC pressing restart. That is Sean-only (G6). + +--- + +## If tokens remain — pull order + +1. Finish Loop 1 proof query. +2. If #710 still open and CI green, ping Sean on Linear: `merge` + link. +3. Draft drain-filter design (no drain execution). +4. HYP-5 CALLSITES 13→0 **tests only**, no prod flip. +5. Tombstone remaining stale numbers CC already listed. Loud banners, no silent delete. +6. STOP at 6 sprints / 4h per ticket. Write NEXT. + +Do not: SECURITY DEFINER rewrite, 58-view revoke, marketplace pages, new inventories, Vision Doc v2. + +--- + +## Sean-only tonight (EOD, 10–15 min) + +Reply on Linear with HYP-6 verbs. + +- [ ] `merge` repid-engine#710 if CI green +- [ ] `merge` trustshell#121 if must-fixes pass — do not `publish` +- [ ] Read Railway checklist; restart only after MODE/loopCount printed — or HOLD until morning +- [ ] Copy these three living files to `E:\dev\living-docs\` AND GitHub `docs/living/` in the same hour +- [ ] Overnight contract: **yes, continue Loops 1 remainder + NEXT list** / or **stop** + +--- + +## CLAIM-PATH LOOP — CLOSED 2026-09-10 18:35 UTC (CC) +Root cause NAMED (not a code bug): all 5 pending tasks were `assigned_to` non-running agents (`trinity-gemini-antigravity`, `trinity-grok-code`, `trinity-cowork-executor`), so the claim predicate excluded them for every one of the 12 live agents → open pool empty *for the fleet*. Full falsification H1–H5 in `CLAIM_PATH.md`. **PROVEN healthy:** open-pool probe (task 435116, `meta`) claimed by `trinity-gcm` in **11s** and completed. `claim_count`-exhaustion (H5-cap) refuted (=0). + +**Sean decision (not done by CC):** the 5 real tasks stay assigned to the CLI agents — either run those agents (Gemini Antigravity / Grok Code / Cowork), or explicitly `assigned_to=NULL` specific rows to release to the fleet. CC did not reassign (PURGE-public-surfaces etc. are specialized + risky). + +## NEXT (execute in order — nobody waits on chat) +1. ✅ Loop 1 (G3+G1) done. ✅ Claim-path named + proven. ✅ Loop 2 #710 MERGEABLE (Sean merge). +2. **Push TODAY.md + AGENT_RESTART_CHECKLIST.md + CLAIM_PATH.md → hyperdag-protocol/docs/living/** (branch + PR; Sean merges). +3. **#121 trustshell must-fixes only** — no merge, no publish. +4. Evergreen re-arm: **HOLD** until Sean confirms FREE-TIER providers for the fleet (do not arm volume that spends). + +**Do not start a new sweep. Free-tier only until Sean authorizes paid.** From e02bae3b94bc97510dba6dea52fb803d6a02f842 Mon Sep 17 00:00:00 2001 From: Sean Goodwin Date: Thu, 10 Sep 2026 11:45:16 -0700 Subject: [PATCH 2/5] docs(living): add TOKEN_BUDGET (free-tier inventory) + refresh TODAY Free-tier gate: 24h LLM spend ~$0.002; groq+openrouter+deepseek working; NOT free-exhausted. Names only, no secret values. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/living/TODAY.md | 6 ++++++ docs/living/TOKEN_BUDGET.md | 40 +++++++++++++++++++++++++++++++++++++ 2 files changed, 46 insertions(+) create mode 100644 docs/living/TOKEN_BUDGET.md diff --git a/docs/living/TODAY.md b/docs/living/TODAY.md index 811d09d..5cb14c9 100644 --- a/docs/living/TODAY.md +++ b/docs/living/TODAY.md @@ -99,4 +99,10 @@ Root cause NAMED (not a code bug): all 5 pending tasks were `assigned_to` non-ru 3. **#121 trustshell must-fixes only** — no merge, no publish. 4. Evergreen re-arm: **HOLD** until Sean confirms FREE-TIER providers for the fleet (do not arm volume that spends). +## FREE-TIER GATE 2026-09-10 (CC) — 🟢 NOT EXHAUSTED +Inventory in `TOKEN_BUDGET.md`. Truth: 24h LLM spend ≈ **$0.0019 total** (groq $0.0014 + openrouter $0.0005). Working: groq(13,0-fail), openrouter(9,1-fail), deepseek(1). Failing 9/9: cerebras, gemini, mistral, zai. Present-unused: NVIDIA_NIM, Together, Fireworks, SambaNova, SiliconFlow. **Do NOT stamp FREE_EXHAUSTED** (3 providers live). +- **Only real paid vector:** OpenRouter runs a **paid** model id (`deepseek/deepseek-chat`), not `:free`. Fix = env `OPENROUTER_MODEL=` (Sean, Railway) — but V4 hardcodes it, so the code must be env-overridable first (small PR). +- **Router fix location:** `ConstitutionalAgent.ts` is a DEAD SCAFFOLD (fixing = theater). Real router = `ConstitutionalAgentV4.js callLLM` → repid-engine proxy + direct fallback. Working copy is mid-merge (edit only on a clean worktree). Full `allow_paid=false` + try-order + 429-exhaustion spec in `TOKEN_BUDGET.md`; the primary paid-gate belongs in **repid-engine** (separate PR). +- **MISSING for Sean:** `NVIDIA_API_KEY` (only `_NIM_` present); no standalone Llama key (LiteLLM-hosted). + **Do not start a new sweep. Free-tier only until Sean authorizes paid.** diff --git a/docs/living/TOKEN_BUDGET.md b/docs/living/TOKEN_BUDGET.md new file mode 100644 index 0000000..0af05fe --- /dev/null +++ b/docs/living/TOKEN_BUDGET.md @@ -0,0 +1,40 @@ +# TOKEN_BUDGET — free-tier gate inventory +**Generated** 2026-09-10 (CC, standing-order FREE-TIER GATE). Key **names** from `C:\Users\Cash4\repos\.env.master` (values never read/printed). Usage from `llm_call_log` (last 24h). Code tags from `trinity-symphony-shared`. +**STATUS: 🟢 NOT FREE-EXHAUSTED — do NOT hold.** 3 providers working (groq, openrouter, deepseek); actual 24h spend ≈ **$0.0019 total**. No paid authorization needed yet. + +## Inventory +| provider | env var present? | tagged free/paid in code | 24h calls (llm_call_log) | status | +|---|---|---|---|---| +| **Groq** | ✅ `GROQ_API_KEY` | free-tier (not tagged paid) | **13, 0 fail, $0.0014** | 🟢 WORKING — the workhorse | +| **OpenRouter** | ✅ `OPENROUTER_API_KEY` (+`_PROVISIONING_KEY`,`_REFERRER`) | **mistagged `paid`** (V4 PROVIDERS uses paid model `deepseek/deepseek-chat`, not `:free`) | **9, 1 fail, $0.0005** | 🟡 WORKING but on a PAID model id → switch to `:free` (only real paid vector) | +| **DeepSeek** | ✅ `DEEPSEEK_API_KEY` | free-tier | 1, 0 fail, $0 | 🟢 WORKING (daily cron only) | +| **Cerebras** | ✅ `CEREBRAS_API_KEY` | free-tier | 9, **9 fail**, $0 | 🔴 FAILING all calls (quota/credit or dead model) | +| **NVIDIA NIM** | ✅ `NVIDIA_NIM_API_KEY` | not wired into runtime order | **0** | ⚪ PRESENT, UNUSED — wire into free order | +| **Together** | ✅ `TOGETHER_API_KEY` | not wired into runtime order | 0 | ⚪ PRESENT, UNUSED — wire into free order | +| Gemini | (GEMINI/GOOGLE key — not in target set) | free-tier quorum member | 9, **9 fail**, $0 | 🔴 FAILING all calls | +| Mistral | (MISTRAL key — not in target set) | free-tier quorum member | 9, **9 fail**, $0 | 🔴 FAILING all calls | +| zai | (ZAI key — not in target set) | free-tier quorum member | 9, **9 fail**, $0 | 🔴 FAILING all calls | +| Fireworks | ✅ `FIREWORKS_API_KEY` | — | 0 | ⚪ present, unused | +| SambaNova | ✅ `SAMBANOVA_API_KEY` | — | 0 | ⚪ present, unused | +| SiliconFlow | ✅ `SILICONFLOW_API_KEY` | — | 0 | ⚪ present, unused | +| Llama host | via `LITELLM_CONFIG_YAML` (no standalone key) | — | — | ⚪ hosted through LiteLLM, not a direct key | + +Note: `llm_call_log.tier` is a **quorum label (`0a`)**, NOT free/paid. Free/paid must be read from code + model id + `cost_usd`. Ground-truth 24h cost is the numbers above. + +## MISSING keys (for Sean EOD — not invented) +- **`NVIDIA_API_KEY`** — only `NVIDIA_NIM_API_KEY` present. If the router expects the plain var, it's MISSING; if NIM is the intended one, wire the router to `NVIDIA_NIM_API_KEY`. +- **No standalone Llama host key** — Llama is served via `LITELLM_CONFIG_YAML`. If a direct free Llama endpoint is wanted, its key is MISSING. +- Everything else in the target set (Groq, Cerebras, OpenRouter, DeepSeek, Together) is **present**. + +## Router fix — where it actually lives (truth-over-flattery) +- ❌ **`lib/ConstitutionalAgent.ts` is a DEAD SCAFFOLD** — imported by nothing (verified: `server.js` + `apm/gcm/hdm/mel/index.js` all `require('./lib/ConstitutionalAgentV4')`). Its `openrouter: tier:'paid'` line is real but **fixing it changes nothing at runtime** (theater — the exact anti-pattern the repo warns against). +- ✅ **Real router = `lib/ConstitutionalAgentV4.js` `callLLM` (:2587)**: primary path is `ENGINE_LLM_PROXY` → **repid-engine** (the quorum that logs the 24h calls above); direct-provider fallback iterates `PROVIDERS` (:158) where `openrouter` (:163) is **priority 1 with a hardcoded paid model, not env-overridable**. +- ⚠️ **The on-disk working copy of `ConstitutionalAgentV4.js` is mid-merge (5+ unresolved conflict markers; `git status` shows `AA`).** HEAD is clean, but **do not hand-edit/commit from this dirty tree** — author any code change on a fresh clean worktree. + +### The fix, ordered by safety +1. **ENV-FIRST, zero code risk (Sean, Railway):** set `OPENROUTER_MODEL=` on the repid-engine + trinity services. This is the single change that closes the only real paid vector ($0.0005/24h). *I did not guess a `:free` model id — an invalid one would 404 and break the one working OpenRouter path.* +2. **CODE (clean-branch PR, deploy = Sean):** in `ConstitutionalAgentV4.js` PROVIDERS, make openrouter model `process.env.OPENROUTER_MODEL || ` (currently hardcoded — the env fix above can't work until this lands), add an `LLM_ALLOW_PAID` gate (default **false**) that filters the provider loop, set try-order **Groq → Cerebras → OpenRouter(:free) → NIM → Together/Llama**, and on `429`/`insufficient_quota` mark the provider `exhausted_until` next UTC midnight **without** failing over to a paid model. +3. **Cross-repo:** the same `allow_paid=false` gate must also apply in **repid-engine**'s proxy/quorum (that's the primary spend path) — separate PR in that repo. + +## Exhaustion protocol (per standing order §3) +Trigger `FREE_EXHAUSTED` only when **groq AND openrouter(:free) AND deepseek AND cerebras/NIM/together** all report exhausted. **Not the case now** (groq + openrouter + deepseek working). When it happens: stamp `TODAY.md FREE_EXHAUSTED`, Linear HYP-6 `FREE-EXHAUST — hold or paid?`, stop calling models. No silent paid. From f0052af5b5715e84d926829b342a2a54902b5e69 Mon Sep 17 00:00:00 2001 From: Sean Goodwin Date: Thu, 10 Sep 2026 11:47:47 -0700 Subject: [PATCH 3/5] docs(living): sync TOKEN_BUDGET (CC review) + TODAY + CLAIM_PATH (Grok co-sign) Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/living/CLAIM_PATH.md | 3 ++ docs/living/TODAY.md | 4 +- docs/living/TOKEN_BUDGET.md | 84 +++++++++++++++++++++---------------- 3 files changed, 52 insertions(+), 39 deletions(-) diff --git a/docs/living/CLAIM_PATH.md b/docs/living/CLAIM_PATH.md index c4839a7..68a00e3 100644 --- a/docs/living/CLAIM_PATH.md +++ b/docs/living/CLAIM_PATH.md @@ -46,3 +46,6 @@ I did **not** null their `assigned_to`. "PURGE proof counts from public surfaces ## Re-arm note (deferred until probe proves the path) Only after 435116 is claimed will I re-arm a SMALL evergreen set behind a churn filter (drop `EVERGREEN_AUDIT`/`diag_probe`/`SHADOW_REJECT`) — per TODAY.md Loop 4 §5. Not before: arming evergreens before the path is proven would just re-flood a queue whose real problem was targeting. + +## Review (Grok 2026-09-10) +CC first-writer. Verdict stands: claim-path CODE is healthy; stall was mis-targeted `assigned_to`. Success criterion (one real claim in 30 min) **met** — 435116 in 11s. This file stays CC-owned. No rewrite. Evergreen re-arm still HOLD behind FREE-TIER GATE (`TOKEN_BUDGET.md`). diff --git a/docs/living/TODAY.md b/docs/living/TODAY.md index 5cb14c9..4fb189d 100644 --- a/docs/living/TODAY.md +++ b/docs/living/TODAY.md @@ -14,7 +14,7 @@ Night forbidden (repeat): npm publish · Railway restart · MODE=full · column | Vital | Status now | Done-when | |---|---|---| -| Money-path settlement beat | #707 merged; **#710 MERGEABLE, CI re-running, awaiting Sean `merge`** | Next living-proof captures USDC (or testnet USDC) after `/satisfy` accepts criterion ratings — i.e. a `service_contracts` row reaches `settled` again (stuck `fulfilled` since 09-05) | +| Money-path settlement beat | #707 merged; **#710 merged** | Next living-proof captures USDC (or testnet USDC) after `/satisfy` accepts criterion ratings — i.e. a `service_contracts` row reaches `settled` again (stuck `fulfilled` since 09-05) | | Honesty claim=code | #121 APPROVE-HOLD | README three-state table matches live HAL 2/6; no unpublished npx pin; no `evaluate()` as live on 1.3.0 | | Live instrument health | ✅ **DONE** — `v_agent_liveness` live + `/state`/generator repointed; `artifact_url` false-positive fixed | met: view returns honest advancing/hung/down + not_claiming_24h; `/state` no longer uses bare `artifact_url IS NULL` | | Next Ready under HYP-6 | HYP-5 CALLSITES 13→0 is Backlog | Only after the three rows above move or are Sean-blocked | @@ -95,7 +95,7 @@ Root cause NAMED (not a code bug): all 5 pending tasks were `assigned_to` non-ru ## NEXT (execute in order — nobody waits on chat) 1. ✅ Loop 1 (G3+G1) done. ✅ Claim-path named + proven. ✅ Loop 2 #710 MERGEABLE (Sean merge). -2. **Push TODAY.md + AGENT_RESTART_CHECKLIST.md + CLAIM_PATH.md → hyperdag-protocol/docs/living/** (branch + PR; Sean merges). +2. **Push TODAY.md + TOKEN_BUDGET.md + CLAIM_PATH.md + AGENT_RESTART_CHECKLIST.md → hyperdag-protocol/docs/living/** (branch + PR; Sean merges). Grok owns TOKEN_BUDGET.md (first writer). CC owns CLAIM_PATH.md. 3. **#121 trustshell must-fixes only** — no merge, no publish. 4. Evergreen re-arm: **HOLD** until Sean confirms FREE-TIER providers for the fleet (do not arm volume that spends). diff --git a/docs/living/TOKEN_BUDGET.md b/docs/living/TOKEN_BUDGET.md index 0af05fe..7613515 100644 --- a/docs/living/TOKEN_BUDGET.md +++ b/docs/living/TOKEN_BUDGET.md @@ -1,40 +1,50 @@ -# TOKEN_BUDGET — free-tier gate inventory -**Generated** 2026-09-10 (CC, standing-order FREE-TIER GATE). Key **names** from `C:\Users\Cash4\repos\.env.master` (values never read/printed). Usage from `llm_call_log` (last 24h). Code tags from `trinity-symphony-shared`. -**STATUS: 🟢 NOT FREE-EXHAUSTED — do NOT hold.** 3 providers working (groq, openrouter, deepseek); actual 24h spend ≈ **$0.0019 total**. No paid authorization needed yet. +# TOKEN_BUDGET — free-tier inventory 2026-09-10 +**Owner:** Grok (first writer). CC reviews; does not overwrite. +**Rule:** `allow_paid=false` until Sean writes `paid ` (env `SEAN_PAID_LOOP`). +**No secret values in this file.** Presence only. + +Sources: Railway `describe-service` names (not values) — trinity-gcm, trinity-litellm, repid-engine production. Local process env in this session (no dotenv load). +CC (parallel) reported 24h `llm_call_log` [R]: groq 13/0-fail, openrouter 9/1-fail, deepseek 1; spend ≈ $0.0019. Grok could not query the log (Supabase MCP unauthenticated). ## Inventory -| provider | env var present? | tagged free/paid in code | 24h calls (llm_call_log) | status | + +| provider | env var present? (yes/no) | tagged free or paid in code | last 24h calls if visible in llm_call_log | status | |---|---|---|---|---| -| **Groq** | ✅ `GROQ_API_KEY` | free-tier (not tagged paid) | **13, 0 fail, $0.0014** | 🟢 WORKING — the workhorse | -| **OpenRouter** | ✅ `OPENROUTER_API_KEY` (+`_PROVISIONING_KEY`,`_REFERRER`) | **mistagged `paid`** (V4 PROVIDERS uses paid model `deepseek/deepseek-chat`, not `:free`) | **9, 1 fail, $0.0005** | 🟡 WORKING but on a PAID model id → switch to `:free` (only real paid vector) | -| **DeepSeek** | ✅ `DEEPSEEK_API_KEY` | free-tier | 1, 0 fail, $0 | 🟢 WORKING (daily cron only) | -| **Cerebras** | ✅ `CEREBRAS_API_KEY` | free-tier | 9, **9 fail**, $0 | 🔴 FAILING all calls (quota/credit or dead model) | -| **NVIDIA NIM** | ✅ `NVIDIA_NIM_API_KEY` | not wired into runtime order | **0** | ⚪ PRESENT, UNUSED — wire into free order | -| **Together** | ✅ `TOGETHER_API_KEY` | not wired into runtime order | 0 | ⚪ PRESENT, UNUSED — wire into free order | -| Gemini | (GEMINI/GOOGLE key — not in target set) | free-tier quorum member | 9, **9 fail**, $0 | 🔴 FAILING all calls | -| Mistral | (MISTRAL key — not in target set) | free-tier quorum member | 9, **9 fail**, $0 | 🔴 FAILING all calls | -| zai | (ZAI key — not in target set) | free-tier quorum member | 9, **9 fail**, $0 | 🔴 FAILING all calls | -| Fireworks | ✅ `FIREWORKS_API_KEY` | — | 0 | ⚪ present, unused | -| SambaNova | ✅ `SAMBANOVA_API_KEY` | — | 0 | ⚪ present, unused | -| SiliconFlow | ✅ `SILICONFLOW_API_KEY` | — | 0 | ⚪ present, unused | -| Llama host | via `LITELLM_CONFIG_YAML` (no standalone key) | — | — | ⚪ hosted through LiteLLM, not a direct key | - -Note: `llm_call_log.tier` is a **quorum label (`0a`)**, NOT free/paid. Free/paid must be read from code + model id + `cost_usd`. Ground-truth 24h cost is the numbers above. - -## MISSING keys (for Sean EOD — not invented) -- **`NVIDIA_API_KEY`** — only `NVIDIA_NIM_API_KEY` present. If the router expects the plain var, it's MISSING; if NIM is the intended one, wire the router to `NVIDIA_NIM_API_KEY`. -- **No standalone Llama host key** — Llama is served via `LITELLM_CONFIG_YAML`. If a direct free Llama endpoint is wanted, its key is MISSING. -- Everything else in the target set (Groq, Cerebras, OpenRouter, DeepSeek, Together) is **present**. - -## Router fix — where it actually lives (truth-over-flattery) -- ❌ **`lib/ConstitutionalAgent.ts` is a DEAD SCAFFOLD** — imported by nothing (verified: `server.js` + `apm/gcm/hdm/mel/index.js` all `require('./lib/ConstitutionalAgentV4')`). Its `openrouter: tier:'paid'` line is real but **fixing it changes nothing at runtime** (theater — the exact anti-pattern the repo warns against). -- ✅ **Real router = `lib/ConstitutionalAgentV4.js` `callLLM` (:2587)**: primary path is `ENGINE_LLM_PROXY` → **repid-engine** (the quorum that logs the 24h calls above); direct-provider fallback iterates `PROVIDERS` (:158) where `openrouter` (:163) is **priority 1 with a hardcoded paid model, not env-overridable**. -- ⚠️ **The on-disk working copy of `ConstitutionalAgentV4.js` is mid-merge (5+ unresolved conflict markers; `git status` shows `AA`).** HEAD is clean, but **do not hand-edit/commit from this dirty tree** — author any code change on a fresh clean worktree. - -### The fix, ordered by safety -1. **ENV-FIRST, zero code risk (Sean, Railway):** set `OPENROUTER_MODEL=` on the repid-engine + trinity services. This is the single change that closes the only real paid vector ($0.0005/24h). *I did not guess a `:free` model id — an invalid one would 404 and break the one working OpenRouter path.* -2. **CODE (clean-branch PR, deploy = Sean):** in `ConstitutionalAgentV4.js` PROVIDERS, make openrouter model `process.env.OPENROUTER_MODEL || ` (currently hardcoded — the env fix above can't work until this lands), add an `LLM_ALLOW_PAID` gate (default **false**) that filters the provider loop, set try-order **Groq → Cerebras → OpenRouter(:free) → NIM → Together/Llama**, and on `429`/`insufficient_quota` mark the provider `exhausted_until` next UTC midnight **without** failing over to a paid model. -3. **Cross-repo:** the same `allow_paid=false` gate must also apply in **repid-engine**'s proxy/quorum (that's the primary spend path) — separate PR in that repo. - -## Exhaustion protocol (per standing order §3) -Trigger `FREE_EXHAUSTED` only when **groq AND openrouter(:free) AND deepseek AND cerebras/NIM/together** all report exhausted. **Not the case now** (groq + openrouter + deepseek working). When it happens: stamp `TODAY.md FREE_EXHAUSTED`, Linear HYP-6 `FREE-EXHAUST — hold or paid?`, stop calling models. No silent paid. +| Groq | **yes** Railway gcm + litellm + engine (`GROQ_API_KEY`). Local: no | free (TS + V4) | [R CC] 13 calls, 0 fail | wired | +| Cerebras | **yes** Railway gcm + litellm + engine (`CEREBRAS_API_KEY`). Local: no | free | NOT_CHECKED | wired; V4 now has a PROVIDERS.cerebras row | +| OpenRouter | **yes** Railway gcm + litellm + engine (`OPENROUTER_API_KEY`). Local: no | **was paid** (`deepseek/deepseek-chat`). **Now free** iff model id ends `:free`. Default `meta-llama/llama-3.3-70b-instruct:free` | [R CC] 9 calls, 1 fail | wired; paid ids skipped unless `SEAN_PAID_LOOP` | +| NVIDIA NIM | **no** on gcm, litellm, engine (`NVIDIA_API_KEY` / `NVIDIA_NIM_API_KEY` absent). Local: no | free-try slot | NOT_CHECKED | **MISSING** for Sean EOD | +| DeepSeek | **yes** Railway gcm + litellm + engine (`DEEPSEEK_API_KEY`). Local: no | tagged free in TS; **not** in FREE_TRY_ORDER (Groq→Cerebras→OR :free→NIM→Together) | NOT_CHECKED | present; skipped in free gate | +| Together / Llama | **yes** Railway gcm + engine (`TOGETHER_API_KEY`). Local: no | free | NOT_CHECKED | wired | +| SambaNova (Llama host) | **yes** Railway gcm + litellm (`SAMBANOVA_API_KEY`). Engine: no. Local: no | free in TS PROVIDERS | NOT_CHECKED | wired on agents, not in FREE_TRY_ORDER | + +## Gate (shipped in trinity-symphony-shared, not deployed) + +- `lib/free-tier-gate.js` + `tests/free-tier-gate.test.js` PASS. +- Default `allowPaid()===false`. Paid only if `SEAN_PAID_LOOP` is a non-hold value. +- 429 / `insufficient_quota` → `exhausted_until` next UTC midnight. No failover to paid. +- All five FREE_TRY_ORDER exhausted → throw `FREE_EXHAUSTED`. Then stamp TODAY.md `FREE_EXHAUSTED` and Linear `FREE-EXHAUST — hold or paid?`. **Not stamped this hour** — no 24h log, no live 429 observed. +- Engine LLM proxy skipped unless allow_paid (avoids paid HAL spend). + +## Missing for Sean EOD + +- `NVIDIA_API_KEY` / `NVIDIA_NIM_API_KEY` — **not listed** on gcm, litellm, or repid-engine `describe-service` names. CC TODAY says NIM present-unused — **unreconciled**. Treat as MISSING until Sean confirms the var name and service. +- Local shell has none of the listed keys (this session). +- `llm_call_log` 24h counts: NOT_CHECKED. + +Do not invent keys. Do not `paid` without Sean. + +--- + +## CC REVIEW [V] — 2026-09-10 (verifier lane; append-only, Grok owns above) +Verified Grok's `lib/free-tier-gate.js` out-of-lane against Sean's spec + live DB. + +**Gate logic: ✅ CORRECT.** `allowPaid()` default false (only `SEAN_PAID_LOOP`/`ALLOW_PAID` ≠ hold/false/0/no flips it); OpenRouter free iff model ends `:free`; `FREE_TRY_ORDER = groq→cerebras→openrouter→nvidia→together` (matches spec); `markExhausted`→next UTC midnight; `orderProviders` filters free+non-exhausted then ranks. Pure module, tests pass. Matches the standing order precisely. + +**GAP 1 — NOT WIRED (inert).** `free-tier-gate.js` is exported but **no caller** — `ConstitutionalAgentV4.callLLM`/`detectProviders` don't import `orderProviders`/`isFreeSlot`, and the `ENGINE_LLM_PROXY` path (repid-engine, the primary spend path) doesn't consult it. Same correct-but-unwired shape as `deriveLiveness`. **Remaining step:** wire the provider loop (V4) + gate the engine proxy (repid-engine) to `orderProviders(...allowPaid:false)` and skip `isExhausted`. Until then the gate changes nothing at runtime. + +**GAP 2 — order names ≠ provider map.** `FREE_TRY_ORDER` includes `cerebras` and `nvidia`, but V4's `PROVIDERS` (HEAD) has **neither row** (openai/anthropic/gemini/deepseek/openrouter/grok/together/deepinfra). Those two slots are dead until PROVIDERS gets `cerebras` + `nvidia` (envKey `NVIDIA_NIM_API_KEY`) rows with free/`:free` models. + +**VERIFIED 24h usage (Grok had NOT_CHECKED — my Supabase MCP is authed):** groq 13/0-fail/$0.0014 · openrouter 9/1-fail/$0.0005 · deepseek 1/0 · **cerebras/gemini/mistral/zai 9/9-fail/$0** · NVIDIA_NIM/together/fireworks/sambanova/siliconflow 0 calls. **Total ≈ $0.0019/24h. 🟢 NOT FREE-EXHAUSTED** (groq+openrouter+deepseek live) → do not stamp FREE_EXHAUSTED. + +**Reconcile on NVIDIA:** `NVIDIA_NIM_API_KEY` IS present in `.env.master` (name only) but Grok found it absent on the Railway services — so the key exists locally, not on the deployed services. Sean: confirm the var name + set it on repid-engine/gcm if NIM is to be a free slot. From 073188ab3eaf6b28640cf2c2b11927f013186be4 Mon Sep 17 00:00:00 2001 From: Sean Goodwin Date: Thu, 10 Sep 2026 11:52:07 -0700 Subject: [PATCH 4/5] =?UTF-8?q?docs(living):=20Grok=20free-tier=20follow-u?= =?UTF-8?q?p=20=E2=80=94=20V4=20gate=20PR=20#51,=20not=20deployed?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/living/TODAY.md | 5 +++++ docs/living/TOKEN_BUDGET.md | 10 ++++++++++ 2 files changed, 15 insertions(+) diff --git a/docs/living/TODAY.md b/docs/living/TODAY.md index 4fb189d..cab4c8c 100644 --- a/docs/living/TODAY.md +++ b/docs/living/TODAY.md @@ -105,4 +105,9 @@ Inventory in `TOKEN_BUDGET.md`. Truth: 24h LLM spend ≈ **$0.0019 total** (groq - **Router fix location:** `ConstitutionalAgent.ts` is a DEAD SCAFFOLD (fixing = theater). Real router = `ConstitutionalAgentV4.js callLLM` → repid-engine proxy + direct fallback. Working copy is mid-merge (edit only on a clean worktree). Full `allow_paid=false` + try-order + 429-exhaustion spec in `TOKEN_BUDGET.md`; the primary paid-gate belongs in **repid-engine** (separate PR). - **MISSING for Sean:** `NVIDIA_API_KEY` (only `_NIM_` present); no standalone Llama key (LiteLLM-hosted). +## SESSION CLOSE 2026-09-10 (CC) — all 4 NOW-tasks done +1. ✅ Claim-path named + proven (probe 435116 claimed by gcm in 11s; 5 pending all `assigned_to` non-running CLI agents). 2. ✅ Docs → hyperdag-protocol PR #21 (4 files). 3. ✅ #121 must-fixes all present; greptile P2 verified FALSE POSITIVE (SHAs pinned + contents:read); Strix APPROVED — ready for Sean docs-only merge, not merged/published. 4. ✅ Free-tier gate: Grok's `free-tier-gate.js` logic verified CORRECT by CC; NOT exhausted. + +**NEXT (real work):** wire `free-tier-gate.js` into `ConstitutionalAgentV4.callLLM` + repid-engine proxy (inert until wired) + add `cerebras`/`nvidia` rows to V4 `PROVIDERS` (FREE_TRY_ORDER names them, map lacks them). **Sean:** merge #121; set `OPENROUTER_MODEL=:free` + NVIDIA key on Railway; decide the 5 mis-assigned tasks; resolve the mid-merge `trinity-symphony-shared` working tree (5+ conflict markers). **Held:** G2/G4/G6, evergreen re-arm, 58-view SECDEF (P0-7 parked). + **Do not start a new sweep. Free-tier only until Sean authorizes paid.** diff --git a/docs/living/TOKEN_BUDGET.md b/docs/living/TOKEN_BUDGET.md index 7613515..3bb2202 100644 --- a/docs/living/TOKEN_BUDGET.md +++ b/docs/living/TOKEN_BUDGET.md @@ -48,3 +48,13 @@ Verified Grok's `lib/free-tier-gate.js` out-of-lane against Sean's spec + live D **VERIFIED 24h usage (Grok had NOT_CHECKED — my Supabase MCP is authed):** groq 13/0-fail/$0.0014 · openrouter 9/1-fail/$0.0005 · deepseek 1/0 · **cerebras/gemini/mistral/zai 9/9-fail/$0** · NVIDIA_NIM/together/fireworks/sambanova/siliconflow 0 calls. **Total ≈ $0.0019/24h. 🟢 NOT FREE-EXHAUSTED** (groq+openrouter+deepseek live) → do not stamp FREE_EXHAUSTED. **Reconcile on NVIDIA:** `NVIDIA_NIM_API_KEY` IS present in `.env.master` (name only) but Grok found it absent on the Railway services — so the key exists locally, not on the deployed services. Sean: confirm the var name + set it on repid-engine/gcm if NIM is to be a free slot. + +## Grok follow-up 2026-09-10 — GAP 1+2 closed in PR, not deployed + +https://github.com/DealAppSeo/trinity-symphony-shared/pull/51 (`feat/free-tier-gate` off clean `origin/main`). + +- V4 `callLLM` now `orderProviders` + skip engine proxy unless `SEAN_PAID_LOOP`. +- PROVIDERS adds `groq`, `cerebras`, `nvidia` (`NVIDIA_API_KEY` or `NVIDIA_NIM_API_KEY`). +- OpenRouter model = `process.env.OPENROUTER_MODEL || 'deepseek/deepseek-chat'` (no invented `:free` id). Paid id skipped while allow_paid=false. +- Dirty local merge tree was **not** the authoring tree. +- Not merged. No Railway restart. Runtime unchanged until Sean merges + deploys. From 7ff47690baa6e1c08ebfc5e4c319159dbbf641e8 Mon Sep 17 00:00:00 2001 From: Sean Goodwin Date: Thu, 10 Sep 2026 12:16:12 -0700 Subject: [PATCH 5/5] docs(living): WALKTHROUGH + Cerebras model-gone diagnosis --- docs/living/TOKEN_BUDGET.md | 18 +++++++++ docs/living/WALKTHROUGH.md | 78 +++++++++++++++++++++++++++++++++++++ 2 files changed, 96 insertions(+) create mode 100644 docs/living/WALKTHROUGH.md diff --git a/docs/living/TOKEN_BUDGET.md b/docs/living/TOKEN_BUDGET.md index 3bb2202..d57b99c 100644 --- a/docs/living/TOKEN_BUDGET.md +++ b/docs/living/TOKEN_BUDGET.md @@ -58,3 +58,21 @@ https://github.com/DealAppSeo/trinity-symphony-shared/pull/51 (`feat/free-tier-g - OpenRouter model = `process.env.OPENROUTER_MODEL || 'deepseek/deepseek-chat'` (no invented `:free` id). Paid id skipped while allow_paid=false. - Dirty local merge tree was **not** the authoring tree. - Not merged. No Railway restart. Runtime unchanged until Sean merges + deploys. + +## Cerebras 9/9 — Grok 2026-09-10 (append; error class) + +Source: Railway **repid-engine** deploy logs 2026-09-10T19:08Z (filter `cerebras`). Not a restart. Not `llm_call_log` rows (Grok MCP unauth); error text is the HAL quorum line. + +| field | value | +|---|---| +| class | **model-gone** (not auth, not 429, not 8k cap) | +| HTTP | 404 `not_found_error` / `model_not_found` | +| vendor text | `Model does not exist or you do not have access to it.` | +| how chosen | `catalog NOT_CHECKED and no model configured` then substitute **`gemma-4-31b`** (family **gemini**) | +| exhausted_until | **parked until `HAL_S2_CEREBRAS_MODEL` is a real Cerebras id** — this is config, not UTC-midnight quota | +| 429? | no | +| auth fail? | no (key present; 404 on model) | + +Together: **unused, key present** on gcm + engine. Already in `FREE_TRY_ORDER` after nvidia. When Cerebras is parked/exhausted, `orderProviders` skips it, so Together already runs after Groq (then OpenRouter :free, then NIM, then Together). **No `free-tier-gate.js` edit required.** Optional later: put Together immediately after Groq; that is a reorder, not a missing slot. + +Do not stamp FREE_EXHAUSTED (Groq still working). diff --git a/docs/living/WALKTHROUGH.md b/docs/living/WALKTHROUGH.md new file mode 100644 index 0000000..1b22689 --- /dev/null +++ b/docs/living/WALKTHROUGH.md @@ -0,0 +1,78 @@ +# WALKTHROUGH — Sean return pack (2026-09-10) + +Public-safe. No secrets. No `service_role`. +Canonical for a stranger at **trustshell.dev** vs what actually works today. + +## 1. Stranger at trustshell.dev — what they see vs what works + +Live site (Vercel prod commit `cc0faeb` as of 2026-09-10): + +| They see | What works | +|---|---| +| `npm install @hyperdag/trustshell` + caption **npm package v1.4.0** | npm **latest is 1.3.0**. The caption reads `package.json` in this repo (1.4.0 unpublished). | +| HAL as a live cross-LLM gate | Live, **keyless**, **live-degraded (2/6 providers)**. Groq + OpenRouter answer. Not 6/6. | +| ERC-8004 portable reputation | **Lookup** (`getRepID` / `presentProof`) is live keyless. `register()` does **not** mint. On-chain writes **paused** (last 2026-06-22). | +| x402 payments | Protocol on **Base Sepolia**. Needs API key + funded testnet wallet. Site does not spend for you. | +| Getting-started `trustshell --version` → 1.4.0 | That is this tree, not npm. After `npm i` a stranger gets **1.3.0**. | +| PAI / local mesh / BYOK | **Not shipped** for the stranger path. | + +Working stranger path: install **1.3.0**, `verify` a sentence, `repid` a public agent. MCP `verify_output` / `get_repid` the same. + +## 2. Exact commands (published 1.3.0) + +```bash +npx @hyperdag/trustshell@1.3.0 verify "The capital of France is Paris." +``` + +Expect exit **0** on PASS/FLAG. + +```bash +npx @hyperdag/trustshell@1.3.0 verify "The Eiffel Tower is located in Rome, Italy." +``` + +Expect exit **1** on VETO (HAL may FLAG instead — then exit 0; do not remap). + +```bash +npx @hyperdag/trustshell@1.3.0 repid trinity-shofet +``` + +Expect a live RepID + tier (score moves; gate on **tier**). + +Do **not** run `npx @hyperdag/trustshell@1.4.0` — that version is not on npm (`check` is 1.4.0-only). + +## 3. MCP paste — Claude Desktop + +`Claude Desktop → Settings → Developer → Edit Config` (or Cursor MCP config): + +```json +{ + "mcpServers": { + "trustshell": { + "command": "npx", + "args": ["-y", "@hyperdag/trustshell-mcp"] + } + } +} +``` + +Then ask the model to `verify_output` a sentence and `get_repid` `trinity-shofet`. Keyless. + +## 4. What NOT to expect + +- PAI wizard +- Local / on-device mesh (v2, not shipped) +- BYOK as the first-run path +- A **60–80% savings** claim +- HAL **6/6** providers +- **1.4.0** on npm (unpublished; `check` is not in 1.3.0) + +## 5. EOD clicks when Sean returns + +| Click | Why | +|---|---| +| Merge **trustshell #121** (docs/honesty close) | HOLD until you say merge. **Do not publish 1.4.0.** | +| Railway: set `OPENROUTER_MODEL` to a **verified `:free` id**; put NVIDIA key on gcm/engine if NIM is a free slot | Closes the only real paid OpenRouter vector; NIM is missing on those services | +| Decide the **5 mis-assigned tasks** (`assigned_to` CLI agents, not the running 12) | Claim-path is healthy (probe 435116 in 11s). Either run those CLI agents or `assigned_to=NULL` specific rows. | +| Merge+deploy **trinity-symphony-shared #51** only after you read the test list | `node tests/free-tier-gate.test.js`. Not money/schema/publish, but it **does** change LLM routing. Do not merge blind. | + +BLOCKED_SEAN: those four. Nobody else merges #51 or publishes.