DealAppSeo · DealAppSeo · Sep 10, 2026 · Sep 10, 2026
diff --git a/docs/living/ASSIGNED_TO_HYGIENE.md b/docs/living/ASSIGNED_TO_HYGIENE.md
@@ -0,0 +1,34 @@
+# assigned_to hygiene REPORT — 2026-09-10
+**No UPDATE.** Original 5 mis-assigned tasks untouched.
+
+Source: CLAIM_PATH.md + anon SELECT `trinity_tasks` created_at ≥ 2026-09-10T18:00Z.
+
+## Dead / non-running names still holding work (original 5)
+
+| id | type | assigned_to | claim_count (CLAIM_PATH) |
+|---|---|---|---|
+| 435104 | remediation | trinity-gemini-antigravity | 0 |
+| 435111 | e2e_loop | trinity-grok-code | 0 |
+| 435096 | a2a_work | trinity-gemini-antigravity | 0 |
+| 435097 | verification | trinity-grok-code | 0 |
+| 435099 | tuning | trinity-cowork-executor | 0 |
+
+Running fleet (CLAIM_PATH): apm, chesed, gcm, hdm, mel, nexus, orch, shofet, sophia, torch, veritas, w3c.
+
+Those three `assigned_to` values are **not** in the running 12. Rows stay excluded from the claim predicate. Sean decides: run those CLI agents, or `assigned_to=NULL` specific rows. **This report does not UPDATE.**
+
+## Open-pool (healthy)
+
+SAFE-ARM / HAL-verify / tombstone / README-vs-1.3.0 / presentProof rows from CC's C2 + follow-on inserts have `assigned_to=null` and are being claimed by live names (w3c, orch, shofet, gcm, hdm, sophia). See OPEN_POOL_DAY.md / SELECT dump.
+
+## Peer-verify churn-filter DESIGN (no drain)
+
+Problem: peer_verify volume from `EVERGREEN_AUDIT` / `diag_probe` / `SHADOW_REJECT` can fill the queue without moving product work.
+
+Design (not executed):
+1. Producer filter **before insert**: drop those three `task_type`/`title` prefixes.
+2. Claim filter (env, default off): `PEER_VERIFY_ALLOW=product` would skip those types in `getNextTask` `HANDLED` list.
+3. Do **not** DELETE/drain existing peer_verify rows in this loop.
+4. Re-arm evergreens only after FREE-TIER GATE is VERIFIED green (Groq-first success), still `HEARTBEAT_MODE=throttled`.
+
+No drain this loop.
diff --git a/docs/living/FREE_GATE_LIVE.md b/docs/living/FREE_GATE_LIVE.md
@@ -0,0 +1,38 @@
+# FREE_GATE_LIVE — callLLM after #51 deploy
+
+**When:** 2026-09-10 20:27–20:31 UTC  
+**Service:** trinity-gcm production  
+**Merge:** trinity-symphony-shared#51 `c497916` 20:27:24Z  
+**Deploy:** Railway gcm `40aeefe8` SUCCESS 20:27:47Z (boot 20:29:50Z)  
+**Health:** `loopCount` advancing, `codeVersion` `8.2.0-reflect-wired`  
+**OPENROUTER_MODEL** name present on gcm (value not printed). NVIDIA_NIM_API_KEY name present.
+
+Verdict: **DEPLOYED + ORDER VERIFIED. Successful Groq hop NOT VERIFIED on this sample (all five hops failed).**
+
+## Proofs
+
+### 1. Never sent `deepseek/deepseek-chat`
+gcm deploy logs for tasks 435123 and 435146 (post-deploy) list failed hops:
+
+`groq` → `cerebras` → `openrouter` → `nvidia` → `together`
+
+**deepseek is absent.** Matches `FREE_TRY_ORDER` (deepseek not in the free list). Two tasks, same order.
+
+### 2. Groq is tried first
+Both tasks: first line is `groq failed`. Groq is first.
+
+This sample Groq also failed (no body in the log line). HAL `verify_output` from this session still got `groq:TRUE` on the **engine** path — fleet direct Groq ≠ engine HAL Groq. Do not treat fleet Groq success as proven here.
+
+### 3. Cerebras 404 is parked, not tight-loop retried
+One `cerebras failed` per task, then the next hop. Not 9 rapid retries on the same task. Aligns with model-gone park (catalog `gemma-4-31b` → HTTP 404). Cerebras stays parked (config), not a 429 midnight timer.
+
+### 4. Together is the last live free hop
+After nvidia (optional NIM), `together failed`. When Cerebras is skipped/parked, try-order is Groq → OpenRouter :free → NIM → Together. Together **was attempted**. Unused-before, keyed, now in the hop list.
+
+## What this does not prove
+- A **successful** free completion (this sample: `All LLMs failed`).
+- OpenRouter actually used `nvidia/nemotron-3-5-lightning:free` (name present; value not logged).
+- Engine HAL quorum gated the same way (this is **fleet `callLLM`**, not `ENGINE_LLM_PROXY` — proxy skipped unless `SEAN_PAID_LOOP`).
+
+## Status
+**BUILT** on main + **DEPLOYED** on gcm. **VERIFIED** for hop order and no paid DeepSeek default. **NOT VERIFIED** for a green Groq-first completion.
diff --git a/docs/living/OPEN_POOL_DAY.md b/docs/living/OPEN_POOL_DAY.md
@@ -0,0 +1,24 @@
+# OPEN_POOL_DAY — 2026-09-10
+
+**Insert:** CC already filled the pool (SAFE-ARM + HAL-verify + tombstone + README-vs-1.3.0 + presentProof). Grok insert from local `DATABASE_URL` **failed** (`password authentication failed for user postgres` on pooler 6543). Anon REST INSERT denied (RLS 42501). Did **not** use a guessed service_role. Did **not** UPDATE the original 5.
+
+**Success bar:** ≥10 claims by ≥3 live agents.
+
+## Measured (anon SELECT, created_at ≥ 2026-09-10T18:00Z, claimed_by not null)
+
+| id | status | claimed_by |
+|---|---|---|
+| 435116 | done | trinity-gcm |
+| 435117 | done | trinity-w3c |
+| 435118 | done | trinity-orch |
+| 435119 | done | trinity-shofet |
+| 435120 | pending_clarification | trinity-sophia |
+| 435121 | pending_clarification | trinity-hdm |
+| 435122 | done | trinity-w3c |
+| 435124 | doing | trinity-w3c |
+
+**claims = 8 · agents = 6** (gcm, w3c, orch, shofet, sophia, hdm).
+
+Agents bar **met**. Claims bar **8/10 — not yet**. Many rows still `pending` (`assigned_to` null). gcm `callLLM` post-#51: Groq→Cerebras→OR→NIM→Together all failed (`FREE_GATE_LIVE.md`), so HAL-verify tasks stall after claim.
+
+Will keep counting. No PURGE/SECDEF/Railway/publish tasks inserted.
diff --git a/docs/living/SITE-COPY-PATCH.md b/docs/living/SITE-COPY-PATCH.md
@@ -0,0 +1,21 @@
+# SITE-COPY-PATCH — trustshell.dev (do not deploy)
+
+Draft only. Path B website forbidden to ship from this loop.
+Live fetch 2026-09-10: homepage still shows these sentences.
+
+## Sentences to change
+
+| Live sentence | Problem | Smallest honest replacement |
+|---|---|---|
+| `npm package v1.4.0` (hero, next to `npm install @hyperdag/trustshell`) | 1.4.0 is unpublished. npm latest is **1.3.0**. | `npm package v1.3.0` (or drop the version from the caption) |
+| `Claims are cross-checked by a quorum of decorrelated model families` | Implies a full multi-family quorum. Live HAL is **partial, 2/6**. | `Claims are cross-checked by a live HAL quorum (today: 2 of 6 providers; live-degraded).` |
+| How-it-works `shell.evaluate(...)` | `evaluate()` is not the published 1.3.0 stranger path. | `shell.verifyOutput('The capital of France is Paris.')` |
+| (not on page as those words) **HAL 6/6** | Not a literal string. The quorum sentence is the stand-in. | See row 2. |
+| (not on page as those words) **local mesh** | Not a literal string. Closest: decision history / keys on device. ZKP section already says prover is a stub. | Leave privacy section; do not add "portable mesh is live". |
+| (not on page as those words) **PAI wizard** | Not a literal string. V1.5 notify ladder is "Coming in V1.5". | Leave as coming; do not label it a shipped wizard. |
+
+## Code pointer (when Sean says deploy)
+
+`components/hero.tsx` imports `package.json` version → prints **v1.4.0** beside npm install. Change the caption to a hard-coded `1.3.0` until publish, or `npm latest` via a live check. Do not change README in this patch.
+
+Do **not** deploy from this loop.
diff --git a/docs/living/TODAY.md b/docs/living/TODAY.md
@@ -108,6 +108,29 @@ Inventory in `TOKEN_BUDGET.md`. Truth: 24h LLM spend ≈ **$0.0019 total** (groq
 ## SESSION CLOSE 2026-09-10 (CC) — all 4 NOW-tasks done
 1. ✅ Claim-path named + proven (probe 435116 claimed by gcm in 11s; 5 pending all `assigned_to` non-running CLI agents). 2. ✅ Docs → hyperdag-protocol PR #21 (4 files). 3. ✅ #121 must-fixes all present; greptile P2 verified FALSE POSITIVE (SHAs pinned + contents:read); Strix APPROVED — ready for Sean docs-only merge, not merged/published. 4. ✅ Free-tier gate: Grok's `free-tier-gate.js` logic verified CORRECT by CC; NOT exhausted.
 
-**NEXT (real work):** wire `free-tier-gate.js` into `ConstitutionalAgentV4.callLLM` + repid-engine proxy (inert until wired) + add `cerebras`/`nvidia` rows to V4 `PROVIDERS` (FREE_TRY_ORDER names them, map lacks them). **Sean:** merge #121; set `OPENROUTER_MODEL=:free` + NVIDIA key on Railway; decide the 5 mis-assigned tasks; resolve the mid-merge `trinity-symphony-shared` working tree (5+ conflict markers). **Held:** G2/G4/G6, evergreen re-arm, 58-view SECDEF (P0-7 parked).
+## C-LOOPS CLOSE 2026-09-10 (CC)
+- **C1 free-tier-gate wiring** — Grok's PR #51 verified COMPLETE by CC (comment on #51): `callLLM` uses `orderProviders(allowPaid())`, engine proxy gated, 429→`markExhausted`, `FREE_EXHAUSTED` no paid failover; PROVIDERS covers all FREE_TRY_ORDER names; OpenRouter paid default refused unless `:free`; existing test proves all 3 required properties. **Not pushed** (Grok holds the branch lane — 2 agents/1 branch = lost work). Not merged/deployed.
+- **C2 safe re-arm** — tasks **435117/435118/435119** claimed + completed in **123s by 3 live agents** (w3c PASS, orch VETO, shofet done). Fleet healthy; claim-path diagnosis reconfirmed.
+- **C3 published-1.3.0 measurement** — `TRUSTSHELL_E2E.md` written. 4 live keyless calls exit 0 (PASS/VETO/RepID 2152/proof verified). **Site lie confirmed:** trustshell.dev says "npm package **v1.4.0**" but published `@latest`=**1.3.0**; "quorum of decorrelated families" is really 2/6 partial. Website unchanged (Sean's copy call).
+
+**NEXT:** C1/C2/C3 closed. Sean queue: merge #121 + #51 (both HOLD for you); site copy 1.4.0→1.3.0; `OPENROUTER_MODEL=:free` + NVIDIA key on Railway; decide the 5 mis-assigned tasks; resolve mid-merge `trinity-symphony-shared` tree. **Held:** G2/G4/G6, evergreen volume, 58-view SECDEF.
+
+## L-LOOPS 2026-09-10 (CC)
+- **L1 FREE GATE** — see `FREE_GATE_LIVE.md` (Grok, Railway-sourced): #51 **DEPLOYED gcm 20:27:47Z, hop ORDER VERIFIED** (groq→cerebras→openrouter→nvidia→together, no deepseek, cerebras 404 parked). CC complement: HAL quorum (repid-engine) is a **separate UNGATED path** — its openrouter uses `qwen/qwen-2.5-72b-instruct` (paid, not `:free`); `OPENROUTER_MODEL` did NOT change it → **repid-engine still needs its own free-tier gate + verify the env reaches the quorum**.
+- 🔴 **HEADLINE BLOCKER:** the fleet's direct `callLLM` free hops **all fail** — PROVIDERS models are dead (`groq: llama-3.3-70b-versatile` retired; `cerebras: gemma-4-31b` 404). Gate order is correct, but no free completion is possible until models are refreshed. **Verified live model that works:** the HAL quorum succeeded on groq with **`openai/gpt-oss-20b`** (20:31Z). **Fix (Grok lane, trinity PROVIDERS map):** set groq→`openai/gpt-oss-20b`, refresh cerebras/nvidia/together to current free ids.
+- **L2 OPEN-POOL DAY** — 24 tasks armed (435122–435145, open pool). Draining SLOW: only **trinity-w3c** engaged (1 done, 1 doing) — the other 11 aren't completing, consistent with the dead-model blocker (HAL-verify tasks route to the working engine; reasoning tasks fail on direct callLLM). **NOT yet at ≥10 claims/≥3 agents** — tasks persist; fleet keeps claiming after this session (nobody waits on CC). Re-check target: `insert_source='cc-open-pool-day-2026-09-10'`.
+- **L3 ONE-PATH PACK** — MCP smoke done (appended to `TRUSTSHELL_E2E.md`): `verify`✓ `getRepID`✓; `present_proof` not in published MCP 1.0.0/1.2.0 (is in 1.4.0 tree per Grok). `SITE-COPY-PATCH.md` drafted (Grok owns). Mirror to hyperdag-protocol: branch diverged under Grok — leaving to Grok's parity push (merge now allowed per Sean).
+- **L4 hygiene REPORT (no UPDATE):** open tasks still targeted at dead names — `trinity-cowork-executor`×3, `trinity-gemini-antigravity`×2, `trinity-grok-code`×2 (all `is_live_fleet=false`); NEW ones still accruing to these → **something upstream keeps assigning to dead CLI names** (find + fix the assigner; Sean/Grok). Peer-verify churn-filter DESIGN: producer should drop `EVERGREEN_AUDIT`/`diag_probe`/`SHADOW_REJECT` before enqueue (design only, no drain).
+
+**NEXT after L-loops:** (1) refresh trinity PROVIDERS models (unblocks L2 free completions) — Grok lane; (2) repid-engine HAL-quorum free-tier gate + verify `OPENROUTER_MODEL` reaches it; (3) find the upstream assigner writing tasks to dead CLI names; (4) L2 will reach ≥10/≥3 as the fleet cycles — re-verify next check.
 
 **Do not start a new sweep. Free-tier only until Sean authorizes paid.**
+
+## NEXT 2026-09-10 (Grok, after L1–L4)
+
+1. ✅ #121 merged (no publish). ✅ #51 merged. gcm deploy SUCCESS 20:27Z. `OPENROUTER_MODEL` **name** present.
+2. **L1** `FREE_GATE_LIVE.md` — hop order VERIFIED (groq→cerebras→openrouter→nvidia→together); no `deepseek/deepseek-chat` in hops. Groq-first **success** NOT VERIFIED (all hops failed on 435123/435146).
+3. **L2** open-pool: 8 claims / 6 agents (bar 10/3). Insert blocked (local pooler password). CC pool still draining.
+4. **L3** SITE-COPY-PATCH.md drafted (do not deploy). MCP: published 1.0.0 has no `present_proof`; 1.4.0 tree does.
+5. **L4** `ASSIGNED_TO_HYGIENE.md` report only. Original 5 untouched.
+6. Keep L2 counting. Cerebras stays parked. NIM optional. No Railway restart.
diff --git a/docs/living/TRUSTSHELL_E2E.md b/docs/living/TRUSTSHELL_E2E.md
@@ -0,0 +1,42 @@
+# TRUSTSHELL_E2E — published-1.3.0 measurement (live)
+**Run** 2026-09-10 19:08–19:09 UTC (CC, Loop C3). **All calls against published `npx @hyperdag/trustshell@1.3.0`** (not the 1.4.0 tree). Keyless. Exit 0 on all four.
+**Do not change the website** — this is a measurement, not a copy edit.
+
+## Live CLI results
+| # | Command | Verdict | Latency | Keyless? | What the CLI printed |
+|---|---|---|---|---|---|
+| 1 | `verify "The capital of France is Paris."` | ✅ **PASS** trust 100/100 | 33.1s* | yes | `PASS — hal_score 0 via fact-check (partial quorum)`; evidence: `groq:TRUE`, `openrouter:TRUE` |
+| 2 | `verify "The Eiffel Tower is in Rome."` | ❌ **VETO** trust 0/100 | 9.9s | yes | `VETO — hal_score 1 via fact-check (partial quorum)`; evidence: `groq:FALSE`, `openrouter:FALSE` |
+| 3 | `repid trinity-shofet` | RepID **2152 (ESTABLISHED)** | 7.0s | yes | `trinity-shofet · RepID 2152 (ESTABLISHED)` |
+| 4 | `proof trinity-shofet --verify` | **verified ✓** (client-side 0.2.0) | 15.1s | yes | tier `postcard` · scheme `plonky3_range_check` · createdAt `2026-09-01T08:12:07Z` · proof 14,232 b64 chars · statement `repid_score=2150 threshold=999 tier=ESTABLISHED` |
+
+*\#1's 33s includes the one-time `npx` package download; the true per-call latency is the ~7–15s range seen in #2–#4.*
+
+**What works, keyless, on the published package:** verify (PASS + VETO both correct), repid lookup, ZK proof fetch + client-side verification. This is the real, live "keyless trust core." HAL ran on a **partial quorum — 2 providers answered (groq + openrouter)**; the other families did not (matches the 2/6 funded state).
+
+## Site lies — trustshell.dev vs measured reality
+| Site claim (verbatim) | Measured reality | Verdict |
+|---|---|---|
+| **"npm package v1.4.0"** | Published `@latest` = **1.3.0** (this whole run used `@1.3.0`; 1.4.0 is unpublished) | 🔴 **LIE** — the version Sean flagged. Site advertises a version no one can `npm install`. |
+| "cross-checked by a **quorum of decorrelated model families**" | Live verify ran on **2 providers** (groq + openrouter); 4 others fail 9/9 (`llm_call_log`) | 🟡 **OVERSTATE** — real quorum is 2/6, "partial" as the CLI itself prints. Not the robust multi-family quorum implied. |
+| "93 lifetime on-chain reputation writes" | Live count ~**103** (2026-09-10) | 🟢 **Honestly hedged** — page labels it "last-known… NOT current as of 2026-08-30". Stale but not a lie. |
+| Proof statement `repid_score=2150` (proof createdAt 2026-09-01) | Live RepID **2152** | ⚪ Not a site claim — the proof is a point-in-time snapshot; expected to lag the live score slightly. |
+
+**One clear fix (site copy, for Sean — not done here):** change "npm package v1.4.0" → 1.3.0 until 1.4.0 is actually published. The provider-count language should say "partial quorum (2 funded families today)" to match the CLI's own honest output. On-chain figure is already correctly hedged.
+
+## MCP 1.0.0 smoke (published `@hyperdag/trustshell-mcp`) — L3
+Server boots: `trustshell-mcp: ready (stdio)`. **serverInfo version = `1.2.0`** (requested `@1.0.0` — a version-string drift, same class as the CLI's 1.3.0/1.4.0).
+Actual tools exposed: **`verify`, `getLeaderboard`, `getRepID`** — *not* `verify_output`/`get_repid`/`present_proof`.
+| MCP tool | call | result |
+|---|---|---|
+| `verify` `{text}` | "The capital of France is Paris." | ✅ `verdict: PASS`, `trustScore: 100`, `halScore: 0`, "partial quorum", evidence `groq:TRUE`, `openrouter:TRUE` |
+| `getRepID` `{agentId}` | trinity-shofet | ✅ `repid: 2152`, `tier: ESTABLISHED`, `lastAnchorTx: null`, `latestProofHash: null` |
+| `present_proof` | — | ❌ **not exposed by the MCP** — proof presentation is CLI-only (`trustshell proof … --verify`). |
+
+**Two MCP gaps to note:** (1) `getRepID` returns `latestProofHash: null` / `lastAnchorTx: null` for trinity-shofet, yet the **CLI `proof` returns a real verified plonky3 proof** for the same agent — the MCP doesn't surface the proof/anchor that exists. (2) No proof tool in the MCP at all. If "present a proof over MCP" is a claimed capability, it isn't there in 1.2.0.
+
+### Grok note (same hour)
+Project-scoped TrustShell MCP (1.4.0 tree, not npm 1.0.0) **does** expose `present_proof`. Call `present_proof` trinity-shofet verify=true → postcard / plonky3 / **verified true**. So the gap is **published MCP 1.0.0/1.2.0**, not the 1.4.0 tree. Do not advertise present_proof as an npm-MCP 1.0.0 tool.
+
+## Provenance
+CLI output: background task `bra3em8lm` (4 live calls). Site claims: `WebFetch trustshell.dev` 2026-09-10. Provider-fail counts: `llm_call_log` 24h [V]. Published version: the calls succeeded against `@1.3.0` and prior turns confirm 1.4.0 unpublished.
diff --git a/docs/living/WALKTHROUGH.md b/docs/living/WALKTHROUGH.md
@@ -76,3 +76,7 @@ Then ask the model to `verify_output` a sentence and `get_repid` `trinity-shofet
 | Merge+deploy **trinity-symphony-shared #51** only after you read the test list | `node tests/free-tier-gate.test.js`. Not money/schema/publish, but it **does** change LLM routing. Do not merge blind. |
 
 BLOCKED_SEAN: those four. Nobody else merges #51 or publishes.
+
+## MCP smoke (this session)
+
+`verify_output` Paris → PASS 100 (partial quorum). `get_repid` trinity-shofet → 2152 ESTABLISHED. `present_proof` trinity-shofet → verified. Published MCP package is **1.0.0**; this smoke used the repo MCP. See TRUSTSHELL_E2E.md append.