Index autorun: on where state is durable, plus an admin trigger to verify it - #27
Open
github-actions[bot] wants to merge 2 commits into
Open
Index autorun: on where state is durable, plus an admin trigger to verify it#27github-actions[bot] wants to merge 2 commits into
github-actions[bot] wants to merge 2 commits into
Conversation
added 2 commits
July 31, 2026 12:48
…can I safely use or pay this endpoint right now?"
Executes docs/AUTONOMOUS_PIVOT_2026-07-31.md. Everything here acquires,
serves, charges, monitors and evaluates with no routine human involvement.
Built on the shipped preflight/reachability work rather than beside it.
FREE PUBLIC TRUST INDEX (app/trustindex.py, indexsources.py, indexops.py)
Registries conflate three different states and report them all as a listing.
This index keeps them apart and never lets one be read as another: `indexed`
(a source listed it, we have never called it - a CLAIM), `live` (completed a
real protocol handshake when we called it), `degraded` (answers, but one of
its own declared claims does not hold), `unreachable`. Measured 2026-07-31:
92.9% of a2aregistry entries report is_healthy:true and 33.9% complete a
task. That 59-point gap is the entire reason this exists, and it is why a
listing is never promoted to `live` without an observation of our own.
Dedupe by endpoint fingerprint then identity: one operator publishing to
three registries is ONE entry with three provenance records, never three
counts in a headline. Drift is retained per endpoint - the property a
one-off review cannot have. Stale is a first-class state, not an absence.
Surfaces: GET /index, /index/search, /index/{id}, /index/{id}/evidence.
The evidence page is gated on trustindex.is_page_worthy and 404s rather than
generating filler - a page for an endpoint we never called contains nothing
the registry does not already have, and publishing those at scale is SEO
spam. Adapters read documented public read-only APIs with a truthful,
contactable User-Agent; remote ingest is default-OFF and capped per run.
PAID SELF-SERVE LAYER (app/deepcheck.py, pricing.py)
GET /preflight/deep adds drift history, cross-source corroboration and an
explicit allow/caution/block policy verdict whose threshold is published so
a caller can reject it. POST /evidence/bundle issues a signed,
checkpoint-anchored snapshot the caller keeps and re-verifies offline
without us. POST /watch self-provisions continuous monitoring - no
onboarding, no human - idempotent by (caller, endpoint) so a retry never
bills twice, charged per recheck ACTUALLY performed.
Free stays free: /preflight, /index, /index/search and /evidence/verify.
Charging for "does this endpoint work" would make the ecosystem worse and
this index poorer, and charging to verify an artefact we sold would make the
artefact worth less than we claimed when we sold it.
FAILS CLOSED. Evidence bundles are produced BEFORE the meter runs; a refusal
returns 409 with "NOT CHARGED". A watch cycle that could not observe is not
billed. A failed charge suspends the watch rather than serving it free.
PRICES ARE CONFIG, NOT DOCTRINE. Every price is env-overridable within a
hard ceiling and publishes its stated basis at GET /pricing. Opening prices
are set for the population that actually exists: July 2026 x402 volume
across all networks was $232,329 (-98.9% from the Nov 2025 peak, ~$0.04/tx)
and the median earning agent made $1.65 per 30 days. deep_preflight 20cr
($0.02), evidence_bundle 100cr, watch_cycle 5cr, provisioning free.
AUTONOMOUS EXPERIMENT ENGINE (app/experiments.py)
Can move exactly two things - a price within its published ceiling, and a
copy variant. It cannot change what counts as success and cannot touch
attribution. Qualified exposure is genuine-external only through the same
central attribution rule used everywhere else, so crawlers and first-party
tooling can never reach the threshold no matter how much of them there is.
A zero denominator yields `insufficient_evidence`, never `kill` - "0%
conversion on 1,790 crawler impressions" is a category error with a number
attached, not a finding. On `kill` the engine CHANGES THE OFFER (halves the
price within its ceiling); on insufficient evidence it fixes distribution
instead, because repricing something nobody saw teaches us nothing.
OPS. Index upkeep rides the existing lease-guarded, jittered scout loop -
one loop, one lease, one deadline, one kill switch - and is default-OFF
behind GUILD_INDEX_AUTORUN. GET /commercial reports revenue first, then
qualified exposure, then experiments, with inventory/reach/free usage under
`supporting_never_sufficient`. docs/RUNBOOK_TRUST_INDEX.md documents every
switch and a five-step rollback, none of which needs a deploy.
Tests: 1069 passed, 9 skipped (43 new) covering dedupe, claim-vs-observation,
fail-closed issuance, bundle tamper-detection, watch idempotency and
non-billing, price clamping, crawler exclusion and deterministic ownership.
…rify it Two gaps found by verifying the deploy rather than assuming it. 1. AUTORUN DEFAULT. GUILD_INDEX_AUTORUN was default-OFF, so the index shipped dormant and would have stayed dormant until someone remembered a dashboard setting. For a system whose whole premise is running without routine human involvement, that is a design flaw wearing a safety feature's clothes. Now three-way, and the asymmetry is the point: explicit "0" always wins (one-config-change kill switch, no redeploy, scout untouched); explicit "1" always on; unset = on only where a DURABLE backend exists. The index is a production surface whose value is a persistent observation history, so running it against an ephemeral JSON store would produce observations that vanish on restart - and it keeps the test suite from silently probing real hosts. Remote registry ingest remains a SEPARATE, independently default-OFF switch, so with it off the only outbound traffic is bounded rechecks of endpoints agents declared to us, which the scout already probes. 2. NO WAY TO FORCE A CYCLE. The loop runs on a jittered multi-hour schedule - correct for steady state, useless for verifying a deploy or recovering from an incident. POST /admin/index/cycle (admin-gated) runs exactly the same code path with exactly the same bounds, so the manual and scheduled paths cannot drift apart, and returns the live bounds it ran under. Tests: full suite green (43 new).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Machine-operated ship branch
ship/index-activate.The ship workflow dispatches the full
cimatrix, waits for it, merges only the certified combined state with main, then runs the deployment-aware release gate against the merged SHA — with automatic certified revert on a red gate. See .github/workflows/ship.yml.