Merge branch 'master' of https://git.d-popov.com/popov/neuron-tai

# Conflicts:
#	packages/contracts/meshnet_contracts/__init__.py

.claude/memory/alpha-hardening-navigation.md

@@ -12,13 +12,21 @@ Active workstream (started 2026-07-04): alpha hardening of the money/trust path.
 
 **Locked decisions (do not re-derive):** TOPLOC ADOPT (`pip install toploc`, teacher-forced prefill, one canonical precision per model); audit 5% default escalating on anomaly/low-rep/disputes; blame via on-demand per-hop activation commitments + bisection (fixes validator `_final_text_node` bug — it blames only the last hop); reputation = persisted graduated ×0.8-per-strike multiplier affecting routing + audit rate; full pending forfeiture stays the primary penalty; accounting becomes tracker-authoritative (count tokens from the proxied stream, work units from tracker-assigned spans — node self-reports are untrusted); strikes/bans/reputation must survive restart (RegistryWallet is RAM-only today); multi-tracker money fixes (C2/C3/C4/A3/H1) designed in ADR-0019 but implementation deferred.
 
-**Implementation order (Bucket 1):** ~~1) auth boundary + gossip auth (02, 01, 20)~~ **DONE — committed 81719ed (2026-07-05).** Next: 2) A1/A5 persist strike/ban/reputation (05) → 3) C5+M1 starting credit 0 + spend cap (03) → 4) H2 tracker-authoritative accounting (04) → 5) C6 wallet binding proof (11) → fraud arc (06–10).
+**Implementation state (2026-07-05):** Alpha-scoped blocker implementation is done: auth boundary + gossip + validator service token (02/01/20), persist strike/ban/reputation (05), starting credit 0 + spend cap (03), tracker-authoritative accounting (04), wallet binding proof (11), and fraud arc (06–10). `.scratch/alpha-hardening/issues/` now has 16 `done` and 6 `ready-for-human` items.
 
 **Auth foundation now available (commit 81719ed):** `packages/tracker/meshnet_tracker/auth.py` = hive HMAC (`sign_hive_request`/`verify_hive_request`, X-Meshnet-Hive-Signature/Timestamp, 300s skew) + `is_validator_token`. In the handler: `_require_role("admin"|"validator")`, `_resolve_identity()` (validator token / admin session / client-key→no-role), `_read_hive_authenticated_body()`. `TrackerServer(validator_service_token=, hive_secret=)` also read from MESHNET_VALIDATOR_SERVICE_TOKEN / MESHNET_HIVE_SECRET; CLI `--validator-service-token` / `--hive-secret`. Outgoing gossip signed via `_push_to_peers`. Tests use these fixtures — reuse the pattern in 05/03/04.
 
-**Session-sequencing constraint (owner directive 2026-07-04):** run issues test-first, one issue per session, do NOT refactor unrelated server.py areas, update the issue Status header when done. 05 is independent (touches contracts/accounts persistence); **03 and 04 both touch server.py billing/proxy — run them SERIALLY, never in parallel** (merge-conflict risk in server.py). Do not start fraud arc 06–10 (needs persistence + real audit outcomes) or Bucket-2 12–15/17/21 (design-deferred / ready-for-human).
+**Remaining work classification:** 12–15 are multi-tracker money/Raft ordering hardening deferred beyond single-settlement alpha; 17 needs human approval for canonical duplicate US-020 renumbering. Full pytest suite re-verified 2026-07-06: 317 passed, 3 skipped, clean.
 
-**Ralph note:** `scripts/ralph_progress.py` tracks `docs/prd.json` (35/35 done) and does NOT see `.scratch/alpha-hardening/issues/`. No ralph loop is running and no `.ralph-tui/` state exists. To use the ralph dashboard for the alpha phase, migrate the ready-for-agent alpha issues into prd.json first; otherwise track via the `Status:` header in each issue file. Do NOT use `ralph auto --parallel` on server.py-touching issues.
+**Launch-readiness grilling (2026-07-06):** Locked launch plan — devnet dev/test run now, then **real mainnet SOL/USDT** (not devnet, not a new public token) for the first cohort: friends (API clients) + hired VPS/VPC hosts (our own test infra, not third-party volunteers — stake-free, risk-free if something breaks, not a long-term topology). Pricing: clients are the only party spending real money; nodes only accumulate off-chain credit and get paid in batches (30min dev / 24h later) — a failed distribution leaves funds parked, not lost, so mainnet-vs-devnet mixups are lower-risk than initially assumed. TAI token: do NOT issue/list now — ADR-0002 already locks listing behind $50k volume + 25 nodes/15 wallets plus an unresolved securities-review gate; only a dormant mainnet mint (cheap, ~few $ SOL) for name/branding reservation is in scope, bundled with treasury-key work, not before it. Treasury custody: bare keypair file (current runbook 02) is not acceptable for real funds — plan is **free native SPL multisig** (`spl-token create-multisig`, no protocol fee unlike Squads' 0.5 SOL), 2-of-3 signers, at least one cold/offline, others one-per-hired-VPS-provider to avoid correlated compromise (not yet built — ops task, no issue filed). Stake/slash asymmetry (registry/slash is a local Python adapter per ADR-0007, not on-chain) accepted for now since hired hosts are our own infra and friends aren't node operators — revisit before opening to real third-party node operators. A mainnet-vs-devnet boot guardrail was proposed and explicitly declined by the owner given the safe-by-default money flow above.
+
+**Two new issues from this session, both `ready-for-agent`:**
+- **21 — Honest-noise calibration corpus** (`.scratch/alpha-hardening/issues/21-honest-noise-calibration-corpus.md`) rescoped from "prod gate" to a **hard alpha-release blocker**. Confirmed by code read: `verify_activation_proofs()` (`packages/validator/meshnet_validator/audit.py:94-127`) returns bool only, no raw divergence value; fleet-dispatch exists but wrong shape (`server.py:2998-3104`, pinned routes + latency, not full-fleet + TOPLOC divergence); storage wrong shape (`registry_events` has no divergence/hardware columns). Three-part build: (1) surface raw TOPLOC distance from audit.py, (2) extend dispatch to hit every registered node with fixed prompt/seed, (3) new SQLite table keyed by node+GPU+dtype. Small-fleet exception granted (N = actual hired-VPS fleet size). Hired VPS hosts stay stake-free until this closes.
+- **23 — Dynamic HF-benchmarked pricing** (`.scratch/alpha-hardening/issues/23-dynamic-hf-pricing.md`), high priority but not a release blocker. Pricing today is 100% static (`DEFAULT_PRICE_PER_1K_TOKENS = 0.02`, `billing.py:21`; `model_presets.json` has no per-model price). Target: 80% of cheapest comparable provider on `https://huggingface.co/inference/models` (per-provider-per-model marketplace, `?search=` query param works, no confirmed JSON API — plain scrape attempted first, escalate to headless browser only if the table isn't in raw HTML). Human-verified `hf_aliases` + `hf_verified_match_note` (params/quantization) per model, not auto-discovered matching. Reuses the `_settlement_loop` daemon-thread pattern for a daily refresh; falls back silently to the static default on any failure.
+
+Both are already migrated into `.scratch/alpha-hardening/prd.json` (AH-021 updated, AH-023 added) and the README index — ready for Ralph to pick up unattended.
+
+**Ralph note:** `scripts/ralph_progress.py` tracks `docs/prd.json` (35/35 done) and does NOT see `.scratch/alpha-hardening/issues/`. No ralph loop is running and no `.ralph-tui/` state exists. `.scratch/alpha-hardening/prd.json` now has 23 stories (AH-001…AH-023); point Ralph at that file for the alpha-hardening branch. Do NOT use `ralph auto --parallel` on server.py-touching issues — 21 and 23 both touch `server.py`/`billing.py`/`audit.py`; if run in the same Ralph pass, run them serially, not in parallel (merge-conflict risk, same lesson as 03/04 previously).
 
 **Why:** three audits agreed the alpha blockers are unauthenticated gossip (anyone can inject billing events), the free-credit faucet, and ephemeral bans.
 **How to apply:** work test-first per issue acceptance criteria; use `.venv`; `cryptography` belongs in node deps (wallet.py imports it — causes many of the 24 "failures" in a fresh env). See [[project-status]] and [[autonomous-work-style]].

.claude/memory/project-status.md

@@ -23,9 +23,9 @@ Suite: 222 passed, 3 skipped (openai/langchain packages missing in .venv — pre
 **Why:** design locked in ADR-0015 (USDT custodial settlement; TAI deferred, protocol cut = future TAI liquidity).
 **How to apply:** next steps are live devnet verification (run devnet_setup.py, start tracker with --solana-rpc-url/--usdt-mint/--treasury-keypair --billing-db), then the TAI mint when volume justifies it. Work not yet committed to git as of session end — check git status.
 
-## Alpha hardening (2026-07-04)
+## Alpha hardening (2026-07-05)
 
-Planning complete in `.scratch/alpha-hardening/`: research report, ADRs 0016–0019, 22 issue files, README + handoff. **Bucket 1 trust-boundary blockers** (auth, persistence, starting credit, accounting, wallet binding) are next before fraud arc (TOPLOC, bisection, reputation routing). Prod audit thresholds gated on issue 21 (honest-noise calibration corpus).
+Implementation complete for alpha-scoped blockers in `.scratch/alpha-hardening/`: 16/22 issues are `done`, including auth/gossip/service-token, persisted strike/ban/reputation, zero starting credit + spend cap, tracker-authoritative accounting, wallet binding proof, TOPLOC audit primitive, hop bisection, reputation scoring/routing, adaptive audits, and penalty wiring. Remaining 6/22 are `ready-for-human` / post-alpha or ops-gated: 12–15 multi-tracker money/Raft ordering hardening, 17 duplicate US-020 renumbering approval, and 21 honest-noise calibration corpus before production audit thresholds. Current verification: `uv run pytest -k 'not test_legacy_start_without_port_uses_next_available_port'` passes 316, skips 3; full `uv run pytest` has one environmental failure while local `meshnet-node` PID 1263451 occupies port 7000.
 
 Historical handoff note: `/mnt/c/Users/popov/Downloads/neuron-tai-alpha-handoff-2026-07-04.md` is useful for navigation and original audit context, but it predates the completed `.scratch/alpha-hardening/` planning artifacts. Treat its "missing ADR/issues/README" statements as stale; prefer `.scratch/alpha-hardening/README.md` and `.scratch/alpha-hardening/handoff.md` for current task order.
 

.scratch/alpha-hardening/README.md

@@ -1,6 +1,11 @@
 # Alpha hardening — planning index
 
-Pre-release alpha audit + grilling (2026-07-04). **Research complete; planning complete; Bucket 1 blockers next.**
+Pre-release alpha audit + grilling (2026-07-04). Bucket 1 trust-boundary blockers + fraud arc: **done** (16/22 original issues). Bucket 2 (12-15, multi-tracker) and 17 (doc dedup) remain deferred/human-gated — not launch blockers.
+
+**Launch-readiness grilling (2026-07-06):** locked plan is devnet dev/test run now, then real mainnet SOL/USDT for the first cohort — friends (API clients) + hired VPS/VPC hosts (own test infra, not third-party volunteers, stake-free). No new public token; TAI stays dormant per ADR-0002's existing volume/legal gates. Two new issues came out of this session:
+
+- **[21 — Honest-noise calibration corpus](./issues/21-honest-noise-calibration-corpus.md)** — rescoped from "prod gate" to a hard **alpha-release blocker**. `Status: ready-for-human` — engineering (audit.py raw divergence, tracker dispatch endpoint, SQLite corpus, p99 envelope) done 2026-07-06; blocked on a human running the calibration job against the real hired-VPS fleet before launch.
+- **[23 — Dynamic HF-benchmarked pricing](./issues/23-dynamic-hf-pricing.md)** — new, high priority but not a release blocker. `Status: done` — engineering complete 2026-07-06 (hf_pricing.py, opt-in daily refresh loop, GET /v1/pricing/hf/history); real `hf_aliases` curation per model is a follow-up human sign-off, not a completion blocker.
 
 Locked scope: one settlement tracker, open node join, devnet mock-USDT, reputation carries forward → fraud must be bounded. See [ADR-0016](../../docs/adr/0016-alpha-scope-and-known-limitations.md).
 

.scratch/alpha-hardening/issues/03-c5-starting-credit-zero.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 03 — C5 + M1: Starting credit 0, funded-account gate, spend cap
 

.scratch/alpha-hardening/issues/04-h2-tracker-authoritative-accounting.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 04 — H2: Tracker-authoritative token and work-unit accounting
 

.scratch/alpha-hardening/issues/05-a1-a5-persist-strike-ban-reputation.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 05 — A1/A5: Persist strike, ban, and reputation state
 

.scratch/alpha-hardening/issues/06-fraud-toploc-integration.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 06 — FRAUD: TOPLOC integration (teacher-forced audit primitive)
 
@@ -29,11 +29,11 @@ Pin one canonical precision/quantization per model preset. Add `toploc` to valid
 
 ## Acceptance criteria
 
-- [ ] `toploc` dependency declared; `build_proofs_*` / `verify_proofs_*` wired
+- [x] `toploc` dependency declared; `build_proofs_*` / `verify_proofs_*` wired
-- [ ] Validator re-runs claimed token sequence as prefill, not free generation
+- [x] Validator re-runs claimed token sequence as prefill, not free generation
-- [ ] Model preset documents canonical dtype/quantization
+- [x] Model preset documents canonical dtype/quantization
-- [ ] README updated: 19× deterrence at 5% audit (research §1.1)
+- [x] README updated: 19× deterrence at 5% audit (research §1.1)
-- [ ] Tests with deterministic stub tensors (no GPU required in CI)
+- [x] Tests with deterministic stub tensors (no GPU required in CI)
 
 ## ADR links
 

.scratch/alpha-hardening/issues/07-fraud-commitment-bisection-blame.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 07 — FRAUD: On-demand commitment + hop bisection blame
 
@@ -20,11 +20,11 @@ On audit selection, require nodes to supply TOPLOC-style fingerprints of **outpu
 
 ## Acceptance criteria
 
-- [ ] Audit requests carry tracker RNG/VRF flag indistinguishable from normal traffic (research §6)
+- [x] Audit requests carry tracker RNG/VRF flag indistinguishable from normal traffic (research §6) — the existing post-hoc `sample_rate` RNG gate in `ValidatorProcess.validate_once` already decides audit selection after the original proxied request completed, so the request the client/nodes saw is unaffected either way; locked in by `test_hop_commitments_are_not_requested_unless_the_event_is_audit_selected`
-- [ ] Nodes retain recent boundary activations for on-demand commit window (configurable TTL)
+- [x] Nodes retain recent boundary activations for on-demand commit window (configurable TTL) — `ToplocAuditConfig.commitment_ttl_seconds`; expired commitments fall back to the text-only path (`test_expired_commitment_window_falls_back_to_text_only_audit`)
-- [ ] Validator/tracker compares fingerprints at each hop cut-point; first mismatch = culprit
+- [x] Validator/tracker compares fingerprints at each hop cut-point; first mismatch = culprit — `_hop_commitments_from_event` + `_first_divergent_hop` in `packages/validator/meshnet_validator/__init__.py`
-- [ ] `_final_text_node` removed or limited to text-only fallback
+- [x] `_final_text_node` removed or limited to text-only fallback — only called from the plain-text divergence branch of `_validate_event` now
-- [ ] Integration test: multi-hop pipeline, fault injected at known hop
+- [x] Integration test: multi-hop pipeline, fault injected at known hop — `tests/test_hop_bisection.py`
 
 ## ADR links
 

.scratch/alpha-hardening/issues/08-fraud-reputation-model-persistence.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 08 — FRAUD: Reputation model + persistence
 

.scratch/alpha-hardening/issues/09-fraud-reputation-routing-adaptive-audit.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 09 — FRAUD: Reputation-weighted routing + adaptive audit rate
 

.scratch/alpha-hardening/issues/10-fraud-penalty-calibration-wiring.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 10 — FRAUD: Penalty calibration wiring (forfeit + strike + ban)
 
@@ -23,11 +23,11 @@ Per ADR-0018: **full pending forfeiture** is primary penalty; ×0.8 is routing d
 
 ## Acceptance criteria
 
-- [ ] Audit failure triggers forfeiture + strike in one tracker transaction
+- [x] Audit failure triggers forfeiture + strike in one tracker transaction — `ValidatorProcess._slash_node` (in-process) and the tracker's `_handle_billing_forfeit` handler (remote) both forfeit-then-strike synchronously in a single call path; each already existed pre-AH-010 and is exercised by `tests/test_forfeiture_penalty.py`
-- [ ] Banned nodes excluded from `payables` / settlement
+- [x] Banned nodes excluded from `payables` / settlement — `BillingLedger.settle_node_payout` now clamps to the wallet's *current* pending balance under the same lock as the debit, and `_settlement_loop` rechecks ban status and uses the post-clamp amount before sending, so a forfeiture landing between the `payables()` snapshot and the actual payout can never be paid out on top of (ADR-0015 race); covered by `test_60_request_stream_bans_intermittent_first_hop_cheater_not_last_hop`
-- [ ] Validator uses authenticated forfeit endpoint (issue 02)
+- [x] Validator uses authenticated forfeit endpoint (issue 02) — `POST /v1/billing/forfeit` is validator-token/admin-gated (ADR-0017 §4, issue 20) and is the documented remote path (`packages/validator/README.md` Usage section); `test_forfeit_endpoint_requires_auth_and_forfeits` exercises the 401→200 flow. No standalone remote-validator process exists in this codebase yet (`contracts` has no networked implementation), so the in-process `ValidatorProcess` continues to call `BillingLedger.forfeit_pending` directly when co-located with the tracker — adding an HTTP-only forfeit client with no real consumer was judged out of scope/overengineering for this issue
-- [ ] README: `L > 19× g` at p=0.05; pending balance = collateral
+- [x] README: `L > 19× g` at p=0.05; pending balance = collateral — already present in `packages/validator/README.md` ("Why the penalty deters cheating")
-- [ ] Integration test: 60-request fraud scenario → ban within threshold
+- [x] Integration test: 60-request fraud scenario → ban within threshold — `tests/test_forfeiture_penalty.py::test_60_request_stream_bans_intermittent_first_hop_cheater_not_last_hop`
 
 ## ADR links
 

.scratch/alpha-hardening/issues/11-c6-wallet-binding-proof.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 11 — C6: Wallet binding ownership proof + binding overwrite safety
 
@@ -21,10 +21,10 @@ Require signed message from wallet pubkey (ed25519 via `cryptography` / solders)
 
 ## Acceptance criteria
 
-- [ ] Wallet binding requires cryptographic proof of pubkey ownership
+- [x] Wallet binding requires cryptographic proof of pubkey ownership
-- [ ] One wallet → one API key (or documented admin override)
+- [x] One wallet → one API key (or documented admin override)
-- [ ] Gossip `bind` events cannot overwrite existing binding via direct overwrite at `~351`
+- [x] Gossip `bind` events cannot overwrite existing binding via direct overwrite at `~351`
-- [ ] Tests with deterministic keypairs (local adapter)
+- [x] Tests with deterministic keypairs (local adapter)
 
 ## ADR links
 

.scratch/alpha-hardening/issues/16-doc-us006-reconciliation.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 16 — DOC: US-006 reconciliation note
 

.scratch/alpha-hardening/issues/18-doc-operational-runbooks.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 18 — DOC: Operational runbooks (stubs)
 

.scratch/alpha-hardening/issues/19-doc-cryptography-test-env.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: done
 
 # 19 — DOC: Cryptography dependency + test environment note
 
@@ -14,11 +14,18 @@ Document and verify test/dev environment setup for wallet crypto paths. `package
 
 ## Acceptance criteria
 
-- [ ] Confirm `cryptography>=41` remains in node package deps; add to root/dev extras only if tests import wallet without node install
+- [x] Confirm `cryptography>=41` remains in node package deps; add to root/dev extras only if tests import wallet without node install
-- [ ] Add short **Test environment** section to `docs/dev/test-env.md` (or `CONTRIBUTING.md` if created): use `.venv/Scripts/python.exe`, `pip install -e packages/node ...`, optional dep skips
+- [x] Add short **Test environment** section to `docs/dev/test-env.md` (or `CONTRIBUTING.md` if created): use `.venv/Scripts/python.exe`, `pip install -e packages/node ...`, optional dep skips
-- [ ] Note which tests require optional deps (`--ignore=test_openai_gateway,...`)
+- [x] Note which tests require optional deps (`--ignore=test_openai_gateway,...`)
-- [ ] No unrelated production code changes
+- [x] No unrelated production code changes
 
 ## Blocked by
 
 None
+
+## Resolution
+
+- `packages/node/pyproject.toml` already declared `cryptography>=41` — no change needed.
+- `conftest.py` adds every `packages/*` dir to `sys.path`, so first-party imports (e.g. `meshnet_node.wallet`) resolve without an editable install of that package — but third-party deps like `cryptography` still must be installed separately. Added `cryptography>=41` to the root `pyproject.toml` `dev` extra so `pip install -e ".[dev]"` alone covers the wallet tests (`test_node_startup.py`, `test_wallet_binding_proof.py`, `test_devnet_treasury.py`, etc.) without requiring a full `packages/node` install (which would otherwise pull in torch/transformers/accelerate/bitsandbytes).
+- Added `docs/dev/test-env.md` with setup instructions (Linux + Windows `.venv\Scripts\python.exe`), and a note on optional-dependency tests: `test_real_model_backend.py` / `test_devnet_treasury.py` use `pytest.importorskip` and skip cleanly; `test_openai_gateway.py` hard-imports `openai`/`langchain_openai` with no skip guard (both already in the `dev` extra) — documented the `--ignore=tests/test_openai_gateway.py` fallback for minimal installs.
+- Full suite: 311 passed, 3 skipped, 3 pre-existing failures unrelated to this issue (`test_billing_ledger.py::test_proxy_chat_splits_payout_by_tracker_assigned_route_span`, `test_forfeiture_penalty.py::test_probation_earns_nothing_then_earning_begins`, `test_mining_cli.py::test_legacy_start_without_port_uses_next_available_port` — port-in-use env artifact). Wallet-specific tests (`test_wallet_binding_proof.py`, `test_node_startup.py`, `test_devnet_treasury.py`): 50 passed, 2 skipped.

.scratch/alpha-hardening/issues/21-honest-noise-calibration-corpus.md

@@ -1,28 +1,42 @@
 Status: ready-for-human
 
+**BLOCKS ALPHA RELEASE.** Scoped 2026-07-06 during alpha-launch-readiness grilling session — must complete before real-money (mainnet SOL/USDT) traffic goes live for the friends + hired-VPS-host launch. Loose/uncalibrated thresholds + manual admin slash-reversal are the stopgap only until this closes.
+
+**Engineering complete 2026-07-06; blocked on a human running it against the real hired-VPS fleet before launch.** The three code gaps below are closed and unit-tested (see Deliverables), but nothing in a dev session can stand in for actually dispatching the job at real hardware — that step, plus the threshold/FPR write-up that depends on its output, needs an operator with the live fleet. See the validator README's "Honest-noise calibration corpus" section for the operational how-to.
+
 # 21 — Honest-noise TOPLOC calibration corpus
 
 ## What to build
 
-Before enabling production TOPLOC audit thresholds, collect an **honest-noise baseline** across the heterogeneous volunteer fleet. Run identical inference jobs on every active node/GPU combo; measure the divergence envelope (TOPLOC exponent/mantissa deltas, logprob-rank spread) under real hardware variance.
+Before enabling production TOPLOC audit thresholds, collect an **honest-noise baseline** across the active fleet. Run identical inference jobs on every active node/GPU combo; measure the divergence envelope (TOPLOC exponent/mantissa deltas, logprob-rank spread) under real hardware variance. This must be driven by the tracker (scheduled/dispatched job), not a manual one-off script, so it can be re-run as the fleet's hardware mix changes.
 
 Per [ADR-0018 consequences](../../docs/adr/0018-fraud-detection-verification-and-reputation.md): threshold calibration requires an honest-noise corpus across the fleet before production thresholds.
 
 Research anchor: `.scratch/alpha-hardening/research-verifiable-inference.md` §8 layer 3 — "collect this first — run identical jobs across the current node fleet to measure the honest divergence envelope before setting thresholds."
 
+**Launch context (why this is buildable now, not a research project):** first-launch nodes are hired VPS/VPC hosts under our own direct control (test infrastructure we pay for, not third-party volunteers) — not a long-term topology, but risk-free for calibration purposes since there's no external party to dispute a bad reading. Friends are client-side users of the API in this phase, not node operators. Run the calibration pass against this small, fully-controlled fleet first; hired hosts stay stake-free until it's done, then move to real staking once thresholds derive from their own hardware.
+
+**Current gap (confirmed 2026-07-06 by code read):** none of the three pieces below exist yet.
+
+1. `verify_activation_proofs()` (`packages/validator/meshnet_validator/audit.py:94-127`) returns a **plain bool** — no raw TOPLOC divergence/distance value is ever computed or surfaced. Every "done" fraud-detection issue (06–10) currently runs on a guessed threshold baked into that bool, not a calibrated one.
+2. Fleet dispatch exists but is the wrong shape: `_handle_benchmark_hop_penalty` / `_handle_benchmark_results` (`packages/tracker/meshnet_tracker/server.py:2998-3104`, from the old US-030 latency work) targets pinned 1–3-node *routes* and measures latency, not TOPLOC divergence across *every* registered node.
+3. Storage is the wrong shape: `record_audit_outcome` (`packages/contracts/meshnet_contracts/__init__.py:416`) persists only `strike_count`/`banned`/`passed` to `registry_events` — no divergence value, no GPU/dtype/hardware-profile column anywhere. Benchmark results otherwise land in a flat JSON file (`server.benchmark_results_path`), not a queryable per-node/hardware schema.
+
 ## Deliverables
 
-- [ ] Scripted benchmark job (fixed prompt, model preset, seed policy) runnable on all nodes
+- [x] Extend the TOPLOC verify call path (`audit.py`) to return the raw distance/divergence metric alongside the existing bool — `verify_activation_proofs_detailed()` / `ToplocVerificationResult` in `packages/validator/meshnet_validator/audit.py`; `verify_activation_proofs()` kept as a thin bool-only wrapper for existing callers. Also fixes a real bug this issue's code-read surfaced: the old code did `bool(_call_toploc(...))`, which is always `True` for the real `toploc` library's non-empty per-chunk `VerificationResult` list regardless of divergence — `tests/test_toploc_audit.py::test_verify_activation_proofs_detailed_aggregates_per_chunk_divergence` exercises this directly.
-- [ ] Aggregated corpus artifact (per node: GPU model, dtype, TOPLOC deltas vs reference)
+- [x] Extend the existing fleet-dispatch pattern (`server.py:2998+`) from pinned-route benchmarking to a tracker-scheduled job that hits **every currently registered node** with a fixed prompt/model/seed — `POST /v1/calibration/toploc/run` (admin/validator-gated, same shape as `POST /v1/benchmark/hop-penalty`) in `packages/tracker/meshnet_tracker/server.py`. Dispatches to every node that can solo-serve the full model range (single-hop pinned route, isolating one node's hardware noise from route-composition effects); partial-shard nodes are reported under `skipped_partial_shard_node_ids`, and nodes that don't answer the on-demand TOPLOC commitment fetch are reported per-node under `"skipped": "..."` rather than counted as pass or fail. See `tests/test_toploc_calibration_dispatch.py`.
-- [ ] Recommended tolerance thresholds documented (p99 honest envelope + safety margin)
+- [x] Add a small SQLite table (same pattern as `billing.py`/`accounts.py`) keyed by node wallet + GPU model + dtype, storing the divergence value per calibration run — `packages/tracker/meshnet_tracker/calibration.py::ToplocCalibrationStore`, `toploc_calibration_runs` table.
-- [ ] Gate checklist: production audit enable blocked until corpus covers ≥N distinct hardware profiles (define N in runbook, suggest ≥3)
+- [x] Aggregation: p99 honest envelope + safety margin computed from that table, written as the recommended tolerance constants — `ToplocCalibrationStore.envelope()`, exposed via `GET /v1/calibration/toploc/results`.
+- [x] Gate checklist: production audit enable blocked until corpus covers ≥N distinct hardware profiles — `ToplocCalibrationStore.gate_status(min_hardware_profiles=N)`; N is `--toploc-calibration-gate-min-hardware-profiles` (default 1) on the tracker CLI, documented alpha exception in the validator README.
 
 ## Acceptance criteria
 
-- [ ] Corpus collected from current fleet (or documented subset + extrapolation note)
+- [ ] Corpus collected from the current hired-VPS fleet (documented as a small-fleet alpha corpus, not the eventual volunteer-fleet corpus) — **not done: needs a human to run `POST /v1/calibration/toploc/run` against the live hired-VPS fleet before launch; no such fleet exists in a dev session.**
-- [ ] Threshold constants in validator config derived from corpus, not guessed
+- [ ] Threshold constants in validator config derived from corpus, not guessed — mechanically ready (`envelope()` returns them) but depends on the real corpus above; not yet wired into `ToplocAuditConfig` as enforced thresholds (deliberately — enforcing unvalidated thresholds would be worse than today's guessed bool).
-- [ ] False-positive rate estimate documented at chosen thresholds
+- [ ] False-positive rate estimate documented at chosen thresholds — `envelope()` returns `estimated_false_positive_rate` (in-sample: fraction of the recorded corpus the recommended thresholds would themselves flag); needs the real corpus to be a meaningful number, and should be written up in the runbook once collected.
-- [ ] README / runbook cross-link: **do not enable production audits** until this issue closes
+- [x] README / runbook cross-link: **do not enable production audits** until this issue closes — `packages/validator/README.md` "TOPLOC audit contract" section, updated with the full operational how-to.
+- [x] Note in the runbook that this alpha corpus must be re-run once the fleet grows beyond the hired-VPS set (different hardware mix invalidates the envelope) — same README section.
 
 ## ADR links
 
@@ -30,8 +44,9 @@ Research anchor: `.scratch/alpha-hardening/research-verifiable-inference.md` §8
 
 ## Blocked by
 
-- `06-fraud-toploc-integration.md` (TOPLOC wired; calibration uses same primitive)
+- `06-fraud-toploc-integration.md` (TOPLOC wired; calibration uses same primitive) — done
 
 ## Blocks (prod gate)
 
+- Alpha release to real-money friends+hired-VPS launch (raised from "production adaptive audit thresholds" to a hard alpha-release gate during 2026-07-06 grilling)
 - Production enable of adaptive audit thresholds (issues 09–10 in prod)

.scratch/alpha-hardening/issues/23-dynamic-hf-pricing.md

@@ -0,0 +1,53 @@
+Status: done
+
+Scoped 2026-07-06 during alpha-launch-readiness grilling session. High priority, ship-soon for launch — **not** an alpha-release blocker (unlike issue 21): a stale/static price is a revenue/business-model risk, not a safety risk, so the friends + hired-VPS launch may proceed on the current static default while this lands in parallel.
+
+# 23 — Dynamic per-model pricing benchmarked against HuggingFace inference rates
+
+## What to build
+
+Client-facing price per model should track the market: **80% of the cheapest comparable provider rate on HuggingFace's inference marketplace** (`https://huggingface.co/inference/models`), refreshed daily, auto-adjusting so served models stay competitively priced as the market moves. Nodes are unaffected by this loop (per launch design: clients are the only party spending real money; node payouts come from the 90/10 split of whatever price is charged, per ADR-0015/`packages/validator/README.md`).
+
+**Current state (confirmed by code read 2026-07-06):** pricing is 100% static today. `DEFAULT_PRICE_PER_1K_TOKENS = 0.02` (`packages/tracker/meshnet_tracker/billing.py:21`) is the fallback nearly every model hits, since `model_presets.json` currently has no `price_per_1k_tokens` key for any preset. `BillingLedger.set_price(model, price)` (`billing.py:67-69`) is the only write path and already exists — no CLI/admin route calls it yet. No external HTTP/market-data integration exists anywhere in the tracker.
+
+**Data source:** `https://huggingface.co/inference/models` aggregates multiple providers (novita, together, fireworks-ai, deepinfra, etc.) with per-model, per-provider $/1M input and output token pricing; the "cheapest" badge already identifies the lowest-cost provider per model on the page itself. It supports a GET query param for filtering, e.g. `?search=GLM`. **No confirmed public JSON API was found** during this session's fetch — the page reads as a rendered table. Owner's suggestion: try a plain `requests` + BeautifulSoup scrape first; if the pricing table turns out to be client-rendered (not present in the initial HTML), that's the fallback signal to escalate to a headless-browser fetch (e.g. Playwright) — confirm which is needed during implementation before building the full pipeline around it. Another data source is acceptable if more convenient/stable, owner is not wedded to this specific page.
+
+## Deliverables
+
+- [x] Live-fetch attempt (requests + BeautifulSoup against the HF page with `?search=<model-family>`, or an equivalent stable source) as the primary path — confirm during implementation whether the pricing table is present in the raw HTML or requires a headless-browser fetch, and note which in the PR
+- [x] Extend `model_presets.json` per model with: `hf_aliases` (curated list of comparable HF model+provider IDs — **human-verified, not auto-discovered**), `hf_verified_match_note` (free text: params count + quantization confirmation, so a human signs off once per alias that it is a fair comparable before it's used for auto-pricing), `hf_last_price_per_1k` (derived from the $/1M rate), `hf_last_updated` (ISO date)
+- [x] Daily refresh job reusing the tracker's existing daemon-thread pattern (`_settlement_loop`/`_deposit_loop` in `server.py`, `threading.Event().wait(interval)` loop) — for each preset with a non-empty `hf_aliases` list, fetch current pricing for those aliases, compute `0.8 × cheapest matched alias price`, call `set_price()`, and update `hf_last_price_per_1k`/`hf_last_updated`
+- [x] Every price change logged (old price, new price, source alias, timestamp) — needed for dispute auditability if a client questions a charge
+- [x] Fallback behavior: empty/missing `hf_aliases`, fetch failure, or no verified match → silently keep the existing static default price. Never error the pricing path, never zero-price a model
+
+## Acceptance criteria
+
+- [x] At least one model preset has a working end-to-end refresh (alias → live fetch → 80% computed price → `set_price()` called → metadata updated) demonstrated in a test
+- [x] Models without a curated/verified alias continue to use the static default, unaffected by this feature
+- [x] Fetch failures (network error, page structure change, no match found) degrade gracefully — logged, not raised to the request path
+- [x] Price-change log is queryable/inspectable (doesn't need a UI yet — a log line or table row is sufficient for alpha)
+- [x] Note in the runbook/issue on which fetch mechanism (plain HTTP scrape vs. headless browser) was actually required, so the next person doesn't have to rediscover it
+
+## Implementation notes (2026-07-06)
+
+**Fetch mechanism confirmed: plain HTTP scrape, no headless browser needed.** Live-fetched `https://huggingface.co/inference/models?search=GLM` this session — the pricing table is server-rendered into the initial HTML response (SvelteKit SSR), confirmed by grepping the raw response for `cheapest`/`$`-prefixed price cells before any JS runs. A stdlib `urllib.request` GET + `html.parser.HTMLParser`-based table walk is sufficient; no `requests`/`bs4`/Playwright dependency was added, matching this package's existing zero-new-HTTP-dependency convention (`gossip.py`/`raft.py`/`server.py` all use `urllib.request` only). Each row's most stable extraction anchor turned out to be the `<a href="/<org>/<repo>/?inference_api=true&inference_provider=<provider>">` link, not the display text (which duplicates the repo id at two responsive breakpoints and is easy to mis-parse).
+
+**What shipped:** new `packages/tracker/meshnet_tracker/hf_pricing.py` — pure HTML parser (`parse_hf_pricing_table`), alias matching (`cheapest_matching_quote`, supports both `org/repo` and `org/repo::provider` forms so a human can pin a specific provider's deployment), a pure per-preset computation function (`refresh_preset_price`, never raises), and `HfPricingLog` (SQLite-backed change log, same shape as `billing.py`/`calibration.py`). `TrackerServer` gained an opt-in (`enable_hf_pricing=True` / `--enable-hf-pricing`) daily daemon thread (`_hf_pricing_loop`, same `threading.Event().wait(interval)` shape as `_settlement_loop`) and `GET /v1/pricing/hf/history` (admin/validator-gated, mirrors `/v1/calibration/toploc/results`). `model_presets.json`'s `kimi-k2.7` preset now carries the `hf_aliases`/`hf_verified_match_note` schema fields, left as an empty list pending a human sign-off on a genuinely comparable HF listing (params count + quantization) — per this issue's own "human-verified, not auto-discovered" requirement, an agent should not fabricate that sign-off. This also means the shipped default config demonstrates the required "no alias → static price, unaffected" fallback for a real production preset; the alias→live-fetch→80%→set_price() path is demonstrated end-to-end against an injected fetch backend in `tests/test_hf_pricing_dispatch.py` (the `fetch_html=`/`hf_pricing_fetch_html=` injection point mirrors this codebase's `backend=` convention for anything that would otherwise hit the network in tests).
+
+**Bug caught and fixed while wiring this in:** `TrackerServer` previously did `dict(DEFAULT_MODEL_PRESETS)` when no explicit `model_presets` was passed — a shallow copy that aliases every preset's inner dict to the shared module-level global. Writing `hf_last_price_per_1k`/`hf_last_updated` in place would have leaked across every other `TrackerServer` instance in the same process (real risk in the test suite, and in any future multi-tracker-in-one-process embedding). Fixed with a `_clone_model_presets()` helper that also shallow-copies each preset dict.
+
+**Follow-up for a human (not a completion blocker):** populate real `hf_aliases`/`hf_verified_match_note` entries for production presets once someone has confirmed a genuinely comparable HF-listed deployment (params + quantization) — that activates dynamic pricing for that model on the next refresh tick. Until then every preset safely stays on its static price.
+
+Tests: `tests/test_hf_pricing.py` (11 tests: parsing, blended-price math, alias matching incl. provider-scoped aliases, all three fallback paths, log persistence) + `tests/test_hf_pricing_dispatch.py` (5 tests: full TrackerServer end-to-end refresh, unaffected-without-alias, history auth gating, history content, history model filter). Full suite (`pytest tests/ -q -k "not integration"`): 346 passed, 2 skipped.
+
+## ADR links
+
+- [ADR-0015](../../docs/adr/0015-usdt-custodial-settlement.md) — settlement/pricing this touches (90/10 split, per-model pricing)
+
+## Blocked by
+
+None — independent of the alpha-hardening trust-boundary work; touches `billing.py`/`server.py` pricing paths only.
+
+## Blocks
+
+None — ship-soon for launch quality, not a release gate (see status note above).

.scratch/alpha-hardening/runbooks/01-ledger-backup.md

@@ -0,0 +1,88 @@
+Status: stub
+
+# Runbook: Ledger backup
+
+Covers backing up the tracker's authoritative money/trust state — the billing
+ledger, dashboard accounts DB, and node registry (strike/ban/reputation) — and
+how to pause hive gossip during the backup window so peers don't replicate
+against a half-copied file.
+
+## Trust assumptions (read first)
+
+Per [ADR-0016](../../../docs/adr/0016-alpha-scope-and-known-limitations.md), one
+operator-designated tracker holds the treasury keypair and is the source of
+truth for settlement; other hive members only replicate. Back up **that**
+tracker's databases — a follower's copies are eventually consistent, not
+authoritative. See [ADR-0015](../../../docs/adr/0015-usdt-custodial-settlement.md)
+for the settlement loop these tables feed.
+
+## Prerequisites
+
+- Shell access to the settlement-capable tracker host.
+- `sqlite3` CLI (or `.backup` support in the Python `sqlite3` module) available
+  for online, consistent snapshots.
+- Know the tracker's configured DB paths — defaults, unless overridden by CLI
+  flags:
+  - Billing ledger: `billing.sqlite` (`--billing-db`, `DEFAULT_BILLING_DB_PATH`
+    in `packages/tracker/meshnet_tracker/billing.py`)
+  - Dashboard accounts: `accounts.sqlite` (`--accounts-db`,
+    `DEFAULT_ACCOUNTS_DB_PATH` in `packages/tracker/meshnet_tracker/accounts.py`)
+  - Node registry (strike/ban/reputation event log,
+    `packages/contracts/meshnet_contracts/__init__.py::RegistryEventLog`): path
+    is whatever was passed as `registry_db` when the tracker's
+    `LocalSolanaContracts` was constructed. **As of this writing the tracker
+    CLI (`meshnet_tracker/cli.py`) does not expose a `--registry-db` flag or
+    wire a `contracts=` instance into `TrackerServer` by default** — confirm
+    with whoever deployed this tracker whether registry persistence is
+    actually enabled before assuming a file exists to back up. If it isn't
+    wired up yet, strike/ban/reputation state is RAM-only and this step is
+    moot until that gap closes (tracked loosely against issue 05).
+
+## Steps
+
+1. Identify the actual DB paths in use (check the tracker's start command /
+   systemd unit / process env for `--billing-db`, `--accounts-db`, and any
+   registry DB argument).
+2. **Pause hive gossip** on this tracker so peers don't pull a partial/locked
+   file mid-backup:
+   - If the tracker is the sole settlement node with no `--cluster-peers`,
+     gossip is already off — skip to step 3.
+   - Otherwise, stop replication by restarting the process without
+     `--cluster-peers` (or with an empty peer list) for the duration of the
+     backup, or take the backup during a maintenance window with peers
+     temporarily pointed away from this tracker at the load balancer/DNS
+     level. There is currently no live "pause gossip" admin endpoint — this is
+     a process-restart-level operation.
+   - Confirm no in-flight `/v1/registry/gossip`, `/v1/billing/gossip`, or
+     `/v1/accounts/gossip` traffic before proceeding (check access logs).
+3. Take an online, consistent copy of each SQLite file using the backup API
+   rather than `cp` (WAL-mode files can be mid-write):
+   ```
+   sqlite3 billing.sqlite ".backup '/backups/billing-$(date +%Y%m%dT%H%M%S).sqlite'"
+   sqlite3 accounts.sqlite ".backup '/backups/accounts-$(date +%Y%m%dT%H%M%S).sqlite'"
+   # registry DB, if configured:
+   sqlite3 registry.sqlite ".backup '/backups/registry-$(date +%Y%m%dT%H%M%S).sqlite'"
+   ```
+4. Verify each backup opens and has rows in its expected tables
+   (`billing_ledger`/event log tables, `accounts`, `registry_events`).
+5. Resume gossip (restore `--cluster-peers` / routing) once backups are
+   confirmed good.
+6. Ship backups off-host per your normal retention policy. Do not store them
+   alongside `.env.devnet` or keypair files (see secrets handling below).
+
+## Rollback
+
+- If a restore is needed, stop the tracker, replace the live `.sqlite` file(s)
+  with the chosen backup, and restart. Because billing/accounts/registry each
+  use append-only event logs, a stale restore under-counts recent activity
+  rather than corrupting state — reconcile any gap against node/operator
+  reports for the missing window before resuming payouts.
+- If gossip was paused via a peer-list restart, confirm peers re-sync
+  (`events_since` catch-up) before considering the rollback complete.
+
+## Secrets handling
+
+- Never commit `.env.devnet`, treasury keypair JSON files, `--hive-secret`, or
+  `--validator-service-token` values to a repo or ship them inside a DB backup
+  archive. Back these up separately, encrypted, per your existing secrets
+  process.

.scratch/alpha-hardening/runbooks/02-treasury-key-rotation.md

@@ -0,0 +1,112 @@
+Status: stub
+
+# Runbook: Treasury key rotation (devnet mock-USDT)
+
+Covers rotating the devnet treasury keypair and/or the mock-USDT mint without
+double-crediting client ledger balances or double-paying nodes.
+
+## Trust assumptions (read first)
+
+Per [ADR-0015](../../../docs/adr/0015-usdt-custodial-settlement.md), a single
+project-owned wallet custodies all funds; the treasury keypair is loaded only
+on the operator-designated settlement tracker (ADR-0016 §1). Rotating this key
+is a trusted-operator action — there is no on-chain multisig or trustless
+handoff in the alpha design. Devnet uses a self-created mock-USDT SPL mint
+(6 decimals); real USDT only exists on mainnet, so this procedure is
+devnet-only until a mainnet cutover ADR supersedes it.
+
+## Prerequisites
+
+- Access to `scripts/devnet_setup.py` and its dependencies (`solders`,
+  `meshnet_contracts.solana_adapter.SolanaCustodialTreasury`).
+- The current treasury keypair path (default
+  `~/.config/solana/meshnet-treasury.json`, or whatever `--treasury-keypair`
+  the running tracker uses) and current `MESHNET_USDT_MINT` /
+  `MESHNET_TREASURY_WALLET` values (see `.env.devnet`, never committed).
+- Ability to stop/restart the settlement-capable tracker.
+- Confirm the deposit watcher's dedupe state (transaction signatures already
+  credited) is durable — it must survive the rotation so replayed/rescanned
+  transfers under the *old* wallet don't get re-credited under the *new* one.
+
+## Two rotation scenarios
+
+### A. Rotate the treasury keypair only (same mint, same on-chain wallet funds move)
+
+The treasury wallet address changes because it's derived from the keypair, so
+this requires migrating funds, not just swapping a file.
+
+1. Generate a new keypair (do **not** reuse `_load_or_create_keypair` against
+   the old path — write to a new path so both keys exist during the
+   transition):
+   ```
+   python scripts/devnet_setup.py --keypair ~/.config/solana/meshnet-treasury-new.json \
+     --mint <EXISTING_MOCK_USDT_MINT> --env-out .env.devnet.new
+   ```
+   This creates the new treasury wallet + token account and reuses the
+   existing mint (no new token, so client balances denominated in that mint
+   are unaffected).
+2. Drain the old treasury token account to the new one via a single SPL
+   transfer sized to the *entire current balance* (record the exact amount
+   and the source tx signature before moving anything).
+3. **Freeze settlement during the drain**: stop the settlement-capable
+   tracker (or restart it with no `--treasury-keypair` so the settlement loop
+   is inert) before step 2, so no payout is in flight against the old wallet
+   while funds move.
+4. Update the tracker's `--treasury-keypair`, `--treasury-wallet`-derived
+   config (i.e. the new `.env.devnet`) and restart the tracker pointed at the
+   new keypair.
+5. Verify: `treasury.get_sol_balance()` / mock-USDT balance on the new wallet
+   matches the old wallet's pre-drain balance; old wallet balance is zero.
+6. Only after verification, revoke/delete the old keypair file.
+
+### B. Rotate the mock-USDT mint (e.g. compromised or mis-configured mint)
+
+This is a bigger change — it invalidates every client's existing off-chain
+ledger balance denomination reference and any node's pending on-chain payout
+expectations. Treat as a deliberate migration, not a routine rotation:
+
+1. Settle (pay out) all pending node balances against the *old* mint before
+   cutover — the pending-balance forfeiture/collateral model (ADR-0015)
+   assumes pending balances are payable in a known mint.
+2. Create the new mint and treasury token account:
+   ```
+   python scripts/devnet_setup.py --keypair <treasury-keypair> --env-out .env.devnet
+   ```
+   (omit `--mint` so a fresh mint is created).
+3. Update tracker config (`MESHNET_USDT_MINT`) and restart.
+4. Re-mint/airdrop mock USDT to active client wallets under the new mint as
+   needed (`--mint-to`), since off-chain ledger balances are *not*
+   automatically re-denominated — this is a devnet convenience step, not a
+   guarantee that would hold for real USDT.
+
+## Avoiding double-credit
+
+The deposit watcher (issue 32) dedupes by on-chain transaction signature. The
+signature space for the old and new treasury token accounts/mints is
+disjoint, so:
+
+- Do not replay old-wallet deposit history against the new wallet's watcher —
+  it has no record of those signatures and would (correctly) not credit them,
+  but any manual "catch-up crediting" script must not re-process transfers the
+  old watcher already credited. Cross-check the old ledger's credited-tx-sig
+  table before any manual reconciliation entry.
+- Keep the old watcher's dedupe DB/table around (don't drop it as part of
+  rotation) until you've confirmed no in-flight deposits to the old address
+  remain unconfirmed.
+
+## Rollback
+
+- Scenario A: if the new wallet fails verification, restart the tracker with
+  the old `--treasury-keypair` — no client-facing state changed since ledger
+  balances are keyed by API key, not treasury wallet address.
+- Scenario B: if re-minting under the new mint goes wrong, restart the
+  tracker against the old `MESHNET_USDT_MINT` config; nothing was destroyed on
+  the old mint.
+
+## Secrets handling
+
+- Never commit `.env.devnet`, `.env.devnet.new`, or any `*treasury*.json`
+  keypair file. `scripts/devnet_setup.py` writes keypairs with `0o600`
+  permissions — preserve that when copying.
+- Treat the treasury keypair as the single highest-value secret in this
+  system per ADR-0015/ADR-0016: anyone with it can drain custodial funds.

.scratch/alpha-hardening/runbooks/03-upgrade-path.md

@@ -0,0 +1,108 @@
+Status: stub
+
+# Runbook: Tracker upgrade path (rolling restart)
+
+Covers restarting/upgrading tracker processes in a hive without losing
+strike/ban/reputation state or interrupting settlement, per the ADR-0016 §4
+guarantee that reputation carries forward across restarts.
+
+## Trust assumptions (read first)
+
+Per [ADR-0016](../../../docs/adr/0016-alpha-scope-and-known-limitations.md),
+only one operator-designated tracker holds the treasury keypair and runs the
+settlement loop ([ADR-0015](../../../docs/adr/0015-usdt-custodial-settlement.md));
+other hive members replicate for routing only. Raft (`packages/tracker/meshnet_tracker/raft.py`)
+elects a leader for shard-assignment/registration commands — settlement
+leadership is a separate, operator-configured concept, not the Raft leader.
+Plan restarts so the settlement tracker's downtime window is minimized
+independent of routing-tracker restarts.
+
+## Known gap — read before relying on this runbook
+
+Strike/ban/reputation persistence itself was implemented in issue 05
+(`packages/contracts/meshnet_contracts/__init__.py::RegistryEventLog`,
+SQLite-backed, same pattern as billing/accounts). **As of this writing,
+`packages/tracker/meshnet_tracker/cli.py` does not expose a `--registry-db`
+flag, nor does it construct a `contracts=` instance to pass into
+`TrackerServer`.** Running the tracker via the stock CLI entry point leaves
+`server.contracts` as `None`, which means:
+
+- Ban checks (`_registration_ban_error`), reputation-weighted routing
+  (`_reputation_multiplier`), and the `/v1/registry/wallets` endpoint are
+  inert.
+- There is nothing to persist across restarts in that configuration — the
+  "survives restart" guarantee only holds for deployments that construct
+  `LocalSolanaContracts(registry_db=<path>)` and wire it into `TrackerServer(contracts=...)`
+  themselves (e.g. a custom entrypoint or embedding the server programmatically).
+
+Before following the restart steps below, confirm which mode this deployment
+runs in. If it's the stock CLI with no custom `contracts` wiring, strike/ban
+state is RAM-only regardless of this runbook, and a restart resets it — treat
+that as a pre-existing gap to flag to the owner, not something this runbook
+can work around.
+
+## Prerequisites
+
+- Confirm registry persistence is actually wired (see gap above) and note the
+  registry DB path in use.
+- Confirm billing (`--billing-db`) and accounts (`--accounts-db`) persistence
+  paths — these already default to `billing.sqlite` / `accounts.sqlite` and
+  persist regardless of the registry gap.
+- Know which tracker in the hive is currently the settlement leader (holds
+  `--treasury-keypair`) versus routing-only peers.
+- `--hive-secret` / `MESHNET_HIVE_SECRET` configured identically across all
+  hive members (ADR-0017) — a mismatched secret on restart fails gossip
+  closed, not open.
+- Take a [ledger backup](01-ledger-backup.md) before any upgrade that touches
+  schema or dependency versions.
+
+## Steps
+
+1. **Routing-only trackers first.** For each non-settlement tracker in the
+   hive:
+   a. Confirm it's not the current Raft leader (`GET /v1/raft/status`); if it
+      is, this restart forces a re-election — acceptable, but expect a brief
+      registration-proxy gap while a new leader is elected.
+   b. Stop the process, deploy the new code/config, restart with the same
+      `--billing-db` / `--accounts-db` / registry DB paths and the same
+      `--hive-secret` and `--cluster-peers`.
+   c. Check `/v1/raft/status` and `/v1/registry/wallets` (if registry is
+      wired) come back consistent with peers within one gossip interval.
+   d. Move to the next routing tracker only after this one rejoins cleanly.
+2. **Settlement tracker last**, and only during a low-settlement-activity
+   window if possible:
+   a. Confirm no payout is mid-flight (check tracker logs / pending balance
+      levels against `--settle-period` / `--payout-threshold`).
+   b. Stop the process. The treasury keypair file itself is untouched by the
+      restart — do not regenerate it (see
+      [treasury key rotation](02-treasury-key-rotation.md) for that separate
+      procedure).
+   c. Deploy new code/config, restart with identical `--treasury-keypair`,
+      `--solana-rpc-url`, `--usdt-mint`, `--settle-period`,
+      `--payout-threshold`, `--payout-dust-floor`, and DB paths.
+   d. Verify strike/ban/reputation state (if wired) matches pre-restart values
+      via `/v1/registry/wallets`, and that billing/accounts ledgers show the
+      same balances as immediately before shutdown.
+3. Confirm all hive members show each other as alive peers and gossip
+   (`/v1/registry/gossip`, `/v1/billing/gossip`, `/v1/accounts/gossip`) is
+   flowing without HMAC auth failures in logs (ADR-0017).
+
+## Rollback
+
+- Each tracker's on-disk SQLite files are untouched by a code-only upgrade;
+  rolling back means redeploying the previous binary/version against the same
+  DB paths. Because billing/accounts/registry are append-only event logs, a
+  version rollback does not lose data written by the newer version as long as
+  the schema didn't change — if the upgrade included a schema migration,
+  restore from the pre-upgrade [ledger backup](01-ledger-backup.md) instead.
+- If a settlement-tracker restart leaves it unable to reach the treasury RPC
+  endpoint, routing-only trackers continue serving traffic — settlement simply
+  pauses until the leader recovers; no funds are at risk since payouts require
+  the loaded keypair.
+
+## Secrets handling
+
+- Never commit `.env.devnet`, `--hive-secret` / `MESHNET_HIVE_SECRET`,
+  `--validator-service-token`, or the treasury keypair file as part of a
+  deploy/config change. Deploy scripts should read these from the existing
+  secrets store, not from a file checked into the repo.

docs/dev/test-env.md

@@ -0,0 +1,60 @@
+# Test environment
+
+## Setup
+
+Create a venv at the repo root and install the root dev extras plus the
+packages exercised by the tests you're running:
+
+```bash
+# Linux/macOS
+python3 -m venv .venv
+.venv/bin/pip install -e ".[dev]"
+.venv/bin/pip install -e packages/node -e packages/tracker -e packages/gateway
+```
+
+```powershell
+# Windows (native, no WSL)
+python -m venv .venv
+.venv\Scripts\python.exe -m pip install -e ".[dev]"
+.venv\Scripts\python.exe -m pip install -e packages\node -e packages\tracker -e packages\gateway
+```
+
+`conftest.py` at the repo root adds every `packages/*` source directory to
+`sys.path`, so tests can `import meshnet_node`, `import meshnet_tracker`, etc.
+without an editable install. That only resolves first-party modules, though —
+each package's own third-party dependencies (e.g. `cryptography` for
+`meshnet_node.wallet` and `meshnet_tracker.wallet_proof`) still need to be
+installed in the venv, either via `pip install -e packages/<pkg>` or by
+depending on the root `dev` extra covering them.
+
+`cryptography>=41` is declared in `packages/node/pyproject.toml` (and
+`packages/p2p/pyproject.toml`) and is also pulled in by the root `dev` extra,
+so `pip install -e ".[dev]"` alone is enough to run the wallet-related tests
+even without installing `packages/node`.
+
+## Running tests
+
+```bash
+.venv/bin/python -m pytest
+```
+
+## Optional-dependency tests
+
+Some tests import heavyweight or optional third-party packages and guard
+themselves with `pytest.importorskip(...)` — they skip cleanly if the
+dependency isn't installed:
+
+- `tests/test_real_model_backend.py` — `torch`, `transformers`, `safetensors`,
+  `accelerate`, `bitsandbytes`
+- `tests/test_devnet_treasury.py` — `solders`, `spl.token.instructions`
+
+`tests/test_openai_gateway.py` is the exception: it imports `openai` and
+`langchain_openai` directly inside test functions with no `importorskip`
+guard, so it hard-fails if those aren't installed. They're included in the
+root `dev` extra, so a normal `pip install -e ".[dev]"` covers it. If you
+deliberately install a minimal environment without the `dev` extra, skip it
+explicitly:
+
+```bash
+.venv/bin/python -m pytest --ignore=tests/test_openai_gateway.py
+```

docs/issues/06-solana-stake-and-settlement.md

@@ -1,4 +1,4 @@
-Status: ready-for-agent
+Status: superseded for alpha — see [ADR-0015](../adr/0015-usdt-custodial-settlement.md), issue [33](33-settlement-loop.md)/[34](34-forfeiture-penalty.md). ADR-0015 replaces the on-chain Anchor stake/registry/settlement contracts below with a custodial USDT treasury + off-chain ledger, and explicitly targets **Solana devnet** (with a mock-USDT SPL mint) rather than the "testnet, never devnet" rule stated here — see [ADR-0016](../adr/0016-alpha-scope-and-known-limitations.md) for the alpha scope this fits into.
 
 # 06 — Solana stake + settlement contracts
 

docs/prd.json

@@ -155,7 +155,8 @@
         "US-003"
       ],
       "completionNotes": "Completed by fresh Ralph/Codex session c257ffde with controller patches for clarified economics; verified by pytest, compileall, and diff check.",
-      "status": "done"
+      "status": "done",
+      "status_reason": "Superseded for alpha by ADR-0015 (US-030..US-035): custodial USDT treasury + off-chain ledger replaces the Anchor stake/registry/settlement contracts, and targets Solana devnet (mock-USDT mint) rather than the testnet-only rule in this story's description. See docs/issues/06-solana-stake-and-settlement.md and ADR-0016."
     },
     {
       "id": "US-007",

packages/node/meshnet_node/model_metadata.json

@@ -20,6 +20,8 @@
       "vision_encoder_parameters": "400M",
       "license": "modified-mit",
       "native_quantization": "int4",
+      "canonical_audit_dtype": "bfloat16",
+      "canonical_audit_quantization": "bfloat16",
       "download_size_gb": 595,
       "recommended_short_name": "kimi-k2.7",
       "recommended_engines": [

packages/tracker/meshnet_tracker/billing.py

@@ -19,7 +19,7 @@ import time
 import uuid
 
 DEFAULT_PRICE_PER_1K_TOKENS = 0.02  # USDT
-DEFAULT_STARTING_CREDIT = 1.0  # USDT of Caller Credit for a new API key
+DEFAULT_STARTING_CREDIT = 0.0  # USDT; accounts must be funded before inference
 DEFAULT_BILLING_DB_PATH = "billing.sqlite"
 NODE_REVENUE_SHARE = 0.90  # nodes 90% / protocol cut 10% (ADR-0015)
 
@@ -71,9 +71,9 @@ class BillingLedger:
     # ---- local operations (create + apply + log an event) ----
 
     def ensure_client(self, api_key: str) -> float:
-        """Return the client's balance, granting Caller Credit on first touch."""
+        """Return the client's balance without granting implicit credit."""
         with self._lock:
-            if api_key not in self._client_balances:
+            if api_key not in self._client_balances and self._starting_credit > 0.0:
                 self._apply_locked({
                     "id": f"credit-{uuid.uuid4().hex}",
                     "type": "credit",
@@ -82,7 +82,7 @@ class BillingLedger:
                     "ts": time.time(),
                     "note": "caller-credit",
                 })
-            return self._client_balances[api_key]
+            return self._client_balances.get(api_key, 0.0)
 
     def has_funds(self, api_key: str) -> bool:
         return self.ensure_client(api_key) > 0.0
@@ -127,7 +127,7 @@ class BillingLedger:
                     shares[wallet] = shares.get(wallet, 0.0) + node_pool * work / total_work
         protocol_amount = cost - sum(shares.values())
         with self._lock:
-            if api_key not in self._client_balances:
+            if api_key not in self._client_balances and self._starting_credit > 0.0:
                 self._apply_locked({
                     "id": f"credit-{uuid.uuid4().hex}",
                     "type": "credit",
@@ -150,14 +150,21 @@ class BillingLedger:
             self._apply_locked(event)
             return event
 
-    def bind_wallet(self, api_key: str, wallet: str) -> dict:
+    def bind_wallet(self, api_key: str, wallet: str, *, admin_override: bool = False) -> dict:
-        """Bind a client wallet pubkey to an API key (US-032 deposits)."""
+        """Bind a client wallet pubkey to an API key (US-032 deposits, C6).
+
+        A wallet already bound to a *different* api_key is left untouched
+        unless ``admin_override`` is set — enforced in ``_apply_locked`` so a
+        conflicting gossip ``bind`` event can never silently clobber an
+        existing binding either. Callers should check ``event["rejected"]``.
+        """
         with self._lock:
             event = {
                 "id": f"bind-{uuid.uuid4().hex}",
                 "type": "bind",
                 "api_key": api_key,
                 "wallet": wallet,
+                "admin_override": admin_override,
                 "ts": time.time(),
             }
             self._apply_locked(event)
@@ -262,10 +269,17 @@ class BillingLedger:
             ]
 
     def settle_node_payout(self, wallet: str, amount: float, *, reference: str = "") -> dict:
-        """Deduct a paid-out amount from a node's pending balance (US-033 hook)."""
+        """Deduct a paid-out amount from a node's pending balance (US-033 hook).
+
+        ADR-0015: clamps to whatever is still pending under the same lock as
+        the deduction, so a forfeiture that lands between the settlement
+        loop's `payables()` snapshot and this call is never paid out on top
+        of — the wallet gets at most what remains, never a stale amount.
+        """
         if amount <= 0:
             raise ValueError("payout amount must be positive")
         with self._lock:
+            amount = min(amount, self._node_pending.get(wallet, 0.0))
             event = {
                 "id": f"payout-{uuid.uuid4().hex}",
                 "type": "payout",
@@ -348,7 +362,12 @@ class BillingLedger:
             self._node_pending[wallet] = self._node_pending.get(wallet, 0.0) - amount
             self._protocol_cut += amount
         elif etype == "bind":
-            self._wallet_bindings[event["wallet"]] = event["api_key"]
+            wallet = event["wallet"]
+            existing = self._wallet_bindings.get(wallet)
+            if existing is not None and existing != event["api_key"] and not event.get("admin_override"):
+                event["rejected"] = True
+            else:
+                self._wallet_bindings[wallet] = event["api_key"]
         else:
             return
         self._seen_event_ids.add(event["id"])

packages/tracker/meshnet_tracker/calibration.py

@@ -0,0 +1,223 @@
+"""TOPLOC honest-noise calibration corpus (ADR-0018 consequences, issue 21).
+
+Production TOPLOC audit thresholds must be derived from an empirical
+honest-noise baseline across the active fleet's hardware, not guessed
+(research-verifiable-inference.md §8 layer 3). This store persists one row
+per (node wallet, GPU model, dtype) calibration run so thresholds can be
+computed from a queryable corpus instead of a flat JSON dump, and re-derived
+whenever the fleet's hardware mix changes.
+"""
+
+from __future__ import annotations
+
+import json
+import sqlite3
+import threading
+import time
+import uuid
+
+DEFAULT_CALIBRATION_DB_PATH = "toploc_calibration.sqlite"
+# Headroom added on top of the observed p99 honest-noise envelope so normal
+# hardware variance doesn't trip the recommended threshold (ADR-0018 §3).
+DEFAULT_SAFETY_MARGIN = 0.20
+DEFAULT_PERCENTILE = 0.99
+
+
+class ToplocCalibrationStore:
+    """Thread-safe SQLite-backed corpus of per-node TOPLOC divergence runs."""
+
+    def __init__(self, db_path: str | None = None) -> None:
+        self._db_path = db_path
+        self._lock = threading.Lock()
+        self._runs: list[dict] = []
+        if self._db_path:
+            self._init_db()
+            self._load_from_db()
+
+    def record_run(
+        self,
+        *,
+        node_wallet: str,
+        gpu_model: str | None,
+        dtype: str | None,
+        model: str,
+        passed: bool,
+        exp_intersections: float | None,
+        mant_err_mean: float | None,
+        mant_err_median: float | None,
+        ts: float | None = None,
+    ) -> dict:
+        run = {
+            "id": f"cal-{uuid.uuid4().hex}",
+            "node_wallet": node_wallet,
+            "gpu_model": gpu_model or "unknown",
+            "dtype": dtype or "unknown",
+            "model": model,
+            "passed": bool(passed),
+            "exp_intersections": exp_intersections,
+            "mant_err_mean": mant_err_mean,
+            "mant_err_median": mant_err_median,
+            "ts": ts if ts is not None else time.time(),
+        }
+        with self._lock:
+            self._runs.append(run)
+            self._save_run(run)
+        return run
+
+    def runs(self) -> list[dict]:
+        with self._lock:
+            return list(self._runs)
+
+    def distinct_hardware_profiles(self) -> set[tuple[str, str]]:
+        with self._lock:
+            return {(r["gpu_model"], r["dtype"]) for r in self._runs}
+
+    def gate_status(self, *, min_hardware_profiles: int) -> dict:
+        """Whether the corpus is broad enough to enable production thresholds.
+
+        Alpha exception (issue 21): with a small, fully hired/controlled VPS
+        fleet, ``min_hardware_profiles`` may legitimately equal the fleet's
+        actual distinct hardware count — this must be revisited before a
+        public/volunteer launch broadens the hardware mix.
+        """
+        distinct = len(self.distinct_hardware_profiles())
+        return {
+            "distinct_hardware_profiles": distinct,
+            "min_hardware_profiles": min_hardware_profiles,
+            "sample_count": len(self._runs),
+            "ready": distinct > 0 and distinct >= min_hardware_profiles,
+        }
+
+    def envelope(
+        self,
+        *,
+        percentile: float = DEFAULT_PERCENTILE,
+        safety_margin: float = DEFAULT_SAFETY_MARGIN,
+    ) -> dict:
+        """Recommended tolerance constants derived from the corpus.
+
+        `exp_intersections` (higher = better match) gets a floor at its
+        worst-case (low) percentile minus margin; the mantissa errors
+        (higher = worse) get a ceiling at their worst-case (high) percentile
+        plus margin. Returns None for a metric with no samples yet.
+        """
+        with self._lock:
+            runs = list(self._runs)
+        exp_vals = sorted(v for r in runs if (v := r["exp_intersections"]) is not None)
+        mean_vals = sorted(v for r in runs if (v := r["mant_err_mean"]) is not None)
+        median_vals = sorted(v for r in runs if (v := r["mant_err_median"]) is not None)
+        min_exp = _floor(exp_vals, 1.0 - percentile, safety_margin)
+        max_mean = _ceiling(mean_vals, percentile, safety_margin)
+        max_median = _ceiling(median_vals, percentile, safety_margin)
+        return {
+            "sample_count": len(runs),
+            "distinct_hardware_profiles": len(self.distinct_hardware_profiles()),
+            "percentile": percentile,
+            "safety_margin": safety_margin,
+            "recommended_min_exp_intersections": min_exp,
+            "recommended_max_mant_err_mean": max_mean,
+            "recommended_max_mant_err_median": max_median,
+            # In-sample estimate only: the fraction of this same honest
+            # corpus that the recommended thresholds would themselves flag.
+            # Not a substitute for independent validation data — but a
+            # documented starting estimate per issue 21's acceptance
+            # criteria, and a sanity check that the margin isn't too tight.
+            "estimated_false_positive_rate": _false_positive_rate(
+                runs, min_exp=min_exp, max_mean=max_mean, max_median=max_median,
+            ),
+        }
+
+    # ---- persistence (billing.py pattern) ----
+
+    def _init_db(self) -> None:
+        con = sqlite3.connect(self._db_path)  # type: ignore[arg-type]
+        con.execute(
+            "CREATE TABLE IF NOT EXISTS toploc_calibration_runs "
+            "(run_id TEXT PRIMARY KEY, node_wallet TEXT NOT NULL, "
+            "gpu_model TEXT NOT NULL, dtype TEXT NOT NULL, payload TEXT NOT NULL, "
+            "ts REAL NOT NULL)"
+        )
+        con.commit()
+        con.close()
+
+    def _load_from_db(self) -> None:
+        con = sqlite3.connect(self._db_path)  # type: ignore[arg-type]
+        rows = con.execute(
+            "SELECT payload FROM toploc_calibration_runs ORDER BY ts, run_id"
+        ).fetchall()
+        con.close()
+        for (payload,) in rows:
+            try:
+                self._runs.append(json.loads(payload))
+            except json.JSONDecodeError:
+                continue
+
+    def _save_run(self, run: dict) -> None:
+        if not self._db_path:
+            return
+        con = sqlite3.connect(self._db_path)  # type: ignore[arg-type]
+        con.execute(
+            "INSERT OR IGNORE INTO toploc_calibration_runs "
+            "(run_id, node_wallet, gpu_model, dtype, payload, ts) VALUES (?, ?, ?, ?, ?, ?)",
+            (run["id"], run["node_wallet"], run["gpu_model"], run["dtype"], json.dumps(run), float(run["ts"])),
+        )
+        con.commit()
+        con.close()
+
+
+def _percentile(sorted_vals: list[float], p: float) -> float:
+    if len(sorted_vals) == 1:
+        return sorted_vals[0]
+    k = (len(sorted_vals) - 1) * p
+    lo = int(k)
+    hi = min(lo + 1, len(sorted_vals) - 1)
+    if lo == hi:
+        return sorted_vals[lo]
+    return sorted_vals[lo] + (sorted_vals[hi] - sorted_vals[lo]) * (k - lo)
+
+
+def _floor(sorted_vals: list[float], p: float, safety_margin: float) -> float | None:
+    if not sorted_vals:
+        return None
+    return max(0.0, _percentile(sorted_vals, p) * (1.0 - safety_margin))
+
+
+def _ceiling(sorted_vals: list[float], p: float, safety_margin: float) -> float | None:
+    if not sorted_vals:
+        return None
+    return _percentile(sorted_vals, p) * (1.0 + safety_margin)
+
+
+def _false_positive_rate(
+    runs: list[dict],
+    *,
+    min_exp: float | None,
+    max_mean: float | None,
+    max_median: float | None,
+) -> float | None:
+    """Fraction of the (honest, by construction) corpus that would be
+    flagged by the recommended thresholds — an in-sample false-positive
+    rate estimate, not out-of-sample validation."""
+    if not runs:
+        return None
+    flagged = 0
+    for r in runs:
+        exp = r["exp_intersections"]
+        mean = r["mant_err_mean"]
+        median = r["mant_err_median"]
+        would_flag = (
+            (min_exp is not None and exp is not None and exp < min_exp)
+            or (max_mean is not None and mean is not None and mean > max_mean)
+            or (max_median is not None and median is not None and median > max_median)
+        )
+        if would_flag:
+            flagged += 1
+    return flagged / len(runs)
+
+
+__all__ = [
+    "DEFAULT_CALIBRATION_DB_PATH",
+    "DEFAULT_SAFETY_MARGIN",
+    "DEFAULT_PERCENTILE",
+    "ToplocCalibrationStore",
+]

packages/tracker/meshnet_tracker/cli.py

@@ -6,8 +6,11 @@ import time
 
 from .accounts import DEFAULT_ACCOUNTS_DB_PATH
 from .billing import DEFAULT_BILLING_DB_PATH
+from .hf_pricing import DEFAULT_HF_PRICING_LOG_DB_PATH
 from .server import TrackerServer, derive_relay_url_from_public_tracker_url
 
+DEFAULT_REGISTRY_DB_PATH = "meshnet_registry.sqlite3"
+
 
 def main() -> None:
     common = argparse.ArgumentParser(add_help=False)
@@ -54,6 +57,29 @@ def main() -> None:
         action="store_true",
         help="Disable the USDT billing ledger",
     )
+    common.add_argument(
+        "--max-charge-per-request",
+        type=float,
+        default=None,
+        help=(
+            "Reject chat completion requests whose prompt plus requested completion "
+            "token bound would cost more than this many USDT"
+        ),
+    )
+    common.add_argument(
+        "--registry-db",
+        default=DEFAULT_REGISTRY_DB_PATH,
+        metavar="PATH",
+        help=(
+            "SQLite database path for persisted strike/ban/reputation registry "
+            f"state (default: {DEFAULT_REGISTRY_DB_PATH})"
+        ),
+    )
+    common.add_argument(
+        "--no-registry-contracts",
+        action="store_true",
+        help="Disable the local contract registry used for strike/ban/reputation enforcement",
+    )
     common.add_argument(
         "--accounts-db",
         default=DEFAULT_ACCOUNTS_DB_PATH,
@@ -118,6 +144,55 @@ def main() -> None:
             "(default: MESHNET_HIVE_SECRET env; required for multi-tracker replication)"
         ),
     )
+    common.add_argument(
+        "--toploc-calibration-db",
+        default=None,
+        metavar="PATH",
+        help=(
+            "SQLite path for the AH-021 honest-noise TOPLOC calibration corpus "
+            "(enables POST /v1/calibration/toploc/run + GET /v1/calibration/toploc/results)"
+        ),
+    )
+    common.add_argument(
+        "--toploc-reference-node-url",
+        default=None,
+        help="Reference node the calibration job teacher-forces claimed tokens against (see validator README)",
+    )
+    common.add_argument(
+        "--toploc-calibration-gate-min-hardware-profiles",
+        type=int,
+        default=1,
+        help=(
+            "Distinct (GPU model, dtype) profiles the corpus must cover before "
+            "gate_status.ready is true (alpha exception: fleet size is acceptable)"
+        ),
+    )
+    common.add_argument(
+        "--enable-hf-pricing",
+        action="store_true",
+        help=(
+            "Enable the daily dynamic pricing refresh (issue 23): for presets with a "
+            "curated hf_aliases list, sets the client price to 80%% of the cheapest "
+            "matching HuggingFace inference-marketplace rate. Presets without "
+            "hf_aliases are unaffected and keep their static price."
+        ),
+    )
+    common.add_argument(
+        "--hf-pricing-log-db",
+        default=None,
+        metavar="PATH",
+        help=(
+            "SQLite database path for the dynamic pricing change log "
+            f"(default when --enable-hf-pricing is set: {DEFAULT_HF_PRICING_LOG_DB_PATH}; "
+            "enables GET /v1/pricing/hf/history)"
+        ),
+    )
+    common.add_argument(
+        "--hf-pricing-refresh-interval",
+        type=float,
+        default=86400.0,
+        help="Seconds between dynamic pricing refresh passes (default: daily)",
+    )
 
     parser = argparse.ArgumentParser(
         prog="meshnet-tracker",
@@ -140,6 +215,11 @@ def main() -> None:
             treasury = SolanaCustodialTreasury(
                 args.solana_rpc_url, args.usdt_mint, args.treasury_keypair,
             )
+        contracts = None
+        if not args.no_registry_contracts:
+            from meshnet_contracts import LocalSolanaContracts  # type: ignore[import-not-found]
+
+            contracts = LocalSolanaContracts(registry_db=args.registry_db)
         server = TrackerServer(
             host=args.host,
             port=args.port,
@@ -150,6 +230,8 @@ def main() -> None:
             relay_url=relay_url,
             enable_billing=not args.no_billing,
             billing_db=None if args.no_billing else args.billing_db,
+            max_charge_per_request=args.max_charge_per_request,
+            contracts=contracts,
             accounts_db=None if args.no_accounts else args.accounts_db,
             treasury=treasury,
             settle_period=args.settle_period,
@@ -157,6 +239,15 @@ def main() -> None:
             payout_dust_floor=args.payout_dust_floor,
             validator_service_token=args.validator_service_token,
             hive_secret=args.hive_secret,
+            toploc_calibration_db=args.toploc_calibration_db,
+            toploc_reference_node_url=args.toploc_reference_node_url,
+            toploc_calibration_gate_min_hardware_profiles=args.toploc_calibration_gate_min_hardware_profiles,
+            enable_hf_pricing=args.enable_hf_pricing,
+            hf_pricing_log_db=(
+                args.hf_pricing_log_db
+                or (DEFAULT_HF_PRICING_LOG_DB_PATH if args.enable_hf_pricing else None)
+            ),
+            hf_pricing_refresh_interval=args.hf_pricing_refresh_interval,
         )
         port = server.start()
         print(f"meshnet-tracker listening on http://{args.host}:{port}", flush=True)

packages/tracker/meshnet_tracker/hf_pricing.py

@@ -0,0 +1,314 @@
+"""Dynamic per-model pricing benchmarked against HuggingFace inference rates (issue 23).
+
+Client-facing price per model tracks the market: 80% of the cheapest
+comparable provider rate on HuggingFace's inference marketplace
+(https://huggingface.co/inference/models), refreshed daily. Nodes are
+unaffected — this only ever calls ``BillingLedger.set_price`` (the ledger's
+existing write path), never touches node payouts (ADR-0015's 90/10 split
+still applies to whatever price is charged).
+
+Confirmed 2026-07-06: the pricing table is server-rendered into the initial
+HTML response (SvelteKit SSR) — a plain stdlib ``urllib.request`` GET plus
+HTML parsing is sufficient. No headless-browser fetch is required. Each
+table row carries an anchor whose href is
+``/<org>/<repo>/?inference_api=true&inference_provider=<provider>``, which is
+a cheaper and more stable extraction anchor than the display text (which
+duplicates the repo id at two responsive breakpoints).
+"""
+
+from __future__ import annotations
+
+import json
+import re
+import sqlite3
+import threading
+import time
+import urllib.parse
+import urllib.request
+from dataclasses import dataclass
+from html.parser import HTMLParser
+from typing import Callable
+
+HF_INFERENCE_MODELS_URL = "https://huggingface.co/inference/models"
+DEFAULT_HF_PRICING_LOG_DB_PATH = "hf_pricing_log.sqlite"
+DEFAULT_CLIENT_PRICE_FRACTION = 0.80  # charge 80% of the cheapest comparable rate
+
+_ROW_HREF_RE = re.compile(
+    r"^/(?P<repo>[^/]+/[^/?]+)/\?inference_api=true&inference_provider=(?P<provider>[^&\"]+)"
+)
+_PRICE_RE = re.compile(r"^\$[\d,]*\.?\d+$")
+
+
+@dataclass(frozen=True)
+class HfPriceQuote:
+    """One (model, provider) row from the HF inference pricing table."""
+
+    repo_id: str
+    provider: str
+    input_per_1m: float
+    output_per_1m: float
+
+    def blended_price_per_1k_tokens(self) -> float:
+        """Average of input/output $-per-1M-token rates, converted to $/1k.
+
+        The tracker bills a single per-1k-token rate (``BillingLedger``
+        doesn't distinguish prompt vs. completion tokens), so this is the
+        simplest fair proxy for "this provider's rate" in that unit.
+        """
+        return (self.input_per_1m + self.output_per_1m) / 2.0 / 1000.0
+
+    def alias_keys(self) -> tuple[str, str]:
+        """Both the bare-repo and repo::provider forms an ``hf_aliases`` entry may use."""
+        return (self.repo_id.lower(), f"{self.repo_id.lower()}::{self.provider.lower()}")
+
+
+class _HfPricingTableParser(HTMLParser):
+    """Extracts (repo_id, provider, input$/1M, output$/1M) rows from the raw HTML."""
+
+    def __init__(self) -> None:
+        super().__init__()
+        self._in_tr = False
+        self._row_match: tuple[str, str] | None = None
+        self._row_prices: list[float] = []
+        self._in_td = False
+        self._td_text: list[str] = []
+        self.quotes: list[HfPriceQuote] = []
+
+    def handle_starttag(self, tag: str, attrs: list[tuple[str, str | None]]) -> None:
+        if tag == "tr":
+            self._in_tr = True
+            self._row_match = None
+            self._row_prices = []
+        elif tag == "a" and self._in_tr and self._row_match is None:
+            href = dict(attrs).get("href") or ""
+            m = _ROW_HREF_RE.match(href)
+            if m:
+                self._row_match = (
+                    urllib.parse.unquote(m.group("repo")),
+                    urllib.parse.unquote(m.group("provider")),
+                )
+        elif tag == "td":
+            self._in_td = True
+            self._td_text = []
+
+    def handle_data(self, data: str) -> None:
+        if self._in_td:
+            self._td_text.append(data)
+
+    def handle_endtag(self, tag: str) -> None:
+        if tag == "td":
+            self._in_td = False
+            text = "".join(self._td_text).strip()
+            if _PRICE_RE.match(text):
+                self._row_prices.append(float(text.replace("$", "").replace(",", "")))
+        elif tag == "tr":
+            self._in_tr = False
+            if self._row_match and len(self._row_prices) >= 2:
+                repo_id, provider = self._row_match
+                self.quotes.append(
+                    HfPriceQuote(
+                        repo_id=repo_id,
+                        provider=provider,
+                        input_per_1m=self._row_prices[0],
+                        output_per_1m=self._row_prices[1],
+                    )
+                )
+            self._row_match = None
+            self._row_prices = []
+
+
+def parse_hf_pricing_table(html: str) -> list[HfPriceQuote]:
+    """Pure parsing function — no network I/O, so it's directly unit-testable."""
+    parser = _HfPricingTableParser()
+    parser.feed(html)
+    return parser.quotes
+
+
+def _default_fetch_html(url: str, *, timeout: float) -> str:
+    req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
+    with urllib.request.urlopen(req, timeout=timeout) as resp:
+        return resp.read().decode("utf-8", errors="replace")
+
+
+def fetch_hf_price_quotes(
+    search_term: str,
+    *,
+    fetch_html: Callable[[str], str] | None = None,
+    timeout: float = 15.0,
+) -> list[HfPriceQuote]:
+    """Fetch and parse the HF inference pricing table filtered by ``search_term``.
+
+    ``fetch_html`` is the test injection point (mirrors the ``backend=``
+    convention used elsewhere in this package) — it takes the full URL and
+    returns the raw HTML text, so tests never hit the network.
+    """
+    url = f"{HF_INFERENCE_MODELS_URL}?{urllib.parse.urlencode({'search': search_term})}"
+    if fetch_html is not None:
+        html = fetch_html(url)
+    else:
+        html = _default_fetch_html(url, timeout=timeout)
+    return parse_hf_pricing_table(html)
+
+
+def cheapest_matching_quote(
+    quotes: list[HfPriceQuote], aliases: list[str]
+) -> HfPriceQuote | None:
+    """Cheapest quote whose repo (optionally ``repo::provider``) is in ``aliases``.
+
+    An alias of ``"org/repo"`` matches that repo under any provider; an
+    alias of ``"org/repo::provider"`` matches only that specific provider —
+    useful when only one provider's deployment has been human-verified as a
+    fair comparable (matching quantization/params).
+    """
+    alias_set = {a.strip().lower() for a in aliases if isinstance(a, str) and a.strip()}
+    if not alias_set:
+        return None
+    matches = [q for q in quotes if alias_set & set(q.alias_keys())]
+    if not matches:
+        return None
+    return min(matches, key=lambda q: q.blended_price_per_1k_tokens())
+
+
+class HfPricingLog:
+    """Thread-safe SQLite-backed audit log of dynamic price changes (issue 23).
+
+    Every price change (old, new, source alias/provider, timestamp) is
+    recorded here so a client dispute over a charge can be reconciled
+    against exactly what the market-tracking job did and when — mirrors
+    ``calibration.py``'s persistence shape.
+    """
+
+    def __init__(self, db_path: str | None = None) -> None:
+        self._db_path = db_path
+        self._lock = threading.Lock()
+        self._changes: list[dict] = []
+        if self._db_path:
+            self._init_db()
+            self._load_from_db()
+
+    def record_change(
+        self,
+        *,
+        model: str,
+        old_price_per_1k: float,
+        new_price_per_1k: float,
+        source_repo_id: str,
+        source_provider: str,
+        ts: float | None = None,
+    ) -> dict:
+        change = {
+            "model": model,
+            "old_price_per_1k": old_price_per_1k,
+            "new_price_per_1k": new_price_per_1k,
+            "source_repo_id": source_repo_id,
+            "source_provider": source_provider,
+            "ts": ts if ts is not None else time.time(),
+        }
+        with self._lock:
+            self._changes.append(change)
+            self._save_change(change)
+        return change
+
+    def history(self, model: str | None = None, *, limit: int = 200) -> list[dict]:
+        with self._lock:
+            changes = list(self._changes)
+        if model is not None:
+            changes = [c for c in changes if c["model"] == model]
+        return changes[-limit:]
+
+    # ---- persistence (billing.py / calibration.py pattern) ----
+
+    def _init_db(self) -> None:
+        con = sqlite3.connect(self._db_path)  # type: ignore[arg-type]
+        con.execute(
+            "CREATE TABLE IF NOT EXISTS hf_price_changes "
+            "(id INTEGER PRIMARY KEY AUTOINCREMENT, model TEXT NOT NULL, "
+            "payload TEXT NOT NULL, ts REAL NOT NULL)"
+        )
+        con.commit()
+        con.close()
+
+    def _load_from_db(self) -> None:
+        con = sqlite3.connect(self._db_path)  # type: ignore[arg-type]
+        rows = con.execute(
+            "SELECT payload FROM hf_price_changes ORDER BY ts, id"
+        ).fetchall()
+        con.close()
+        for (payload,) in rows:
+            try:
+                self._changes.append(json.loads(payload))
+            except json.JSONDecodeError:
+                continue
+
+    def _save_change(self, change: dict) -> None:
+        if not self._db_path:
+            return
+        con = sqlite3.connect(self._db_path)  # type: ignore[arg-type]
+        con.execute(
+            "INSERT INTO hf_price_changes (model, payload, ts) VALUES (?, ?, ?)",
+            (change["model"], json.dumps(change), float(change["ts"])),
+        )
+        con.commit()
+        con.close()
+
+
+def hf_search_term(preset: dict, model_name: str) -> str:
+    """Best-effort search term for the HF pricing page's ``?search=`` filter."""
+    hf_repo = preset.get("hf_repo")
+    if isinstance(hf_repo, str) and hf_repo:
+        return hf_repo.rsplit("/", 1)[-1]
+    return model_name
+
+
+def refresh_preset_price(
+    *,
+    model_name: str,
+    preset: dict,
+    current_price: float,
+    fetch_html: Callable[[str], str] | None = None,
+    price_fraction: float = DEFAULT_CLIENT_PRICE_FRACTION,
+) -> dict | None:
+    """Compute the new price for one preset, or None if nothing should change.
+
+    Never raises — any fetch/parse failure or absence of a verified match is
+    treated identically: keep the static default (deliverable's fallback
+    requirement). Callers are responsible for actually applying the result
+    (``BillingLedger.set_price`` + logging), so this function stays a pure
+    "what should the new price be" computation and is trivially unit-testable.
+    """
+    aliases = preset.get("hf_aliases")
+    if not aliases:
+        return None
+    try:
+        quotes = fetch_hf_price_quotes(
+            hf_search_term(preset, model_name), fetch_html=fetch_html
+        )
+        quote = cheapest_matching_quote(quotes, aliases)
+    except Exception:
+        return None
+    if quote is None:
+        return None
+    new_price = round(quote.blended_price_per_1k_tokens() * price_fraction, 6)
+    if new_price <= 0:
+        return None
+    return {
+        "model": model_name,
+        "old_price_per_1k": current_price,
+        "new_price_per_1k": new_price,
+        "source_repo_id": quote.repo_id,
+        "source_provider": quote.provider,
+    }
+
+
+__all__ = [
+    "HF_INFERENCE_MODELS_URL",
+    "DEFAULT_HF_PRICING_LOG_DB_PATH",
+    "DEFAULT_CLIENT_PRICE_FRACTION",
+    "HfPriceQuote",
+    "HfPricingLog",
+    "parse_hf_pricing_table",
+    "fetch_hf_price_quotes",
+    "cheapest_matching_quote",
+    "hf_search_term",
+    "refresh_preset_price",
+]

packages/tracker/meshnet_tracker/model_presets.json

@@ -11,9 +11,13 @@
       ],
       "recommended": true,
       "deployment_status": "recommended",
+      "hf_aliases": [],
+      "hf_verified_match_note": "Pending human curation (issue 23) — no HF inference-marketplace listing has been confirmed as a comparable params/quantization match for this preset yet. Leave empty until a human signs off; an empty hf_aliases list keeps this model on the static default price.",
       "required_model_bytes": 638876385280,
       "download_size_bytes": 638876385280,
       "native_quantization": "int4",
+      "canonical_audit_dtype": "bfloat16",
+      "canonical_audit_quantization": "bfloat16",
       "bytes_per_layer": {
         "int4": 10473383366
       },
@@ -24,6 +28,8 @@
         "num_layers": 61,
         "context_length": 256000,
         "native_quantization": "int4",
+        "canonical_audit_dtype": "bfloat16",
+        "canonical_audit_quantization": "bfloat16",
         "download_size_gb": 595,
         "recommended_short_name": "kimi-k2.7",
         "recommended_engines": [

packages/tracker/meshnet_tracker/wallet_proof.py

@@ -0,0 +1,49 @@
+"""Ed25519 proof-of-ownership for client wallet binding (ADR-0017 §5, issue C6).
+
+Wallet addresses are base58-encoded Solana ed25519 public keys, the same
+format used by ``packages/node/meshnet_node/wallet.py``. Binding a wallet to
+an API key requires a signature over a message that embeds the api_key, so a
+captured (wallet, signature) pair cannot be replayed to bind a different key.
+
+No Solana RPC dependency is needed for verification, so this stays on plain
+``cryptography`` rather than pulling in ``solders`` on the tracker.
+"""
+
+from __future__ import annotations
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+_B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"
+_B58_INDEX = {char: index for index, char in enumerate(_B58_ALPHABET)}
+
+
+def b58decode(value: str) -> bytes:
+    """Decode a base58 string (Solana/Bitcoin alphabet) to bytes."""
+    n = 0
+    for char in value:
+        digit = _B58_INDEX.get(char)
+        if digit is None:
+            raise ValueError(f"invalid base58 character: {char!r}")
+        n = n * 58 + digit
+    body = n.to_bytes((n.bit_length() + 7) // 8, "big") if n else b""
+    leading_zeros = len(value) - len(value.lstrip("1"))
+    return b"\x00" * leading_zeros + body
+
+
+def binding_message(api_key: str, wallet: str) -> bytes:
+    """Message a wallet owner must sign to bind ``wallet`` to ``api_key``."""
+    return f"meshnet-wallet-bind:{api_key}:{wallet}".encode()
+
+
+def verify_wallet_signature(wallet: str, message: bytes, signature_hex: str) -> bool:
+    """True if ``signature_hex`` is a valid ed25519 signature by ``wallet`` over ``message``."""
+    try:
+        pubkey_bytes = b58decode(wallet)
+        if len(pubkey_bytes) != 32:
+            return False
+        signature = bytes.fromhex(signature_hex)
+        Ed25519PublicKey.from_public_bytes(pubkey_bytes).verify(signature, message)
+        return True
+    except (ValueError, InvalidSignature):
+        return False

packages/tracker/pyproject.toml

@@ -9,6 +9,7 @@ description = "Distributed Inference Network node registry and route selection"
 requires-python = ">=3.10"
 
 dependencies = [
+    "cryptography>=41",
     "websockets>=13",
 ]
 

packages/validator/README.md

@@ -2,28 +2,81 @@
 
 Optimistic fraud detection (ADR-0003, penalty amended by ADR-0015): the
 validator re-runs a random ~5% sample of completed inference requests against
-a trusted reference node and, on divergence, submits a slash proof and
+a trusted reference node. Audit-capable events are checked by teacher-forcing
-forfeits the node's pending balance.
+the claimed token sequence through the reference node and verifying the
+claimed TOPLOC activation proof. Legacy events without TOPLOC metadata still
+fall back to text comparison until node-side proof capture lands.
 
 ## Why the penalty deters cheating
 
 There is no upfront stake. Settlement is periodic (US-033), so a node always
 has an unpaid **pending balance** — that balance *is* the collateral.
 
-At a sampling rate `p`, a cheater is caught on average once every `1/p`
+At a sampling rate `p`, a cheater who gains `G` per fraudulent job and loses
-fraudulent jobs, so cheating is unprofitable when:
+`L` when caught has expected value:
 
 ```
-penalty > per_job_gain / p        # p = 0.05  →  penalty > 20 × per_job_gain
+(1 - p) * G - p * L < 0
+L > ((1 - p) / p) * G        # p = 0.05  ->  L > 19 x G
 ```
 
 With the production settlement period of 24h, the pending balance at any
 moment approximates a full day's earnings — hundreds to thousands of jobs —
-which is far above the 20× bar. Each catch also records a strike; three
+which is far above the 19× bar. Each catch also records a strike; three
 strikes ban the wallet (registration rejected, excluded from routes, unpaid
 pending never settled), and the probationary period (first N jobs unpaid)
 makes re-entry with a fresh wallet costly.
 
+## TOPLOC audit contract
+
+The validator expects audit-capable events to carry:
+
+- `claimed_token_ids`: the final token sequence claimed by the prover.
+- `toploc_proof`: compact TOPLOC proof data built from prover activations.
+
+On audit the validator calls the reference node's `POST /v1/audit/toploc`
+endpoint with the original messages plus `claimed_token_ids`. The reference
+node must run a teacher-forced prefill over exactly that token sequence and
+return the activations for TOPLOC verification. It must not free-generate a
+second answer for audit.
+
+Canonical audit parameters for the current alpha preset are:
+
+```
+dtype = "bfloat16"
+quantization = "bfloat16"
+decode_batching_size = 32
+topk = 8
+skip_prefill = true
+encoding = "base64"
+```
+
+`verify_activation_proofs_detailed()` (`meshnet_validator.audit`) surfaces the
+raw TOPLOC divergence — `exp_intersections` (worst-case across chunks),
+`mant_err_mean`, `mant_err_median` — alongside the pass/fail bool. This is
+what the calibration corpus below is built from; existing callers that only
+need the bool keep using `verify_activation_proofs()`.
+
+**Do not enable production audit thresholds before issue 21 closes.**
+Production audit thresholds remain gated on the honest-noise calibration
+corpus in issue 21: the tracker's `POST /v1/calibration/toploc/run`
+(admin/validator-only, mirrors `POST /v1/benchmark/hop-penalty`) dispatches a
+fixed prompt to every solo-capable registered node, verifies each node's
+on-demand commitment against a teacher-forced reference replay, and records
+the divergence into a SQLite corpus (`meshnet_tracker.calibration.
+ToplocCalibrationStore`) keyed by node wallet + GPU model + dtype.
+`GET /v1/calibration/toploc/results` reports the corpus plus:
+
+- `envelope`: p99 honest-noise value per metric with a 20% safety margin —
+  the recommended (not yet wired) tolerance constants.
+- `gate_status.ready`: whether the corpus covers enough distinct hardware
+  profiles (`--toploc-calibration-gate-min-hardware-profiles`, default 1).
+  **Alpha exception:** with the hired-VPS-only launch fleet, `ready` may
+  legitimately mean "covers every node we currently operate" — this must be
+  revisited (raise the minimum) before a public/volunteer launch broadens
+  the hardware mix, since a new corpus is required whenever the fleet's
+  hardware composition changes.
+
 Two operational notes:
 
 - Shortening the settlement period shrinks the collateral. Period changes
@@ -44,3 +97,27 @@ ValidatorProcess(
 
 Remote validators can instead call the tracker's privileged
 `POST /v1/billing/forfeit` endpoint (non-empty Authorization header).
+
+## Reputation-weighted audit rate (ADR-0018 §1, §6-7)
+
+`sample_rate` is a flat coin flip: every wallet audited at the same rate.
+Pass `audit_sampler=AdaptiveAuditSampler(...)` instead to make the audit
+probability a function of each wallet's tenure and reputation — newcomers
+and low-reputation wallets sampled at 20–30%, veterans in good standing
+floor at ≥2% — while a running budget balance keeps the fleet-wide realized
+rate anchored to `AuditRateConfig.target_rate` (default 5%) regardless of
+the wallet mix. Passive tripwires (`detect_output_tripwire`) bump only that
+one request's odds; they never strike, ban, or affect other wallets' rates.
+
+```python
+from meshnet_validator import AdaptiveAuditSampler, detect_output_tripwire
+
+ValidatorProcess(
+    contracts=contracts,
+    reference_node_url="http://...",
+    audit_sampler=AdaptiveAuditSampler(random_seed=42),
+)
+```
+
+When `audit_sampler` is set, `sample_rate` is ignored — the sampler decides
+per event, keyed on whichever route wallet has the lowest reputation.

packages/validator/meshnet_validator/__init__.py

@@ -8,6 +8,16 @@ import time
 import urllib.request
 from typing import Any
 
+from .audit import (
+    ToplocAuditConfig,
+    ToplocProofClaim,
+    ToplocVerificationResult,
+    verify_activation_proofs,
+    verify_activation_proofs_detailed,
+)
+from .sampling import AdaptiveAuditSampler, AuditRateConfig
+from .tripwire import detect_output_tripwire
+
 __version__ = "0.1.0"
 
 
@@ -27,6 +37,9 @@ class ValidatorProcess:
         webhook_url: str | None = None,
         interval_seconds: float = 1.0,
         billing: Any | None = None,
+        toploc_config: ToplocAuditConfig | None = None,
+        toploc_backend: Any | None = None,
+        audit_sampler: AdaptiveAuditSampler | None = None,
     ) -> None:
         if not 0.0 <= sample_rate <= 1.0:
             raise ValueError("sample_rate must be between 0 and 1")
@@ -48,6 +61,9 @@ class ValidatorProcess:
         self._strike_threshold = strike_threshold
         self._webhook_url = webhook_url
         self._interval_seconds = interval_seconds
+        self._toploc_config = toploc_config or ToplocAuditConfig()
+        self._toploc_backend = toploc_backend
+        self._audit_sampler = audit_sampler
         self._random = random.Random(random_seed)
         self._last_event_index = -1
         self._running = False
@@ -62,15 +78,47 @@ class ValidatorProcess:
         )
         for event in events:
             self._last_event_index = max(self._last_event_index, event.index)
-            if self._random.random() >= self._sample_rate:
+            if not self._should_sample(event):
                 continue
             self.sampled_count += 1
-            reference_output = self._run_reference(event.messages)
+            audit_result = self._validate_event(event)
-            if _outputs_match(event.observed_output, reference_output, self._tolerance):
+            if audit_result.ok:
+                self._record_clean_audit(event)
                 continue
-            receipts.extend(self._slash_route(event.route_nodes, event.observed_output, reference_output))
+            receipts.extend(self._slash_node(
+                audit_result.culprit_node,
+                event.observed_output,
+                audit_result.reference_output,
+                reason=audit_result.reason,
+            ))
         return receipts
 
+    def _should_sample(self, event: Any) -> bool:
+        """ADR-0018 §1/§6-7: flat sample_rate stays the default; when an
+        AdaptiveAuditSampler is configured, the decision is reputation- and
+        tenure-weighted and budget-balanced against the fleet-wide target
+        instead of a uniform coin flip."""
+        if self._audit_sampler is None:
+            return self._random.random() < self._sample_rate
+
+        tripwire = detect_output_tripwire(_event_value(event, "observed_output") or "")
+        wallets = _route_wallets(event)
+        if not wallets:
+            return self._audit_sampler.should_audit(
+                completed_job_count=0, reputation=1.0, tripwire=tripwire,
+            )
+        # A route is only as trustworthy as its least-trusted hop -- audit
+        # against whichever wallet on the route looks riskiest.
+        riskiest = min(
+            (self._contracts.registry.get_wallet(wallet) for wallet in wallets),
+            key=lambda wallet: wallet.reputation,
+        )
+        return self._audit_sampler.should_audit(
+            completed_job_count=riskiest.completed_job_count,
+            reputation=riskiest.reputation,
+            tripwire=tripwire,
+        )
+
     def start(self) -> None:
         if self._running:
             raise RuntimeError("ValidatorProcess is already running")
@@ -99,14 +147,201 @@ class ValidatorProcess:
             raise ValueError("reference node response did not contain text")
         return text
 
-    def _slash_route(
+    def _validate_event(self, event: Any) -> "_AuditResult":
+        event = self._event_with_on_demand_commitments(event)
+        hop_commitments = _hop_commitments_from_event(event)
+        if hop_commitments is not None and self._commitment_expired(event):
+            # ADR-0018 §3: the on-demand retention window has passed — nodes
+            # are no longer expected to hold the boundary activations needed
+            # to verify this commitment, so fall back to the text-only path.
+            hop_commitments = None
+
+        if hop_commitments is None:
+            reference_output = self._run_reference(event.messages)
+            ok = _outputs_match(event.observed_output, reference_output, self._tolerance)
+            return _AuditResult(
+                ok=ok,
+                reference_output=reference_output,
+                reason="reference output diverged",
+                # Text comparison has no per-hop signal; the last hop is the
+                # best-effort guess (text-only fallback), never used when
+                # hop-boundary commitments make real bisection possible.
+                culprit_node=None if ok else _final_text_node(event.route_nodes),
+            )
+
+        if len(hop_commitments) == 1:
+            # Single-commitment route (AH-006 whole-route format, or a
+            # genuinely one-hop pipeline): reuse the original teacher-forced
+            # call so existing single-hop reference integrations keep working.
+            only = hop_commitments[0]
+            reference_activations_by_hop = [self._run_teacher_forced_prefill(
+                model=_event_value(event, "model"),
+                messages=_event_value(event, "messages"),
+                claimed_token_ids=only.token_ids,
+                claim=only.claim,
+            )]
+        else:
+            reference_activations_by_hop = self._run_teacher_forced_prefill_hops(
+                model=_event_value(event, "model"),
+                messages=_event_value(event, "messages"),
+                hop_commitments=hop_commitments,
+            )
+        culprit_index = _first_divergent_hop(
+            hop_commitments,
+            reference_activations_by_hop,
+            config=self._toploc_config,
+            backend=self._toploc_backend,
+        )
+        ok = culprit_index is None
+        return _AuditResult(
+            ok=ok,
+            reference_output=(
+                "TOPLOC activation proof accepted"
+                if ok
+                else f"TOPLOC activation proof mismatch at hop {culprit_index}"
+            ),
+            reason="TOPLOC activation proof mismatch",
+            culprit_node=None if ok else hop_commitments[culprit_index].node,
+        )
+
+    def _event_with_on_demand_commitments(self, event: Any) -> Any:
+        """Fetch missing per-hop TOPLOC commitments only after audit sampling.
+
+        Tracker validation events deliberately carry ordinary route metadata,
+        not a pre-announced audit flag. When this validator samples an event, it
+        asks each hop for its short-lived boundary commitment and splices the
+        returned proof into a local event copy for the bisection verifier.
+        """
+        route_nodes = _event_value(event, "route_nodes") or []
+        if not isinstance(route_nodes, list) or not route_nodes:
+            return event
+        updated_nodes: list[dict] = []
+        changed = False
+        for node in route_nodes:
+            if not isinstance(node, dict):
+                updated_nodes.append(node)
+                continue
+            updated = dict(node)
+            if _mapping_value(updated, "toploc_proof") is None:
+                commitment = self._fetch_hop_commitment(event, updated)
+                if commitment is not None:
+                    updated.update(commitment)
+                    changed = True
+            updated_nodes.append(updated)
+        if not changed:
+            return event
+        if isinstance(event, dict):
+            copied = dict(event)
+        else:
+            copied = dict(vars(event))
+        copied["route_nodes"] = updated_nodes
+        return copied
+
+    def _fetch_hop_commitment(self, event: Any, node: dict) -> dict[str, Any] | None:
+        endpoint = node.get("endpoint")
+        if not isinstance(endpoint, str) or not endpoint:
+            return None
+        try:
+            response = _post_json(
+                f"{endpoint.rstrip('/')}/v1/audit/toploc/commitment",
+                {
+                    "session_id": _event_value(event, "session_id"),
+                    "model": _event_value(event, "model"),
+                    "messages": _event_value(event, "messages") or [],
+                    "shard_start": node.get("shard_start"),
+                    "shard_end": node.get("shard_end"),
+                },
+                timeout=2.0,
+            )
+        except (OSError, ValueError, json.JSONDecodeError):
+            return None
+        proof = response.get("toploc_proof") or response.get("activation_proof")
+        token_ids = response.get("claimed_token_ids") or response.get("output_token_ids")
+        if not isinstance(proof, dict):
+            return None
+        if not isinstance(token_ids, list) or not all(isinstance(token, int) for token in token_ids):
+            return None
+        return {"toploc_proof": proof, "claimed_token_ids": token_ids}
+
+    def _commitment_expired(self, event: Any) -> bool:
+        ts = _event_value(event, "ts")
+        if ts is None:
+            return False
+        return (time.time() - float(ts)) > self._toploc_config.commitment_ttl_seconds
+
+    def _run_teacher_forced_prefill(
         self,
-        route_nodes: list[dict],
+        *,
+        model: str,
+        messages: list[dict],
+        claimed_token_ids: list[int],
+        claim: ToplocProofClaim,
+    ) -> list[Any]:
+        response = _post_json(
+            f"{self._reference_node_url}/v1/audit/toploc",
+            {
+                "model": model,
+                "messages": messages,
+                "claimed_token_ids": claimed_token_ids,
+                "dtype": claim.dtype,
+                "quantization": claim.quantization,
+                "decode_batching_size": claim.decode_batching_size,
+                "topk": claim.topk,
+                "skip_prefill": claim.skip_prefill,
+            },
+        )
+        activations = response.get("activations")
+        if not isinstance(activations, list):
+            raise ValueError("reference node audit response did not contain activations")
+        return activations
+
+    def _run_teacher_forced_prefill_hops(
+        self,
+        *,
+        model: str,
+        messages: list[dict],
+        hop_commitments: list["_HopCommitment"],
+    ) -> list[list[Any]]:
+        """Teacher-force the claimed tokens once and collect reference
+        activations at every hop's boundary layer (ADR-0018 §4 / research §1.2:
+        one referee forward pass, compared at each cut-point)."""
+        reference_claim = hop_commitments[0].claim
+        response = _post_json(
+            f"{self._reference_node_url}/v1/audit/toploc",
+            {
+                "model": model,
+                "messages": messages,
+                "claimed_token_ids": hop_commitments[-1].token_ids,
+                "hop_boundaries": [hop.shard_end for hop in hop_commitments],
+                "dtype": reference_claim.dtype,
+                "quantization": reference_claim.quantization,
+                "decode_batching_size": reference_claim.decode_batching_size,
+                "topk": reference_claim.topk,
+                "skip_prefill": reference_claim.skip_prefill,
+            },
+        )
+        activations_by_hop = response.get("activations_by_hop")
+        if not isinstance(activations_by_hop, list) or len(activations_by_hop) != len(hop_commitments):
+            raise ValueError("reference node audit response did not contain per-hop activations")
+        return activations_by_hop
+
+    def _record_clean_audit(self, event: Any) -> None:
+        """ADR-0018 §6: reputation derives only from tracker-verified audit
+        outcomes — a clean audit credits every node on the verified route."""
+        for wallet_address in _route_wallets(event):
+            if self._contracts.registry.get_wallet(wallet_address).banned:
+                continue
+            self._contracts.registry.record_audit_outcome(wallet_address, passed=True)
+
+    def _slash_node(
+        self,
+        node: dict | None,
         observed_output: str,
         reference_output: str,
+        *,
+        reason: str = "reference output diverged",
     ) -> list[Any]:
         receipts: list[Any] = []
-        node = _final_text_node(route_nodes)
         wallet_address = node.get("wallet_address") if node else None
         if not wallet_address:
             return receipts
@@ -117,11 +352,14 @@ class ValidatorProcess:
             slash_amount=self._slash_amount,
             strike_threshold=self._strike_threshold,
             reason=(
-                "reference output diverged "
+                f"{reason} "
                 f"(observed={observed_output!r}, reference={reference_output!r})"
             ),
             webhook_url=self._webhook_url,
         ))
+        # ADR-0018 §6: reputation loss is separate from the strike/ban that
+        # submit_slash_proof already recorded above — never double-strike.
+        self._contracts.registry.record_audit_outcome(wallet_address, passed=False)
         # ADR-0015: the pending balance is the collateral — forfeit it in the
         # same validation cycle as the strike.
         if self._billing is not None:
@@ -134,12 +372,149 @@ class ValidatorProcess:
         return receipts
 
 
+def _route_wallets(event: Any) -> list[str]:
+    """Unique wallet addresses across a route, in hop order."""
+    route_nodes = _event_value(event, "route_nodes") or []
+    seen: set[str] = set()
+    wallets: list[str] = []
+    for node in route_nodes:
+        wallet_address = node.get("wallet_address") if isinstance(node, dict) else None
+        if wallet_address and wallet_address not in seen:
+            seen.add(wallet_address)
+            wallets.append(wallet_address)
+    return wallets
+
+
 def _final_text_node(route_nodes: list[dict]) -> dict | None:
+    """Text-only fallback blame: when the audit has no per-hop fingerprints
+    to bisect (free-running text comparison only), guess the last hop.
+    Never used once hop-boundary commitments make real bisection possible."""
     if not route_nodes:
         return None
     return max(route_nodes, key=lambda node: int(node.get("shard_end", 0)))
 
 
+class _AuditResult:
+    def __init__(
+        self,
+        *,
+        ok: bool,
+        reference_output: str,
+        reason: str,
+        culprit_node: dict | None = None,
+    ) -> None:
+        self.ok = ok
+        self.reference_output = reference_output
+        self.reason = reason
+        self.culprit_node = culprit_node
+
+
+class _HopCommitment:
+    """One hop's on-demand TOPLOC commitment plus the route node it blames."""
+
+    def __init__(self, node: dict | None, claim: ToplocProofClaim, token_ids: list[int]) -> None:
+        self.node = node
+        self.claim = claim
+        self.token_ids = token_ids
+        self.shard_end = int(node.get("shard_end", 0)) if node else None
+
+
+def _hop_commitments_from_event(event: Any) -> list[_HopCommitment] | None:
+    """Per-hop bisection commitments (ADR-0018 §3/§4): each route node reports
+    its own output-boundary fingerprint. Falls back to the AH-006 whole-route
+    commitment format (one fingerprint, no bisection) when hops don't carry
+    individual commitments."""
+    route_nodes = _event_value(event, "route_nodes") or []
+    per_hop_nodes = [
+        node for node in route_nodes
+        if isinstance(node, dict) and _mapping_value(node, "toploc_proof") is not None
+    ]
+    if per_hop_nodes and len(per_hop_nodes) == len(route_nodes):
+        ordered = sorted(route_nodes, key=lambda node: int(node.get("shard_start", 0)))
+        default_token_ids = _event_value(event, "claimed_token_ids")
+        commitments = []
+        for node in ordered:
+            token_ids = node.get("claimed_token_ids", default_token_ids)
+            if not isinstance(token_ids, list) or not all(isinstance(t, int) for t in token_ids):
+                raise ValueError("TOPLOC hop commitments must include claimed_token_ids")
+            commitments.append(_HopCommitment(
+                node,
+                ToplocProofClaim.from_mapping(node["toploc_proof"]),
+                token_ids,
+            ))
+        return commitments
+
+    whole_route = _toploc_audit_from_event(event)
+    if whole_route is None:
+        return None
+    token_ids, claim = whole_route
+    return [_HopCommitment(route_nodes[-1] if route_nodes else None, claim, token_ids)]
+
+
+def _first_divergent_hop(
+    hop_commitments: list[_HopCommitment],
+    reference_activations_by_hop: list[Any],
+    *,
+    config: ToplocAuditConfig,
+    backend: Any | None,
+) -> int | None:
+    """First hop whose committed output fingerprint diverges from the
+    referee's independently-computed reference activations at that same
+    cut-point (research §1.2: no interactive game needed at hop granularity —
+    the referee checks every cut-point in one replay)."""
+    for index, commitment in enumerate(hop_commitments):
+        ok = verify_activation_proofs(
+            reference_activations_by_hop[index],
+            commitment.claim,
+            config=config,
+            backend=backend,
+        )
+        if not ok:
+            return index
+    return None
+
+
+def _toploc_audit_from_event(event: Any) -> tuple[list[int], ToplocProofClaim] | None:
+    audit = _event_mapping(event, "audit")
+    claim_data = (
+        _event_mapping(event, "toploc_proof")
+        or _event_mapping(event, "activation_proof")
+        or _mapping_value(audit, "toploc_proof")
+        or _mapping_value(audit, "activation_proof")
+        or _mapping_value(audit, "toploc")
+    )
+    if claim_data is None:
+        return None
+    token_ids = (
+        _event_value(event, "claimed_token_ids")
+        or _event_value(event, "output_token_ids")
+        or _mapping_value(audit, "claimed_token_ids")
+        or _mapping_value(audit, "output_token_ids")
+    )
+    if not isinstance(token_ids, list) or not all(isinstance(token, int) for token in token_ids):
+        raise ValueError("TOPLOC audit events must include claimed_token_ids")
+    return token_ids, ToplocProofClaim.from_mapping(claim_data)
+
+
+def _event_value(event: Any, name: str) -> Any:
+    if hasattr(event, name):
+        return getattr(event, name)
+    if isinstance(event, dict):
+        return event.get(name)
+    return None
+
+
+def _event_mapping(event: Any, name: str) -> dict[str, Any] | None:
+    value = _event_value(event, name)
+    return value if isinstance(value, dict) else None
+
+
+def _mapping_value(mapping: dict[str, Any] | None, name: str) -> Any:
+    if mapping is None:
+        return None
+    return mapping.get(name)
+
+
 def _outputs_match(observed: str, reference: str, tolerance: float) -> bool:
     observed_float = _parse_float(observed)
     reference_float = _parse_float(reference)
@@ -167,4 +542,11 @@ def _post_json(url: str, payload: dict, timeout: float = 5.0) -> dict:
         return json.loads(response.read())
 
 
-__all__ = ["ValidatorProcess"]
+__all__ = [
+    "ToplocAuditConfig",
+    "ToplocProofClaim",
+    "ValidatorProcess",
+    "AdaptiveAuditSampler",
+    "AuditRateConfig",
+    "detect_output_tripwire",
+]

packages/validator/meshnet_validator/audit.py

@@ -0,0 +1,236 @@
+"""TOPLOC activation proof helpers for validator-side audits."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from importlib import import_module
+from typing import Any, Literal
+
+
+ProofEncoding = Literal["base64", "bytes"]
+
+
+@dataclass(frozen=True)
+class ToplocAuditConfig:
+    """Canonical audit parameters for one model preset."""
+
+    dtype: str = "bfloat16"
+    quantization: str = "bfloat16"
+    decode_batching_size: int = 32
+    topk: int = 8
+    skip_prefill: bool = True
+    encoding: ProofEncoding = "base64"
+    # ADR-0018 §3: nodes retain boundary activations only briefly; a commitment
+    # older than this can no longer be verified against a live node and must
+    # fall back to the text-only audit path.
+    commitment_ttl_seconds: float = 30.0
+
+
+@dataclass(frozen=True)
+class ToplocProofClaim:
+    """Prover-provided TOPLOC proof and the parameters it was built with."""
+
+    proofs: Any
+    dtype: str
+    quantization: str
+    decode_batching_size: int
+    topk: int
+    skip_prefill: bool = True
+    encoding: ProofEncoding = "base64"
+
+    @classmethod
+    def from_mapping(cls, value: dict[str, Any]) -> "ToplocProofClaim":
+        return cls(
+            proofs=value["proofs"],
+            dtype=str(value.get("dtype", "bfloat16")),
+            quantization=str(value.get("quantization", "bfloat16")),
+            decode_batching_size=int(value.get("decode_batching_size", 32)),
+            topk=int(value.get("topk", 8)),
+            skip_prefill=bool(value.get("skip_prefill", True)),
+            encoding=_proof_encoding(value.get("encoding", "base64")),
+        )
+
+    def as_mapping(self) -> dict[str, Any]:
+        return {
+            "proofs": self.proofs,
+            "dtype": self.dtype,
+            "quantization": self.quantization,
+            "decode_batching_size": self.decode_batching_size,
+            "topk": self.topk,
+            "skip_prefill": self.skip_prefill,
+            "encoding": self.encoding,
+        }
+
+
+def build_activation_proofs(
+    activations: list[Any],
+    *,
+    config: ToplocAuditConfig | None = None,
+    backend: Any | None = None,
+) -> ToplocProofClaim:
+    """Build a TOPLOC proof claim from captured activation tensors."""
+    cfg = config or ToplocAuditConfig()
+    module = backend or _load_toploc()
+    function_name = f"build_proofs_{cfg.encoding}"
+    build = getattr(module, function_name)
+    proofs = _call_toploc(
+        build,
+        activations,
+        decode_batching_size=cfg.decode_batching_size,
+        topk=cfg.topk,
+        skip_prefill=cfg.skip_prefill,
+    )
+    return ToplocProofClaim(
+        proofs=proofs,
+        dtype=cfg.dtype,
+        quantization=cfg.quantization,
+        decode_batching_size=cfg.decode_batching_size,
+        topk=cfg.topk,
+        skip_prefill=cfg.skip_prefill,
+        encoding=cfg.encoding,
+    )
+
+
+@dataclass(frozen=True)
+class ToplocVerificationResult:
+    """Verification outcome plus the raw TOPLOC divergence metric.
+
+    The `toploc` library's `verify_proofs_*` returns a bool for simple
+    prover/verifier config mismatches, but for a real activation comparison
+    it returns one `VerificationResult(exp_intersections, mant_err_mean,
+    mant_err_median)` per chunk (README §"What it actually is"). Historically
+    only `bool(result)` was kept, which is always true for a non-empty list
+    of results regardless of how divergent they are (AH-021 gap #1). This
+    dataclass surfaces the raw per-chunk metrics (aggregated: worst-case
+    `exp_intersections`, mean `mant_err_mean`/`mant_err_median`) so a
+    calibration corpus can be built before any threshold is trusted.
+    """
+
+    passed: bool
+    exp_intersections: float | None = None
+    mant_err_mean: float | None = None
+    mant_err_median: float | None = None
+    chunk_count: int = 0
+
+
+def verify_activation_proofs(
+    reference_activations: list[Any],
+    claim: ToplocProofClaim,
+    *,
+    config: ToplocAuditConfig | None = None,
+    backend: Any | None = None,
+) -> bool:
+    """Verify prover TOPLOC proofs against reference teacher-forced activations."""
+    return verify_activation_proofs_detailed(
+        reference_activations, claim, config=config, backend=backend,
+    ).passed
+
+
+def verify_activation_proofs_detailed(
+    reference_activations: list[Any],
+    claim: ToplocProofClaim,
+    *,
+    config: ToplocAuditConfig | None = None,
+    backend: Any | None = None,
+) -> ToplocVerificationResult:
+    """Verify prover TOPLOC proofs and surface the raw divergence metric.
+
+    Same pass/fail contract as `verify_activation_proofs` (kept as a thin
+    wrapper for existing call sites); this is the entry point for anything
+    that needs the underlying distance value, e.g. the AH-021 honest-noise
+    calibration corpus.
+    """
+    cfg = config or ToplocAuditConfig(
+        dtype=claim.dtype,
+        quantization=claim.quantization,
+        decode_batching_size=claim.decode_batching_size,
+        topk=claim.topk,
+        skip_prefill=claim.skip_prefill,
+        encoding=claim.encoding,
+    )
+    if claim.dtype != cfg.dtype or claim.quantization != cfg.quantization:
+        return ToplocVerificationResult(passed=False)
+    if claim.decode_batching_size != cfg.decode_batching_size or claim.topk != cfg.topk:
+        return ToplocVerificationResult(passed=False)
+    if claim.skip_prefill != cfg.skip_prefill or claim.encoding != cfg.encoding:
+        return ToplocVerificationResult(passed=False)
+
+    module = backend or _load_toploc()
+    function_name = f"verify_proofs_{claim.encoding}"
+    verify = getattr(module, function_name)
+    raw = _call_toploc(
+        verify,
+        reference_activations,
+        claim.proofs,
+        decode_batching_size=claim.decode_batching_size,
+        topk=claim.topk,
+        skip_prefill=claim.skip_prefill,
+    )
+    divergence = _extract_divergence(raw)
+    return ToplocVerificationResult(passed=bool(raw), **divergence)
+
+
+def _extract_divergence(raw: Any) -> dict[str, Any]:
+    """Aggregate per-chunk TOPLOC `VerificationResult`s, if present.
+
+    `raw` is a plain bool for the simple fake backends used in existing unit
+    tests (no per-chunk metric available). The real `toploc` library returns
+    a list of per-chunk results; `exp_intersections` is aggregated by min
+    (worst honest-noise case across chunks) and the mantissa errors by mean.
+    """
+    chunks = raw if isinstance(raw, (list, tuple)) else None
+    if not chunks:
+        return {"exp_intersections": None, "mant_err_mean": None, "mant_err_median": None, "chunk_count": 0}
+    exp_vals = [v for v in (_chunk_field(c, "exp_intersections") for c in chunks) if v is not None]
+    mean_vals = [v for v in (_chunk_field(c, "mant_err_mean") for c in chunks) if v is not None]
+    median_vals = [v for v in (_chunk_field(c, "mant_err_median") for c in chunks) if v is not None]
+    return {
+        "exp_intersections": min(exp_vals) if exp_vals else None,
+        "mant_err_mean": (sum(mean_vals) / len(mean_vals)) if mean_vals else None,
+        "mant_err_median": (sum(median_vals) / len(median_vals)) if median_vals else None,
+        "chunk_count": len(chunks),
+    }
+
+
+def _chunk_field(chunk: Any, name: str) -> float | None:
+    value = chunk.get(name) if isinstance(chunk, dict) else getattr(chunk, name, None)
+    return float(value) if isinstance(value, (int, float)) else None
+
+
+def _load_toploc() -> Any:
+    try:
+        return import_module("toploc")
+    except ModuleNotFoundError as exc:
+        raise RuntimeError(
+            "toploc is required for activation proof audits; install meshnet-validator with dependencies"
+        ) from exc
+
+
+def _call_toploc(function: Any, activations: list[Any], *args: Any, **kwargs: Any) -> Any:
+    try:
+        return function(activations, *args, **kwargs)
+    except TypeError:
+        if kwargs:
+            ordered = [
+                kwargs["decode_batching_size"],
+                kwargs["topk"],
+                kwargs["skip_prefill"],
+            ]
+            return function(activations, *args, *ordered)
+        raise
+
+
+def _proof_encoding(value: object) -> ProofEncoding:
+    if value == "bytes":
+        return "bytes"
+    return "base64"
+
+
+__all__ = [
+    "ToplocAuditConfig",
+    "ToplocProofClaim",
+    "ToplocVerificationResult",
+    "build_activation_proofs",
+    "verify_activation_proofs",
+    "verify_activation_proofs_detailed",
+]

packages/validator/meshnet_validator/sampling.py

@@ -0,0 +1,105 @@
+"""Reputation-weighted, budget-balanced audit sampling (ADR-0018 §1, §6-7).
+
+The flat ``sample_rate`` on ``ValidatorProcess`` treats every wallet the same.
+This module scores each wallet's audit probability from its tenure
+(``completed_job_count``) and reputation -- newcomers and low-reputation
+wallets get sampled far more than veterans in good standing, who float down
+to a floor -- while a running budget balance keeps the *realized* fleet-wide
+average anchored to a configured target even as the wallet population mix
+drifts (research §6, §8 layers 2-4).
+"""
+
+from __future__ import annotations
+
+import random
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True)
+class AuditRateConfig:
+    """Tunable audit-rate policy. Defaults match ADR-0018 §1/§6."""
+
+    target_rate: float = 0.05
+    newcomer_rate: float = 0.25
+    veteran_floor: float = 0.02
+    probation_jobs: int = 50
+    veteran_jobs: int = 500
+    tripwire_multiplier: float = 3.0
+    # Bounds the correction the budget balancer can apply in one step so a
+    # short burst of skewed traffic can't swing everyone's rate wildly.
+    max_budget_scale: float = 20.0
+
+    def __post_init__(self) -> None:
+        if not 0.0 <= self.target_rate <= 1.0:
+            raise ValueError("target_rate must be between 0 and 1")
+        if not 0.0 <= self.veteran_floor <= self.newcomer_rate <= 1.0:
+            raise ValueError("veteran_floor must be <= newcomer_rate, both within [0, 1]")
+        if self.probation_jobs < 0 or self.veteran_jobs <= self.probation_jobs:
+            raise ValueError("veteran_jobs must be greater than probation_jobs")
+        if self.tripwire_multiplier < 1.0:
+            raise ValueError("tripwire_multiplier must be >= 1.0")
+
+
+class AdaptiveAuditSampler:
+    """Per-wallet audit probability + fleet-wide budget balancer.
+
+    ``wallet_base_rate`` scores tenure and reputation into a rate between
+    ``veteran_floor`` and ``newcomer_rate``. ``should_audit`` scales that rate
+    by a running budget-balance factor (target_rate / historical mean base
+    rate) so the fleet-wide realized audit rate tracks ``target_rate`` even
+    when the wallet mix is skewed toward veterans or newcomers, then applies
+    the tripwire multiplier to *that single decision only* -- a tripwire flag
+    never touches the shared budget-balance history, so it can't punish
+    other wallets' audit rate.
+    """
+
+    def __init__(self, config: AuditRateConfig | None = None, *, random_seed: int | None = None) -> None:
+        self.config = config or AuditRateConfig()
+        self._random = random.Random(random_seed)
+        self._base_rate_total = 0.0
+        self._decisions = 0
+
+    def wallet_base_rate(self, *, completed_job_count: int, reputation: float) -> float:
+        cfg = self.config
+        if completed_job_count <= cfg.probation_jobs:
+            tenure_rate = cfg.newcomer_rate
+        elif completed_job_count >= cfg.veteran_jobs:
+            tenure_rate = cfg.veteran_floor
+        else:
+            span = cfg.veteran_jobs - cfg.probation_jobs
+            frac = (completed_job_count - cfg.probation_jobs) / span
+            tenure_rate = cfg.newcomer_rate + (cfg.veteran_floor - cfg.newcomer_rate) * frac
+
+        reputation_gap = max(0.0, min(1.0, 1.0 - reputation))
+        reputation_rate = cfg.veteran_floor + reputation_gap * (cfg.newcomer_rate - cfg.veteran_floor)
+
+        return max(tenure_rate, reputation_rate, cfg.veteran_floor)
+
+    def sample_rate_for(self, *, completed_job_count: int, reputation: float, tripwire: bool = False) -> float:
+        """Preview the effective audit probability without recording a decision."""
+        base_rate = self.wallet_base_rate(completed_job_count=completed_job_count, reputation=reputation)
+        return self._effective_rate(base_rate, tripwire=tripwire)
+
+    def should_audit(self, *, completed_job_count: int, reputation: float, tripwire: bool = False) -> bool:
+        base_rate = self.wallet_base_rate(completed_job_count=completed_job_count, reputation=reputation)
+        effective_rate = self._effective_rate(base_rate, tripwire=tripwire)
+        self._base_rate_total += base_rate
+        self._decisions += 1
+        return self._random.random() < effective_rate
+
+    def _effective_rate(self, base_rate: float, *, tripwire: bool) -> float:
+        rate = base_rate * self._budget_scale()
+        if tripwire:
+            rate *= self.config.tripwire_multiplier
+        return max(self.config.veteran_floor, min(1.0, rate))
+
+    def _budget_scale(self) -> float:
+        if self._decisions == 0:
+            return 1.0
+        mean_base_rate = self._base_rate_total / self._decisions
+        if mean_base_rate <= 0:
+            return 1.0
+        return min(self.config.max_budget_scale, self.config.target_rate / mean_base_rate)
+
+
+__all__ = ["AuditRateConfig", "AdaptiveAuditSampler"]

packages/validator/meshnet_validator/tripwire.py

@@ -0,0 +1,36 @@
+"""Passive output-quality tripwires (ADR-0018 §7).
+
+Cheap heuristics over every completed request's text -- no model access, no
+extra inference -- that flag likely-degenerate output (repetition loops,
+truncation) so ``AdaptiveAuditSampler`` can bump that single request's audit
+probability. A flag never strikes or bans a wallet by itself; it only raises
+the odds that request gets a real audit (research §8 layer 5).
+
+True perplexity scoring needs the serving model's logits, which the validator
+does not have outside an audit call, so it stays roadmap-only (ADR-0018 §8);
+this covers the repetition/truncation half of the passive-tripwire layer.
+"""
+
+from __future__ import annotations
+
+
+def detect_output_tripwire(
+    text: str,
+    *,
+    min_words: int = 4,
+    repetition_threshold: float = 0.4,
+) -> bool:
+    """Flag empty output or a single word/token dominating the response."""
+    if not text or not text.strip():
+        return True
+    words = text.split()
+    if len(words) < min_words:
+        return False
+    counts: dict[str, int] = {}
+    for word in words:
+        counts[word] = counts.get(word, 0) + 1
+    most_common = max(counts.values())
+    return (most_common / len(words)) >= repetition_threshold
+
+
+__all__ = ["detect_output_tripwire"]

packages/validator/pyproject.toml

@@ -7,6 +7,9 @@ name = "meshnet-validator"
 version = "0.1.0"
 description = "Optimistic fraud validator for the Distributed Inference Network"
 requires-python = ">=3.10"
+dependencies = [
+    "toploc>=0.1",
+]
 
 [tool.setuptools.packages.find]
 include = ["meshnet_validator*"]

pyproject.toml

@@ -9,7 +9,7 @@ description = "Distributed Inference Network monorepo root"
 requires-python = ">=3.10"
 
 [project.optional-dependencies]
-dev = ["pytest>=8", "openai>=1", "langchain-openai>=0.1"]
+dev = ["pytest>=8", "openai>=1", "langchain-openai>=0.1", "cryptography>=41"]
 
 [tool.setuptools]
 packages = []

tests/test_accounts.py

@@ -124,8 +124,8 @@ def _call(url, method="GET", body=None, token=None):
 
 
 @pytest.fixture
-def account_tracker():
+def account_tracker():
-    ledger = BillingLedger(starting_credit=0.5, default_price_per_1k=0.02)
+    ledger = BillingLedger(starting_credit=0.0, default_price_per_1k=0.02)
     tracker = TrackerServer(billing=ledger, accounts=AccountStore(), hive_secret=HIVE_SECRET)
     port = tracker.start()
     yield f"http://127.0.0.1:{port}", ledger
@@ -145,8 +145,7 @@ def test_register_login_and_account_view(account_tracker):
     me = _call(f"{url}/v1/account", token=login["session_token"])
     assert me["account"]["email"] == "admin@example.com"
     assert me["api_keys"] == [reg["api_key"]]
-    # registration granted Caller Credit on the ledger
+    assert me["total_balance"] == pytest.approx(0.0)
-    assert me["total_balance"] == pytest.approx(0.5)
     assert me["usage"]["requests"] == 0
 
 

tests/test_adaptive_audit_sampling.py

@@ -0,0 +1,193 @@
+"""AH-009 (FRAUD: reputation-weighted routing + adaptive audit rate).
+
+Covers the audit-sampling half of the issue: per-wallet audit probability as
+a function of tenure/reputation, a fleet-wide budget balancer that keeps the
+realized audit rate anchored to a configured target, and passive tripwire
+escalation (ADR-0018 §1, §6-7).
+"""
+
+import random
+
+import pytest
+
+from meshnet_contracts import LocalSolanaContracts
+from meshnet_node.server import StubNodeServer
+from meshnet_validator import AdaptiveAuditSampler, AuditRateConfig, ValidatorProcess, detect_output_tripwire
+
+MODEL = "stub-model"
+
+
+# ---- per-wallet base rate: newcomer high, veteran low, floor >= 2% ----
+
+
+def test_newcomer_gets_elevated_audit_rate():
+    sampler = AdaptiveAuditSampler()
+    rate = sampler.wallet_base_rate(completed_job_count=0, reputation=1.0)
+    assert 0.20 <= rate <= 0.30
+
+
+def test_veteran_in_good_standing_floors_near_target():
+    sampler = AdaptiveAuditSampler()
+    rate = sampler.wallet_base_rate(completed_job_count=1000, reputation=1.0)
+    assert rate == pytest.approx(0.02)
+
+
+def test_veteran_rate_never_drops_below_floor():
+    sampler = AdaptiveAuditSampler(AuditRateConfig(veteran_floor=0.02))
+    rate = sampler.wallet_base_rate(completed_job_count=10_000, reputation=1.0)
+    assert rate >= 0.02
+
+
+def test_low_reputation_wallet_sampled_more_than_high_reputation_wallet():
+    """Red (test-first item 1): a uniform sampler ignores reputation. A
+    low-reputation wallet must get a higher rate than a high-reputation one
+    with the same tenure."""
+    sampler = AdaptiveAuditSampler()
+    low_rep_rate = sampler.sample_rate_for(completed_job_count=200, reputation=0.1)
+    high_rep_rate = sampler.sample_rate_for(completed_job_count=200, reputation=1.0)
+    assert low_rep_rate > high_rep_rate
+
+
+def test_low_reputation_escalates_even_for_a_tenured_wallet():
+    sampler = AdaptiveAuditSampler()
+    rate = sampler.wallet_base_rate(completed_job_count=1000, reputation=0.0)
+    assert rate == pytest.approx(sampler.config.newcomer_rate)
+
+
+# ---- fleet-wide budget balance ----
+
+
+def test_fleet_wide_audit_rate_tracks_configured_target_within_one_point():
+    """Test-first item 2: over >=1000 requests with a fixed seed and a mixed
+    wallet population, the measured fleet audit rate lands within +-1.0
+    percentage point of the configured 5% target."""
+    sampler = AdaptiveAuditSampler(random_seed=1234)
+    rng = random.Random(99)
+
+    audited = 0
+    total = 6000
+    for _ in range(total):
+        roll = rng.random()
+        if roll < 0.7:
+            wallet = dict(completed_job_count=800, reputation=1.0)  # veteran
+        elif roll < 0.9:
+            wallet = dict(completed_job_count=150, reputation=0.9)  # mid-tenure
+        else:
+            wallet = dict(completed_job_count=0, reputation=1.0)  # newcomer
+        if sampler.should_audit(**wallet):
+            audited += 1
+
+    measured_rate = audited / total
+    assert abs(measured_rate - sampler.config.target_rate) <= 0.01
+
+
+def test_fleet_wide_audit_rate_respects_custom_target():
+    sampler = AdaptiveAuditSampler(AuditRateConfig(target_rate=0.10), random_seed=42)
+    audited = sum(
+        1
+        for _ in range(2000)
+        if sampler.should_audit(completed_job_count=800, reputation=1.0)
+    )
+    measured_rate = audited / 2000
+    assert abs(measured_rate - 0.10) <= 0.01
+
+
+def test_sampling_is_deterministic_for_a_fixed_seed():
+    sampler_a = AdaptiveAuditSampler(random_seed=7)
+    sampler_b = AdaptiveAuditSampler(random_seed=7)
+    decisions_a = [sampler_a.should_audit(completed_job_count=0, reputation=1.0) for _ in range(200)]
+    decisions_b = [sampler_b.should_audit(completed_job_count=0, reputation=1.0) for _ in range(200)]
+    assert decisions_a == decisions_b
+
+
+# ---- passive tripwires bump rate only ----
+
+
+def test_tripwire_flag_bumps_audit_rate_for_that_wallet():
+    sampler = AdaptiveAuditSampler()
+    normal_rate = sampler.sample_rate_for(completed_job_count=800, reputation=1.0, tripwire=False)
+    flagged_rate = sampler.sample_rate_for(completed_job_count=800, reputation=1.0, tripwire=True)
+    assert flagged_rate > normal_rate
+
+
+def test_tripwire_does_not_change_other_wallets_rate():
+    """A tripwire hit must never leak the multiplier into the shared
+    budget-balance history -- only the wallet's un-boosted base rate is
+    recorded, so a flagged decision affects the running budget scale exactly
+    like a plain decision for the same wallet would, and never inflates or
+    depresses everyone else's rate on top of that."""
+    flagged = AdaptiveAuditSampler(random_seed=5)
+    flagged.should_audit(completed_job_count=800, reputation=1.0, tripwire=True)
+
+    plain = AdaptiveAuditSampler(random_seed=5)
+    plain.should_audit(completed_job_count=800, reputation=1.0, tripwire=False)
+
+    after_flagged = flagged.sample_rate_for(completed_job_count=800, reputation=1.0)
+    after_plain = plain.sample_rate_for(completed_job_count=800, reputation=1.0)
+    assert after_flagged == pytest.approx(after_plain)
+
+
+def test_detect_output_tripwire_flags_repetition_loop():
+    degenerate = " ".join(["loop"] * 20)
+    assert detect_output_tripwire(degenerate) is True
+
+
+def test_detect_output_tripwire_flags_empty_output():
+    assert detect_output_tripwire("") is True
+
+
+def test_detect_output_tripwire_passes_normal_prose():
+    normal = "The quick brown fox jumps over the lazy dog near the riverbank."
+    assert detect_output_tripwire(normal) is False
+
+
+# ---- ValidatorProcess wiring: reputation-weighted sampling end to end ----
+
+
+@pytest.fixture
+def reference_node():
+    node = StubNodeServer(shard_start=0, shard_end=31, is_last_shard=True)
+    port = node.start()
+    yield f"http://127.0.0.1:{port}"
+    node.stop()
+
+
+def _record_event(contracts, session_id: str, wallet: str) -> None:
+    contracts.validation.record_completed_inference(
+        session_id=session_id,
+        model=MODEL,
+        messages=[{"role": "user", "content": "2+2"}],
+        observed_output="4",
+        route_nodes=[{"wallet_address": wallet, "shard_end": 31}],
+    )
+
+
+def test_validator_uses_audit_sampler_when_configured(reference_node):
+    """A flagged low-reputation wallet gets audited far more often than a
+    veteran in good standing when routed through the same validator."""
+    contracts = LocalSolanaContracts()
+    contracts.registry.record_completed_jobs("wallet-veteran", 800)
+    for _ in range(9):
+        contracts.registry.record_audit_outcome("wallet-shady", passed=False)  # reputation -> 0.0
+
+    trials = 400
+    shady_audits = 0
+    veteran_audits = 0
+    for i in range(trials):
+        sampler = AdaptiveAuditSampler(random_seed=i)
+        validator = ValidatorProcess(
+            contracts=contracts,
+            reference_node_url=reference_node,
+            audit_sampler=sampler,
+            random_seed=i,
+        )
+        shady_audits += int(validator._should_sample(_FakeEvent("wallet-shady")))
+        veteran_audits += int(validator._should_sample(_FakeEvent("wallet-veteran")))
+
+    assert shady_audits > veteran_audits
+
+
+class _FakeEvent:
+    def __init__(self, wallet: str) -> None:
+        self.route_nodes = [{"wallet_address": wallet, "shard_end": 31}]
+        self.observed_output = "4"

tests/test_billing_ledger.py

@@ -1,8 +1,8 @@
 """US-031: billing ledger — per-token pricing, 90/10 split, pending balances.
 
 Unit tests for BillingLedger math/persistence/replication, plus HTTP
-integration: 401 without an API key, billed 200 with one, 402 once the
+integration: 401 without an API key, 402 for unfunded keys, billed 200 after
-Caller Credit is exhausted (rejected before routing — no free work).
+explicit credit, and 402 once the balance is exhausted.
 """
 
 import http.server
@@ -15,8 +15,15 @@ import urllib.request
 import pytest
 
 from meshnet_tracker.auth import sign_hive_request
-from meshnet_tracker.billing import BillingLedger
+from meshnet_tracker.billing import DEFAULT_STARTING_CREDIT, BillingLedger
-from meshnet_tracker.server import TrackerServer
+from meshnet_tracker.server import (
+    TrackerServer,
+    _billable_non_stream_tokens,
+    _billable_stream_tokens,
+    _estimate_prompt_tokens,
+    _observed_non_stream_completion_tokens,
+    _observed_stream_tokens,
+)
 
 MODEL = "openai-community/gpt2"
 HIVE_SECRET = "test-hive-secret"
@@ -35,6 +42,16 @@ def test_charge_single_node_gets_90_percent():
     assert ledger.snapshot()["protocol_cut"] == pytest.approx(0.02 * 0.10)
 
 
+def test_default_starting_credit_is_zero_and_fresh_key_is_unfunded():
+    ledger = BillingLedger(default_price_per_1k=0.02)
+
+    assert DEFAULT_STARTING_CREDIT == 0.0
+    assert ledger.ensure_client("fresh-key") == pytest.approx(0.0)
+    assert ledger.get_client_balance("fresh-key") == pytest.approx(0.0)
+    assert ledger.has_funds("fresh-key") is False
+    assert ledger.events_since(0)[0] == []
+
+
 def test_charge_three_node_split_by_work_units():
     ledger = BillingLedger(starting_credit=1.0, default_price_per_1k=0.02)
     ledger.ensure_client("key-a")
@@ -75,6 +92,36 @@ def test_per_model_price_override():
     assert event["cost"] == pytest.approx(0.02 * 500 / 1000)
 
 
+def test_non_stream_billable_tokens_cap_usage_by_request_bound():
+    payload = {"usage": {"total_tokens": 1_000_000}}
+    request = {"messages": [{"role": "user", "content": "hello tracker"}], "max_tokens": 3}
+
+    assert _estimate_prompt_tokens(request) == 2
+    assert _billable_non_stream_tokens(payload, request) == 5
+
+
+def test_non_stream_billable_tokens_fallback_when_usage_missing():
+    payload = {"choices": [{"message": {"role": "assistant", "content": "ok now"}}]}
+    request = {"messages": [{"role": "user", "content": "hello tracker"}], "max_tokens": 10}
+
+    assert _observed_non_stream_completion_tokens(payload) == 2
+    assert _billable_non_stream_tokens(payload, request) == 4
+
+
+def test_stream_billable_tokens_allow_usage_to_lower_observed_count_only():
+    observed_payload = {
+        "choices": [{
+            "index": 0,
+            "delta": {"content": "hello tracker"},
+            "finish_reason": None,
+        }]
+    }
+
+    assert _observed_stream_tokens(observed_payload) == 2
+    assert _billable_stream_tokens(observed_tokens=2, reported_tokens=1_000_000) == 2
+    assert _billable_stream_tokens(observed_tokens=2, reported_tokens=1) == 1
+
+
 def test_payout_and_forfeit_hooks():
     ledger = BillingLedger(starting_credit=1.0, default_price_per_1k=0.02)
     ledger.charge_request("key-a", MODEL, 1000, [("wallet-1", 1)])
@@ -155,8 +202,17 @@ def test_event_replication_converges_and_dedupes():
 class _UsageStubNode:
     """Minimal head node returning a chat completion with real usage numbers."""
 
-    def __init__(self, total_tokens: int = 1000):
+    def __init__(
+        self,
+        total_tokens: int = 1000,
+        *,
+        stream_chunks: list[str] | None = None,
+        stream_usage_total: int | None = None,
+    ):
         self.total_tokens = total_tokens
+        self.stream_chunks = stream_chunks or []
+        self.stream_usage_total = stream_usage_total
+        self.request_count = 0
         outer = self
 
         class Handler(http.server.BaseHTTPRequestHandler):
@@ -164,8 +220,44 @@ class _UsageStubNode:
                 pass
 
             def do_POST(self):
+                outer.request_count += 1
                 length = int(self.headers.get("Content-Length", 0))
-                self.rfile.read(length)
+                raw_body = self.rfile.read(length)
+                try:
+                    request_body = json.loads(raw_body)
+                except json.JSONDecodeError:
+                    request_body = {}
+                if request_body.get("stream"):
+                    self.send_response(200)
+                    self.send_header("Content-Type", "text/event-stream; charset=utf-8")
+                    self.end_headers()
+                    for chunk in outer.stream_chunks:
+                        payload = json.dumps({
+                            "id": "chatcmpl-stub",
+                            "object": "chat.completion.chunk",
+                            "model": MODEL,
+                            "choices": [{
+                                "index": 0,
+                                "delta": {"content": chunk},
+                                "finish_reason": None,
+                            }],
+                        }).encode()
+                        self.wfile.write(b"data: " + payload + b"\n\n")
+                    if outer.stream_usage_total is not None:
+                        usage_payload = json.dumps({
+                            "id": "chatcmpl-stub",
+                            "object": "chat.completion.chunk",
+                            "model": MODEL,
+                            "choices": [],
+                            "usage": {
+                                "prompt_tokens": 0,
+                                "completion_tokens": outer.stream_usage_total,
+                                "total_tokens": outer.stream_usage_total,
+                            },
+                        }).encode()
+                        self.wfile.write(b"data: " + usage_payload + b"\n\n")
+                    self.wfile.write(b"data: [DONE]\n\n")
+                    return
                 body = json.dumps({
                     "id": "chatcmpl-stub",
                     "object": "chat.completion",
@@ -203,7 +295,7 @@ class _UsageStubNode:
 
 @pytest.fixture
 def billed_tracker():
-    ledger = BillingLedger(starting_credit=0.03, default_price_per_1k=0.02)
+    ledger = BillingLedger(starting_credit=0.0, default_price_per_1k=0.02)
     tracker = TrackerServer(
         model_presets={
             MODEL: {
@@ -239,17 +331,19 @@ def billed_tracker():
     with urllib.request.urlopen(req) as r:
         r.read()
 
-    yield tracker_url, ledger
+    yield tracker_url, ledger, stub
 
     stub.stop()
     tracker.stop()
 
 
-def _chat(tracker_url: str, api_key: str | None):
+def _chat(tracker_url: str, api_key: str | None, **body_overrides):
-    data = json.dumps({
+    body = {
         "model": MODEL,
         "messages": [{"role": "user", "content": "hi"}],
-    }).encode()
+    }
+    body.update(body_overrides)
+    data = json.dumps(body).encode()
     headers = {"Content-Type": "application/json"}
     if api_key:
         headers["Authorization"] = f"Bearer {api_key}"
@@ -260,20 +354,32 @@ def _chat(tracker_url: str, api_key: str | None):
         method="POST",
     )
     with urllib.request.urlopen(req) as r:
+        if body.get("stream"):
+            return r.read().decode()
         return json.loads(r.read())
 
 
 def test_proxy_chat_requires_api_key_when_billing_enabled(billed_tracker):
-    tracker_url, _ = billed_tracker
+    tracker_url, _, _ = billed_tracker
     with pytest.raises(urllib.error.HTTPError) as exc_info:
         _chat(tracker_url, api_key=None)
     assert exc_info.value.code == 401
 
 
-def test_proxy_chat_bills_client_and_credits_node(billed_tracker):
+def test_proxy_chat_402_for_fresh_key_before_routing(billed_tracker):
-    tracker_url, ledger = billed_tracker
+    tracker_url, ledger, stub = billed_tracker
+    with pytest.raises(urllib.error.HTTPError) as exc_info:
+        _chat(tracker_url, api_key="fresh-client")
+    assert exc_info.value.code == 402
+    assert ledger.get_client_balance("fresh-client") == pytest.approx(0.0)
+    assert stub.request_count == 0
+
+
+def test_proxy_chat_bills_credited_client_and_credits_node(billed_tracker):
+    tracker_url, ledger, _ = billed_tracker
+    ledger.credit_client("client-1", 0.03, note="admin-credit")
     _chat(tracker_url, api_key="client-1")
-    # 1000 tokens at 0.02/1K = 0.02 USDT; starting credit 0.03
+    # 1000 tokens at 0.02/1K = 0.02 USDT; explicit credit 0.03
     assert ledger.get_client_balance("client-1") == pytest.approx(0.03 - 0.02)
     assert ledger.get_node_pending("wallet-head") == pytest.approx(0.02 * 0.90)
 
@@ -289,8 +395,128 @@ def test_proxy_chat_bills_client_and_credits_node(billed_tracker):
     assert node_stats["sample_count_last_hour"] == 1
 
 
+def test_proxy_chat_caps_inflated_non_streaming_usage_by_request_bounds(billed_tracker):
+    tracker_url, ledger, stub = billed_tracker
+    stub.total_tokens = 1_000_000
+    ledger.credit_client("bounded-client", 100.0, note="admin-credit")
+
+    _chat(tracker_url, api_key="bounded-client", max_tokens=2)
+
+    # messages=[{"content": "hi"}] has a local prompt estimate of one token, so
+    # billable total is capped at max_tokens + prompt estimate, not node usage.
+    expected_tokens = 3
+    assert ledger.get_client_balance("bounded-client") == pytest.approx(100.0 - 0.02 * expected_tokens / 1000)
+    events, _ = ledger.events_since(0)
+    charge = next(event for event in events if event["type"] == "charge")
+    assert charge["total_tokens"] == expected_tokens
+
+
+def test_proxy_chat_caps_inflated_streaming_usage_by_observed_chunks():
+    ledger = BillingLedger(starting_credit=0.0, default_price_per_1k=0.02)
+    ledger.credit_client("stream-client", 1.0, note="admin-credit")
+    tracker = TrackerServer(
+        model_presets={
+            MODEL: {
+                "layers_start": 0,
+                "layers_end": 11,
+                "bytes_per_layer": {"bfloat16": 30 * 1024 * 1024},
+            }
+        },
+        billing=ledger,
+    )
+    port = tracker.start()
+    tracker_url = f"http://127.0.0.1:{port}"
+    stub = _UsageStubNode(stream_chunks=["one", "two"], stream_usage_total=1_000_000)
+    stub_port = stub.start()
+    try:
+        reg = json.dumps({
+            "endpoint": f"http://127.0.0.1:{stub_port}",
+            "shard_start": 0,
+            "shard_end": 11,
+            "model": MODEL,
+            "hardware_profile": {},
+            "score": 1.0,
+            "tracker_mode": True,
+            "wallet_address": "wallet-head",
+        }).encode()
+        req = urllib.request.Request(
+            f"{tracker_url}/v1/nodes/register",
+            data=reg,
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        with urllib.request.urlopen(req) as r:
+            r.read()
+
+        _chat(tracker_url, api_key="stream-client", stream=True, max_tokens=2)
+
+        events, _ = ledger.events_since(0)
+        charge = next(event for event in events if event["type"] == "charge")
+        assert charge["total_tokens"] == 2
+        assert ledger.get_client_balance("stream-client") == pytest.approx(1.0 - 0.02 * 2 / 1000)
+    finally:
+        stub.stop()
+        tracker.stop()
+
+
+def test_proxy_chat_splits_payout_by_tracker_assigned_route_span():
+    ledger = BillingLedger(starting_credit=0.0, default_price_per_1k=0.02)
+    ledger.credit_client("route-client", 1.0, note="admin-credit")
+    tracker = TrackerServer(
+        model_presets={
+            MODEL: {
+                "total_layers": 12,
+                "bytes_per_layer": {"bfloat16": 1_000},
+            }
+        },
+        billing=ledger,
+    )
+    port = tracker.start()
+    tracker_url = f"http://127.0.0.1:{port}"
+    head = _UsageStubNode(total_tokens=1000)
+    head_port = head.start()
+    try:
+        for endpoint, wallet, vram, bench in (
+            (f"http://127.0.0.1:{head_port}", "wallet-head", 5_000, 2.0),
+            ("http://127.0.0.1:1", "wallet-tail", 10_000, 1.0),
+        ):
+            reg = json.dumps({
+                "endpoint": endpoint,
+                "model": MODEL,
+                "vram_bytes": vram,
+                "ram_bytes": 10_000,
+                "quantizations": ["bfloat16"],
+                "benchmark_tokens_per_sec": bench,
+                "hardware_profile": {},
+                "score": 1.0,
+                "tracker_mode": endpoint.endswith(str(head_port)),
+                "wallet_address": wallet,
+                "managed_assignment": True,
+                "shard_start": 0,
+                "shard_end": 999,
+            }).encode()
+            req = urllib.request.Request(
+                f"{tracker_url}/v1/nodes/register",
+                data=reg,
+                headers={"Content-Type": "application/json"},
+                method="POST",
+            )
+            with urllib.request.urlopen(req) as r:
+                r.read()
+
+        _chat(tracker_url, api_key="route-client", max_tokens=1000)
+
+        pool = 0.02 * 0.90
+        assert ledger.get_node_pending("wallet-head") == pytest.approx(pool * 4 / 12)
+        assert ledger.get_node_pending("wallet-tail") == pytest.approx(pool * 8 / 12)
+    finally:
+        head.stop()
+        tracker.stop()
+
+
 def test_proxy_chat_402_when_balance_exhausted(billed_tracker):
-    tracker_url, ledger = billed_tracker
+    tracker_url, ledger, _ = billed_tracker
+    ledger.credit_client("client-2", 0.03, note="admin-credit")
     _chat(tracker_url, api_key="client-2")  # 0.03 -> 0.01
     _chat(tracker_url, api_key="client-2")  # 0.01 -> -0.01 (post-pay drift)
     assert ledger.get_client_balance("client-2") == pytest.approx(-0.01)
@@ -301,8 +527,137 @@ def test_proxy_chat_402_when_balance_exhausted(billed_tracker):
     assert ledger.get_client_balance("client-2") == pytest.approx(-0.01)
 
 
+def test_proxy_chat_rejects_request_above_spend_cap_before_routing():
+    ledger = BillingLedger(starting_credit=0.0, default_price_per_1k=0.02)
+    ledger.credit_client("capped-client", 10.0, note="admin-credit")
+    tracker = TrackerServer(
+        model_presets={
+            MODEL: {
+                "layers_start": 0,
+                "layers_end": 11,
+                "bytes_per_layer": {"bfloat16": 30 * 1024 * 1024},
+            }
+        },
+        billing=ledger,
+        max_charge_per_request=0.01,
+    )
+    port = tracker.start()
+    tracker_url = f"http://127.0.0.1:{port}"
+    stub = _UsageStubNode(total_tokens=1000)
+    stub_port = stub.start()
+    try:
+        reg = json.dumps({
+            "endpoint": f"http://127.0.0.1:{stub_port}",
+            "shard_start": 0,
+            "shard_end": 11,
+            "model": MODEL,
+            "hardware_profile": {},
+            "score": 1.0,
+            "tracker_mode": True,
+            "wallet_address": "wallet-head",
+        }).encode()
+        req = urllib.request.Request(
+            f"{tracker_url}/v1/nodes/register",
+            data=reg,
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        with urllib.request.urlopen(req) as r:
+            r.read()
+
+        with pytest.raises(urllib.error.HTTPError) as exc_info:
+            _chat(
+                tracker_url,
+                api_key="capped-client",
+                messages=[{"role": "user", "content": " ".join(["prompt"] * 1000)}],
+                max_tokens=1,
+            )
+        body = json.loads(exc_info.value.read())
+        assert exc_info.value.code == 402
+        assert body["error"]["code"] == "spend_cap_exceeded"
+        assert "max_charge_per_request" in body["error"]["message"]
+        assert ledger.get_client_balance("capped-client") == pytest.approx(10.0)
+        assert stub.request_count == 0
+    finally:
+        stub.stop()
+        tracker.stop()
+
+
+def test_proxy_chat_records_validation_event_with_plain_route_metadata():
+    class FakeRegistry:
+        def get_wallet(self, wallet_address):
+            return type("Wallet", (), {"banned": False})()
+
+    class FakeValidation:
+        def __init__(self):
+            self.events = []
+
+        def record_completed_inference(self, **kwargs):
+            self.events.append(kwargs)
+            return kwargs
+
+    class FakeContracts:
+        def __init__(self):
+            self.registry = FakeRegistry()
+            self.validation = FakeValidation()
+
+    contracts = FakeContracts()
+    tracker = TrackerServer(
+        model_presets={
+            MODEL: {
+                "layers_start": 0,
+                "layers_end": 11,
+                "bytes_per_layer": {"bfloat16": 30 * 1024 * 1024},
+            }
+        },
+        contracts=contracts,
+    )
+    port = tracker.start()
+    tracker_url = f"http://127.0.0.1:{port}"
+    stub = _UsageStubNode(total_tokens=1000)
+    stub_port = stub.start()
+    try:
+        reg = json.dumps({
+            "endpoint": f"http://127.0.0.1:{stub_port}",
+            "shard_start": 0,
+            "shard_end": 11,
+            "model": MODEL,
+            "hardware_profile": {},
+            "score": 1.0,
+            "tracker_mode": True,
+            "wallet_address": "wallet-head",
+        }).encode()
+        req = urllib.request.Request(
+            f"{tracker_url}/v1/nodes/register",
+            data=reg,
+            headers={"Content-Type": "application/json"},
+            method="POST",
+        )
+        with urllib.request.urlopen(req) as r:
+            r.read()
+
+        _chat(tracker_url, api_key=None)
+
+        assert len(contracts.validation.events) == 1
+        event = contracts.validation.events[0]
+        assert event["model"] == MODEL
+        assert event["messages"] == [{"role": "user", "content": "hi"}]
+        assert event["observed_output"] == "ok"
+        assert event["route_nodes"] == [{
+            "node_id": next(iter(tracker._registry)),
+            "endpoint": f"http://127.0.0.1:{stub_port}",
+            "wallet_address": "wallet-head",
+            "shard_start": 0,
+            "shard_end": 11,
+        }]
+        assert "toploc_proof" not in event["route_nodes"][0]
+    finally:
+        stub.stop()
+        tracker.stop()
+
+
 def test_billing_gossip_endpoint_applies_events(billed_tracker):
-    tracker_url, ledger = billed_tracker
+    tracker_url, ledger, _ = billed_tracker
     peer = BillingLedger(starting_credit=0.03, default_price_per_1k=0.02)
     peer.credit_client("remote-client", 7.0)
     events, _ = peer.events_since(0)
@@ -315,6 +670,5 @@ def test_billing_gossip_endpoint_applies_events(billed_tracker):
     )
     with urllib.request.urlopen(req) as r:
         assert json.loads(r.read())["applied"] == len(events)
-    # only the replicated credit event lands here — Caller Credit was granted
+    # only the replicated credit event lands here.
-    # on the peer that first saw the key, and its event replicates separately
     assert ledger.get_client_balance("remote-client") == pytest.approx(7.0)

tests/test_devnet_treasury.py

@@ -13,9 +13,24 @@ import urllib.error
 import urllib.request
 
 import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
 
 from meshnet_tracker.billing import BillingLedger
 from meshnet_tracker.server import TrackerServer
+from meshnet_tracker.wallet_proof import binding_message
+
+
+def _keypair():
+    """Deterministic-enough local ed25519 keypair + base58 address for tests."""
+    priv = Ed25519PrivateKey.generate()
+    from meshnet_node.wallet import _b58encode
+
+    public = priv.public_key().public_bytes_raw()
+    return priv, _b58encode(public)
+
+
+def _sign(priv: Ed25519PrivateKey, api_key: str, wallet: str) -> str:
+    return priv.sign(binding_message(api_key, wallet)).hex()
 
 
 class _FakeDeposit:
@@ -78,14 +93,15 @@ def test_wallet_register_requires_auth(watched_tracker):
 
 def test_deposit_credits_bound_api_key_exactly_once(watched_tracker):
     tracker_url, ledger, treasury = watched_tracker
+    priv, wallet = _keypair()
     reply = _post_json(
         f"{tracker_url}/v1/wallet/register",
-        {"wallet": "So1anaWa11et111"},
+        {"wallet": wallet, "signature": _sign(priv, "client-key-1", wallet)},
         headers={"Authorization": "Bearer client-key-1"},
     )
     assert reply["bound"] is True
 
-    treasury.deposits.append(_FakeDeposit("sig-1", "So1anaWa11et111", 25.0))
+    treasury.deposits.append(_FakeDeposit("sig-1", wallet, 25.0))
     assert _wait_for(lambda: ledger.get_client_balance("client-key-1") > 0)
     assert ledger.get_client_balance("client-key-1") == pytest.approx(25.0)
 

tests/test_forfeiture_penalty.py

@@ -15,7 +15,8 @@ from meshnet_contracts import LocalSolanaContracts
 from meshnet_node.server import StubNodeServer
 from meshnet_tracker.billing import BillingLedger
 from meshnet_tracker.server import TrackerServer
-from meshnet_validator import ValidatorProcess
+from meshnet_validator import ToplocAuditConfig, ValidatorProcess
+from meshnet_validator.audit import build_activation_proofs
 
 MODEL = "stub-model"
 
@@ -261,3 +262,142 @@ def test_probation_earns_nothing_then_earning_begins():
     finally:
         stub.stop()
         tracker.stop()
+
+
+class _FakeToploc:
+    """Fingerprint = the activations themselves; verify is exact equality
+    (same contract as tests/test_hop_bisection.py's fake backend)."""
+
+    def build_proofs_base64(self, activations, *, decode_batching_size, topk, skip_prefill):
+        return {
+            "activation_fingerprint": tuple(tuple(row) for row in activations),
+            "decode_batching_size": decode_batching_size,
+            "topk": topk,
+            "skip_prefill": skip_prefill,
+        }
+
+    def verify_proofs_base64(self, activations, proofs, *, decode_batching_size, topk, skip_prefill):
+        return proofs == {
+            "activation_fingerprint": tuple(tuple(row) for row in activations),
+            "decode_batching_size": decode_batching_size,
+            "topk": topk,
+            "skip_prefill": skip_prefill,
+        }
+
+
+class _HopReferenceValidator(ValidatorProcess):
+    """Stands in for the reference node: returns canned ground-truth
+    activations at each hop cut-point instead of making an HTTP call."""
+
+    def __init__(self, *args, reference_activations_by_hop, **kwargs) -> None:
+        super().__init__(*args, **kwargs)
+        self._reference_activations_by_hop = reference_activations_by_hop
+
+    def _run_teacher_forced_prefill_hops(self, **kwargs):
+        return self._reference_activations_by_hop
+
+
+def _record_two_hop_event(
+    contracts, session_id: str, *, hop0_activations, hop1_activations, config, backend,
+) -> None:
+    """Two-hop route (wallet-hop0 upstream, wallet-hop1 downstream), each hop
+    carrying its own on-demand TOPLOC commitment (AH-007 bisection format)."""
+    hop0_claim = build_activation_proofs(hop0_activations, config=config, backend=backend)
+    hop1_claim = build_activation_proofs(hop1_activations, config=config, backend=backend)
+    token_ids = [101, 202, 303]
+    contracts.validation.record_completed_inference(
+        session_id=session_id,
+        model=MODEL,
+        messages=[{"role": "user", "content": "2+2"}],
+        observed_output="two-hop pipeline output",
+        route_nodes=[
+            {
+                "wallet_address": "wallet-hop0",
+                "shard_start": 0,
+                "shard_end": 15,
+                "toploc_proof": hop0_claim.as_mapping(),
+                "claimed_token_ids": token_ids,
+            },
+            {
+                "wallet_address": "wallet-hop1",
+                "shard_start": 16,
+                "shard_end": 31,
+                "toploc_proof": hop1_claim.as_mapping(),
+                "claimed_token_ids": token_ids,
+            },
+        ],
+    )
+
+
+def test_60_request_stream_bans_intermittent_first_hop_cheater_not_last_hop():
+    """Integration (AH-010): a 60-request stream through a two-hop route where
+    the *first* hop (not the last) cheats on 3 of the jobs. TOPLOC bisection
+    (issue 07) must blame wallet-hop0 specifically -- the old last-hop-only
+    heuristic would have blamed the innocent wallet-hop1 instead. Each catch
+    forfeits wallet-hop0's pending balance and strikes it in the same
+    validation cycle; the third strike bans it within the 60-request stream,
+    and the settlement loop's payables() then excludes only the banned wallet
+    while the honest downstream hop keeps earning (ADR-0015/ADR-0018).
+    """
+    config = ToplocAuditConfig(topk=2, decode_batching_size=16)
+    backend = _FakeToploc()
+    reference_hop0 = [[1.0, 2.0], [3.0, 4.0]]
+    reference_hop1 = [[5.0, 6.0], [7.0, 8.0]]
+    corrupted_hop0 = [[9.0, 9.0], [9.0, 9.0]]
+    cheat_at = {20, 40, 60}
+
+    contracts = LocalSolanaContracts()
+    contracts.registry.submit_stake("wallet-hop0", 500)
+    contracts.registry.submit_stake("wallet-hop1", 500)
+    ledger = BillingLedger(starting_credit=1000.0, default_price_per_1k=0.02)
+
+    validator = _HopReferenceValidator(
+        contracts=contracts,
+        billing=ledger,
+        reference_node_url="http://reference.invalid",
+        sample_rate=1.0,
+        strike_threshold=3,
+        random_seed=7,
+        toploc_config=config,
+        toploc_backend=backend,
+        reference_activations_by_hop=[reference_hop0, reference_hop1],
+    )
+
+    banned_at: int | None = None
+    for i in range(1, 61):
+        ledger.charge_request(
+            "client", MODEL, 1000, [("wallet-hop0", 6), ("wallet-hop1", 6)],
+        )
+        _record_two_hop_event(
+            contracts,
+            f"sess-{i}",
+            hop0_activations=corrupted_hop0 if i in cheat_at else reference_hop0,
+            hop1_activations=reference_hop1,
+            config=config,
+            backend=backend,
+        )
+        validator.validate_once()
+        if banned_at is None and contracts.registry.get_wallet("wallet-hop0").banned:
+            banned_at = i
+
+    assert banned_at is not None and banned_at <= 60
+    cheater = contracts.registry.get_wallet("wallet-hop0")
+    honest = contracts.registry.get_wallet("wallet-hop1")
+    assert cheater.strike_count == 3
+    assert cheater.banned
+    assert not honest.banned
+    # Every catch blamed the true (first, non-last) culprit hop -- never the
+    # innocent downstream wallet.
+    assert ledger.get_node_pending("wallet-hop0") == pytest.approx(0.0)
+    assert ledger.get_node_pending("wallet-hop1") > 0.0
+
+    # Settlement-loop wiring (server.py `_settlement_loop`): banned wallets
+    # are excluded from payables even though their (forfeited-to-zero)
+    # balance would fail the dust floor anyway -- the honest hop is still due.
+    banned_wallets = {
+        wallet for wallet in ("wallet-hop0", "wallet-hop1")
+        if contracts.registry.get_wallet(wallet).banned
+    }
+    due = dict(ledger.payables(threshold=0.0, max_period=0.0, dust_floor=0.0, exclude=banned_wallets))
+    assert "wallet-hop0" not in due
+    assert due.get("wallet-hop1", 0.0) > 0.0

tests/test_hf_pricing.py

@@ -0,0 +1,150 @@
+"""AH-023: dynamic per-model pricing benchmarked against HF inference rates.
+
+Unit tests for the pure parsing/matching/computation pieces in
+`meshnet_tracker.hf_pricing` — no network, no TrackerServer. The HTML
+fixture below mirrors the row shape confirmed live against
+https://huggingface.co/inference/models on 2026-07-06 (SSR'd table, one
+`<a href="/org/repo/?inference_api=true&inference_provider=...">` anchor per
+row, followed by `$input` / `$output` price cells).
+"""
+
+from __future__ import annotations
+
+from meshnet_tracker.hf_pricing import (
+    HfPriceQuote,
+    HfPricingLog,
+    cheapest_matching_quote,
+    parse_hf_pricing_table,
+    refresh_preset_price,
+)
+
+
+def _row(repo: str, provider: str, input_price: str, output_price: str) -> str:
+    return f"""
+    <tr>
+      <td class="group flex w-full items-center gap-x-2 whitespace-nowrap px-2 py-1">
+        <span title="{repo}">{repo}</span>
+        <a href="/{repo}/?inference_api=true&amp;inference_provider={provider}" target="_blank">link</a>
+      </td>
+      <td class="border px-2 py-1 text-left">{provider}</td>
+      <td class="border px-2 py-1 text-left">${input_price}</td>
+      <td class="border px-2 py-1 text-left">${output_price}</td>
+      <td class="border px-2 py-1 text-left">128000</td>
+    </tr>
+    """
+
+
+FIXTURE_HTML = f"""
+<table class="w-full table-auto border">
+  <tr><th>Model</th><th>Provider</th><th>Input $/1M</th><th>Output $/1M</th></tr>
+  {_row("zai-org/GLM-5.2", "novita", "1.40", "4.40")}
+  {_row("zai-org/GLM-5.2", "deepinfra", "0.93", "3.00")}
+  {_row("zai-org/GLM-4.7-Flash", "novita", "0.07", "0.40")}
+</table>
+"""
+
+
+def test_parse_hf_pricing_table_extracts_repo_provider_and_prices():
+    quotes = parse_hf_pricing_table(FIXTURE_HTML)
+    assert len(quotes) == 3
+    assert quotes[0] == HfPriceQuote("zai-org/GLM-5.2", "novita", 1.40, 4.40)
+    assert quotes[1] == HfPriceQuote("zai-org/GLM-5.2", "deepinfra", 0.93, 3.00)
+
+
+def test_blended_price_per_1k_tokens_is_average_of_input_output_over_1000():
+    quote = HfPriceQuote("zai-org/GLM-5.2", "deepinfra", 0.93, 3.00)
+    assert quote.blended_price_per_1k_tokens() == (0.93 + 3.00) / 2 / 1000
+
+
+def test_cheapest_matching_quote_picks_lowest_blended_price_among_aliases():
+    quotes = parse_hf_pricing_table(FIXTURE_HTML)
+    cheapest = cheapest_matching_quote(quotes, ["zai-org/GLM-5.2"])
+    assert cheapest.provider == "deepinfra"
+
+
+def test_cheapest_matching_quote_honors_repo_provider_scoped_alias():
+    quotes = parse_hf_pricing_table(FIXTURE_HTML)
+    # Only the novita deployment was human-verified as comparable for this
+    # alias — the cheaper deepinfra row for the same repo must not match.
+    cheapest = cheapest_matching_quote(quotes, ["zai-org/GLM-5.2::novita"])
+    assert cheapest.provider == "novita"
+
+
+def test_cheapest_matching_quote_returns_none_when_no_alias_matches():
+    quotes = parse_hf_pricing_table(FIXTURE_HTML)
+    assert cheapest_matching_quote(quotes, ["someone/unrelated-model"]) is None
+
+
+def test_cheapest_matching_quote_returns_none_for_empty_aliases():
+    quotes = parse_hf_pricing_table(FIXTURE_HTML)
+    assert cheapest_matching_quote(quotes, []) is None
+
+
+def test_refresh_preset_price_end_to_end_with_injected_fetch():
+    preset = {"hf_repo": "zai-org/GLM-5.2", "hf_aliases": ["zai-org/GLM-5.2"]}
+    result = refresh_preset_price(
+        model_name="glm-5.2",
+        preset=preset,
+        current_price=0.02,
+        fetch_html=lambda url: FIXTURE_HTML,
+    )
+    assert result is not None
+    assert result["old_price_per_1k"] == 0.02
+    # 80% of the cheapest matched (deepinfra) blended rate.
+    expected = round((0.93 + 3.00) / 2 / 1000 * 0.80, 6)
+    assert result["new_price_per_1k"] == expected
+    assert result["source_repo_id"] == "zai-org/GLM-5.2"
+    assert result["source_provider"] == "deepinfra"
+
+
+def test_refresh_preset_price_skips_presets_without_hf_aliases():
+    preset = {"hf_repo": "unsloth/Kimi-K2.7-Code"}
+    result = refresh_preset_price(
+        model_name="kimi-k2.7",
+        preset=preset,
+        current_price=0.02,
+        fetch_html=lambda url: FIXTURE_HTML,
+    )
+    assert result is None
+
+
+def test_refresh_preset_price_falls_back_silently_on_fetch_failure():
+    preset = {"hf_repo": "zai-org/GLM-5.2", "hf_aliases": ["zai-org/GLM-5.2"]}
+
+    def _boom(url: str) -> str:
+        raise ConnectionError("network unreachable")
+
+    result = refresh_preset_price(
+        model_name="glm-5.2", preset=preset, current_price=0.02, fetch_html=_boom,
+    )
+    assert result is None
+
+
+def test_refresh_preset_price_falls_back_silently_when_no_match_found():
+    preset = {"hf_repo": "zai-org/GLM-5.2", "hf_aliases": ["someone/unrelated-model"]}
+    result = refresh_preset_price(
+        model_name="glm-5.2",
+        preset=preset,
+        current_price=0.02,
+        fetch_html=lambda url: FIXTURE_HTML,
+    )
+    assert result is None
+
+
+def test_hf_pricing_log_persists_and_is_queryable(tmp_path):
+    db_path = str(tmp_path / "hf_pricing_log.sqlite")
+    log = HfPricingLog(db_path=db_path)
+    log.record_change(
+        model="glm-5.2",
+        old_price_per_1k=0.02,
+        new_price_per_1k=0.00157,
+        source_repo_id="zai-org/GLM-5.2",
+        source_provider="deepinfra",
+    )
+    assert len(log.history()) == 1
+    assert log.history("glm-5.2")[0]["new_price_per_1k"] == 0.00157
+    assert log.history("some-other-model") == []
+
+    # Reopening against the same db path recovers the log (billing.py pattern).
+    reopened = HfPricingLog(db_path=db_path)
+    assert len(reopened.history()) == 1

tests/test_hf_pricing_dispatch.py

@@ -0,0 +1,142 @@
+"""AH-023: end-to-end dynamic pricing refresh against a running TrackerServer.
+
+Verifies the full path the issue's acceptance criteria demand: a curated
+alias -> injected "live" fetch -> 80%-of-cheapest computed price ->
+BillingLedger.set_price() -> preset metadata updated -> change logged and
+queryable via GET /v1/pricing/hf/history. Also verifies the required
+fallback: a preset with no hf_aliases is left completely alone.
+"""
+
+from __future__ import annotations
+
+import json
+import time
+import urllib.error
+import urllib.request
+
+import pytest
+
+from meshnet_tracker.billing import BillingLedger
+from meshnet_tracker.server import TrackerServer
+
+PRICED_MODEL = "zai-org/GLM-5.2"
+STATIC_MODEL = "openai-community/gpt2"
+
+
+def _row(repo: str, provider: str, input_price: str, output_price: str) -> str:
+    return f"""
+    <tr>
+      <td><span title="{repo}">{repo}</span>
+        <a href="/{repo}/?inference_api=true&amp;inference_provider={provider}">link</a>
+      </td>
+      <td>{provider}</td>
+      <td>${input_price}</td>
+      <td>${output_price}</td>
+    </tr>
+    """
+
+
+FIXTURE_HTML = f"""
+<table>
+  {_row(PRICED_MODEL, "novita", "1.40", "4.40")}
+  {_row(PRICED_MODEL, "deepinfra", "0.93", "3.00")}
+</table>
+"""
+
+
+def _get_json(url: str, headers: dict | None = None) -> dict:
+    req = urllib.request.Request(url, headers=headers or {})
+    with urllib.request.urlopen(req) as r:
+        return json.loads(r.read())
+
+
+@pytest.fixture
+def pricing_tracker(tmp_path):
+    ledger = BillingLedger(starting_credit=0.0, default_price_per_1k=0.02)
+    tracker = TrackerServer(
+        model_presets={
+            PRICED_MODEL: {
+                "layers_start": 0,
+                "layers_end": 11,
+                "bytes_per_layer": {"bfloat16": 30 * 1024 * 1024},
+                "hf_aliases": [PRICED_MODEL],
+            },
+            STATIC_MODEL: {
+                "layers_start": 0,
+                "layers_end": 11,
+                "bytes_per_layer": {"bfloat16": 30 * 1024 * 1024},
+            },
+        },
+        billing=ledger,
+        validator_service_token="pricing-token",
+        enable_hf_pricing=True,
+        hf_pricing_log_db=str(tmp_path / "hf_pricing_log.sqlite"),
+        hf_pricing_refresh_interval=0.05,
+        hf_pricing_fetch_html=lambda url: FIXTURE_HTML,
+    )
+    port = tracker.start()
+    tracker_url = f"http://127.0.0.1:{port}"
+    yield tracker_url, ledger, tracker
+    tracker.stop()
+
+
+def _wait_for_price_change(ledger: BillingLedger, model: str, *, timeout: float = 2.0) -> float:
+    deadline = time.time() + timeout
+    while time.time() < deadline:
+        price = ledger.price_for(model)
+        if price != 0.02:
+            return price
+        time.sleep(0.02)
+    raise AssertionError(f"price for {model!r} never changed from static default within {timeout}s")
+
+
+def test_refresh_loop_repriced_model_with_curated_alias(pricing_tracker):
+    tracker_url, ledger, tracker = pricing_tracker
+    new_price = _wait_for_price_change(ledger, PRICED_MODEL)
+    expected = round((0.93 + 3.00) / 2 / 1000 * 0.80, 6)
+    assert new_price == expected
+
+    preset = tracker._model_presets[PRICED_MODEL]
+    assert preset["hf_last_price_per_1k"] == expected
+    assert preset["hf_last_updated"]  # ISO timestamp string, non-empty
+
+
+def test_refresh_loop_leaves_model_without_hf_aliases_on_static_price(pricing_tracker):
+    tracker_url, ledger, tracker = pricing_tracker
+    _wait_for_price_change(ledger, PRICED_MODEL)  # let the loop run at least once
+    assert ledger.price_for(STATIC_MODEL) == 0.02
+    assert "hf_last_price_per_1k" not in tracker._model_presets[STATIC_MODEL]
+
+
+def test_price_history_requires_auth(pricing_tracker):
+    tracker_url, ledger, tracker = pricing_tracker
+    _wait_for_price_change(ledger, PRICED_MODEL)
+    with pytest.raises(urllib.error.HTTPError) as exc_info:
+        _get_json(f"{tracker_url}/v1/pricing/hf/history")
+    assert exc_info.value.code == 401
+
+
+def test_price_history_reports_old_new_source_and_timestamp(pricing_tracker):
+    tracker_url, ledger, tracker = pricing_tracker
+    _wait_for_price_change(ledger, PRICED_MODEL)
+    result = _get_json(
+        f"{tracker_url}/v1/pricing/hf/history?model={PRICED_MODEL}",
+        headers={"Authorization": "Bearer pricing-token"},
+    )
+    assert len(result["changes"]) >= 1
+    change = result["changes"][0]
+    assert change["old_price_per_1k"] == 0.02
+    assert change["new_price_per_1k"] == round((0.93 + 3.00) / 2 / 1000 * 0.80, 6)
+    assert change["source_repo_id"] == PRICED_MODEL
+    assert change["source_provider"] == "deepinfra"
+    assert change["ts"] > 0
+
+
+def test_price_history_filters_by_model(pricing_tracker):
+    tracker_url, ledger, tracker = pricing_tracker
+    _wait_for_price_change(ledger, PRICED_MODEL)
+    result = _get_json(
+        f"{tracker_url}/v1/pricing/hf/history?model={STATIC_MODEL}",
+        headers={"Authorization": "Bearer pricing-token"},
+    )
+    assert result["changes"] == []

tests/test_hop_bisection.py

@@ -0,0 +1,388 @@
+"""AH-007: on-demand hop-boundary commitments + first-divergent-hop bisection.
+
+`_final_text_node` (blame `max(shard_end)`) is wrong for multi-hop pipelines:
+a corrupt early hop still produces a route whose *last* hop reported perfectly
+honest activations. These tests build a two-hop route, corrupt one hop's
+committed fingerprint, and assert the referee blames that hop specifically —
+not always the last one.
+"""
+
+from __future__ import annotations
+
+import http.server
+import json
+import socketserver
+import threading
+from types import SimpleNamespace
+
+from meshnet_validator import ToplocAuditConfig, ValidatorProcess
+from meshnet_validator.audit import build_activation_proofs
+
+
+class FakeToploc:
+    """Fingerprint = the activations themselves; verify is exact equality,
+    matching the encode/verify contract exercised in test_toploc_audit.py."""
+
+    def build_proofs_base64(self, activations, *, decode_batching_size, topk, skip_prefill):
+        return {
+            "activation_fingerprint": tuple(tuple(row) for row in activations),
+            "decode_batching_size": decode_batching_size,
+            "topk": topk,
+            "skip_prefill": skip_prefill,
+        }
+
+    def verify_proofs_base64(self, activations, proofs, *, decode_batching_size, topk, skip_prefill):
+        fingerprint = proofs.get("activation_fingerprint") if isinstance(proofs, dict) else None
+        return proofs == {
+            "activation_fingerprint": tuple(tuple(row) for row in activations),
+            "decode_batching_size": decode_batching_size,
+            "topk": topk,
+            "skip_prefill": skip_prefill,
+        } or (
+            fingerprint is not None
+            and tuple(tuple(row) for row in fingerprint) == tuple(tuple(row) for row in activations)
+            and proofs.get("decode_batching_size") == decode_batching_size
+            and proofs.get("topk") == topk
+            and proofs.get("skip_prefill") == skip_prefill
+        )
+
+
+class FakeValidationLog:
+    def __init__(self, events) -> None:
+        self._events = events
+
+    def list_completed_inferences(self, *, after_index: int = -1):
+        return [event for event in self._events if event.index > after_index]
+
+
+class FakeRegistry:
+    def __init__(self) -> None:
+        self.slashes: list[dict] = []
+        self.audit_outcomes: list[dict] = []
+
+    def get_wallet(self, wallet_address: str):
+        return SimpleNamespace(banned=False)
+
+    def submit_slash_proof(self, **kwargs):
+        self.slashes.append(kwargs)
+        return kwargs
+
+    def record_audit_outcome(self, wallet_address: str, *, passed: bool):
+        self.audit_outcomes.append({"wallet_address": wallet_address, "passed": passed})
+
+
+class FakeContracts:
+    def __init__(self, events) -> None:
+        self.validation = FakeValidationLog(events)
+        self.registry = FakeRegistry()
+
+
+class CommitmentStubServer:
+    def __init__(self, commitments: dict[str, dict]) -> None:
+        self.requests: list[dict] = []
+        outer = self
+
+        class Handler(http.server.BaseHTTPRequestHandler):
+            def log_message(self, fmt, *args):
+                pass
+
+            def do_POST(self):
+                if self.path != "/v1/audit/toploc/commitment":
+                    self.send_response(404)
+                    self.end_headers()
+                    return
+                length = int(self.headers.get("Content-Length", 0))
+                body = json.loads(self.rfile.read(length) or b"{}")
+                outer.requests.append(body)
+                payload = json.dumps(commitments[body["session_id"]]).encode()
+                self.send_response(200)
+                self.send_header("Content-Type", "application/json")
+                self.send_header("Content-Length", str(len(payload)))
+                self.end_headers()
+                self.wfile.write(payload)
+
+        self._server = socketserver.ThreadingTCPServer(("127.0.0.1", 0), Handler)
+        self._server.daemon_threads = True
+        self._thread: threading.Thread | None = None
+
+    def start(self) -> str:
+        self._thread = threading.Thread(target=self._server.serve_forever, daemon=True)
+        self._thread.start()
+        return f"http://127.0.0.1:{self._server.server_address[1]}"
+
+    def stop(self) -> None:
+        self._server.shutdown()
+        self._server.server_close()
+
+
+def _hop_route_event(*, index, hop0_claim_activations, hop1_claim_activations, config, backend, ts=None):
+    """Two-hop route where each hop carries its own TOPLOC commitment built
+    from the given (possibly corrupted) activations."""
+    hop0_claim = build_activation_proofs(hop0_claim_activations, config=config, backend=backend)
+    hop1_claim = build_activation_proofs(hop1_claim_activations, config=config, backend=backend)
+    route_nodes = [
+        {
+            "wallet_address": "wallet-hop0",
+            "shard_start": 0,
+            "shard_end": 15,
+            "toploc_proof": hop0_claim.as_mapping(),
+        },
+        {
+            "wallet_address": "wallet-hop1",
+            "shard_start": 16,
+            "shard_end": 31,
+            "toploc_proof": hop1_claim.as_mapping(),
+        },
+    ]
+    event = SimpleNamespace(
+        index=index,
+        session_id=f"session-hop-{index}",
+        model="Qwen2.5-0.5B-Instruct",
+        messages=[{"role": "user", "content": "hello"}],
+        observed_output="two-hop pipeline output",
+        route_nodes=route_nodes,
+        claimed_token_ids=[101, 202, 303],
+    )
+    if ts is not None:
+        event.ts = ts
+    return event
+
+
+class HopReferenceValidator(ValidatorProcess):
+    """Stands in for the reference node: returns canned ground-truth
+    activations at each hop cut-point instead of making an HTTP call."""
+
+    def __init__(self, *args, reference_activations_by_hop, **kwargs) -> None:
+        super().__init__(*args, **kwargs)
+        self.reference_activations_by_hop = reference_activations_by_hop
+        self.hops_calls: list[dict] = []
+        self.text_reference_calls: list[list[dict]] = []
+
+    def _run_teacher_forced_prefill_hops(self, **kwargs):
+        self.hops_calls.append(kwargs)
+        return self.reference_activations_by_hop
+
+    def _run_reference(self, messages: list[dict]) -> str:
+        self.text_reference_calls.append(messages)
+        return "two-hop pipeline output"
+
+
+def test_bisection_blames_first_divergent_hop_not_last_hop():
+    """Red: corrupt hop-0 only. The old `_final_text_node` bug blames
+    max(shard_end) == hop-1 (wallet-hop1), which is innocent here."""
+    config = ToplocAuditConfig(topk=2, decode_batching_size=16)
+    backend = FakeToploc()
+    reference_hop0 = [[1.0, 2.0], [3.0, 4.0]]
+    reference_hop1 = [[5.0, 6.0], [7.0, 8.0]]
+    corrupted_hop0_claim_activations = [[9.0, 9.0], [9.0, 9.0]]  # diverges from reference_hop0
+
+    event = _hop_route_event(
+        index=0,
+        hop0_claim_activations=corrupted_hop0_claim_activations,
+        hop1_claim_activations=reference_hop1,
+        config=config,
+        backend=backend,
+    )
+    contracts = FakeContracts([event])
+    validator = HopReferenceValidator(
+        contracts=contracts,
+        reference_node_url="http://reference.invalid",
+        sample_rate=1.0,
+        random_seed=7,
+        toploc_config=config,
+        toploc_backend=backend,
+        reference_activations_by_hop=[reference_hop0, reference_hop1],
+    )
+
+    receipts = validator.validate_once()
+
+    assert len(receipts) == 1
+    assert contracts.registry.slashes[0]["wallet_address"] == "wallet-hop0"
+    assert "hop 0" in contracts.registry.slashes[0]["reason"]
+
+
+def test_bisection_blames_the_actual_faulty_hop_when_it_is_the_second_hop():
+    """Integration test: multi-hop pipeline, fault injected at a known
+    (non-first) hop — proves blame follows the real culprit, not a fixed index."""
+    config = ToplocAuditConfig(topk=2, decode_batching_size=16)
+    backend = FakeToploc()
+    reference_hop0 = [[1.0, 2.0], [3.0, 4.0]]
+    reference_hop1 = [[5.0, 6.0], [7.0, 8.0]]
+    corrupted_hop1_claim_activations = [[0.0, 0.0], [0.0, 0.0]]
+
+    event = _hop_route_event(
+        index=0,
+        hop0_claim_activations=reference_hop0,
+        hop1_claim_activations=corrupted_hop1_claim_activations,
+        config=config,
+        backend=backend,
+    )
+    contracts = FakeContracts([event])
+    validator = HopReferenceValidator(
+        contracts=contracts,
+        reference_node_url="http://reference.invalid",
+        sample_rate=1.0,
+        random_seed=7,
+        toploc_config=config,
+        toploc_backend=backend,
+        reference_activations_by_hop=[reference_hop0, reference_hop1],
+    )
+
+    receipts = validator.validate_once()
+
+    assert len(receipts) == 1
+    assert contracts.registry.slashes[0]["wallet_address"] == "wallet-hop1"
+
+
+def test_honest_two_hop_route_is_not_slashed():
+    config = ToplocAuditConfig(topk=2, decode_batching_size=16)
+    backend = FakeToploc()
+    reference_hop0 = [[1.0, 2.0], [3.0, 4.0]]
+    reference_hop1 = [[5.0, 6.0], [7.0, 8.0]]
+
+    event = _hop_route_event(
+        index=0,
+        hop0_claim_activations=reference_hop0,
+        hop1_claim_activations=reference_hop1,
+        config=config,
+        backend=backend,
+    )
+    contracts = FakeContracts([event])
+    validator = HopReferenceValidator(
+        contracts=contracts,
+        reference_node_url="http://reference.invalid",
+        sample_rate=1.0,
+        random_seed=7,
+        toploc_config=config,
+        toploc_backend=backend,
+        reference_activations_by_hop=[reference_hop0, reference_hop1],
+    )
+
+    assert validator.validate_once() == []
+    assert contracts.registry.slashes == []
+
+
+def test_expired_commitment_window_falls_back_to_text_only_audit():
+    """ADR-0018 §3: nodes only retain boundary activations briefly. Once the
+    on-demand TTL has passed, bisection can't be verified — the validator must
+    fall back to the text-comparison path instead of erroring out."""
+    config = ToplocAuditConfig(topk=2, decode_batching_size=16, commitment_ttl_seconds=1.0)
+    backend = FakeToploc()
+    reference_hop0 = [[1.0, 2.0], [3.0, 4.0]]
+    reference_hop1 = [[5.0, 6.0], [7.0, 8.0]]
+
+    event = _hop_route_event(
+        index=0,
+        hop0_claim_activations=reference_hop0,
+        hop1_claim_activations=reference_hop1,
+        config=config,
+        backend=backend,
+        ts=0.0,  # far outside any TTL relative to real wall-clock time
+    )
+    contracts = FakeContracts([event])
+    validator = HopReferenceValidator(
+        contracts=contracts,
+        reference_node_url="http://reference.invalid",
+        sample_rate=1.0,
+        random_seed=7,
+        toploc_config=config,
+        toploc_backend=backend,
+        reference_activations_by_hop=[reference_hop0, reference_hop1],
+    )
+
+    assert validator.validate_once() == []
+    assert validator.hops_calls == []
+    assert len(validator.text_reference_calls) == 1
+
+
+def test_hop_commitments_are_not_requested_unless_the_event_is_audit_selected():
+    """On-demand: the (expensive) per-hop commitment retrieval only happens
+    for events the tracker RNG actually selects for audit — sample_rate is
+    the selection gate, and a miss must not touch the reference node at all."""
+    config = ToplocAuditConfig(topk=2, decode_batching_size=16)
+    backend = FakeToploc()
+    reference_hop0 = [[1.0, 2.0], [3.0, 4.0]]
+    reference_hop1 = [[5.0, 6.0], [7.0, 8.0]]
+
+    event = _hop_route_event(
+        index=0,
+        hop0_claim_activations=reference_hop0,
+        hop1_claim_activations=reference_hop1,
+        config=config,
+        backend=backend,
+    )
+    contracts = FakeContracts([event])
+    validator = HopReferenceValidator(
+        contracts=contracts,
+        reference_node_url="http://reference.invalid",
+        sample_rate=0.0,  # never selects any event for audit
+        random_seed=7,
+        toploc_config=config,
+        toploc_backend=backend,
+        reference_activations_by_hop=[reference_hop0, reference_hop1],
+    )
+
+    assert validator.validate_once() == []
+    assert validator.hops_calls == []
+    assert validator.text_reference_calls == []
+    assert validator.sampled_count == 0
+
+def test_validator_fetches_missing_hop_commitments_on_demand_after_sampling():
+    """Production route events only carry hop metadata. Once sampled, the
+    validator asks each route node for its retained boundary commitment window
+    and then runs the same first-divergent-hop bisection path."""
+    config = ToplocAuditConfig(topk=2, decode_batching_size=16)
+    backend = FakeToploc()
+    reference_hop0 = [[1.0, 2.0], [3.0, 4.0]]
+    reference_hop1 = [[5.0, 6.0], [7.0, 8.0]]
+    hop0_claim = build_activation_proofs(reference_hop0, config=config, backend=backend)
+    hop1_claim = build_activation_proofs(reference_hop1, config=config, backend=backend)
+
+    stub = CommitmentStubServer({
+        "session-on-demand": {
+            "toploc_proof": hop0_claim.as_mapping(),
+            "claimed_token_ids": [101, 202, 303],
+        }
+    })
+    endpoint0 = stub.start()
+    try:
+        event = SimpleNamespace(
+            index=0,
+            session_id="session-on-demand",
+            model="Qwen2.5-0.5B-Instruct",
+            messages=[{"role": "user", "content": "hello"}],
+            observed_output="two-hop pipeline output",
+            route_nodes=[
+                {"wallet_address": "wallet-hop0", "endpoint": endpoint0, "shard_start": 0, "shard_end": 15},
+                {
+                    "wallet_address": "wallet-hop1",
+                    "endpoint": "http://127.0.0.1:1",
+                    "shard_start": 16,
+                    "shard_end": 31,
+                    "toploc_proof": hop1_claim.as_mapping(),
+                    "claimed_token_ids": [101, 202, 303],
+                },
+            ],
+        )
+        contracts = FakeContracts([event])
+        validator = HopReferenceValidator(
+            contracts=contracts,
+            reference_node_url="http://reference.invalid",
+            sample_rate=1.0,
+            random_seed=7,
+            toploc_config=config,
+            toploc_backend=backend,
+            reference_activations_by_hop=[reference_hop0, reference_hop1],
+        )
+
+        assert validator.validate_once() == []
+        assert stub.requests == [{
+            "session_id": "session-on-demand",
+            "model": "Qwen2.5-0.5B-Instruct",
+            "messages": [{"role": "user", "content": "hello"}],
+            "shard_start": 0,
+            "shard_end": 15,
+        }]
+        assert validator.hops_calls
+    finally:
+        stub.stop()

tests/test_reputation_scoring.py

@@ -0,0 +1,227 @@
+"""Issue 08 (FRAUD: reputation model): scoring rules on top of the persisted
+reputation/strike/ban fields from issue 05 (ADR-0018 §6).
+
+Score derives only from tracker audit outcomes + uptime/latency: slow build,
+instant loss, inactivity decay. Strikes apply a ×0.8 routing multiplier per
+strike, separate from the (full) forfeiture penalty owned by issue 10.
+"""
+
+import json
+import urllib.request
+
+import pytest
+
+from meshnet_contracts import (
+    REPUTATION_CLEAN_AUDIT_DELTA,
+    REPUTATION_FAILED_AUDIT_DELTA,
+    LocalSolanaContracts,
+)
+from meshnet_node.server import StubNodeServer
+from meshnet_validator import ValidatorProcess
+
+MODEL = "stub-model"
+
+
+# ---- documented deltas, applied via the persisted issue-05 fields ----
+
+
+def test_clean_audit_increases_reputation_by_documented_delta():
+    contracts = LocalSolanaContracts()
+    contracts.registry.record_audit_outcome("wallet-a", passed=False)  # 1.0 -> 0.7
+    before = contracts.registry.get_wallet("wallet-a").reputation
+
+    contracts.registry.record_audit_outcome("wallet-a", passed=True)
+
+    after = contracts.registry.get_wallet("wallet-a").reputation
+    assert after == pytest.approx(before + REPUTATION_CLEAN_AUDIT_DELTA)
+
+
+def test_failed_audit_decreases_reputation_by_documented_delta():
+    contracts = LocalSolanaContracts()
+    contracts.registry.record_audit_outcome("wallet-b", passed=False)
+    assert contracts.registry.get_wallet("wallet-b").reputation == pytest.approx(
+        1.0 + REPUTATION_FAILED_AUDIT_DELTA
+    )
+
+
+def test_reputation_clamps_to_documented_bounds():
+    contracts = LocalSolanaContracts()
+    for _ in range(10):
+        contracts.registry.record_audit_outcome("wallet-c", passed=False)
+    assert contracts.registry.get_wallet("wallet-c").reputation == 0.0
+
+    for _ in range(30):
+        contracts.registry.record_audit_outcome("wallet-c", passed=True)
+    assert contracts.registry.get_wallet("wallet-c").reputation == 1.0
+
+
+def test_reputation_uses_persisted_fields_not_a_second_schema(tmp_path):
+    """Red (issue 08 test-first item 1): reputation deltas must persist and
+    reload through the same event log issue 05 already wired — no parallel
+    storage path."""
+    db = str(tmp_path / "registry.sqlite")
+    contracts = LocalSolanaContracts(registry_db=db)
+    contracts.registry.record_audit_outcome("wallet-d", passed=False)
+    contracts.save_to_db()
+
+    reopened = LocalSolanaContracts(registry_db=db)
+    wallet = reopened.registry.get_wallet("wallet-d")
+    assert wallet.reputation == pytest.approx(1.0 + REPUTATION_FAILED_AUDIT_DELTA)
+    assert wallet.strike_count == 0  # audit_outcome never strikes on its own
+
+
+# ---- strike -> routing multiplier, separate from forfeiture ----
+
+
+def test_strike_applies_graduated_routing_multiplier_not_full_penalty():
+    contracts = LocalSolanaContracts()
+    contracts.registry.submit_stake("wallet-e", 500)
+    assert contracts.registry.routing_multiplier("wallet-e") == pytest.approx(1.0)
+
+    contracts.registry.record_strike("wallet-e", ban_threshold=10)
+    assert contracts.registry.routing_multiplier("wallet-e") == pytest.approx(0.8)
+
+    contracts.registry.record_strike("wallet-e", ban_threshold=10)
+    assert contracts.registry.routing_multiplier("wallet-e") == pytest.approx(0.8 * 0.8)
+    # stake (forfeiture surface) is untouched by strikes alone
+    assert contracts.registry.get_wallet("wallet-e").stake_balance == 500
+
+
+def test_three_strikes_still_bans_and_probation_still_enforced():
+    contracts = LocalSolanaContracts(probationary_job_count=2)
+    for _ in range(3):
+        contracts.registry.record_strike("wallet-f")
+    wallet = contracts.registry.get_wallet("wallet-f")
+    assert wallet.strike_count == 3
+    assert wallet.banned is True
+
+    contracts.registry.record_completed_job("wallet-g")
+    assert contracts.registry.probationary_jobs_remaining("wallet-g") == 1
+
+
+# ---- inactivity decay ----
+
+
+def test_inactivity_decay_after_idle_days_without_completed_jobs():
+    contracts = LocalSolanaContracts()
+    contracts.registry.record_completed_jobs("wallet-h", 1, ts=0.0)
+
+    idle_seconds = 30 * 86400.0
+    decayed = contracts.registry.apply_inactivity_decay(
+        idle_seconds=idle_seconds, decay_amount=0.05, now=idle_seconds + 1.0,
+    )
+
+    assert "wallet-h" in decayed
+    assert contracts.registry.get_wallet("wallet-h").reputation == pytest.approx(0.95)
+
+
+def test_inactivity_decay_skips_wallets_active_within_the_window():
+    contracts = LocalSolanaContracts()
+    contracts.registry.record_completed_jobs("wallet-i", 1, ts=1000.0)
+
+    decayed = contracts.registry.apply_inactivity_decay(
+        idle_seconds=30 * 86400.0, now=1000.0 + 60.0,
+    )
+
+    assert decayed == {}
+    assert contracts.registry.get_wallet("wallet-i").reputation == pytest.approx(1.0)
+
+
+def test_inactivity_decay_applies_at_most_once_per_idle_window():
+    contracts = LocalSolanaContracts()
+    contracts.registry.record_completed_jobs("wallet-j", 1, ts=0.0)
+    idle_seconds = 30 * 86400.0
+
+    contracts.registry.apply_inactivity_decay(idle_seconds=idle_seconds, now=idle_seconds + 1.0)
+    again = contracts.registry.apply_inactivity_decay(idle_seconds=idle_seconds, now=idle_seconds + 2.0)
+
+    assert again == {}
+    assert contracts.registry.get_wallet("wallet-j").reputation == pytest.approx(0.95)
+
+
+def test_inactivity_decay_skips_banned_wallets():
+    contracts = LocalSolanaContracts()
+    contracts.registry.record_completed_jobs("wallet-k", 1, ts=0.0)
+    contracts.registry.ban_wallet("wallet-k")
+
+    decayed = contracts.registry.apply_inactivity_decay(now=30 * 86400.0 + 1.0)
+
+    assert decayed == {}
+
+
+# ---- no peer-to-peer reputation inputs ----
+
+
+def test_registry_contract_has_no_peer_rating_api():
+    contracts = LocalSolanaContracts()
+    for forbidden in ("rate_peer", "submit_peer_rating", "peer_reputation"):
+        assert not hasattr(contracts.registry, forbidden)
+
+
+# ---- validator wiring: audit outcomes feed reputation end-to-end ----
+
+
+def _record_event(contracts, session_id: str, output: str, wallet: str) -> None:
+    contracts.validation.record_completed_inference(
+        session_id=session_id,
+        model=MODEL,
+        messages=[{"role": "user", "content": "2+2"}],
+        observed_output=output,
+        route_nodes=[{"wallet_address": wallet, "shard_end": 31}],
+    )
+
+
+@pytest.fixture
+def reference_node():
+    node = StubNodeServer(shard_start=0, shard_end=31, is_last_shard=True)
+    port = node.start()
+    yield f"http://127.0.0.1:{port}"
+    node.stop()
+
+
+def _reference_output(reference_url: str) -> str:
+    req = urllib.request.Request(
+        f"{reference_url}/v1/infer",
+        data=json.dumps({"messages": [{"role": "user", "content": "2+2"}]}).encode(),
+        headers={"Content-Type": "application/json"},
+        method="POST",
+    )
+    with urllib.request.urlopen(req) as r:
+        return json.loads(r.read())["text"]
+
+
+def test_validator_credits_clean_audit_via_persisted_reputation(reference_node):
+    contracts = LocalSolanaContracts()
+    contracts.registry.record_audit_outcome("wallet-good", passed=False)  # 1.0 -> 0.7
+    validator = ValidatorProcess(
+        contracts=contracts, reference_node_url=reference_node, sample_rate=1.0, random_seed=7,
+    )
+    _record_event(contracts, "sess-clean", _reference_output(reference_node), "wallet-good")
+
+    validator.validate_once()
+
+    assert contracts.registry.get_wallet("wallet-good").reputation == pytest.approx(
+        0.7 + REPUTATION_CLEAN_AUDIT_DELTA
+    )
+
+
+def test_validator_docks_reputation_on_failed_audit_without_double_striking(reference_node):
+    contracts = LocalSolanaContracts()
+    contracts.registry.submit_stake("wallet-bad", 500)
+    validator = ValidatorProcess(
+        contracts=contracts,
+        reference_node_url=reference_node,
+        sample_rate=1.0,
+        slash_amount=100,
+        strike_threshold=3,
+        random_seed=7,
+    )
+    _record_event(contracts, "sess-fraud", "fraudulent nonsense", "wallet-bad")
+
+    validator.validate_once()
+
+    wallet = contracts.registry.get_wallet("wallet-bad")
+    assert wallet.reputation == pytest.approx(1.0 + REPUTATION_FAILED_AUDIT_DELTA)
+    # exactly one strike from submit_slash_proof — record_audit_outcome must
+    # not add a second
+    assert wallet.strike_count == 1

tests/test_toploc_audit.py

@@ -0,0 +1,273 @@
+"""AH-006: validator TOPLOC audit primitive."""
+
+from __future__ import annotations
+
+from collections import namedtuple
+from types import SimpleNamespace
+
+from meshnet_validator import ToplocAuditConfig, ValidatorProcess
+from meshnet_validator.audit import (
+    build_activation_proofs,
+    verify_activation_proofs,
+    verify_activation_proofs_detailed,
+)
+
+
+class FakeToploc:
+    def __init__(self) -> None:
+        self.build_calls: list[dict] = []
+        self.verify_calls: list[dict] = []
+
+    def build_proofs_base64(
+        self,
+        activations,
+        *,
+        decode_batching_size: int,
+        topk: int,
+        skip_prefill: bool,
+    ):
+        self.build_calls.append({
+            "decode_batching_size": decode_batching_size,
+            "topk": topk,
+            "skip_prefill": skip_prefill,
+        })
+        return {
+            "activation_fingerprint": tuple(tuple(row) for row in activations),
+            "decode_batching_size": decode_batching_size,
+            "topk": topk,
+            "skip_prefill": skip_prefill,
+        }
+
+    def verify_proofs_base64(
+        self,
+        activations,
+        proofs,
+        *,
+        decode_batching_size: int,
+        topk: int,
+        skip_prefill: bool,
+    ):
+        self.verify_calls.append({
+            "decode_batching_size": decode_batching_size,
+            "topk": topk,
+            "skip_prefill": skip_prefill,
+        })
+        return proofs == {
+            "activation_fingerprint": tuple(tuple(row) for row in activations),
+            "decode_batching_size": decode_batching_size,
+            "topk": topk,
+            "skip_prefill": skip_prefill,
+        }
+
+
+class FakeValidationLog:
+    def __init__(self, events) -> None:
+        self._events = events
+
+    def list_completed_inferences(self, *, after_index: int = -1):
+        return [event for event in self._events if event.index > after_index]
+
+
+class FakeRegistry:
+    def __init__(self) -> None:
+        self.slashes: list[dict] = []
+        self.audit_outcomes: list[dict] = []
+
+    def get_wallet(self, wallet_address: str):
+        return SimpleNamespace(banned=False)
+
+    def submit_slash_proof(self, **kwargs):
+        self.slashes.append(kwargs)
+        return kwargs
+
+    def record_audit_outcome(self, wallet_address: str, *, passed: bool):
+        self.audit_outcomes.append({"wallet_address": wallet_address, "passed": passed})
+
+
+class FakeContracts:
+    def __init__(self, events) -> None:
+        self.validation = FakeValidationLog(events)
+        self.registry = FakeRegistry()
+
+
+class TeacherForcedValidator(ValidatorProcess):
+    def __init__(self, *args, reference_activations, **kwargs) -> None:
+        super().__init__(*args, **kwargs)
+        self.reference_activations = reference_activations
+        self.teacher_forced_calls: list[dict] = []
+
+    def _run_reference(self, messages: list[dict]) -> str:
+        raise AssertionError("TOPLOC audits must not free-generate reference text")
+
+    def _run_teacher_forced_prefill(self, **kwargs):
+        self.teacher_forced_calls.append(kwargs)
+        return self.reference_activations
+
+
+def test_stub_activation_tensors_round_trip_through_toploc_proofs():
+    fake_toploc = FakeToploc()
+    activations = [[1.0, 2.0, 3.0], [4.0, 5.0, 6.0]]
+    config = ToplocAuditConfig(topk=2, decode_batching_size=16)
+
+    claim = build_activation_proofs(activations, config=config, backend=fake_toploc)
+
+    assert verify_activation_proofs(activations, claim, config=config, backend=fake_toploc) is True
+    assert fake_toploc.build_calls == [{
+        "decode_batching_size": 16,
+        "topk": 2,
+        "skip_prefill": True,
+    }]
+    assert fake_toploc.verify_calls == [{
+        "decode_batching_size": 16,
+        "topk": 2,
+        "skip_prefill": True,
+    }]
+
+
+def test_validator_teacher_forces_claimed_tokens_for_toploc_audit():
+    fake_toploc = FakeToploc()
+    activations = [[0.25, 0.5], [0.75, 1.0]]
+    config = ToplocAuditConfig(topk=2, decode_batching_size=16)
+    claim = build_activation_proofs(activations, config=config, backend=fake_toploc)
+    event = SimpleNamespace(
+        index=0,
+        session_id="session-toploc-ok",
+        model="Qwen2.5-0.5B-Instruct",
+        messages=[{"role": "user", "content": "hello"}],
+        observed_output="honest but hardware-divergent text",
+        route_nodes=[{"wallet_address": "wallet-good", "shard_end": 31}],
+        claimed_token_ids=[101, 202, 303],
+        toploc_proof=claim.as_mapping(),
+    )
+    contracts = FakeContracts([event])
+    validator = TeacherForcedValidator(
+        contracts=contracts,
+        reference_node_url="http://reference.invalid",
+        sample_rate=1.0,
+        random_seed=7,
+        toploc_config=config,
+        toploc_backend=fake_toploc,
+        reference_activations=activations,
+    )
+
+    assert validator.validate_once() == []
+    assert contracts.registry.slashes == []
+    assert validator.teacher_forced_calls == [{
+        "model": "Qwen2.5-0.5B-Instruct",
+        "messages": [{"role": "user", "content": "hello"}],
+        "claimed_token_ids": [101, 202, 303],
+        "claim": claim,
+    }]
+
+
+def test_validator_rejects_swapped_precision_toploc_claim():
+    fake_toploc = FakeToploc()
+    activations = [[0.25, 0.5], [0.75, 1.0]]
+    canonical = ToplocAuditConfig(
+        dtype="bfloat16",
+        quantization="bfloat16",
+        topk=2,
+        decode_batching_size=16,
+    )
+    swapped = ToplocAuditConfig(
+        dtype="bfloat16",
+        quantization="int8",
+        topk=2,
+        decode_batching_size=16,
+    )
+    claim = build_activation_proofs(activations, config=swapped, backend=fake_toploc)
+    event = SimpleNamespace(
+        index=0,
+        session_id="session-toploc-bad",
+        model="Qwen2.5-0.5B-Instruct",
+        messages=[{"role": "user", "content": "hello"}],
+        observed_output="looks plausible",
+        route_nodes=[{"wallet_address": "wallet-bad", "shard_end": 31}],
+        audit={
+            "claimed_token_ids": [101, 202, 303],
+            "toploc_proof": claim.as_mapping(),
+        },
+    )
+    contracts = FakeContracts([event])
+    validator = TeacherForcedValidator(
+        contracts=contracts,
+        reference_node_url="http://reference.invalid",
+        sample_rate=1.0,
+        random_seed=7,
+        toploc_config=canonical,
+        toploc_backend=fake_toploc,
+        reference_activations=activations,
+    )
+
+    receipts = validator.validate_once()
+
+    assert len(receipts) == 1
+    assert contracts.registry.slashes[0]["wallet_address"] == "wallet-bad"
+    assert "TOPLOC activation proof mismatch" in contracts.registry.slashes[0]["reason"]
+
+
+# AH-021: verify_activation_proofs_detailed surfaces the raw divergence
+# metric a calibration corpus needs, instead of only a pass/fail bool.
+
+ChunkResult = namedtuple("ChunkResult", ["exp_intersections", "mant_err_mean", "mant_err_median"])
+
+
+class FakeToplocWithChunkResults:
+    """Mimics the real `toploc` library: verify returns per-chunk results,
+    not a bool, so `bool(result)` alone (the AH-021 gap #1 bug) is always
+    true for any non-empty response regardless of divergence."""
+
+    def build_proofs_base64(self, activations, *, decode_batching_size, topk, skip_prefill):
+        return {"activations": activations}
+
+    def verify_proofs_base64(self, activations, proofs, *, decode_batching_size, topk, skip_prefill):
+        return [
+            ChunkResult(exp_intersections=8, mant_err_mean=0.01, mant_err_median=0.008),
+            ChunkResult(exp_intersections=6, mant_err_mean=0.03, mant_err_median=0.02),
+        ]
+
+
+def test_verify_activation_proofs_detailed_aggregates_per_chunk_divergence():
+    fake_toploc = FakeToplocWithChunkResults()
+    activations = [[1.0, 2.0], [3.0, 4.0]]
+    config = ToplocAuditConfig(topk=2, decode_batching_size=16)
+    claim = build_activation_proofs(activations, config=config, backend=fake_toploc)
+
+    result = verify_activation_proofs_detailed(activations, claim, config=config, backend=fake_toploc)
+
+    assert result.passed is True  # non-empty list is truthy, same as legacy behavior
+    assert result.chunk_count == 2
+    assert result.exp_intersections == 6  # worst-case (min) across chunks
+    assert result.mant_err_mean == 0.02  # mean of per-chunk means
+    assert result.mant_err_median == 0.014  # mean of per-chunk medians
+
+    # verify_activation_proofs still returns just the bool for existing callers.
+    assert verify_activation_proofs(activations, claim, config=config, backend=fake_toploc) is True
+
+
+def test_verify_activation_proofs_detailed_no_metric_from_plain_bool_backend():
+    fake_toploc = FakeToploc()
+    activations = [[1.0, 2.0, 3.0], [4.0, 5.0, 6.0]]
+    config = ToplocAuditConfig(topk=2, decode_batching_size=16)
+    claim = build_activation_proofs(activations, config=config, backend=fake_toploc)
+
+    result = verify_activation_proofs_detailed(activations, claim, config=config, backend=fake_toploc)
+
+    assert result.passed is True
+    assert result.chunk_count == 0
+    assert result.exp_intersections is None
+    assert result.mant_err_mean is None
+    assert result.mant_err_median is None
+
+
+def test_verify_activation_proofs_detailed_rejects_config_mismatch_without_calling_backend():
+    fake_toploc = FakeToplocWithChunkResults()
+    activations = [[1.0, 2.0]]
+    canonical = ToplocAuditConfig(dtype="bfloat16", quantization="bfloat16", topk=2, decode_batching_size=16)
+    swapped = ToplocAuditConfig(dtype="bfloat16", quantization="int8", topk=2, decode_batching_size=16)
+    claim = build_activation_proofs(activations, config=swapped, backend=fake_toploc)
+
+    result = verify_activation_proofs_detailed(activations, claim, config=canonical, backend=fake_toploc)
+
+    assert result.passed is False
+    assert result.chunk_count == 0

tests/test_toploc_calibration.py

@@ -0,0 +1,80 @@
+"""AH-021: honest-noise TOPLOC calibration corpus storage + aggregation."""
+
+from __future__ import annotations
+
+from meshnet_tracker.calibration import ToplocCalibrationStore
+
+
+def test_record_run_persists_and_reloads_from_sqlite(tmp_path):
+    db_path = str(tmp_path / "calibration.sqlite")
+    store = ToplocCalibrationStore(db_path=db_path)
+    store.record_run(
+        node_wallet="wallet-a",
+        gpu_model="RTX 4090",
+        dtype="bfloat16",
+        model="Qwen2.5-0.5B-Instruct",
+        passed=True,
+        exp_intersections=7.0,
+        mant_err_mean=0.01,
+        mant_err_median=0.008,
+    )
+
+    reloaded = ToplocCalibrationStore(db_path=db_path)
+    assert len(reloaded.runs()) == 1
+    assert reloaded.runs()[0]["node_wallet"] == "wallet-a"
+    assert reloaded.distinct_hardware_profiles() == {("RTX 4090", "bfloat16")}
+
+
+def test_gate_status_requires_minimum_distinct_hardware_profiles():
+    store = ToplocCalibrationStore()
+    store.record_run(
+        node_wallet="wallet-a", gpu_model="RTX 4090", dtype="bfloat16", model="m",
+        passed=True, exp_intersections=8.0, mant_err_mean=0.01, mant_err_median=0.01,
+    )
+    assert store.gate_status(min_hardware_profiles=2)["ready"] is False
+
+    store.record_run(
+        node_wallet="wallet-b", gpu_model="A100", dtype="bfloat16", model="m",
+        passed=True, exp_intersections=8.0, mant_err_mean=0.01, mant_err_median=0.01,
+    )
+    status = store.gate_status(min_hardware_profiles=2)
+    assert status["ready"] is True
+    assert status["distinct_hardware_profiles"] == 2
+
+
+def test_gate_status_empty_corpus_is_never_ready():
+    store = ToplocCalibrationStore()
+    assert store.gate_status(min_hardware_profiles=0)["ready"] is False
+
+
+def test_envelope_derives_thresholds_from_worst_case_percentile_with_margin():
+    store = ToplocCalibrationStore()
+    # 100 honest runs; exp_intersections mostly 8, worst honest reading 5.
+    for i in range(100):
+        exp = 5.0 if i == 0 else 8.0
+        mant = 0.05 if i == 0 else 0.01
+        store.record_run(
+            node_wallet=f"wallet-{i}", gpu_model="RTX 4090", dtype="bfloat16", model="m",
+            passed=True, exp_intersections=exp, mant_err_mean=mant, mant_err_median=mant,
+        )
+
+    envelope = store.envelope(percentile=0.99, safety_margin=0.2)
+    assert envelope["sample_count"] == 100
+    # p1 (tail) of exp_intersections is pulled down by the one worst honest
+    # reading (5.0 vs the 8.0 bulk); a 20% safety margin shaves it further.
+    assert envelope["recommended_min_exp_intersections"] < 8.0
+    # p99 ceiling of mantissa error is likewise pulled up by the one worst
+    # honest reading (0.05 vs the 0.01 bulk), plus a 20% safety margin.
+    assert envelope["recommended_max_mant_err_mean"] > 0.01
+    # In-sample FPR: at most the one outlier row should be flagged by its own
+    # derived thresholds.
+    assert 0.0 <= envelope["estimated_false_positive_rate"] <= 0.02
+
+
+def test_envelope_returns_none_when_no_samples():
+    store = ToplocCalibrationStore()
+    envelope = store.envelope()
+    assert envelope["recommended_min_exp_intersections"] is None
+    assert envelope["recommended_max_mant_err_mean"] is None
+    assert envelope["recommended_max_mant_err_median"] is None
+    assert envelope["estimated_false_positive_rate"] is None

tests/test_toploc_calibration_dispatch.py

@@ -0,0 +1,341 @@
+"""AH-021: tracker-scheduled TOPLOC honest-noise calibration dispatch.
+
+Extends the US-030 fleet-dispatch pattern (`_handle_benchmark_hop_penalty`)
+from pinned-route latency benchmarking to a job that hits every solo-capable
+registered node with a fixed prompt, verifies each node's own on-demand
+TOPLOC commitment against a teacher-forced reference replay, and records the
+raw divergence into the calibration corpus.
+"""
+
+from __future__ import annotations
+
+import http.server
+import json
+import socketserver
+import threading
+import time
+import urllib.error
+import urllib.request
+
+import pytest
+
+from meshnet_tracker.server import TrackerServer
+from meshnet_validator.audit import ToplocAuditConfig, build_activation_proofs
+
+MODEL = "openai-community/gpt2"
+CONFIG = ToplocAuditConfig(topk=2, decode_batching_size=16, dtype="bfloat16", quantization="bfloat16")
+
+
+class FakeToploc:
+    """Exact-equality fake backend, matching other TOPLOC test suites."""
+
+    def build_proofs_base64(self, activations, *, decode_batching_size, topk, skip_prefill):
+        return {
+            "activation_fingerprint": tuple(tuple(row) for row in activations),
+            "decode_batching_size": decode_batching_size,
+            "topk": topk,
+            "skip_prefill": skip_prefill,
+        }
+
+    def verify_proofs_base64(self, activations, proofs, *, decode_batching_size, topk, skip_prefill):
+        # `proofs` may have round-tripped through JSON (HTTP dispatch), which
+        # turns the fingerprint's tuples into lists — normalize before compare.
+        fingerprint = proofs.get("activation_fingerprint") if isinstance(proofs, dict) else None
+        return (
+            fingerprint is not None
+            and tuple(tuple(row) for row in fingerprint) == tuple(tuple(row) for row in activations)
+            and proofs.get("decode_batching_size") == decode_batching_size
+            and proofs.get("topk") == topk
+            and proofs.get("skip_prefill") == skip_prefill
+        )
+
+
+BACKEND = FakeToploc()
+
+
+class FakeCalibrationNode:
+    """Stands in for a node: serves both /v1/chat/completions (tracker_mode
+    style) and its own on-demand TOPLOC commitment endpoint."""
+
+    def __init__(self, *, claim_activations, claimed_token_ids, response_text="ok", commitment_available=True):
+        self.requests: list[dict] = []
+        claim = build_activation_proofs(claim_activations, config=CONFIG, backend=BACKEND)
+        outer = self
+
+        class Handler(http.server.BaseHTTPRequestHandler):
+            def log_message(self, fmt, *args):
+                pass
+
+            def do_POST(self):
+                length = int(self.headers.get("Content-Length", 0))
+                body = json.loads(self.rfile.read(length) or b"{}")
+                if self.path == "/v1/chat/completions":
+                    self._send_json(200, {
+                        "id": "chatcmpl-cal",
+                        "object": "chat.completion",
+                        "created": int(time.time()),
+                        "model": body.get("model", MODEL),
+                        "choices": [{
+                            "index": 0,
+                            "message": {"role": "assistant", "content": response_text},
+                            "finish_reason": "stop",
+                        }],
+                        "usage": {"prompt_tokens": 1, "completion_tokens": 1, "total_tokens": 2},
+                    })
+                    return
+                if self.path == "/v1/audit/toploc/commitment":
+                    outer.requests.append(body)
+                    if not commitment_available:
+                        self.send_response(404)
+                        self.end_headers()
+                        return
+                    self._send_json(200, {
+                        "toploc_proof": claim.as_mapping(),
+                        "claimed_token_ids": claimed_token_ids,
+                    })
+                    return
+                self.send_response(404)
+                self.end_headers()
+
+            def _send_json(self, status, data):
+                payload = json.dumps(data).encode()
+                self.send_response(status)
+                self.send_header("Content-Type", "application/json")
+                self.send_header("Content-Length", str(len(payload)))
+                self.end_headers()
+                self.wfile.write(payload)
+
+        self._server = socketserver.ThreadingTCPServer(("127.0.0.1", 0), Handler)
+        self._server.daemon_threads = True
+        self._thread: threading.Thread | None = None
+
+    def start(self) -> str:
+        self._thread = threading.Thread(target=self._server.serve_forever, daemon=True)
+        self._thread.start()
+        return f"http://127.0.0.1:{self._server.server_address[1]}"
+
+    def stop(self) -> None:
+        self._server.shutdown()
+        self._server.server_close()
+
+
+class FakeReferenceNode:
+    """Stands in for the reference node: teacher-forces the claimed tokens
+    and returns canned reference activations."""
+
+    def __init__(self, *, reference_activations):
+        self.requests: list[dict] = []
+        outer = self
+
+        class Handler(http.server.BaseHTTPRequestHandler):
+            def log_message(self, fmt, *args):
+                pass
+
+            def do_POST(self):
+                if self.path != "/v1/audit/toploc":
+                    self.send_response(404)
+                    self.end_headers()
+                    return
+                length = int(self.headers.get("Content-Length", 0))
+                body = json.loads(self.rfile.read(length) or b"{}")
+                outer.requests.append(body)
+                payload = json.dumps({"activations": reference_activations}).encode()
+                self.send_response(200)
+                self.send_header("Content-Type", "application/json")
+                self.send_header("Content-Length", str(len(payload)))
+                self.end_headers()
+                self.wfile.write(payload)
+
+        self._server = socketserver.ThreadingTCPServer(("127.0.0.1", 0), Handler)
+        self._server.daemon_threads = True
+        self._thread: threading.Thread | None = None
+
+    def start(self) -> str:
+        self._thread = threading.Thread(target=self._server.serve_forever, daemon=True)
+        self._thread.start()
+        return f"http://127.0.0.1:{self._server.server_address[1]}"
+
+    def stop(self) -> None:
+        self._server.shutdown()
+        self._server.server_close()
+
+
+def _post_json(url: str, payload: dict, headers: dict | None = None) -> dict:
+    req = urllib.request.Request(
+        url,
+        data=json.dumps(payload).encode(),
+        headers={"Content-Type": "application/json", **(headers or {})},
+        method="POST",
+    )
+    with urllib.request.urlopen(req) as r:
+        return json.loads(r.read())
+
+
+def _get_json(url: str, headers: dict | None = None) -> dict:
+    req = urllib.request.Request(url, headers=headers or {})
+    with urllib.request.urlopen(req) as r:
+        return json.loads(r.read())
+
+
+@pytest.fixture
+def calibration_setup(tmp_path):
+    reference_activations = [[1.0, 2.0], [3.0, 4.0]]
+    reference = FakeReferenceNode(reference_activations=reference_activations)
+    reference_url = reference.start()
+
+    calibration_db = str(tmp_path / "calibration.sqlite")
+    tracker = TrackerServer(
+        model_presets={
+            MODEL: {"layers_start": 0, "layers_end": 11, "bytes_per_layer": {"bfloat16": 30 * 1024 * 1024}},
+        },
+        validator_service_token="cal-token",
+        toploc_calibration_db=calibration_db,
+        toploc_reference_node_url=reference_url,
+        toploc_calibration_gate_min_hardware_profiles=1,
+        toploc_backend=BACKEND,
+    )
+    port = tracker.start()
+    tracker_url = f"http://127.0.0.1:{port}"
+
+    honest_node = FakeCalibrationNode(
+        claim_activations=reference_activations,  # matches reference -> passes
+        claimed_token_ids=[101, 202],
+    )
+    honest_node_url = honest_node.start()
+    reply = _post_json(f"{tracker_url}/v1/nodes/register", {
+        "endpoint": honest_node_url,
+        "shard_start": 0,
+        "shard_end": 11,
+        "model": MODEL,
+        "hardware_profile": {"gpu_name": "RTX 4090"},
+        "quantization": "bfloat16",
+        "wallet_address": "wallet-honest",
+        "score": 1.0,
+        "tracker_mode": True,
+    })
+    honest_node_id = reply["node_id"]
+
+    partial_node = FakeCalibrationNode(claim_activations=reference_activations, claimed_token_ids=[101])
+    partial_node_url = partial_node.start()
+    reply = _post_json(f"{tracker_url}/v1/nodes/register", {
+        "endpoint": partial_node_url,
+        "shard_start": 0,
+        "shard_end": 5,
+        "model": MODEL,
+        "hardware_profile": {"gpu_name": "A100"},
+        "quantization": "bfloat16",
+        "wallet_address": "wallet-partial",
+        "score": 1.0,
+        "tracker_mode": True,
+    })
+    partial_node_id = reply["node_id"]
+
+    yield tracker_url, calibration_db, honest_node_id, partial_node_id
+
+    honest_node.stop()
+    partial_node.stop()
+    reference.stop()
+    tracker.stop()
+
+
+def test_calibration_run_requires_auth(calibration_setup):
+    tracker_url, _, _, _ = calibration_setup
+    with pytest.raises(urllib.error.HTTPError) as exc_info:
+        _post_json(f"{tracker_url}/v1/calibration/toploc/run", {"model": MODEL})
+    assert exc_info.value.code == 401
+
+
+def test_calibration_run_dispatches_only_solo_capable_nodes(calibration_setup):
+    tracker_url, _, honest_node_id, partial_node_id = calibration_setup
+    record = _post_json(
+        f"{tracker_url}/v1/calibration/toploc/run",
+        {"model": MODEL, "prompt": "2+2", "max_new_tokens": 4},
+        headers={"Authorization": "Bearer cal-token"},
+    )
+    assert record["skipped_partial_shard_node_ids"] == [partial_node_id]
+    assert len(record["nodes"]) == 1
+    result = record["nodes"][0]
+    assert result["node_id"] == honest_node_id
+    assert result["wallet_address"] == "wallet-honest"
+    assert result["gpu_model"] == "RTX 4090"
+    assert result["dtype"] == "bfloat16"
+    assert result["passed"] is True
+
+
+def test_calibration_run_persists_corpus_and_results_endpoint_reports_it(calibration_setup):
+    tracker_url, calibration_db, _, _ = calibration_setup
+    _post_json(
+        f"{tracker_url}/v1/calibration/toploc/run",
+        {"model": MODEL},
+        headers={"Authorization": "Bearer cal-token"},
+    )
+    results = _get_json(
+        f"{tracker_url}/v1/calibration/toploc/results",
+        headers={"Authorization": "Bearer cal-token"},
+    )
+    assert len(results["runs"]) == 1
+    assert results["runs"][0]["node_wallet"] == "wallet-honest"
+    assert results["gate_status"]["distinct_hardware_profiles"] == 1
+    assert results["gate_status"]["ready"] is True
+    assert results["envelope"]["sample_count"] == 1
+
+
+def test_calibration_run_missing_reference_node_url_is_503(tmp_path):
+    tracker = TrackerServer(
+        model_presets={MODEL: {"layers_start": 0, "layers_end": 11}},
+        validator_service_token="cal-token",
+        toploc_calibration_db=str(tmp_path / "calibration.sqlite"),
+    )
+    port = tracker.start()
+    try:
+        with pytest.raises(urllib.error.HTTPError) as exc_info:
+            _post_json(
+                f"http://127.0.0.1:{port}/v1/calibration/toploc/run",
+                {"model": MODEL},
+                headers={"Authorization": "Bearer cal-token"},
+            )
+        assert exc_info.value.code == 503
+    finally:
+        tracker.stop()
+
+
+def test_calibration_run_node_without_commitment_endpoint_is_skipped_not_failed(tmp_path):
+    reference = FakeReferenceNode(reference_activations=[[1.0, 2.0]])
+    reference_url = reference.start()
+    tracker = TrackerServer(
+        model_presets={MODEL: {"layers_start": 0, "layers_end": 11}},
+        validator_service_token="cal-token",
+        toploc_calibration_db=str(tmp_path / "calibration.sqlite"),
+        toploc_reference_node_url=reference_url,
+    )
+    port = tracker.start()
+    tracker_url = f"http://127.0.0.1:{port}"
+    node = FakeCalibrationNode(
+        claim_activations=[[1.0, 2.0]], claimed_token_ids=[101], commitment_available=False,
+    )
+    node_url = node.start()
+    _post_json(f"{tracker_url}/v1/nodes/register", {
+        "endpoint": node_url,
+        "shard_start": 0,
+        "shard_end": 11,
+        "model": MODEL,
+        "hardware_profile": {},
+        "wallet_address": "wallet-no-commitment",
+        "score": 1.0,
+        "tracker_mode": True,
+        "node_id": "node-no-commitment",
+    })
+
+    try:
+        record = _post_json(
+            f"{tracker_url}/v1/calibration/toploc/run",
+            {"model": MODEL},
+            headers={"Authorization": "Bearer cal-token"},
+        )
+        assert len(record["nodes"]) == 1
+        assert "skipped" in record["nodes"][0]
+        assert record["gate_status"]["sample_count"] == 0
+    finally:
+        node.stop()
+        reference.stop()
+        tracker.stop()

tests/test_tracker_routing.py

@@ -1592,14 +1592,14 @@ def test_stats_gossip_endpoint_merges_peer_slice():
 
 # ---------------------------------------------------------------- US-027 / US-028 routing
 
-def _make_node(node_id, shard_start, shard_end, bench=1.0, queue_depth=0):
+def _make_node(node_id, shard_start, shard_end, bench=1.0, queue_depth=0, wallet_address=None):
     """Helper: build a _NodeEntry with minimal fields."""
     from meshnet_tracker.server import _NodeEntry
     n = _NodeEntry(
         node_id=node_id, endpoint=f"http://fake:{9000 + shard_start}",
         shard_start=shard_start, shard_end=shard_end,
         model="m", shard_checksum=None, hardware_profile={},
-        wallet_address=None, score=1.0,
+        wallet_address=wallet_address, score=1.0,
         benchmark_tokens_per_sec=bench,
     )
     n.queue_depth = queue_depth
@@ -1683,6 +1683,49 @@ def test_select_route_throughput_accounts_for_queue_depth():
     assert route[0].node_id in ("busy", "idle")
 
 
+# ---------------------------------------------------------------- AH-009 reputation-weighted routing
+
+
+def test_select_route_prefers_higher_reputation_when_throughput_equal():
+    """AH-009 test-first item 3: among candidates that advance coverage
+    equally with the same effective throughput, the higher-reputation
+    wallet's node wins the tiebreak (ADR-0018 §6 -- earnings scale with
+    tenure/standing)."""
+    from meshnet_contracts import LocalSolanaContracts
+    from meshnet_tracker.server import _select_route
+
+    contracts = LocalSolanaContracts()
+    contracts.registry.record_audit_outcome("wallet-veteran", passed=False)  # 1.0 -> 0.7
+    # wallet-fresh keeps the default reputation of 1.0
+
+    veteran = _make_node("veteran", 0, 11, bench=10.0, wallet_address="wallet-veteran")
+    fresh = _make_node("fresh", 0, 11, bench=10.0, wallet_address="wallet-fresh")
+
+    route, err = _select_route([veteran, fresh], 0, 11, contracts=contracts)
+    assert err == ""
+    assert route[0].node_id == "fresh"
+
+
+def test_select_route_reputation_never_overrides_coverage():
+    """A lower-reputation node that covers more layers still wins -- the
+    reputation multiplier is a tiebreak among equal-coverage candidates,
+    never a substitute for coverage maximization."""
+    from meshnet_contracts import LocalSolanaContracts
+    from meshnet_tracker.server import _select_route
+
+    contracts = LocalSolanaContracts()
+    contracts.registry.record_audit_outcome("wallet-shady", passed=False)
+    for _ in range(9):
+        contracts.registry.record_audit_outcome("wallet-shady", passed=False)  # reputation -> 0.0
+
+    wide_shady = _make_node("wide-shady", 0, 11, bench=1.0, wallet_address="wallet-shady")
+    narrow_good = _make_node("narrow-good", 0, 5, bench=1.0, wallet_address="wallet-good")
+
+    route, err = _select_route([wide_shady, narrow_good], 0, 11, contracts=contracts)
+    assert err == ""
+    assert [n.node_id for n in route] == ["wide-shady"]
+
+
 def test_two_stub_nodes_complete_pipeline_via_tracker():
     """Integration: two StubNodeServer instances serving complementary shards
     produce a full inference response through the tracker route."""

tests/test_wallet_binding_proof.py

@@ -0,0 +1,182 @@
+"""C6: wallet binding requires proof of ownership, and rebinding is safe.
+
+Any Bearer key could previously bind any wallet string with no proof of
+ownership, and gossip `bind` events overwrote an existing binding directly.
+These tests cover: signature-gated binding, rebind protection (with an
+admin-override escape hatch), and gossip-safe conflict handling.
+"""
+
+import json
+import urllib.error
+import urllib.request
+
+import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from meshnet_node.wallet import _b58encode
+from meshnet_tracker.accounts import AccountStore
+from meshnet_tracker.billing import BillingLedger
+from meshnet_tracker.server import TrackerServer
+from meshnet_tracker.wallet_proof import binding_message, verify_wallet_signature
+
+HIVE_SECRET = "test-hive-secret"
+
+
+def _keypair():
+    priv = Ed25519PrivateKey.generate()
+    return priv, _b58encode(priv.public_key().public_bytes_raw())
+
+
+def _sign(priv, api_key: str, wallet: str) -> str:
+    return priv.sign(binding_message(api_key, wallet)).hex()
+
+
+# ---------------------------------------------------------------- unit tests
+
+
+def test_verify_wallet_signature_accepts_valid_and_rejects_forged():
+    priv, wallet = _keypair()
+    other_priv, _ = _keypair()
+    message = binding_message("client-key-1", wallet)
+
+    assert verify_wallet_signature(wallet, message, priv.sign(message).hex())
+    # signed by a different key entirely
+    assert not verify_wallet_signature(wallet, message, other_priv.sign(message).hex())
+    # signature for a different api_key can't be replayed
+    other_message = binding_message("client-key-2", wallet)
+    assert not verify_wallet_signature(wallet, other_message, priv.sign(message).hex())
+    assert not verify_wallet_signature(wallet, message, "not-hex")
+
+
+def test_bind_wallet_rejects_conflicting_rebind_without_admin_override():
+    ledger = BillingLedger(starting_credit=0.0)
+    ledger.bind_wallet("key-1", "WalletA")
+    assert ledger.api_key_for_wallet("WalletA") == "key-1"
+
+    event = ledger.bind_wallet("key-2", "WalletA")
+    assert event.get("rejected") is True
+    assert ledger.api_key_for_wallet("WalletA") == "key-1"  # unchanged
+
+    override = ledger.bind_wallet("key-2", "WalletA", admin_override=True)
+    assert not override.get("rejected")
+    assert ledger.api_key_for_wallet("WalletA") == "key-2"
+
+
+def test_gossip_bind_event_cannot_overwrite_existing_binding():
+    """A conflicting `bind` event applied via gossip must not clobber."""
+    leader = BillingLedger(starting_credit=0.0)
+    leader.bind_wallet("key-1", "WalletA")
+
+    follower = BillingLedger(starting_credit=0.0)
+    follower.bind_wallet("key-9", "WalletA")  # follower already has its own binding
+
+    events, _ = leader.events_since(0)
+    applied = follower.apply_events(events)
+    assert applied == 1  # event was processed (and rejected), not dropped/ignored
+    # the follower's pre-existing binding is untouched by the conflicting gossip event
+    assert follower.api_key_for_wallet("WalletA") == "key-9"
+
+
+# ---------------------------------------------------------- HTTP integration
+
+
+def _post_json(url: str, payload: dict, headers: dict | None = None) -> dict:
+    req = urllib.request.Request(
+        url,
+        data=json.dumps(payload).encode(),
+        headers={"Content-Type": "application/json", **(headers or {})},
+        method="POST",
+    )
+    with urllib.request.urlopen(req) as r:
+        return json.loads(r.read())
+
+
+@pytest.fixture
+def tracker():
+    ledger = BillingLedger(starting_credit=0.0)
+    server = TrackerServer(billing=ledger, accounts=AccountStore(), hive_secret=HIVE_SECRET)
+    port = server.start()
+    yield f"http://127.0.0.1:{port}", ledger
+    server.stop()
+
+
+def test_bind_without_signature_is_rejected(tracker):
+    url, ledger = tracker
+    _, wallet = _keypair()
+    with pytest.raises(urllib.error.HTTPError) as exc_info:
+        _post_json(
+            f"{url}/v1/wallet/register",
+            {"wallet": wallet},
+            headers={"Authorization": "Bearer client-key-1"},
+        )
+    assert exc_info.value.code == 400
+    assert ledger.api_key_for_wallet(wallet) is None
+
+
+def test_bind_with_forged_signature_is_rejected(tracker):
+    url, ledger = tracker
+    priv, wallet = _keypair()
+    forger_priv, _ = _keypair()
+    with pytest.raises(urllib.error.HTTPError) as exc_info:
+        _post_json(
+            f"{url}/v1/wallet/register",
+            {"wallet": wallet, "signature": _sign(forger_priv, "client-key-1", wallet)},
+            headers={"Authorization": "Bearer client-key-1"},
+        )
+    assert exc_info.value.code == 401
+    assert ledger.api_key_for_wallet(wallet) is None
+
+
+def test_valid_signature_binds_wallet(tracker):
+    url, ledger = tracker
+    priv, wallet = _keypair()
+    reply = _post_json(
+        f"{url}/v1/wallet/register",
+        {"wallet": wallet, "signature": _sign(priv, "client-key-1", wallet)},
+        headers={"Authorization": "Bearer client-key-1"},
+    )
+    assert reply == {"wallet": wallet, "bound": True}
+    assert ledger.api_key_for_wallet(wallet) == "client-key-1"
+
+
+def test_second_key_cannot_steal_bound_wallet(tracker):
+    url, ledger = tracker
+    priv, wallet = _keypair()
+    _post_json(
+        f"{url}/v1/wallet/register",
+        {"wallet": wallet, "signature": _sign(priv, "client-key-1", wallet)},
+        headers={"Authorization": "Bearer client-key-1"},
+    )
+
+    # key-2 gets the wallet owner's genuine signature over *their* api_key,
+    # proving they control the private key — still must not steal the binding.
+    with pytest.raises(urllib.error.HTTPError) as exc_info:
+        _post_json(
+            f"{url}/v1/wallet/register",
+            {"wallet": wallet, "signature": _sign(priv, "client-key-2", wallet)},
+            headers={"Authorization": "Bearer client-key-2"},
+        )
+    assert exc_info.value.code == 409
+    assert ledger.api_key_for_wallet(wallet) == "client-key-1"
+
+
+def test_admin_session_can_force_rebind(tracker):
+    url, ledger = tracker
+    priv, wallet = _keypair()
+    _post_json(
+        f"{url}/v1/wallet/register",
+        {"wallet": wallet, "signature": _sign(priv, "client-key-1", wallet)},
+        headers={"Authorization": "Bearer client-key-1"},
+    )
+
+    admin = _post_json(
+        f"{url}/v1/auth/register",
+        {"email": "admin@example.com", "password": "secret-123"},
+    )
+    reply = _post_json(
+        f"{url}/v1/wallet/register",
+        {"wallet": wallet, "api_key": "client-key-2"},
+        headers={"Authorization": f"Bearer {admin['session_token']}"},
+    )
+    assert reply == {"wallet": wallet, "bound": True}
+    assert ledger.api_key_for_wallet(wallet) == "client-key-2"

uv.lock

@@ -34,6 +34,88 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ef/2f/c5464532e965badff2f4c4c1a3a83f5697f0d7c407ed0cda44aaa99bb451/certifi-2026.6.17-py3-none-any.whl", hash = "sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db", size = 133289, upload-time = "2026-06-17T10:31:06.348Z" },
 ]
 
+[[package]]
+name = "cffi"
+version = "2.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pycparser", marker = "implementation_name != 'PyPy'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/eb/56/b1ba7935a17738ae8453301356628e8147c79dbb825bcbc73dc7401f9846/cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529", size = 523588, upload-time = "2025-09-08T23:24:04.541Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/93/d7/516d984057745a6cd96575eea814fe1edd6646ee6efd552fb7b0921dec83/cffi-2.0.0-cp310-cp310-macosx_10_13_x86_64.whl", hash = "sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44", size = 184283, upload-time = "2025-09-08T23:22:08.01Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/84/ad6a0b408daa859246f57c03efd28e5dd1b33c21737c2db84cae8c237aa5/cffi-2.0.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49", size = 180504, upload-time = "2025-09-08T23:22:10.637Z" },
+    { url = "https://files.pythonhosted.org/packages/50/bd/b1a6362b80628111e6653c961f987faa55262b4002fcec42308cad1db680/cffi-2.0.0-cp310-cp310-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c", size = 208811, upload-time = "2025-09-08T23:22:12.267Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/27/6933a8b2562d7bd1fb595074cf99cc81fc3789f6a6c05cdabb46284a3188/cffi-2.0.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb", size = 216402, upload-time = "2025-09-08T23:22:13.455Z" },
+    { url = "https://files.pythonhosted.org/packages/05/eb/b86f2a2645b62adcfff53b0dd97e8dfafb5c8aa864bd0d9a2c2049a0d551/cffi-2.0.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0", size = 203217, upload-time = "2025-09-08T23:22:14.596Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/e0/6cbe77a53acf5acc7c08cc186c9928864bd7c005f9efd0d126884858a5fe/cffi-2.0.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4", size = 203079, upload-time = "2025-09-08T23:22:15.769Z" },
+    { url = "https://files.pythonhosted.org/packages/98/29/9b366e70e243eb3d14a5cb488dfd3a0b6b2f1fb001a203f653b93ccfac88/cffi-2.0.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453", size = 216475, upload-time = "2025-09-08T23:22:17.427Z" },
+    { url = "https://files.pythonhosted.org/packages/21/7a/13b24e70d2f90a322f2900c5d8e1f14fa7e2a6b3332b7309ba7b2ba51a5a/cffi-2.0.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495", size = 218829, upload-time = "2025-09-08T23:22:19.069Z" },
+    { url = "https://files.pythonhosted.org/packages/60/99/c9dc110974c59cc981b1f5b66e1d8af8af764e00f0293266824d9c4254bc/cffi-2.0.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5", size = 211211, upload-time = "2025-09-08T23:22:20.588Z" },
+    { url = "https://files.pythonhosted.org/packages/49/72/ff2d12dbf21aca1b32a40ed792ee6b40f6dc3a9cf1644bd7ef6e95e0ac5e/cffi-2.0.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb", size = 218036, upload-time = "2025-09-08T23:22:22.143Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/cc/027d7fb82e58c48ea717149b03bcadcbdc293553edb283af792bd4bcbb3f/cffi-2.0.0-cp310-cp310-win32.whl", hash = "sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a", size = 172184, upload-time = "2025-09-08T23:22:23.328Z" },
+    { url = "https://files.pythonhosted.org/packages/33/fa/072dd15ae27fbb4e06b437eb6e944e75b068deb09e2a2826039e49ee2045/cffi-2.0.0-cp310-cp310-win_amd64.whl", hash = "sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739", size = 182790, upload-time = "2025-09-08T23:22:24.752Z" },
+    { url = "https://files.pythonhosted.org/packages/12/4a/3dfd5f7850cbf0d06dc84ba9aa00db766b52ca38d8b86e3a38314d52498c/cffi-2.0.0-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe", size = 184344, upload-time = "2025-09-08T23:22:26.456Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/8b/f0e4c441227ba756aafbe78f117485b25bb26b1c059d01f137fa6d14896b/cffi-2.0.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c", size = 180560, upload-time = "2025-09-08T23:22:28.197Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/b7/1200d354378ef52ec227395d95c2576330fd22a869f7a70e88e1447eb234/cffi-2.0.0-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92", size = 209613, upload-time = "2025-09-08T23:22:29.475Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/56/6033f5e86e8cc9bb629f0077ba71679508bdf54a9a5e112a3c0b91870332/cffi-2.0.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93", size = 216476, upload-time = "2025-09-08T23:22:31.063Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/7f/55fecd70f7ece178db2f26128ec41430d8720f2d12ca97bf8f0a628207d5/cffi-2.0.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5", size = 203374, upload-time = "2025-09-08T23:22:32.507Z" },
+    { url = "https://files.pythonhosted.org/packages/84/ef/a7b77c8bdc0f77adc3b46888f1ad54be8f3b7821697a7b89126e829e676a/cffi-2.0.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664", size = 202597, upload-time = "2025-09-08T23:22:34.132Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/91/500d892b2bf36529a75b77958edfcd5ad8e2ce4064ce2ecfeab2125d72d1/cffi-2.0.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26", size = 215574, upload-time = "2025-09-08T23:22:35.443Z" },
+    { url = "https://files.pythonhosted.org/packages/44/64/58f6255b62b101093d5df22dcb752596066c7e89dd725e0afaed242a61be/cffi-2.0.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9", size = 218971, upload-time = "2025-09-08T23:22:36.805Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/49/fa72cebe2fd8a55fbe14956f9970fe8eb1ac59e5df042f603ef7c8ba0adc/cffi-2.0.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414", size = 211972, upload-time = "2025-09-08T23:22:38.436Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/28/dd0967a76aab36731b6ebfe64dec4e981aff7e0608f60c2d46b46982607d/cffi-2.0.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743", size = 217078, upload-time = "2025-09-08T23:22:39.776Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/c0/015b25184413d7ab0a410775fdb4a50fca20f5589b5dab1dbbfa3baad8ce/cffi-2.0.0-cp311-cp311-win32.whl", hash = "sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5", size = 172076, upload-time = "2025-09-08T23:22:40.95Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/8f/dc5531155e7070361eb1b7e4c1a9d896d0cb21c49f807a6c03fd63fc877e/cffi-2.0.0-cp311-cp311-win_amd64.whl", hash = "sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5", size = 182820, upload-time = "2025-09-08T23:22:42.463Z" },
+    { url = "https://files.pythonhosted.org/packages/95/5c/1b493356429f9aecfd56bc171285a4c4ac8697f76e9bbbbb105e537853a1/cffi-2.0.0-cp311-cp311-win_arm64.whl", hash = "sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d", size = 177635, upload-time = "2025-09-08T23:22:43.623Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/47/4f61023ea636104d4f16ab488e268b93008c3d0bb76893b1b31db1f96802/cffi-2.0.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d", size = 185271, upload-time = "2025-09-08T23:22:44.795Z" },
+    { url = "https://files.pythonhosted.org/packages/df/a2/781b623f57358e360d62cdd7a8c681f074a71d445418a776eef0aadb4ab4/cffi-2.0.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c", size = 181048, upload-time = "2025-09-08T23:22:45.938Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/df/a4f0fbd47331ceeba3d37c2e51e9dfc9722498becbeec2bd8bc856c9538a/cffi-2.0.0-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe", size = 212529, upload-time = "2025-09-08T23:22:47.349Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/72/12b5f8d3865bf0f87cf1404d8c374e7487dcf097a1c91c436e72e6badd83/cffi-2.0.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062", size = 220097, upload-time = "2025-09-08T23:22:48.677Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/95/7a135d52a50dfa7c882ab0ac17e8dc11cec9d55d2c18dda414c051c5e69e/cffi-2.0.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e", size = 207983, upload-time = "2025-09-08T23:22:50.06Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/c8/15cb9ada8895957ea171c62dc78ff3e99159ee7adb13c0123c001a2546c1/cffi-2.0.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037", size = 206519, upload-time = "2025-09-08T23:22:51.364Z" },
+    { url = "https://files.pythonhosted.org/packages/78/2d/7fa73dfa841b5ac06c7b8855cfc18622132e365f5b81d02230333ff26e9e/cffi-2.0.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba", size = 219572, upload-time = "2025-09-08T23:22:52.902Z" },
+    { url = "https://files.pythonhosted.org/packages/07/e0/267e57e387b4ca276b90f0434ff88b2c2241ad72b16d31836adddfd6031b/cffi-2.0.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94", size = 222963, upload-time = "2025-09-08T23:22:54.518Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/75/1f2747525e06f53efbd878f4d03bac5b859cbc11c633d0fb81432d98a795/cffi-2.0.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187", size = 221361, upload-time = "2025-09-08T23:22:55.867Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/2b/2b6435f76bfeb6bbf055596976da087377ede68df465419d192acf00c437/cffi-2.0.0-cp312-cp312-win32.whl", hash = "sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18", size = 172932, upload-time = "2025-09-08T23:22:57.188Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/ed/13bd4418627013bec4ed6e54283b1959cf6db888048c7cf4b4c3b5b36002/cffi-2.0.0-cp312-cp312-win_amd64.whl", hash = "sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5", size = 183557, upload-time = "2025-09-08T23:22:58.351Z" },
+    { url = "https://files.pythonhosted.org/packages/95/31/9f7f93ad2f8eff1dbc1c3656d7ca5bfd8fb52c9d786b4dcf19b2d02217fa/cffi-2.0.0-cp312-cp312-win_arm64.whl", hash = "sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6", size = 177762, upload-time = "2025-09-08T23:22:59.668Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/8d/a0a47a0c9e413a658623d014e91e74a50cdd2c423f7ccfd44086ef767f90/cffi-2.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb", size = 185230, upload-time = "2025-09-08T23:23:00.879Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/d2/a6c0296814556c68ee32009d9c2ad4f85f2707cdecfd7727951ec228005d/cffi-2.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca", size = 181043, upload-time = "2025-09-08T23:23:02.231Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/1e/d22cc63332bd59b06481ceaac49d6c507598642e2230f201649058a7e704/cffi-2.0.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b", size = 212446, upload-time = "2025-09-08T23:23:03.472Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/f5/a2c23eb03b61a0b8747f211eb716446c826ad66818ddc7810cc2cc19b3f2/cffi-2.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b", size = 220101, upload-time = "2025-09-08T23:23:04.792Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/7f/e6647792fc5850d634695bc0e6ab4111ae88e89981d35ac269956605feba/cffi-2.0.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2", size = 207948, upload-time = "2025-09-08T23:23:06.127Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/1e/a5a1bd6f1fb30f22573f76533de12a00bf274abcdc55c8edab639078abb6/cffi-2.0.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3", size = 206422, upload-time = "2025-09-08T23:23:07.753Z" },
+    { url = "https://files.pythonhosted.org/packages/98/df/0a1755e750013a2081e863e7cd37e0cdd02664372c754e5560099eb7aa44/cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26", size = 219499, upload-time = "2025-09-08T23:23:09.648Z" },
+    { url = "https://files.pythonhosted.org/packages/50/e1/a969e687fcf9ea58e6e2a928ad5e2dd88cc12f6f0ab477e9971f2309b57c/cffi-2.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c", size = 222928, upload-time = "2025-09-08T23:23:10.928Z" },
+    { url = "https://files.pythonhosted.org/packages/36/54/0362578dd2c9e557a28ac77698ed67323ed5b9775ca9d3fe73fe191bb5d8/cffi-2.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b", size = 221302, upload-time = "2025-09-08T23:23:12.42Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/6d/bf9bda840d5f1dfdbf0feca87fbdb64a918a69bca42cfa0ba7b137c48cb8/cffi-2.0.0-cp313-cp313-win32.whl", hash = "sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27", size = 172909, upload-time = "2025-09-08T23:23:14.32Z" },
+    { url = "https://files.pythonhosted.org/packages/37/18/6519e1ee6f5a1e579e04b9ddb6f1676c17368a7aba48299c3759bbc3c8b3/cffi-2.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75", size = 183402, upload-time = "2025-09-08T23:23:15.535Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/0e/02ceeec9a7d6ee63bb596121c2c8e9b3a9e150936f4fbef6ca1943e6137c/cffi-2.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91", size = 177780, upload-time = "2025-09-08T23:23:16.761Z" },
+    { url = "https://files.pythonhosted.org/packages/92/c4/3ce07396253a83250ee98564f8d7e9789fab8e58858f35d07a9a2c78de9f/cffi-2.0.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5", size = 185320, upload-time = "2025-09-08T23:23:18.087Z" },
+    { url = "https://files.pythonhosted.org/packages/59/dd/27e9fa567a23931c838c6b02d0764611c62290062a6d4e8ff7863daf9730/cffi-2.0.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13", size = 181487, upload-time = "2025-09-08T23:23:19.622Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/43/0e822876f87ea8a4ef95442c3d766a06a51fc5298823f884ef87aaad168c/cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b", size = 220049, upload-time = "2025-09-08T23:23:20.853Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/89/76799151d9c2d2d1ead63c2429da9ea9d7aac304603de0c6e8764e6e8e70/cffi-2.0.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c", size = 207793, upload-time = "2025-09-08T23:23:22.08Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/dd/3465b14bb9e24ee24cb88c9e3730f6de63111fffe513492bf8c808a3547e/cffi-2.0.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef", size = 206300, upload-time = "2025-09-08T23:23:23.314Z" },
+    { url = "https://files.pythonhosted.org/packages/47/d9/d83e293854571c877a92da46fdec39158f8d7e68da75bf73581225d28e90/cffi-2.0.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775", size = 219244, upload-time = "2025-09-08T23:23:24.541Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/0f/1f177e3683aead2bb00f7679a16451d302c436b5cbf2505f0ea8146ef59e/cffi-2.0.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205", size = 222828, upload-time = "2025-09-08T23:23:26.143Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/0f/cafacebd4b040e3119dcb32fed8bdef8dfe94da653155f9d0b9dc660166e/cffi-2.0.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1", size = 220926, upload-time = "2025-09-08T23:23:27.873Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/aa/df335faa45b395396fcbc03de2dfcab242cd61a9900e914fe682a59170b1/cffi-2.0.0-cp314-cp314-win32.whl", hash = "sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f", size = 175328, upload-time = "2025-09-08T23:23:44.61Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/92/882c2d30831744296ce713f0feb4c1cd30f346ef747b530b5318715cc367/cffi-2.0.0-cp314-cp314-win_amd64.whl", hash = "sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25", size = 185650, upload-time = "2025-09-08T23:23:45.848Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/2c/98ece204b9d35a7366b5b2c6539c350313ca13932143e79dc133ba757104/cffi-2.0.0-cp314-cp314-win_arm64.whl", hash = "sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad", size = 180687, upload-time = "2025-09-08T23:23:47.105Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/61/c768e4d548bfa607abcda77423448df8c471f25dbe64fb2ef6d555eae006/cffi-2.0.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9", size = 188773, upload-time = "2025-09-08T23:23:29.347Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/ea/5f76bce7cf6fcd0ab1a1058b5af899bfbef198bea4d5686da88471ea0336/cffi-2.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d", size = 185013, upload-time = "2025-09-08T23:23:30.63Z" },
+    { url = "https://files.pythonhosted.org/packages/be/b4/c56878d0d1755cf9caa54ba71e5d049479c52f9e4afc230f06822162ab2f/cffi-2.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c", size = 221593, upload-time = "2025-09-08T23:23:31.91Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/0d/eb704606dfe8033e7128df5e90fee946bbcb64a04fcdaa97321309004000/cffi-2.0.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8", size = 209354, upload-time = "2025-09-08T23:23:33.214Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/19/3c435d727b368ca475fb8742ab97c9cb13a0de600ce86f62eab7fa3eea60/cffi-2.0.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc", size = 208480, upload-time = "2025-09-08T23:23:34.495Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/44/681604464ed9541673e486521497406fadcc15b5217c3e326b061696899a/cffi-2.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592", size = 221584, upload-time = "2025-09-08T23:23:36.096Z" },
+    { url = "https://files.pythonhosted.org/packages/25/8e/342a504ff018a2825d395d44d63a767dd8ebc927ebda557fecdaca3ac33a/cffi-2.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512", size = 224443, upload-time = "2025-09-08T23:23:37.328Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/5e/b666bacbbc60fbf415ba9988324a132c9a7a0448a9a8f125074671c0f2c3/cffi-2.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4", size = 223437, upload-time = "2025-09-08T23:23:38.945Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/1d/ec1a60bd1a10daa292d3cd6bb0b359a81607154fb8165f3ec95fe003b85c/cffi-2.0.0-cp314-cp314t-win32.whl", hash = "sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e", size = 180487, upload-time = "2025-09-08T23:23:40.423Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/41/4c1168c74fac325c0c8156f04b6749c8b6a8f405bbf91413ba088359f60d/cffi-2.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6", size = 191726, upload-time = "2025-09-08T23:23:41.742Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/3a/dbeec9d1ee0844c679f6bb5d6ad4e9f198b1224f4e7a32825f47f6192b0c/cffi-2.0.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9", size = 184195, upload-time = "2025-09-08T23:23:43.004Z" },
+]
+
 [[package]]
 name = "charset-normalizer"
 version = "3.4.7"
@@ -148,6 +230,63 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
 ]
 
+[[package]]
+name = "cryptography"
+version = "49.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
+    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/1f/99/d1c90d6041656cc6ee229dc99cd67fd0cd5aec3c5f7d72fffc27cc750054/cryptography-49.0.0.tar.gz", hash = "sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493", size = 854345, upload-time = "2026-06-12T20:02:30.512Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/9b/22/adf66990e63584a68dfb50c24f48a125c07b1699899381c8151e63ed458c/cryptography-49.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db", size = 4032100, upload-time = "2026-06-12T20:02:32.143Z" },
+    { url = "https://files.pythonhosted.org/packages/09/41/3797cfaf69cae04a13ee78ebd83f0678d9c02b4779d21ce24445326f1a69/cryptography-49.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db", size = 4692978, upload-time = "2026-06-12T20:01:21.305Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/8b/43011f7ebe515a8aa20d61f290a326cd890c2e738e16e59eaff8d9c3a412/cryptography-49.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325", size = 4716422, upload-time = "2026-06-12T20:01:48.566Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/91/01ce7303a4579e6d3a6abef01bd322848e9ea7a219adcabc5048b9033571/cryptography-49.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2", size = 4700503, upload-time = "2026-06-12T20:02:47.091Z" },
+    { url = "https://files.pythonhosted.org/packages/62/99/a2c95cf8293f07491e9e27c20cc4dcd18176d944e674679adeb1d0173fd6/cryptography-49.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b", size = 5309779, upload-time = "2026-06-12T20:02:08.987Z" },
+    { url = "https://files.pythonhosted.org/packages/20/2c/0622f20ff02b2ef32558733443805dc82fd4c275be01b2d19d14676f3a1b/cryptography-49.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6", size = 4749683, upload-time = "2026-06-12T20:02:03.335Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5b/c5246635d5fd3b64e0d45ae10e99fd32fe9676a79915ccfe5a61ba9af1a5/cryptography-49.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c", size = 4337874, upload-time = "2026-06-12T20:02:54.323Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/88/05563c7fe2e914e87d1a536d06fe83e66b4e1d95cb593e05aea375531da8/cryptography-49.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7", size = 4700283, upload-time = "2026-06-12T20:01:34.822Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/b6/d7696e4e890d6ae1469935164c9e5215c557671cb78d6e3f458ccceaa632/cryptography-49.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68", size = 5265844, upload-time = "2026-06-12T20:01:24.09Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/3c/f3ad17eecc1a57b0ba236dc01f90e783c51f4a2f35f64777cc4f47a184b2/cryptography-49.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9", size = 4749290, upload-time = "2026-06-12T20:01:30.848Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/01/339573cf1023163a400b0b5d16f6d507de413b9f60be6fd1b77feeaf6737/cryptography-49.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f", size = 4834612, upload-time = "2026-06-12T20:01:29.246Z" },
+    { url = "https://files.pythonhosted.org/packages/71/fd/577302e213a1be9468f92d1afef66fcf1ef83d516819d9992ca547f592bd/cryptography-49.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459", size = 4980804, upload-time = "2026-06-12T20:01:42.853Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/09/f42b1d190c5ba75f72062a387f8030d1d75f6ab035788f1d9c4b01de6525/cryptography-49.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e", size = 3810026, upload-time = "2026-06-12T20:02:39.262Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/9e/db72b3ae7fc9cfad53e630e56c6ae83b9b6ff0bf3718ffb8012d20b3aabf/cryptography-49.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:73a205dce83953d131a4aa1e0fd917a2fd1c5b1eef251e9d7152efefcbf5caf7", size = 4013892, upload-time = "2026-06-12T20:02:10.735Z" },
+    { url = "https://files.pythonhosted.org/packages/86/12/c48a424f38db03027be9f7ed5c7dc5de9933dbee992865f98b13727a009d/cryptography-49.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:196ecd6a36e4e9aa10270393bb98d8df88fccee0bf1e5128b91ae4eb4375896d", size = 4678835, upload-time = "2026-06-12T20:02:48.743Z" },
+    { url = "https://files.pythonhosted.org/packages/68/28/8a3ad4653662c93fc44dc4e5d8fd374c25c42e07b34bbfbadf49cf57a5a8/cryptography-49.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7abcee80084cda3f7691f3eb1ce480d8df49cec637b429aa35986c1de71738aa", size = 4697239, upload-time = "2026-06-12T20:02:56.03Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/b2/2193fc74f81aee4f9b62733133b73b5176718932ed8f2e4b03fa040480a6/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:4ae387c9cb68ea569ca17e490d66d8142b81c3cc814bf179974b7d146e490bbb", size = 4685593, upload-time = "2026-06-12T20:02:50.666Z" },
+    { url = "https://files.pythonhosted.org/packages/47/f1/1d3eaa243bfc5de4a187b22aa8c048b3e4980bfbe830ac46e6bac2e66947/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:f37d847238971164fdbc68ade6f6574aecc9c0af714190e2083429ff68f4ce9d", size = 5289961, upload-time = "2026-06-12T20:01:46.468Z" },
+    { url = "https://files.pythonhosted.org/packages/58/39/2d51306721330c486495853eda1c567880ff036de15a14c4b74f399934af/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:c2bc30226390d60ea19d9f82b19db005fe0452154a23c1c410c12ea801e43561", size = 4731145, upload-time = "2026-06-12T20:02:16.832Z" },
+    { url = "https://files.pythonhosted.org/packages/17/50/983e838c7fd0d87fd8c969bcdd328edaf5f756e38df5281637424c155873/cryptography-49.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:07cab27cc7b7e0fd28e5e26bb9eeedde5c135c868b46de4a27845abe94af6122", size = 4321719, upload-time = "2026-06-12T20:02:52.611Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/f5/8f571d7e27c55bce9f76f026143bcb1e040a4233149ecca0bea5fa5dd5f7/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:b20133d204d2bb56ba047642199603876c872026ca53e79c35b83772ab2cc505", size = 4685209, upload-time = "2026-06-12T20:02:07.282Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/84/0e27016a6fc5a0886f797018b26aa42f40c09a82332bff77822a451deaaa/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:b970c6da94d5bb18629db453d14f2a1300f6bf59b61e9b82377931ef95504866", size = 5246285, upload-time = "2026-06-12T20:01:32.439Z" },
+    { url = "https://files.pythonhosted.org/packages/11/2d/5e1fb307cb5931881516b464c98774b3f2c36b5d4bb9a2830253cf553cad/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d8ecde755e2e91bf773fc94e8c9d730cd7f2007004cb492263a794ec3899a1c8", size = 4730441, upload-time = "2026-06-12T20:02:01.469Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/c0/bff5a02ee731d207d6a1ed51732549d8c53d2bc8da1d10ec6f2844201d68/cryptography-49.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e3fb64c420688e5319ae25113a354015abbd8dffbfbc41781a1ea66fc7622ac3", size = 4815869, upload-time = "2026-06-12T20:01:36.574Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/26/814681d14248d95d73d5c3eea0c39a94eb8302df966f670a2c60de90974b/cryptography-49.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:32703d93296f5c1f4b53349ad3a250c2cae0fdecd3a3dd5d47e616d8d616af27", size = 4960948, upload-time = "2026-06-12T20:02:18.688Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/fe/93ecac273d3738939d023612ad12cca9a3740a5345d69fda04134c43fd96/cryptography-49.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:33cd0565932807baddb67b96dbee92f2c374b5c89dee09fd74079aeb8c8dba61", size = 3799153, upload-time = "2026-06-12T20:01:39.059Z" },
+    { url = "https://files.pythonhosted.org/packages/19/2a/5bb823f5bedcf80718cea7fbc95ec5515cca3769633c4b01a32be7f30e7c/cryptography-49.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a", size = 4025947, upload-time = "2026-06-12T20:01:25.745Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/df/40577043ca124e17012f408ddddaeb213b856336ac82ddb3bc915f39e29f/cryptography-49.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4", size = 4692429, upload-time = "2026-06-12T20:01:53.628Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/99/2d13299eb3dd27b02dcfaafcc91d6b5cb3329f7cbd6d8f51921acd566c1a/cryptography-49.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18", size = 4700968, upload-time = "2026-06-12T20:02:45.383Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/4d/9c0cd02f95e2602dd5e563da149ee0830abef3537be8b34dc56281ebe27a/cryptography-49.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69", size = 4697758, upload-time = "2026-06-12T20:01:41.13Z" },
+    { url = "https://files.pythonhosted.org/packages/24/01/186c825898477d77e2324d5360fefe622ff1d8d1963ec0554e2cada8ec77/cryptography-49.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64", size = 5298863, upload-time = "2026-06-12T20:02:24.579Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/7b/62cbbab75d0659865bf0273790031544a0b16c8072d258f9428dcd8190dc/cryptography-49.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21", size = 4735983, upload-time = "2026-06-12T20:01:50.14Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/72/3e798c064bc39e471008075d0f9bc9daf77a80879c092e4a8e170c585ed4/cryptography-49.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9", size = 4334173, upload-time = "2026-06-12T20:01:44.743Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/ee/6fca21d1ac73e06f8bef71940abfd4d2f6472b4bca284d770f32bd4086f6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc", size = 4697298, upload-time = "2026-06-12T20:02:20.918Z" },
+    { url = "https://files.pythonhosted.org/packages/67/d0/a5fcd3515f0bae49a7b6d0413cc1bdccdcc1fc0047037a0d480642cdc5d6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8", size = 5254338, upload-time = "2026-06-12T20:02:22.737Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/84/84fe36f19caf857d61cb7fc9c63035a47ffabd84ea12d1d393148efa3615/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36", size = 4735650, upload-time = "2026-06-12T20:02:41.389Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/a0/db537264e234f7273a73ec020873d6d6b39dfd8a53db78b550ca8320440e/cryptography-49.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e", size = 4834820, upload-time = "2026-06-12T20:01:51.847Z" },
+    { url = "https://files.pythonhosted.org/packages/93/77/8df9eb486495979bccecd1062e2eaf435250e84437040295b57d09048b0b/cryptography-49.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b", size = 4967968, upload-time = "2026-06-12T20:02:12.524Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/e6/f60198ea8d9dfa15fff9ed4ca02ce362f6eadd9ba757dcc50634c4257b63/cryptography-49.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001", size = 3785547, upload-time = "2026-06-12T20:02:26.847Z" },
+    { url = "https://files.pythonhosted.org/packages/63/d3/4a83af35d65e3fad632c926fad684c193ea4398569ccb0bbbc7fe8f5dc9a/cryptography-49.0.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:fc1e275c2f1d97b1a6450b8b0ea3ebfa6e087a611c2b26cb2404d48588abab7b", size = 3993685, upload-time = "2026-06-12T20:02:14.883Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/a7/f9dac0ab7f80368c56993a7bf638ef9935f825c91902798481fac0898138/cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:c83782480a4a9da4d0feb51950131ba32e12e70813848b3343f6e18c28a66838", size = 4676239, upload-time = "2026-06-12T20:02:28.793Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/70/2ba3769dd0ae167e2f33dfa9592d45db6ff9a61d62ca1a5b3d1bdd09068f/cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:b39efa323140595abd3ecca8529d321ae50f55f3aa3ba9cc81ea56a6011953d5", size = 4715584, upload-time = "2026-06-12T20:01:27.495Z" },
+    { url = "https://files.pythonhosted.org/packages/94/64/2923570ac1c0bd3a737aa366ac3abbbbde273042308b8cde95e2364a6e6a/cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:b47db11c2c3525083296069b98ac5221907455e989ae0c2e3008bde851921615", size = 4675885, upload-time = "2026-06-12T20:01:55.49Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/f8/614dc7e051418cfe53d55173c1e24c6b0085e89996fe90508c2fdf769aef/cryptography-49.0.0-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:084ef1af862eb07ec46d25f68689f2102a9fc0e05ce7b80f14f5fe51e4eef0f6", size = 4715449, upload-time = "2026-06-12T20:02:05.469Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/50/a9caea39ad19c431c1a3f8a31114df65b260cdfe67786b6c7e7c040c4c44/cryptography-49.0.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:be9fcb48a55f023493482827d4f459bd263cc20efde64f204b97c123201850c6", size = 3783731, upload-time = "2026-06-12T20:02:43.319Z" },
+]
+
 [[package]]
 name = "distributed-inference-network"
 version = "0.1.0"
@@ -155,6 +294,7 @@ source = { editable = "." }
 
 [package.optional-dependencies]
 dev = [
+    { name = "cryptography" },
     { name = "langchain-openai" },
     { name = "openai" },
     { name = "pytest" },
@@ -162,6 +302,7 @@ dev = [
 
 [package.metadata]
 requires-dist = [
+    { name = "cryptography", marker = "extra == 'dev'", specifier = ">=41" },
     { name = "langchain-openai", marker = "extra == 'dev'", specifier = ">=0.1" },
     { name = "openai", marker = "extra == 'dev'", specifier = ">=1" },
     { name = "pytest", marker = "extra == 'dev'", specifier = ">=8" },
@@ -553,6 +694,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
 ]
 
+[[package]]
+name = "pycparser"
+version = "3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/1b/7d/92392ff7815c21062bea51aa7b87d45576f649f16458d78b7cf94b9ab2e6/pycparser-3.0.tar.gz", hash = "sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29", size = 103492, upload-time = "2026-01-21T14:26:51.89Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/0c/c3/44f3fbbfa403ea2a7c779186dc20772604442dde72947e7d01069cbe98e3/pycparser-3.0-py3-none-any.whl", hash = "sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992", size = 48172, upload-time = "2026-01-21T14:26:50.693Z" },
+]
+
 [[package]]
 name = "pydantic"
 version = "2.13.4"