h

Author: gblinproject

worker/src/index.js

@@ -942,7 +942,7 @@ async function callTool(rawName, env, args = {}) {
 
 function howtoSeal() {
   return {
-        what: "AI Action Receipts: a portable, signed receipt for any AI action, in a public append-only transparency log. Input/output go in as HASHES only (the action label and metadata you send are published); you get back signature + RFC 6962 inclusion proof + operator-signed C2SP checkpoint; the tree root is anchored daily on Base (EAS). Evidence of existence and time — NOT a compliance certificate. Independent witness cosigning: invitation open.",
+        what: "AI Action Receipts: a portable, signed receipt for any AI action, in a public append-only transparency log. Input/output go in as HASHES only (the action label and metadata you send are published); you get back signature + RFC 6962 inclusion proof + a C2SP checkpoint signed by us and cosigned by an independent witness (markovianprotocol.com/witness, since 2026-08-22); the tree root is anchored daily on Base (EAS). Evidence of existence and time — NOT a compliance certificate. A cosignature attests only that the log stayed append-only between the sizes that witness has seen; it says nothing about whether a sealed action is true.",
         paid_endpoint: `${SITE}/api/x402/seal`,
         price: "0.01 USDC on Base via x402 (unlimited)",
         demo: "MCP tool receipts.seal (mode demo) or POST https://gblin-mcp.gblin-mcp-worker.workers.dev/v1/seal-demo (5/day/IP, receipts marked demo:true)",
@@ -1386,12 +1386,12 @@ export default {
     if (url.pathname === "/log" && request.method === "GET") {
       const st = await rlogStatus(env);
       return json({ ...st,
-        what: "GBLIN AI Action Receipts — signed append-only RFC 6962 transparency log of sealed AI actions (input/output as hashes only; the action label and metadata you send are published). A seal proves existence and time; root anchored daily on Base via EAS. It is NOT a compliance certificate and NOT an endorsement. Independent witness cosigning of the checkpoint: invitation open.",
+        what: "GBLIN AI Action Receipts — signed append-only RFC 6962 transparency log of sealed AI actions (input/output as hashes only; the action label and metadata you send are published). A seal proves existence and time; root anchored daily on Base via EAS. It is NOT a compliance certificate and NOT an endorsement. The checkpoint is cosigned by an independent witness since 2026-08-22 (see /log/witnesses); that cosignature attests only that the log stayed append-only between the sizes it has seen. More witnesses welcome.",
         seal_paid: "POST https://gblin.digital/api/x402/seal ($0.01 USDC via x402)",
         seal_demo: "POST /v1/seal-demo (5/day/IP, marked demo:true)",
         read: "GET /v1/receipt/:index (free forever) · GET /log/proof/:index · GET /log/checkpoint",
         explorer: "GET /receipt/:index (human page)",
-        for_witnesses: "GET /log/checkpoint (C2SP signed note) · GET /log/consistency?old=<m>&new=<n> (RFC 6962 append-only proof) · GET /log/leaves?start=&end= (raw records, recompute the tree yourself) · GET /log/proof/<i> (inclusion) · GET /log/witnesses (who cosigns, and how to join). We also push our checkpoints with c2sp.org/tlog-witness (POST add-checkpoint) to any witness that configures our origin. Cosigning invitation open.",
+        for_witnesses: "GET /log/checkpoint (C2SP signed note) · GET /log/consistency?old=<m>&new=<n> (RFC 6962 append-only proof) · GET /log/leaves?start=&end= (raw records, recompute the tree yourself) · GET /log/proof/<i> (inclusion) · GET /log/witnesses (who cosigns, and how to join). We also push our checkpoints with c2sp.org/tlog-witness (POST add-checkpoint) to any witness that configures our origin. One witness cosigns today (markovianprotocol.com/witness); more are welcome.",
         anchor: "tree root anchored daily on Base via EAS (schema " + "0x9f433a96..., promiseId keccak256('gblin-receipts-log'))",
         offline_verifier: "verify-receipt.mjs in github.com/gblinproject/gblin-treasury-risk-regime (zero deps)",
         design_note: "https://github.com/gblinproject/gblin-treasury-risk-regime/blob/main/docs/ai-action-transparency-log.md — what a receipt proves and what it does not, wire formats, and the honest scale of this log",
@@ -1612,7 +1612,9 @@ export default {
         } else {
           // Giro di sonde del catalogo SOLO nei tick senza sigillo: il budget
           // free è 50 subrequest/invocazione e il sigillo ne consuma parecchi.
-          await catalogTick(env).catch((e) => console.error("catalog:", e.message));
+          // Una volta all'ora, non a ogni tick: il budget KV free e' 1000 scritture/giorno
+          // e il catalogo ne scriveva una ogni 10 minuti (144) per un dato che cambia di rado.
+          if (new Date().getUTCMinutes() < 10) await catalogTick(env).catch((e) => console.error("catalog:", e.message));
         }
       }
     })();

worker/src/rlog.mjs

@@ -185,7 +185,18 @@ export async function leaves(env, start, end) {
     const c = await env.COHERENCE.get(`rlog:entry:${i}`);
     out.push(c === null ? null : c);
   }
-  return { start, end, size: N, encoding: "raw canonical JSON (gblin-canonical-json/1); leaf = SHA256(0x00 || record)", leaves: out };
+  // Onesta': quattro record (indici 11-14) NON sono JSON valido — contengono il token
+  // letterale `undefined` scritto dal bug del canonicalizzatore corretto il 21/08/2026.
+  // Le foglie restano quei byte esatti (un log append-only non si riscrive) e l'albero e'
+  // corretto, ma un consumatore che fa JSON.parse va in errore: va detto QUI, non solo nei doc.
+  const malformed = [];
+  for (let i = 0; i < out.length; i++) { try { JSON.parse(out[i]); } catch { malformed.push(start + i); } }
+  const res = { start, end, size: N, encoding: "raw record bytes; leaf = SHA256(0x00 || record). Normally gblin-canonical-json/1, but see malformed_indices", leaves: out };
+  if (malformed.length) {
+    res.malformed_indices = malformed;
+    res.malformed_note = "These records are NOT parseable JSON: they contain the literal token `undefined`, written by a canonicalizer bug fixed on 2026-08-21. They are hashed and served as the exact bytes they were appended with, because an append-only log is not rewritten. Hash them as opaque bytes; do not JSON.parse them.";
+  }
+  return res;
 }
 
 // ---------- checkpoint (signed note C2SP) ----------
@@ -226,6 +237,20 @@ export async function witnessState(env) {
   return out;
 }
 
+// Quale size tiene questo witness per il NOSTRO log? Il c2sp espone la nota cofirmata
+// sotto sha256(origin) in esadecimale minuscolo: la leggiamo e ne prendiamo la size.
+async function witnessHeldSize(w, fetchImpl = fetch) {
+  try {
+    const h = new Uint8Array(await crypto.subtle.digest("SHA-256", te.encode(RLOG_ORIGIN)));
+    const hex = [...h].map((b) => b.toString(16).padStart(2, "0")).join("");
+    const base = new URL(w.url); base.pathname = `/${hex}/checkpoint`;
+    const res = await fetchImpl(base.toString());
+    if (res.status !== 200) return null;
+    const n = Number((await res.text()).split("\n")[1]);
+    return Number.isInteger(n) ? n : null;
+  } catch { return null; }
+}
+
 export async function pushToWitnesses(env, { force = false, fetchImpl = fetch } = {}) {
   if (!env.RLOG_KEY) return { skipped: "no key" };
   const N = Number((await env.COHERENCE.get("rlog:size")) || 0);
@@ -253,8 +278,13 @@ export async function pushToWitnesses(env, { force = false, fetchImpl = fetch }
     };
     try {
       let r = await attempt(prev?.size || 0);
-      if (r.status === 409) {                    // il witness ne tiene un'altra: riparti dalla sua
-        const held = Number(r.text.trim().split(/\s+/).pop());
+      // 409 = il witness ne tiene una piu' grande e la dichiara nel corpo.
+      // 422 = la prova non regge per la size che gli abbiamo dichiarato: succede quando
+      // il witness ci ha gia' registrati fuori banda (trust-on-first-use) e noi non lo
+      // sappiamo. In quel caso chiediamo a LUI quale size tiene e rifacciamo la prova.
+      if (r.status === 409 || r.status === 422) {
+        let held = Number(r.text.trim().split(/\s+/).pop());
+        if (!Number.isInteger(held) || held < 0 || held > N) held = await witnessHeldSize(w, fetchImpl);
         if (Number.isInteger(held) && held >= 0 && held <= N) r = await attempt(held);
       }
       if (r.status === 200 && r.text.startsWith(SEP)) {

worker/src/witness.mjs

@@ -184,7 +184,7 @@ export async function witnessHistory(env, id) {
 // State in KV (binding COHERENCE, same namespace as the coherence automaton):
 //   witness:<id>:last   {size, root(b64), ts, cosignedNote, logSigOk:true}
 //   witness:<id>:err    {at, error}   (cleared on success)
-//   witness:<id>:count  number of cosignatures ever produced
+//   witness:<id>:count  contatore STORICO (non piu' scritto: ora vive dentro :last come .count)
 export async function witnessTick(env, fetchImpl = fetch) {
   if (!env.COHERENCE || !env.WITNESS_KEY) return { skipped: "not armed" };
   let keyPair;
@@ -219,10 +219,11 @@ export async function witnessTick(env, fetchImpl = fetch) {
 
       const { line, ts } = await cosign(note, keyPair);
       const cosignedNote = text.endsWith("\n") ? text + line + "\n" : text + "\n" + line + "\n";
-      await env.COHERENCE.put(kLast, JSON.stringify({ size: note.size, root: b64(note.root), ts, cosignedNote, firstSeen: prev?.firstSeen || ts }));
+      // Il contatore sta DENTRO kLast: su Cloudflare free il budget e' 1000 scritture/giorno
+      // e una chiave separata per il conteggio ne bruciava 144 al giorno per niente.
+      const count = (Number.isInteger(prev?.count) ? prev.count : Number((await env.COHERENCE.get(kCount)) || 0)) + 1;
+      await env.COHERENCE.put(kLast, JSON.stringify({ size: note.size, root: b64(note.root), ts, cosignedNote, count, firstSeen: prev?.firstSeen || ts }));
       await appendHistory(env, log.id, { size: note.size, root: b64(note.root), ts, via: "fetch", note: cosignedNote });
-      const count = Number((await env.COHERENCE.get(kCount)) || 0) + 1;
-      await env.COHERENCE.put(kCount, String(count));
       await env.COHERENCE.delete(kErr);
       out[log.id] = { cosigned: true, size: note.size, ts, count };
     } catch (e) {
@@ -335,10 +336,10 @@ export async function witnessAddCheckpoint(env, bodyText) {
   if (!prev || note.size > prev.size) {
     const text = bodyText.slice(sep + 2);
     const cosignedNote = text.endsWith("\n") ? text + line + "\n" : text + "\n" + line + "\n";
-    await env.COHERENCE.put(kLast, JSON.stringify({ size: note.size, root: b64(note.root), ts, cosignedNote, firstSeen: prev?.firstSeen || ts, via: "push" }));
+    const pushCount = (Number.isInteger(prev?.count) ? prev.count : Number((await env.COHERENCE.get(kCount)) || 0)) + 1;
+    await env.COHERENCE.put(kLast, JSON.stringify({ size: note.size, root: b64(note.root), ts, cosignedNote, count: pushCount, firstSeen: prev?.firstSeen || ts, via: "push" }));
     await appendHistory(env, log.id, { size: note.size, root: b64(note.root), ts, via: "push", note: cosignedNote });
-    const count = Number((await env.COHERENCE.get(kCount)) || 0) + 1;
-    await env.COHERENCE.put(kCount, String(count));
+    const count = pushCount;
     await env.COHERENCE.delete(kErr);
   }
   return { status: 200, body: line + "\n" };
@@ -354,7 +355,7 @@ export async function witnessIndex(env) {
     if (env.COHERENCE) {
       try { last = JSON.parse((await env.COHERENCE.get(`witness:${log.id}:last`)) || "null"); } catch { /* none */ }
       try { err = JSON.parse((await env.COHERENCE.get(`witness:${log.id}:err`)) || "null"); } catch { /* none */ }
-      count = Number((await env.COHERENCE.get(`witness:${log.id}:count`)) || 0);
+      count = Number.isInteger(last?.count) ? last.count : Number((await env.COHERENCE.get(`witness:${log.id}:count`)) || 0);
     }
     logs.push({
       id: log.id, origin: log.origin, log: log.base, pinnedLogKey: log.vkey, note: log.note,
@@ -385,7 +386,7 @@ export async function witnessIndex(env) {
       limits: "best effort, work-in-progress service run by one operator; not a production guarantee",
       ourOwnLog: {
         origin: "gblin.digital/receipts-log",
-        note: "We also operate an application transparency log for AI actions; it is operator-signed only and we are looking for witnesses.",
+        note: "We also operate an application transparency log for AI actions (gblin.digital/receipts-log). Since 2026-08-22 it is cosigned by markovianprotocol.com/witness — see /log/witnesses for who cosigns and at which size. More witnesses welcome: we speak the log side of c2sp.org/tlog-witness and push on every size change.",
         designNote: "https://github.com/gblinproject/gblin-treasury-risk-regime/blob/main/docs/ai-action-transparency-log.md",
         forWitnesses: "GET /log/checkpoint · /log/consistency?old=&new= · /log/leaves?start=&end= · /log/proof/<i>",
       },