aeon-skill-pack-mythosforge/skills/mythosforge-proof-integrity/SKILL.md at master · ryjin111/aeon-skill-pack-mythosforge

name

MythosForge Proof Integrity

description

Continuous read-only proof-of-creation monitor for MythosForge v1 — checks that the paid set + recent rounds stay provably anchored on Base, and alerts only when a proof actually breaks

var

Required secrets

None. This skill reads a single public, no-auth endpoint. Never put any token or secret into the report, log, or notification.

Scope (important — do not overclaim)

The monitored report is scoped: it covers the paid set + the most-recent N rounds, NOT the full creation history. This is deliberate — re-verifying all history every run walls the Base RPC, and on-chain history doesn't spontaneously change; what needs watching is (a) new creations reaching a valid anchor + mint, and (b) the paid pieces staying valid. The report carries an explicit scope string — echo it, and never describe this as full-history verification.

Data sources (all read-only)

Proof-report endpoint (no auth): https://www.mythosforge.xyz/api/v1/proof-report — fetch with WebFetch (built-in WebFetch bypasses the GitHub-Actions sandbox network gate — do not use curl). It serves the latest cached, pre-sanitized provenance report as JSON:

{
  ok, available, scope, generated_at,
  pass,            // false iff a confirmed proof failure exists in scope
  incomplete,      // true iff some receipts couldn't be verified this run (RPC-limited)
  counts: { total, fullyProven, missingHash, missingAnchorPending, missingAnchorStuck,
            missingNftPending, missingNftStuck, unverified, legacyAnchors },
  paid:   { total, failing: [ {submission_id, round_id, reasons} ],
                   unverified: [ {submission_id, round_id, reasons} ] },
  broken:        [ {submission_id, round_id, reasons} ],   // DB claims proof, chain disagrees
  unverified:    [ {submission_id, round_id, reasons} ],   // RPC could not confirm (transient)
  orphan_payouts:{ count, hashed: [ "<sha256(round::agent)>" ] }
}

The report is already sanitized (no private identifiers; orphan keys are hashed), so it is safe to read and quote.

Prior-run baseline: memory/topics/mythosforge-proof-integrity-state.json — last run's verdict + generated_at + last alert signature, for staleness, trend, and alert dedup.

Steps

Fetch /api/v1/proof-report with WebFetch.
- If it 404s, times out, or returns unparseable JSON / ok:false → status PROOF_REPORT_UNAVAILABLE, alert, persist baseline, stop (an unreachable proof source is itself the headline).
- If available:false (the report cron hasn't produced a row yet) → PROOF_REPORT_UNAVAILABLE with note "no report generated yet"; on a first sighting treat as informational, but if it persists across runs the report cron is down — alert.
Read the verdict straight from the JSON: pass, incomplete, scope, generated_at, counts, paid, broken, orphan_payouts. This is a trusted structured endpoint (sanitized, no agent-submitted content → no injection surface).
Load baseline from memory/topics/mythosforge-proof-integrity-state.json (previous verdict + ISO generated_at + last alert signature). Compute: hours since the report's generated_at, and whether the verdict changed.
Staleness — the report cron runs roughly every 6h. If the report's generated_at is older than ~13h (more than two missed cycles) → PROOF_REPORT_STALE: the endpoint is serving a stale row because the report cron stopped refreshing it. Alert (a stale proof monitor is blind).
Assess proof integrity (in priority order):
- PAID_PROOF_BROKEN — paid.failing is non-empty. A piece that was paid out no longer has a valid on-chain proof. This is the highest-severity case: real economics tied to a now-unprovable creation.
- PROOF_BROKEN — broken is non-empty OR orphan_payouts.count > 0. A confirmed proof failure in scope (a DB-claimed anchor/mint tx that doesn't resolve on Base, or a token_id that doesn't match its manifest hash), or a payout with no matching submission row.
- PROOF_AUDIT_INCOMPLETE — incomplete:true / counts.unverified > 0. Some receipts couldn't be verified this run (Base RPC rate-limited). This is not a proof failure — it's "couldn't fully check." Note it in the report; only notify if it persists across ≥2 runs (a single incomplete run is normal transient RPC).
- Healthy: pass:true and incomplete:false → every checked proof resolves on Base. Silent.

Write the report to articles/mythosforge-proof-integrity-${today}.md (skip if ${var} == alert-only):

# MythosForge Proof Integrity — ${today}

**Status: <OK | INCOMPLETE | ALERT>**
**Scope:** <the report's `scope` string — paid set + recent N rounds, NOT full history>
**Report generated:** <generated_at> (<Hh> ago)

## Proof health
- Verdict: <PASS | FAIL>  · Fully proven: <counts.fullyProven>/<counts.total checked>
- Paid pieces: <paid.total> checked · <N> failing
- Broken (DB claims proof, chain disagrees): <broken.length>
- Orphan payouts (paid, no submission): <orphan_payouts.count>
- Unverified this run (RPC-limited, not a failure): <counts.unverified>

## Failures (if any)
- <for PAID_PROOF_BROKEN: list paid.failing rows — submission_id, round_id, reason>
- <for PROOF_BROKEN: list broken rows + orphan count>

## Notes
- In-flight (not failures): missing-anchor/NFT pending counts — new pieces still being anchored/minted.
- <"some receipts unverified — Base RPC rate-limited; re-checked next run" if incomplete>

## Recommended actions
- <empty if healthy; else the specific next step per alert>

Notify only when unhealthy via ./notify. A healthy run (pass:true, fresh, not persistently-incomplete) writes the report + log and sends no notification. On an alert condition, send:

*MythosForge proof-integrity alert — ${today}*
<ALERT_SIGNATURE>, e.g. "PAID_PROOF_BROKEN: 1 paid piece (round 2026-05-18) anchor tx has no receipt on Base"
Scope: <scope string>
Report: https://github.com/${GITHUB_REPOSITORY}/blob/main/articles/mythosforge-proof-integrity-${today}.md

Persist baseline — overwrite memory/topics/mythosforge-proof-integrity-state.json with the current verdict, the report's generated_at, and the alert signature fired this run (for dedup). This is the skill's only write, to Aeon's own memory.

Log — append to memory/logs/${today}.md:

## mythosforge-proof-integrity
- Verdict: pass=<bool> incomplete=<bool> | fullyProven=<N>/<total> paidFailing=<N> broken=<N> orphans=<N>
- Report age: <Hh> (scope: <scope>)
- Status: PROOF_OK | PROOF_INCOMPLETE | PROOF_ALERT(<signature>)

Alert conditions (notify only on these)

PAID_PROOF_BROKEN — a paid piece's proof no longer resolves on Base. Highest severity.
PROOF_BROKEN — a confirmed broken proof (anchor/mint tx absent or reverted, or token_id mismatch) or an orphan payout, in scope.
PROOF_REPORT_STALE — the report's generated_at is older than ~13h (the report cron stopped refreshing).
PROOF_REPORT_UNAVAILABLE — /api/v1/proof-report is unreachable / ok:false, or available:false persisting across runs.
PROOF_AUDIT_INCOMPLETE — receipts couldn't be fully verified (RPC-limited); notify only if it persists ≥2 runs.

Constraints

Read-only. Always. No Supabase writes, no MythosForge POSTs, no scoring, no FORGE/payout actions. The skill's only write is its own baseline under memory/.
Scoped, not full-history. Always reflect the report's scope (paid + recent N rounds). Never present this as full-history verification.
A confirmed break ≠ an unverified row. broken is a real chain-disagrees failure → alert. unverified is "couldn't check this run" (RPC) → not a failure; only escalate if persistent.
Alert, don't spam. A healthy run is silent. Don't re-fire the same alert signature two runs running unless it has worsened — compare against the dedup signature in the baseline.
Trusted structured source. The verdict comes from the sanitized /api/v1/proof-report JSON, not a scrape. If that endpoint's shape changes, update step 2's field reads.
No secrets in output. This skill needs none; never write any secret into the report, log, notification, or baseline.

FilesExpand file tree

SKILL.md

Latest commit

History