submit: BHRIGU Bitcoin Temporal Evidence v2

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/RIGHTS.md

@@ -0,0 +1,14 @@
+# Submission rights declaration
+
+Project: `BHRIGU Bitcoin Temporal Evidence`
+Submission slug: `bhrigu-bitcoin-research-state-api`
+Submitter: `Yulchiev A.Kh`
+Date: `2026-09-10`
+
+The submitter confirms that they own, or have sufficient authorization for, the source code, service, frozen public research baselines, durable evidence records, BHRIGU branding used in this package, and other materials submitted in this pull request.
+
+Subject to the official program terms, the submitter authorizes X-Agent to retain, reproduce, audit, test, archive, and publish the submitted program artifact for judging, fraud prevention, dispute handling, ecosystem submission, and post-award accountability. Closing the pull request, deleting a fork, or deleting an external repository does not revoke the official archive rights attached to an accepted and rewarded entry.
+
+Third-party components and their licenses: no bundled runtime dependencies. The service uses the Node.js runtime and calls public Binance market-data and mempool.space endpoints subject to their respective terms. See `source/THIRD_PARTY.md`.
+
+Exceptions or restrictions: authorization covers only the bounded source and materials actually present in this submission directory. ORION, private prompts, planners, evaluators, private corpora, unpublished research methods, credentials, wallet/payment code, and other protected BHRIGU internals are not included in the artifact and are not submitted.

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/SUBMISSION.md

@@ -0,0 +1,56 @@
+# BHRIGU Bitcoin Temporal Evidence
+
+## Capability
+
+- **One-line description:** Lets an AI agent read what Bitcoin evidence was fixed before a declared future boundary, compare it with live reality after the boundary, and inspect durable hash-bound evidence without rewriting the past.
+- **Who it helps:** AI agents and researchers that need reproducible temporal evidence rather than only a live-price snapshot.
+- **Capability boundary:** Read-only Bitcoin research. It does not predict price, trade, place orders, access wallets, move funds, read private account data, or accept credentials.
+
+## Live API
+
+- **API base URL:** https://bhrigu-bitcoin-research-state-api.vercel.app/v1
+- **Health-check URL:** https://bhrigu-bitcoin-research-state-api.vercel.app/health
+- **Authentication:** none
+- **Rate limits / known limits:** BTCUSDT only; public upstream services impose their own limits; market calls fail closed when fresh evidence is unavailable; no SLA is claimed.
+- **API contract:** `GET /v1/state`, `GET /v1/windows`, `GET /v1/windows/{id}`, `POST /mcp`, and `GET /openapi.json`. The MCP endpoint exposes four read-only tools and supports modern `2026-07-28` stateless discovery plus legacy `2025-11-25` / `2025-03-26` compatibility.
+
+## Source and reproducibility
+
+- **Source repository:** https://github.com/AiBhrigu/bhrigu-bitcoin-research-state-api
+- **Review commit:** `905adc26632e4595d998c01da26b3ccd88bf8a6f`
+- **Source submitted in this PR:** `source/`
+- **Run tests:** `npm ci && npm test` (106 deterministic checks: acceptance 18 + temporal 17 + MCP 56 + integrity 15)
+- **Run locally:** `npm ci && npm start`, then call `http://localhost:3000/v1/state`, `/v1/windows`, or `/mcp`.
+- **Deploy:** deploy the exact review commit to Vercel with Node.js 22+; no environment variables or secrets are required.
+- **Version binding:** `/health` and `/.well-known/xagent-verification.json` expose the exact deployed review commit.
+
+## Verification
+
+Repeatable commands and expected results are in `verification/README.md`.
+
+- **Health-check result:** HTTP 200 with `status: ok` and exact review commit.
+- **Capability call:** an agent can `DISCOVER → READ_LOCKED_PAST → COMPARE_LIVE_REALITY` using the four read-only MCP tools or equivalent HTTP endpoints.
+- **Expected error behavior:** unsupported symbols return HTTP 400; write methods are rejected; unsupported modern MCP versions and header/body mismatches fail closed; unavailable market evidence is not fabricated.
+
+## Security and data handling
+
+- **Data collected:** none from users. The service is stateless with respect to user identity and accepts no account, wallet, or credential data.
+- **Purpose and retention:** frozen precommit records and committed post-boundary evidence are public research artifacts retained in source; no personal data is retained.
+- **Third parties / outbound network calls:** Binance public Spot BTCUSDT market data and mempool.space public Bitcoin tip height.
+- **Secrets:** none required; none committed.
+- **Known risks / restrictions:** public upstream availability and rate limits affect live evidence. `SEP_10_2026` has one durable post-boundary evidence record; `SEP_17_2026` is a genuine second precommit and remains pre-boundary until its declared UTC boundary.
+
+## Temporal-evidence proof
+
+`SEP_10_2026` was committed before its `2026-09-10T00:00:00Z` boundary. The original baseline remains hash-pinned and unchanged, and the reviewed source contains a durable post-boundary observation. `SEP_17_2026` provides a second future window. The public registry exposes append-only intent, evidence counts, phases, and artifact hashes so reviewers can distinguish frozen past evidence from live current state.
+
+## MCP productization
+
+`POST /mcp` is shipped, not proposed. It provides four read-only tools for current Bitcoin state, temporal-window discovery, frozen-window retrieval, and live comparison. Modern `2026-07-28` requests are stateless and handshake-free via `server/discover`; legacy clients retain `initialize` compatibility. No MCP tool creates observations or carries trading, wallet, payment, transfer, withdrawal, credential, or private-account authority.
+
+## Support
+
+- **Team / builder:** BHRIGU / AiBhrigu
+- **Contact:** https://x.com/bhrigu_io
+- **Canonical project surface:** https://www.bhrigu.io/
+- **License / rights:** no general open-source license is granted. X-Agent review/archive rights are limited to the bounded submitted artifact and are declared in `RIGHTS.md`.

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+      - run: npm ci
+      - run: npm run check
+      - name: Local HTTP and MCP smoke
+        run: |
+          BHRIGU_COMMIT="$GITHUB_SHA" npm start > /tmp/bhrigu.log 2>&1 &
+          SERVER_PID=$!
+          trap 'kill $SERVER_PID || true' EXIT
+          for n in $(seq 1 20); do
+            curl -fsS http://127.0.0.1:3000/health > /tmp/health.json && break
+            sleep 1
+          done
+          node --input-type=module -e 'const h=JSON.parse(await (await fetch("http://127.0.0.1:3000/health")).text()); if(h.commit!==process.env.GITHUB_SHA) process.exit(1)'
+          curl -fsS http://127.0.0.1:3000/v1/windows > /tmp/windows.json
+          curl -fsS -X POST http://127.0.0.1:3000/mcp \
+            -H 'content-type: application/json' \
+            -H 'MCP-Protocol-Version: 2026-07-28' \
+            -H 'Mcp-Method: server/discover' \
+            --data '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{},"io.modelcontextprotocol/clientInfo":{"name":"ci","version":"1.0.0"}}}}' > /tmp/discover.json
+          curl -fsS -X POST http://127.0.0.1:3000/mcp \
+            -H 'content-type: application/json' \
+            -H 'MCP-Protocol-Version: 2026-07-28' \
+            -H 'Mcp-Method: tools/list' \
+            --data '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}}' > /tmp/mcp-modern.json
+          curl -fsS -X POST http://127.0.0.1:3000/mcp \
+            -H 'content-type: application/json' \
+            -H 'MCP-Protocol-Version: 2026-07-28' \
+            -H 'Mcp-Method: tools/call' \
+            -H 'Mcp-Name: bhrigu_get_temporal_window' \
+            --data '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"bhrigu_get_temporal_window","arguments":{"window_id":"SEP_10_2026"},"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}}' > /tmp/mcp-call.json
+          node --input-type=module -e 'import fs from "node:fs"; const w=JSON.parse(fs.readFileSync("/tmp/windows.json")); const d=JSON.parse(fs.readFileSync("/tmp/discover.json")); const l=JSON.parse(fs.readFileSync("/tmp/mcp-modern.json")); const c=JSON.parse(fs.readFileSync("/tmp/mcp-call.json")); if(w.window_count!==2||w.durable_evidence_count!==1||d.result.resultType!=="complete"||!d.result.supportedVersions.includes("2026-07-28")||l.result.tools.length!==4||l.result.ttlMs!==300000||c.result.structuredContent.window.id!=="SEP_10_2026") process.exit(1)'

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/.gitignore

@@ -0,0 +1,6 @@
+node_modules/
+.vercel/
+.env*
+.DS_Store
+npm-debug.log*
+.vercel

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/IP_BOUNDARY.md

@@ -0,0 +1,28 @@
+# IP Boundary
+
+## Public artifact
+
+This repository intentionally contains only:
+
+- the read-only HTTP adapter;
+- deterministic state-shaping logic;
+- one frozen public observation baseline;
+- public-source fetchers;
+- tests and deployment metadata.
+
+## Explicitly excluded
+
+The following are not part of this artifact and must not be added during hackathon packaging:
+
+- ORION core or private services;
+- private prompts, planners, evaluators, or routing contracts;
+- private or unpublished corpora;
+- unpublished reconstruction or forecasting methods;
+- credentials, secrets, customer/account data;
+- wallet, payment, transfer, withdrawal, or trade execution logic.
+
+## Law
+
+`EXPOSE MEANING / PROTECT MECHANISM`
+
+Any future submission must copy only the source already present in this bounded public repository unless separately reviewed and authorized.

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/README.md

@@ -0,0 +1,64 @@
+# BHRIGU Bitcoin Temporal Evidence
+
+A bounded, read-only Bitcoin research capability for AI agents.
+
+It turns public Bitcoin evidence into a repeatable temporal record:
+
+`FIELD → WINDOW → REALITY → MEMORY → NEXT WINDOW`
+
+## Why this is different
+
+A live-price endpoint tells an agent what is true now. BHRIGU also preserves what was fixed **before a declared future boundary**, then lets the agent compare that immutable precommit with later reality.
+
+The first real experiment, `SEP_10_2026`, crossed its boundary without rewriting the baseline. A durable post-boundary observation is included. `SEP_17_2026` is the second genuine future precommit.
+
+## Public interfaces
+
+- `GET /v1/state` — live BTCUSDT + protocol-time state and temporal summary
+- `GET /v1/windows` — list precommitted windows
+- `GET /v1/windows/{id}` — one frozen window and durable evidence
+- `POST /mcp` — stateless Streamable HTTP MCP JSON-RPC
+- `GET /openapi.json` — HTTP contract
+- `GET /health` — exact deployed commit
+- `GET /.well-known/xagent-verification.json` — slug + exact deployed commit
+
+## MCP tools
+
+- `bhrigu_get_bitcoin_research_state`
+- `bhrigu_list_temporal_windows`
+- `bhrigu_get_temporal_window`
+- `bhrigu_compare_window_to_reality`
+
+The MCP endpoint serves both lifecycle eras on the same URL:
+
+- modern `2026-07-28`: handshake-free `server/discover`, per-request protocol/capability envelope, `Mcp-Method`/`Mcp-Name` header validation, complete-result discrimination, and explicit cache hints;
+- legacy `2025-11-25` / `2025-03-26`: `initialize` compatibility for existing clients.
+
+See `docs/MCP_PROTOCOL.md` for the exact transport contract. All tools are read-only. There is no trading, wallet, payment, transfer, withdrawal, credential, or private-account authority.
+
+## Verification
+
+```bash
+npm ci
+npm run check
+npm start
+```
+
+For review, follow `docs/AGENT_WORKFLOW.md` for the exact three-step agent path and `docs/OPERATING_PROOF.md` for commit binding, failure behavior, and the reviewer challenge. See `docs/TEMPORAL_EVIDENCE.md` for the immutable-window contract and `docs/SCORECARD.md` for scorecard evidence.
+
+## Public data dependencies
+
+- Binance public Spot BTCUSDT 24h ticker
+- mempool.space public Bitcoin tip height
+
+Market-source failure is fail-closed. Protocol-height failure is exposed as unavailable rather than silently substituted.
+
+## IP boundary
+
+This repository contains only the bounded public adapter and public evidence records. It does not contain ORION, private prompts, planners, evaluators, private corpora, unpublished research methods, credentials, account state, wallet code, payment code, or trading execution.
+
+See `IP_BOUNDARY.md`.
+
+## License / rights
+
+No general open-source license is granted by this repository. X-Agent review/archive rights apply only to the bounded submitted artifact when explicitly declared.

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/THIRD_PARTY.md

@@ -0,0 +1,17 @@
+# Third-party public data
+
+## Binance Spot public market data
+
+Endpoint class: public market data, security type `NONE`.
+
+Used for BTCUSDT 24-hour ticker fields only. No Binance account authentication, API key, trading endpoint, wallet endpoint, transfer endpoint, or private account endpoint is used.
+
+## mempool.space public Bitcoin tip height
+
+Used only to retrieve the current public Bitcoin block height and derive position within the current halving epoch.
+
+If this source is unavailable, the API exposes the source as unavailable and does not substitute hidden data.
+
+## Runtime dependencies
+
+The project has no npm runtime dependencies. It uses only Node.js built-ins and the platform-provided `fetch` implementation.

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/api/about.mjs

@@ -0,0 +1,16 @@
+import { methodGate, sendJson } from "../lib/http.mjs";
+
+export default function handler(req, res) {
+  if (!methodGate(req, res)) return;
+  sendJson(res, 200, {
+    name: "BHRIGU Bitcoin Temporal Evidence",
+    capability: "read-only precommit → reality → memory for Bitcoin research",
+    endpoint: "/v1/state",
+    windows: "/v1/windows",
+    mcp: "/mcp",
+    openapi: "/openapi.json",
+    health: "/health",
+    verification: "/.well-known/xagent-verification.json",
+    boundary: "RESEARCH_STATE_NOT_TRADE"
+  }, "public, max-age=60");
+}

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/api/health.mjs

@@ -0,0 +1,7 @@
+import { healthPayload } from "../lib/runtime.mjs";
+import { methodGate, sendJson } from "../lib/http.mjs";
+
+export default function handler(req, res) {
+  if (!methodGate(req, res)) return;
+  sendJson(res, 200, healthPayload(), "public, max-age=30");
+}

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/api/mcp.mjs

@@ -0,0 +1,37 @@
+import { sendJson } from "../lib/http.mjs";
+import { handleMcpRpc } from "../lib/mcp.mjs";
+
+async function readBody(req) {
+  if (req.body && typeof req.body === "object") return req.body;
+  let raw = "";
+  for await (const chunk of req) raw += chunk;
+  return raw ? JSON.parse(raw) : null;
+}
+
+function headerValue(req, name) {
+  const headers = req.headers;
+  if (headers?.get) return headers.get(name);
+  const value = headers?.[name.toLowerCase()] ?? headers?.[name];
+  return Array.isArray(value) ? value[0] : value ?? null;
+}
+
+export default async function handler(req, res) {
+  if (req.method !== "POST") return sendJson(res, 405, { error: "METHOD_NOT_ALLOWED", allowed: ["POST"] });
+  try {
+    const result = await handleMcpRpc(await readBody(req), {
+      transportMeta: {
+        requireHeaders: true,
+        protocolVersion: headerValue(req, "MCP-Protocol-Version"),
+        method: headerValue(req, "Mcp-Method"),
+        name: headerValue(req, "Mcp-Name")
+      }
+    });
+    if (result.status === 202) {
+      res.statusCode = 202;
+      return res.end();
+    }
+    sendJson(res, result.status, result.body, "no-store");
+  } catch {
+    sendJson(res, 400, { jsonrpc: "2.0", id: null, error: { code: -32700, message: "Parse error" } });
+  }
+}

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/api/openapi.mjs

@@ -0,0 +1,7 @@
+import { methodGate, sendJson } from "../lib/http.mjs";
+import { openapiPayload } from "../lib/openapi.mjs";
+
+export default function handler(req, res) {
+  if (!methodGate(req, res)) return;
+  sendJson(res, 200, openapiPayload(), "public, max-age=300");
+}

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/api/state.mjs

@@ -0,0 +1,23 @@
+import { buildState } from "../lib/state.mjs";
+import { methodGate, sendJson } from "../lib/http.mjs";
+
+export default async function handler(req, res) {
+  if (!methodGate(req, res)) return;
+  const url = new URL(req.url || "/v1/state", "http://localhost");
+  const symbol = String(url.searchParams.get("symbol") || "BTCUSDT").toUpperCase();
+  if (symbol !== "BTCUSDT") {
+    sendJson(res, 400, { error: "UNSUPPORTED_SYMBOL", supported: ["BTCUSDT"] });
+    return;
+  }
+  try {
+    const state = await buildState();
+    sendJson(res, 200, state, "public, max-age=10, s-maxage=10");
+  } catch (error) {
+    sendJson(res, 502, {
+      error: "PUBLIC_MARKET_SOURCE_UNAVAILABLE",
+      source: "Binance Spot BTCUSDT",
+      detail: String(error.message || error),
+      trading_authority: false
+    });
+  }
+}

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/api/verification.mjs

@@ -0,0 +1,7 @@
+import { verificationPayload } from "../lib/runtime.mjs";
+import { methodGate, sendJson } from "../lib/http.mjs";
+
+export default function handler(req, res) {
+  if (!methodGate(req, res)) return;
+  sendJson(res, 200, verificationPayload(), "public, max-age=30");
+}

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/api/window.mjs

@@ -0,0 +1,11 @@
+import { methodGate, sendJson } from "../lib/http.mjs";
+import { getWindow } from "../lib/windows.mjs";
+
+export default function handler(req, res) {
+  if (!methodGate(req, res)) return;
+  const url = new URL(req.url || "/", "http://localhost");
+  const id = String(url.searchParams.get("id") || "");
+  const record = getWindow(id, new Date());
+  if (!record) return sendJson(res, 404, { error: "WINDOW_NOT_FOUND", supported: ["SEP_10_2026", "SEP_17_2026"] });
+  sendJson(res, 200, record, "public, max-age=30");
+}

submissions/mcp-hackathon/bhrigu-bitcoin-research-state-api/source/api/windows.mjs

@@ -0,0 +1,8 @@
+import { methodGate, sendJson } from "../lib/http.mjs";
+import { listWindows, temporalSummary } from "../lib/windows.mjs";
+
+export default function handler(req, res) {
+  if (!methodGate(req, res)) return;
+  const now = new Date();
+  sendJson(res, 200, { ...temporalSummary(now), windows: listWindows(now) }, "public, max-age=30");
+}