{
  "markdown": "# DJZS  Deterministic Pre-Execution Audit for Agents\n\nDJZS audits the **reasoning** behind an autonomous agent's move *before* capital is\ncommitted, and returns one of three verdicts  **PASS**, **WAIT**, or **FAIL** with the\nspecific reasoning defects flagged and a reproducible hash of the decision.\n\nThe wedge: transaction-security tools answer *\"is this transaction safe to sign?\"*. DJZS answers\na different question  *\"should this position be taken at all?\"*. A perfectly safe transaction can\nstill rest on broken reasoning; DJZS is the layer that catches the bad thesis.\n\n---\n\n## Use it now — the live MCP gate\n\n`verify_pm_trade` is deployed as a Model Context Protocol tool (streamable HTTP) on a\nCloudflare Worker. Add it to an MCP-capable agent in one line:\n\n```\nclaude mcp add --transport http djzs-trust https://mcp.djzs.ai/mcp\n```\n\nThen call `verify_pm_trade` with a free-text prediction-market trade thesis. It extracts the\nreasoning, audits it against the calibrated DJZS-M taxonomy, and returns\n`PASS → PROCEED` / `FAIL` / `WAIT → HALT`, with the flagged defects and a `verdict_hash`.\n\n**First external audit on record.** An outside agent audited a benchmark thesis\n(`pm-block-008`) through the deployed tool and received:\n\n```\nverdict:       FAIL\nflags:         DJZS-M03 (PROBABILITY_UNSOURCED), DJZS-M04 (CONSENSUS_NO_EDGE)\nrisk_score:    40\ndisagreements: []\nverdict_hash:  0x85918814b3dffa31b00d6892c2e00b2001efd35f7e0044b4cd3789fe1df14937\n```\n\nBehavioral parity against the offline batteries (verdict + flags + extracted input) is green.\nHash parity is a pending re-mint the calibration key lapsed during deployment so the live\nhash above stands as the record until it is re-run.\n\n---\n\n## Pay it over HTTP x402 - the ecosystem rail\n\nBeyond the MCP transport above, `verify_pm_trade` is now payable over the **HTTP x402**\ntransport, live on Base mainnet:\n\n```\nPOST https://mcp.djzs.ai/x402/verify\n```\n\nAn unpaid request returns an HTTP 402 challenge (`exact` scheme, `eip155:8453`, USDC, 2.00\nUSDC to the treasury); the client signs an EIP-3009 authorization and retries. This is the\nsame rail **Base MCP**, **MetaMask Agent Wallet**, and `x402-axios` speak, so any HTTP x402\nclient can pay the gate directly - no MCP integration required.\n\nFree-refusal is preserved on both transports: an out-of-scope intent is answered 402 and\nnever settled, so a refused audit costs nothing. Verified end to end on Base Sepolia\n(paid settlement plus an on-chain zero-delta refusal) before the mainnet deploy.\n\n## Architecture C — extraction reports, the engine decides\n\nDJZS separates the model-bound step from the trusted step:\n\n```\nfree-text intent\n      │\n      ▼\nEXTRACTION  (LLM, N=3 consensus)          reports observable FACTS, never a verdict\n  · per-field state unanimity across the 3 samples; any disagreement → unknown\n  · quote gates: a claimed \"absent\" must quote the intent verbatim, or it demotes to unknown\n  · evidence-unanimity: a critical-driving \"absent\" needs the same quote across all samples\n      │\n      ▼\nAuditInput  (each fact is tri-state: present / absent / unknown)\n      │\n      ▼\nDETERMINISTIC ENGINE  (pure code — no model, no network, no clock)\n  rules fire → weighted score → verdict\n      │\n      ▼\nPASS · WAIT · FAIL   +   verdict_hash\n```\n\n**Why this shape:** the verdict rules are model-independent. The LLM only turns messy text into a\nstructured struct; the audit *rules* that decide the verdict are frozen code. Swap the model and\nthe extraction quality changes the rules, weights, and hash do not.\n\n**Determinism by construction.** The same `AuditInput` always yields the same verdict and the same\nhash:\n\n```\nverdict_hash = sha256(canonicalize({ verdict, risk_score, flags: codes.sorted(), unknown_fields }))\n```\n\n**WAIT is never silent.** An under-specified thesis — one where a decision-critical fact is\n`unknown` — resolves to WAIT, mapped to **HALT** for the caller, with `unknown_fields` returned so\nthe agent knows exactly what to clarify. Abstention is a first-class outcome, never a guessed\nPASS or FAIL.\n\n---\n\n## Taxonomies (frozen)\n\n### DJZS-M — Prediction Market (`DJZS-PM-v1.0`) the calibrated, live path\n\nWeights sum to **100**; FAIL threshold **25**. All four codes are implemented and calibrated.\n\n| Code | Name | Severity | Weight | Detects |\n|------|------|----------|-------:|---------|\n| DJZS-M01 | NARRATIVE_RESOLUTION_GAP | CRITICAL | 30 | Thesis reasons about a narrative adjacent to the actual resolution question. |\n| DJZS-M02 | FALSIFICATION_ABSENT | CRITICAL | 30 | No stated condition that would prove the thesis wrong before resolution. |\n| DJZS-M03 | PROBABILITY_UNSOURCED | HIGH | 25 | Market or model probability asserted without verifiable basis. |\n| DJZS-M04 | CONSENSUS_NO_EDGE | MEDIUM | 15 | Thesis restates consensus at an extreme price with no differentiated edge. |\n\n**M04 is advisory-grade.** On its own it does not block a lone M04 rides a PASS with the flag on\nthe certificate (weight 15 is below the FAIL threshold). It contributes to a block only by stacking\nwith another finding (e.g. M03 + M04 = 40 → FAIL, as in the first audit above).\n\n`verify_pm_trade` is **PM-only**: if the intent does not extract as a prediction-market thesis\n(including the undetermined case), it returns `in_scope: false` rather than silently running a\nperpetuals audit.\n\n### DJZS-LF — Perpetuals / general reasoning (`DJZS-LF-v1.1`)\n\nWeights sum to **200**. The taxonomy is frozen at **11 codes**; **3 are wired live** in the engine\ntoday (marked ●). The rest are defined and weighted but not yet firing — coverage is stated\nhonestly rather than implied.\n\n| Code | Name | Category | Severity | Weight | Live |\n|------|------|----------|----------|-------:|:----:|\n| DJZS-S01 | CIRCULAR_LOGIC | Structural | CRITICAL | 30 | |\n| DJZS-S02 | LAYER_INVERSION | Structural | HIGH | 25 | |\n| DJZS-S03 | DEPENDENCY_GHOST | Structural | MEDIUM | 18 | |\n| DJZS-E01 | ORACLE_UNVERIFIED | Epistemic | HIGH | 25 | ● |\n| DJZS-E02 | CONFIDENCE_INFLATION | Epistemic | MEDIUM | 18 | |\n| DJZS-I01 | FOMO_LOOP | Incentive | MEDIUM | 16 | ● |\n| DJZS-I02 | MISALIGNED_REWARD | Incentive | MEDIUM | 16 | |\n| DJZS-I03 | DATA_UNVERIFIED | Incentive | MEDIUM | 16 | |\n| DJZS-X01 | EXECUTION_UNBOUND | Execution | CRITICAL | 15 | ● |\n| DJZS-X02 | RACE_CONDITION | Execution | HIGH | 9 | |\n| DJZS-T01 | STALE_REFERENCE | Temporal | LOW | 12 | |\n\nBoth weight tables are hash-locked (`WEIGHTS_HASH` / `TAXONOMY_HASH`, and the PM equivalents, are\nexported constants); changing a weight is a deliberate re-derive, not a hot patch.\n\n---\n\n## MCP tools\n\nThe deployed Worker exposes three tools over streamable HTTP at `/mcp`:\n\n| Tool | What it does |\n|------|--------------|\n| `verify_pm_trade` | Pre-execution audit of a prediction-market thesis (the gate described above). |\n| `query_pol_certificates` | Read prior ProofOfLogic certificates from the Irys datachain. |\n| `query_agent_trust` | LIVE on-chain trust score (subgraph-indexed): totalAudits, failRate, latest verdict, action PROCEED/HALT/NO_HISTORY. |\n\n---\n\n## Honest v1 posture\n\nWhat the tool does **not** do yet — recorded deliberately, to be re-ruled before the gate is\nbroadly promoted:\n\n- **No ProofOfLogic write on the tool.** `verify_pm_trade` returns a `verdict_hash` but does not yet\n  anchor a certificate. Existing Irys certificates are prior-architecture lineage, not output of\n  this tool.\n- **Taxonomy hashes not in the response.** The four hash constants are exported from the frozen\n  tables but are not yet included in the tool's JSON response.\n\nThe response contract today is: `verdict`, `action`, `risk_score`, `flags`, `unknown_fields`,\n`disagreements` (the per-field sample-agreement telemetry), `verdict_hash`, `extraction_failsafe`,\n`in_scope`, and taxonomy versions.\n\n---\n\n## Legacy HTTP API (backward-compatible)\n\nBefore the MCP gate, DJZS ran as a paid HTTP audit service. Those endpoints remain for\nbackward compatibility the MCP gate above is the current surface. The tiers are metered in\nUSDC on Base Mainnet via an `x-payment-proof` header:\n\n| Tier | Endpoint | Price | Memo limit |\n|------|----------|------:|-----------|\n| Micro | `POST /api/audit/micro` | $0.10 | 2,000 chars |\n| Founder | `POST /api/audit/founder` | $1.00 | 5,000 chars |\n| Treasury | `POST /api/audit/treasury` | $10.00 | unlimited |\n\n`POST /api/audit` aliases the Micro tier, and an escrow-settled variant (`POST /api/audit/escrow`)\ntakes on-chain escrow in place of a payment header. These tiers run the older detection path, not\nthe Architecture C engine — treat their output as legacy.\n\n---\n\n## On-chain artifacts\n\nThe A2A manifest (`agent.json`) attests four DJZS contracts on Base Mainnet, each marked\n`verified`. Source for each lives in `contracts/`:\n\n| Contract | Address | Source |\n|----------|---------|--------|\n| DJZSLogicTrustScore | `0xB3324D07A8713b354435FF0e2A982A504e81b137` | `contracts/DJZSLogicTrustScore.sol` |\n| DJZSEscrowLock | `0xB041760147a60F63Ca701da9e431412bCc25Cfb7` | `contracts/DJZSEscrowLock.sol` |\n| DJZSAgentRegistry | `0xe40d5669Ce8e06A91188B82Ce7292175E2013E41` | `contracts/DJZSAgentRegistry.sol` |\n| DJZSStaking | `0xA362947D23D52C05a431E378F30C8A962De91e8A` | `contracts/DJZSStaking.sol` |\n\nAddresses are as recorded in `agent.json`; verify any of them on BaseScan.\n\nA fifth contract, `contracts/DJZSProofOfLogicNFT.sol`, exists as source only — it is not in the\ndeployed manifest, and this document makes no claim that certificate NFTs are live or mintable.\n\nPrior ProofOfLogic certificates live on the Irys datachain and are readable via the\n`query_pol_certificates` MCP tool. They are prior-architecture lineage, not output of\n`verify_pm_trade`.\n\n---\n\n## Read the log\n\nThe commit history is the product's own audit trail: each verdict-bearing change ships with a\n`PENDING` note naming what is still unproven, and the next commit that closes it discharges that\nnote explicitly. Every claim a recall number, a parity result, a live verdict hash — is cited to\na specific run at the moment it is pushed, not asserted after the fact. If you want to know what is\nproven versus deferred, `git log` is the source of truth and this file is downstream of it.\n\n---\n\n## Repository map\n\n- `server/engine-v2/` — Architecture C: `deterministic-engine.ts` (the frozen decider),\n  `extraction-layer.ts` (N=3 consensus extraction), `audit-input-schema.ts`, `hash.ts`, and the\n  `calibration/` bench + scorer.\n- `shared/audit-schema.ts` — the DJZS-LF perpetuals taxonomy (source of the table above).\n- `shared/pm-taxonomy.ts` — the DJZS-M prediction-market taxonomy.\n- `djzs-trust-mcp/` — the Cloudflare Worker: the MCP server and the `verify_pm_trade` tool,\n  importing the engine and shared taxonomies frozen via a build alias.\n- `server/` (older tiers) — the prior HTTP audit path and its ProofOfLogic / settlement plumbing,\n  retained for backward compatibility. Its legacy detection tier historically used a Venice-hosted\n  model; the Architecture C path does not depend on it.\n\n---\n\n*The deterministic core runs with zero external dependencies. The extraction step is the only\nmodel-bound component, isolated to a single swappable function.*\n",
  "bytes": 11172,
  "sha": "da0183f1eccc5dd4705c307c2866d034e775dd1aff931663bf944031768c0386",
  "repo_slug": "sifr0-dev/djzs-ai",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_ai_djzs_trust_mcp_f7487078/readme"
}