Neuruh — CRUCIBLE

CRUCIBLE, Running In This Page

One endpoint that scores an output, checks every factual claim against its sources, decides PASS or FLAG, and seals a hash-chained receipt. This page does not simulate the idea: it implements the brief's documented heuristic gate and the real SHA-256 receipt chain in your browser. Run the brief's own smoke tests, seal receipts, then tamper with the ledger and watch chain verification name the exact broken line.

Operator brief — read in full (17 sections)POST /v1/verify, heuristic-v1 SHA-256 hash-chained receipts, canonical JSONThreshold default 70 Ledger stores fingerprints, never source textFLAG does not publish

§1The Gate — POST /v1/verify

Send an output and its sources. CRUCIBLE runs eta scoring and self_check in order: every sentence stated as fact is checked against the sources; anything with no source support and no citation marker is counted as an uncited claim and returned by exact text. Verdict is PASS when eta is at or above threshold and uncited count is zero. Otherwise FLAG.

Ready.

Response

No verification yet this session.
The gate's rule, complete: PASS publishes. FLAG returns the exact claims to fix, and does not publish.

BriefThe Four Smoke Tests, Reproduced Live

The brief's shipped smoke results, run against this page's implementation of the same documented heuristic. The FLAG case reproduces the real Defense market brief pattern: factual claims, zero sources.

Not run yet.

§7The Ledger — Hash-Chained, Tamper-Evident

Every verification above appends exactly one line here. Each receipt's hash covers the previous receipt's hash, starting from the genesis value (64 zeros). Edit any past line and every later line points at a hash that no longer exists. Prove it: verify the chain, then tamper with a sealed receipt and verify again.

Ledger is empty. Run a verification first.
(no receipts yet)

§11The Live Map Feed — GATE Events

Every sealed receipt maps to one compact GATE event, the shape the galaxy ticker already shows. The map only ever reads: there is no endpoint that lets the visualization mutate the ledger or the gate. This surface writes nothing, and here that is literally true.

No gate events yet.

§2Architecture — Two Deploy Shapes, Same Core

Local (internal gate)caller --HTTP--> CRUCIBLE (127.0.0.1:8600) --> eta + self_check (heuristic, or local model via IAR) --> receipt --> ledger JSONL on disk --> GALAXY-LIVE reads it
Port 8600 sits clear of the stack: Bonsai 8100, IAR 8090, AXON 8788, landos-engine 8400, LandGraph 8500, AnythingLLM 3001.
Edge (sellable, sovereign, white-label)external caller --HTTPS--> Cloudflare (auth, rate-limit, billing) --> cloudflared tunnel --> CRUCIBLE on your Mac --> local model + ledger stay on-prem
Data and model never leave the machine. Cloudflare only ever sees the API contract. The verification has to run where the model and the private data live; competitors who send data to their cloud cannot make that promise.

Files (on the Mac, per the brief): crucible_service.py (the FastAPI app), receipt.py (hash-chained receipt + ledger, pure stdlib, zero third-party dependencies on purpose: if the rest of the stack breaks, the provenance math still runs), crucible_config.json (white-label config, the only file you edit), requirements.txt, ledger/ (one .jsonl per tenant), logs/.

§5Endpoint Reference

MethodPathAuthPurpose
GET/healthznoneLiveness and current provider mode
POST/v1/verifykeyGate one output. The core call.
POST/v1/verify/batchkeyGate a list of outputs
GET/v1/receipt/{receipt_id}keyRetrieve one sealed receipt
GET/v1/ledger/verifykeyProve the whole chain is intact
GET/v1/events?limit=NkeyRecent GATE events for the live map
GET/v1/events/streamkeySSE tail of GATE events, live

Auth is the header X-API-Key. The tenant is derived from the key, never trusted from the request body. Different keys write to different ledgers, fully isolated. Provider modes (§8): heuristic (default; deterministic, no model, no network) or iar (routes through the local model with a strict JSON contract; on any model error the gate falls back to the heuristic and stamps the checker name heuristic-v1(iar-fallback:...) so the receipt records exactly what happened. The gate never hard-fails).

§7The Receipt Format and the Hash, Step by Step

1. Assemble every field except receipt_hash. 2. prev_receipt_hash = the receipt_hash of the previous ledger line (the first line points to the genesis value: 64 zeros). 3. Serialize with canonical JSON: keys sorted, no whitespace, UTF-8. The same record always produces the same bytes. 4. receipt_hash = SHA-256(canonical_json(record)). 5. Append the line. Privacy by design: the ledger stores the SHA-256 fingerprint of each source, never the raw source text. You can prove a given source was used without the ledger holding the source itself. Output bodies are also stored only as fingerprint plus metadata.

Verify offline, no server running (from the brief): python3 -c "import receipt; print(receipt.Ledger('~/crucible/ledger/neuruh.jsonl').verify_chain())" — intact returns ok true, reason intact; tampered returns ok false, reason hash_mismatch, and the exact line index.

§12Security, Access Control, Audit, Privacy

Controls present as primitivesPer-tenant API keys with server-side tenant derivation. One ledger file per tenant, no shared state. The hash-chained ledger is the audit log: append-only, tamper-evident by construction. Source and output bodies stored as fingerprints only. Local-first data residency; FileVault for encryption at rest; TLS end to end on the edge path.
Gaps named in the briefAccess control, audit logging, tenant isolation, and encryption at rest are the load-bearing SOC 2 / ISO 27001 controls and this design provides all four as primitives. The gaps to close before an audit: formal key rotation cadence, log retention policy, and backup procedure. The brief's own warning: one copy of an audit ledger is not an audit ledger.

§13-14The Recursive Loop and White-Label

Feedback loopGenerator produces output. CRUCIBLE gates it. On FLAG, the response returns the exact uncited claims. The generator revises, re-sources, and calls /v1/verify again. Repeat until PASS, or a human pulls it. A webhook fires the GATE event on FLAG (or PASS) to Slack, Make.com, or a Notion automation, and each gate result becomes an outcome record scored over time.
White-labelNo branding in the logic. Service name, threshold, provider, keys, and webhook all live in crucible_config.json. Add a customer in one edit: their own tenant and key, their own ledger file, their own chain, their own audit proof. Per-tenant thresholds and providers are a small, localized extension.

§15Monetization — Structure, Not Valuation

The gate is horizontal: the same endpoint verifies a real estate lead brief, a resale listing, and a defense market brief. Four pricing surfaces, lowest to highest margin. The brief's honesty stamp applies verbatim: no dollar figure here is current or claimable pre-MRR. This section is structure, not valuation.

Metered API

Per-verify pricing, billed on receipt count. The ledger already is the usage meter. Simplest to stand up, lowest margin.

Subscription

A monthly seat or volume tier per tenant. The per-tenant key and ledger are the account boundary.

White-label license

Another operator runs CRUCIBLE under their own brand: license plus per-tenant fee. Config separation makes this a contract, not a rebuild.

On-prem / sovereign license

The highest tier and the real edge. Defense, healthcare, finance, and legal buyers run it inside their own perimeter. Nobody else in the slop-generation race can sell this, because their architecture assumes the cloud.

Who buys, ranked by pain: compliance and legal teams that must source every claim, regulated operators that must keep an audit trail, and any high-volume publisher that refuses to become a slop factory with their name attached.

§17Next Actions, In the Brief's Order

The brief's warningDo not skip step 4. A running service nobody calls is the same trap as a repo nobody ships. One proven loop first.