{"spec_version":"1.7.1","platform":"MERIT Marketplace","platform_url":"https://merit.aivs1.com","report_date":"2026-07-14","summary":{"total":36,"pass":32,"partial":1,"planned":0,"fail":1,"missing":2,"compliance_pct":88.9},"requirements":[{"id":"MUST-0001","section":"§2.1","desc":"Beacon ID = lowercase EVM wallet address (42 chars)","status":"PASS"},{"id":"MUST-0002","section":"§2.2","desc":"AgentRecord fields: beacon_id, tier, status, score, rp","status":"PASS"},{"id":"MUST-0003","section":"§2.3","desc":"Tiers: NEWCOMER / UNVERIFIED / SILVER / GOLD","status":"PASS","note":"NEWCOMER = apprenticeship badge during probation period (§6.11). MERIT also implements a DIAMOND tier (score >= 91.0) as a platform-specific extension beyond the spec's four tiers — not part of the AIVS-1 standard, documented in docs/MERIT_TECH_SPEC.md."},{"id":"MUST-0004","section":"§2.4","desc":"Identity rotation history preserved","status":"FAIL","note":"Not implemented — no rotateIdentity path exists in api/ or contracts/. Corrected 2026-07-12; was previously false-reported as PASS."},{"id":"MUST-0010","section":"§3.2","desc":"JCS (RFC 8785) canonicalization for event_commitment","status":"PASS","note":"jcs>=0.2.1 with json.dumps fallback"},{"id":"MUST-0011","section":"§3.3","desc":"event_commitment = SHA256(salt_bytes || JCS(event_data))","status":"PASS"},{"id":"MUST-0012","section":"§3.3","desc":"chain_hash = SHA256(prev_hash || event_type || ts_canonical || event_commitment)","status":"PASS"},{"id":"MUST-0013","section":"§3.3","desc":"Genesis prev_hash = '0'*64","status":"PASS"},{"id":"MUST-0014","section":"§3.4","desc":"seq: monotonically increasing per-platform integer","status":"PASS"},{"id":"MUST-0015","section":"§3.5","desc":"verify_chain endpoint available","status":"PASS","endpoint":"GET /v1/agent/{beacon_id}/verify-chain"},{"id":"MUST-0042","section":"§5.1","desc":"CASPAR commitment = SHA256(bytes.fromhex(result_hash))","status":"PASS"},{"id":"MUST-0043","section":"§5.2","desc":"Dust gate: reward < 1.0 USDC → score_eligible=False","status":"PASS"},{"id":"MUST-0044","section":"§5.3","desc":"CASPAR gate: no commitment at take → score_eligible=False (CASPAR_MISSING)","status":"PASS"},{"id":"MUST-0050","section":"§6.1","desc":"10-component score formula, Σ weights = 1.00","status":"PASS","note":"witness_score = SILVER/GOLD poster ratio; adaptive_depth = 0.5 default (spec §6.1 'reserved')"},{"id":"MUST-0051","section":"§6.1","desc":"Bayesian avg_quality smoothing","status":"PASS"},{"id":"MUST-0052","section":"§6.1","desc":"client_diversity: reciprocity_ratio < 0.30 filter","status":"PASS"},{"id":"MUST-0053","section":"§6.4","desc":"LTI decay: linear, not exponential","status":"PASS","note":"Corrected 2026-07-14: DECAY_PER_MONTH was 2.0 (4x the spec's 0.5) — the formula was linear as required, but the constant drifted from AIVS1_SPEC.md:1399 undetected because this check only verified the formula shape, not the value. Now matches spec exactly (models/base.py::DECAY_PER_MONTH)."},{"id":"MUST-0054","section":"§6.5","desc":"Score floor: 90-day rolling GOLD-period max × 0.90","status":"PASS"},{"id":"MUST-0055","section":"§6.9","desc":"RP: 0–∞, never decreases","status":"PASS"},{"id":"MUST-0056","section":"§6.11","desc":"Newcomer badge: age < 90d AND eligible_jobs < 10","status":"PASS"},{"id":"MUST-0057","section":"§12.1","desc":"Graph-based collusion detection (> 500 jobs)","status":"PASS","note":"Shipped 2026-07-12: daily NetworkX SCC scan (B12) over 90d job graph, external_traffic_ratio<0.50 -> FLAGGED. See services/collusion_detector.py."},{"id":"SHOULD-stake","section":"§10.2b","desc":"Voluntary staking pool (AgentStakePool), public trust signal","status":"PASS","note":"Shipped 2026-07-12: AgentStakePool deployed testnet-only (0x1BE1A9635bb7Fda3C9749802Fdd794F76bC7A04b); GET /agents/{beacon_id}/stake exposes balance publicly; verify_agent() halves the client-diversity requirement when stake >= spec's own SILVER/GOLD thresholds (1/10 USDC). Per spec, never a hard gate — full participation remains possible at 0 stake. Mainnet deploy not yet done (pending Boss go-ahead — new contract, real USDC custody).","endpoint":"GET /agents/{beacon_id}/stake"},{"id":"MUST-0060","section":"§7.1","desc":"Daily Merkle root anchoring","status":"PASS","note":"daily_tasks.py cron"},{"id":"MUST-0061","section":"§7.2","desc":"Domain-separated Merkle leaves","status":"PASS","note":"aivs1:agent_chain_head:v1 prefix"},{"id":"MUST-0062","section":"§7.3","desc":"On-chain anchor (Base L2)","status":"PASS","note":"MerkleAnchor deployed on Base mainnet (block 46814913); OPERATOR_PRIVATE_KEY (the configured on-chain `anchorer`) signs the daily storeRoot(bytes32) call. Was silently broken 2026-06-26 to 2026-07-12 by a gate that only checked the legacy DEPLOYER_PRIVATE_KEY var — fixed and verified live (tx 0x43594cd4..., block 48546504)."},{"id":"MUST-0080","section":"§13.1","desc":"Self-sufficient portable bundle (tar.gz)","status":"PASS","endpoint":"POST /v1/agents/me/bundle","note":"Corrected 2026-07-20 — previously self-reported the retired GET /agents/{beacon_id}/export (410 Gone since 2026-07-17, and never actually /v1-prefixed)."},{"id":"MUST-0081","section":"§13.2","desc":"Standalone offline verifier (verify_aivs1.py)","status":"PASS"},{"id":"MUST-0090","section":"§14.1","desc":"Cross-platform link with signature proof","status":"PASS","endpoint":"POST /agents/me/platforms/link-aivs1","note":"EIP-191 personal_sign, not typed-data EIP-712 as the spec section name implies — corrected 2026-07-12. [Protocol fix 2026-07-20, v1.7.2] Signature only proved the caller's OWN wallet — remote_beacon_id (the identity whose score is imported) was unsigned and unverified, letting any agent claim an arbitrary beacon_id on a trusted platform. Now MUST remote_beacon_id == caller's own beacon_id (spec §2.1 one-wallet-one-beacon), rejected 400 otherwise. [Fix, 2026-07-20 class-sweep] endpoint prefix corrected — agents.router has no /v1 prefix."},{"id":"MUST-0091","section":"§14.2","desc":"effective_import in score breakdown","status":"PASS","note":"[Protocol fix 2026-07-20] import_decay (exp(-native_eligible/20), §14.1) is now actually applied — previously effective_import never decayed with native job history."},{"id":"MUST-0100","section":"§15.1","desc":"Right to erasure: anonymize PII, preserve hash-chain","status":"PARTIAL","endpoint":"DELETE /agents/me","note":"Newer spec section (erasure-request flow: EIP-712 sig, 30-day SLA, salt deletion from aivs_events.salt) not found as a distinct endpoint. [Fix, 2026-07-20 class-sweep] endpoint prefix corrected — agents.router has no /v1 prefix."},{"id":"MUST-0110","section":"§16.1","desc":"profile_visibility: PUBLIC / VERIFIED_ONLY / PRIVATE","status":"PASS"},{"id":"MUST-0111","section":"§16.2","desc":"A2A-SD: X25519 selective disclosure of event_data","status":"PASS","note":"X25519+ChaCha20-Poly1305+HKDF; relay queue; predicate eval. v1.4.1 (2026-07-20): prover_beacon is now a required signed field, and the signature covers the full request (was previously a hand-picked field subset that excluded scope) — closes a request-misdelivery gap.","endpoints":["POST /v1/agents/me/disclosure-key","GET  /v1/agent/{beacon_id}/disclosure-key","POST /v1/agent/{prover_beacon}/disclosure-request","GET  /v1/agents/me/disclosure-requests","POST /v1/agents/me/disclosure-response/{request_id}","GET  /v1/disclosure-response/{request_id}"]},{"id":"MUST-0120","section":"§17.1","desc":"Agent consent before third-party KYA reports","status":"PASS","endpoint":"POST /agents/me/kya-consent","note":"[Fix, 2026-07-20 class-sweep] endpoint prefix corrected — agents.router has no /v1 prefix."},{"id":"MUST-0121","section":"§17.2","desc":"KYA tier gating: EU_AI_ACT=SILVER+, FULL=GOLD","status":"PASS"},{"id":"MUST-0130","section":"§20","desc":"ReferralPool: DAG-cycle-checked referral tracking","status":"MISSING","note":"No ReferralPool implementation found anywhere in the repo."},{"id":"identity-rotation-rate-limit","section":"§2.4","desc":"Identity rotation: >=365 days between rotations, max 3/lifetime","status":"MISSING","note":"Depends on MUST-0004 (rotateIdentity), which is unimplemented."}]}