Bring the public release up to date with a week of work

Ports the epistemic layer, the Tool Provider Layer, and the MCP client from the
private instance, plus this week's two loop repairs.

New capability

  · epistemic_dossier.py — GET /api/house/prove returns a receipt for a belief:
    who asserted it, on what evidence, who dissented and whether that was ever
    resolved, what would falsify it, and the asserters' calibrated record. The
    load-bearing field is trust_basis: UNEARNED when a belief carries a
    confidence figure but nobody who asserted it has ever been graded against
    reality. GET /api/house/self-audit says the same about the whole system, and
    is written to be unflattering — empty ratios return null, never a
    complimentary zero.

  · judgment_queue.py — GET /api/house/judgments separates AWAITING_HORIZON
    (reality has not answered) from AWAITING_HUMAN (overdue, no automatic judge,
    and blocking N dissents). One unanswerable claim had been silently blocking
    every dissent recorded in its session. Also flags MALFORMED records.

  · tool_providers/ + mcp_client.py — external tool sources arrive as providers
    rather than as edits to exec_tool. MCP is provider #1: tools are namespaced
    mcp__<server>__<tool> so an external server can never shadow a native tool,
    output is quarantined as untrusted, and the gate ESCALATES anything the
    server has not itself declared read-only. An absent hint is treated as
    dangerous, never as safe — safety is never inferred from a tool's name.

  · extractor.py — refuses to stake a claim nobody can read or judge. Two rows
    in production held a Python dict repr as the statement and a fragment of raw
    JSON as the invalidation, from a character-window slice taken out of
    serialised data.

Merging, not overwriting

The public tree is not a copy of the private one and the drift runs both ways.
It carries fixes the private instance does not: the YELLOW health verdict,
OLLAMA_BASE_URL, platform-aware discovery, per-hook kernel reporting, and the
privacy-scan repairs. It is also relicensed — every module header says
Apache-2.0 where the private one still says Open Cognitive License v1.0.

So this is a merge. Files where the private copy is strictly newer were ported
with their headers rewritten; files carrying public-only fixes were left alone;
and main.py, which holds work from both sides, had only its private-only blocks
lifted in by anchor.

Safety

mcp_servers.json is now git-ignored in the public tree as well. It holds API
tokens — the shipped example has a GITHUB_PERSONAL_ACCESS_TOKEN field — and
without this a user who created one would publish their own credentials. Only
the .example. template ships. The ADR-0014 state tripwire has both registered
deliberately, with the reasoning recorded beside them.

Counts corrected against measurement, not memory: 272 routes, 91 tools (75
native + 16 arriving through the provider layer), 672 tests. Social preview
regenerated to match.

672 tests pass. Privacy scan clean.

Author: ElmatadorZ

.gitignore

@@ -151,3 +151,8 @@ backend/skills_usage.jsonl
 
 # Operator's personal profile (copy backend/prompts/USER.example.md)
 backend/prompts/USER.md
+
+# MCP server config — holds API tokens (GITHUB_PERSONAL_ACCESS_TOKEN etc).
+# Copy mcp_servers.example.json to create it; the example is what ships.
+mcp_servers.json
+backend/mcp_servers.json

README.md

@@ -139,6 +139,22 @@ Full provider matrix — Ollama, llama.cpp, and ten cloud APIs: **[docs/MODELS.m
   overconfidence-penalised).
 - **The House Mind** — a shared cognitive state that can answer, at any moment: *what do we know ·
   what don't we know · what do we believe · why · what changed our mind.*
+- **"Prove it"** — a receipt for any belief: who asserted it, on what evidence, who dissented and
+  whether that was ever resolved, what would falsify it, and the calibrated track record of the
+  asserters. The field that matters is `trust_basis`: **UNEARNED** when a belief carries a
+  confidence figure but nobody who asserted it has ever been graded against reality. Most beliefs
+  start there, and saying so is the point.
+- **Tool Provider Layer** — external tool sources reach the House as *providers*, the way runtimes
+  reach it through drivers. **MCP servers** are provider #1: tools arrive namespaced
+  `mcp__<server>__<tool>` so an external server can never shadow a native tool and inherit its
+  trust, output is quarantined as untrusted, and the gate escalates anything the server has not
+  itself declared read-only.
+
+```bash
+curl "http://127.0.0.1:8766/api/house/prove?claim=your+claim+here"
+curl  http://127.0.0.1:8766/api/house/self-audit     # the loop's vital signs, stated against itself
+curl  http://127.0.0.1:8766/api/house/judgments      # what is open, and who it is waiting on
+```
 
 See [`docs/`](docs/) for the architecture of each layer.
 
@@ -235,7 +251,7 @@ badge is red, the claim that this works is not currently true.
 
 ```bash
 cd backend
-python -m pytest -q          # 601 tests
+python -m pytest -q          # 672 tests
 ```
 
 ---

backend/.gitignore

@@ -1,3 +1,8 @@
 vision_probe_cache.json
 kernel_audit.jsonl
 .operator_token
+
+# MCP server config — holds API tokens (GITHUB_PERSONAL_ACCESS_TOKEN etc).
+# Copy mcp_servers.example.json to create it; the example is what ships.
+mcp_servers.json
+backend/mcp_servers.json

backend/builtin_tools.py

@@ -112,6 +112,13 @@
         "parameters":{"type":"object","properties":{}}}},
     {"type":"function","function":{"name":"recall_archive","description":"DISCOVER FIRST: prior deliberations and similar past missions for a directive — avoid redoing solved work.",
         "parameters":{"type":"object","properties":{"query":{"type":"string","description":"the directive to find similar prior work for"}}}}},
+    # ── Epistemic self-audit — check the warrant BEFORE relying on a belief ──
+    {"type":"function","function":{"name":"prove_it","description":"CHECK WARRANT BEFORE ASSERTING: the receipt for a belief — which agent asserted it, on what evidence, who dissented and whether that was ever resolved, what would prove it wrong, whether reality has graded it, and the calibrated track record of the asserters. Returns trust_basis EARNED or UNEARNED. Use before stating anything as established, and when the operator asks 'why do you believe that' or 'ตรวจสอบว่าเชื่อได้ไหม'.",
+        "parameters":{"type":"object","properties":{"claim":{"type":"string","description":"the claim or topic to pull the record for"},"limit":{"type":"integer","description":"max items per section (default 6)"}},"required":["claim"]}}},
+    {"type":"function","function":{"name":"self_audit","description":"The House's epistemic vital signs stated against itself: how many dissents were ever resolved, how many staked claims were graded, how many beliefs changed because of an outcome rather than more talk, how many agents have a real track record. Reports uncomfortable findings deliberately. Use when asked how reliable the House is, or before claiming the learning loop works.",
+        "parameters":{"type":"object","properties":{}}}},
+    {"type":"function","function":{"name":"pending_judgments","description":"What the learning loop is still waiting on, and WHO it is waiting on — separates claims whose horizon has not elapsed (reality has not answered) from claims that are overdue with no automatic judge (a human must rule, and until they do it blocks that session's dissents). Also flags malformed records. Use when asked what is outstanding, why a dissent is unresolved, or ทำไม loop ยังไม่ปิด.",
+        "parameters":{"type":"object","properties":{"limit":{"type":"integer","description":"max items (default 20)"}}}}},
     # ── Social / Integrations ──
     {"type":"function","function":{"name":"telegram_send","description":"Send a message via Telegram bot (requires Telegram integration)",
         "parameters":{"type":"object","properties":{"message":{"type":"string"},"chat_id":{"type":"string","default":""}},"required":["message"]}}},