fix(drift): Wave 1 backend audit fixes + 3 drift guards (non-SDK surfaces)

The drift audit found 42 confirmed issues; the runtime money/routing path is
sound, but the agent-facing doc/config surfaces had drifted. This fixes the
non-SDK Wave 1 set across every affected surface and adds guards so the two
dominant classes cannot silently recur.

Tool-count drift (MCP stdio server is 24 tools, was advertised as 61/42):
- worker/src/mcp-http.ts, worker/src/index.ts (/api/meta), mcp-server/src/
  meta-snapshot.json, openapi.json/yaml, llms.txt, and 6 marketing/use-case
  pages (for-ai-agents, glossary/mcp, use-cases x2, developers x2) corrected to
  24 with tier-aware copy. Hosted HTTP V1 count (32) left as-is (correct).
- Dropped get_ai_today (folded into get_ai_news in v2.0.0); renamed a stale
  example tool to benchmark_series.

Other confirmed drift:
- Dead reference /api/premium/agents/reputation/series removed from /api/meta
  and the meta snapshot (no handler).
- Agent cards: /api/gpu-pricing -> /api/gpu/pricing path token; the phantom free
  /api/verified-feed reframed to the real paid /api/premium/history/news/verified.
- OpenAPI: /api/premium/news/search q made optional (matches handler/catalog);
  pricing guidance corrected to the real 1/5/10 credit tiers.
- HF dataset feed count corrected to 46 across llms.txt, datasets, developers,
  whitepaper (and the gitignored whitepaper source, locally).
- Worker tier-3 credit comments corrected (5 credits / $0.10), each verified
  against requirePayment tier + premium-catalog.

New guards (worker vitest):
- mcp-tool-count.test.ts: pins the 24 registerTool count and asserts retired
  literals (61 tool, 37 free, 42 tools) are gone from all advertised surfaces.
- openapi-parity.test.ts: openapi.json/yaml path parity, every premium path maps
  to PREMIUM_CATALOG, news/search q stays optional.
- agent-card-liveness.test.ts: agent-card.json/agent.json byte-identical, no dead
  path tokens in any discovery card.

Left intentionally: the deprecated VR-news-search worker comment (no live cost
to assert) and a dated point-in-time whitepaper snapshot figure.

Verified: worker 4715/4715, worker + web tsc clean, ESLint clean, zero em dashes,
meta-snapshot valid JSON.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: RipperMercs

mcp-server/src/meta-snapshot.json

@@ -19,15 +19,15 @@
   "skills": [
     {
       "id": "ai-news",
-      "name": "AI news and verified feed",
-      "description": "Aggregated AI industry news and a cross-source corroborated verified feed. GET https://tensorfeed.ai/api/news and https://tensorfeed.ai/api/verified-feed",
+      "name": "AI news feed",
+      "description": "Aggregated AI industry news. GET https://tensorfeed.ai/api/news. A cross-source corroborated verified history is available as a paid x402-priced feed at https://tensorfeed.ai/api/premium/history/news/verified",
       "tags": ["news", "ai", "industry"],
       "examples": ["What AI news broke in the last 24 hours?"]
     },
     {
       "id": "model-pricing",
       "name": "Model and GPU pricing",
-      "description": "Current model API pricing and GPU rental pricing across providers. GET https://tensorfeed.ai/api/pricing and https://tensorfeed.ai/api/gpu-pricing",
+      "description": "Current model API pricing and GPU rental pricing across providers. GET https://tensorfeed.ai/api/pricing and https://tensorfeed.ai/api/gpu/pricing",
       "tags": ["pricing", "models", "gpu"],
       "examples": ["Compare the cheapest provider for a given model."]
     },

public/.well-known/agent-card.json

@@ -19,15 +19,15 @@
   "skills": [
     {
       "id": "ai-news",
-      "name": "AI news and verified feed",
-      "description": "Aggregated AI industry news and a cross-source corroborated verified feed. GET https://tensorfeed.ai/api/news and https://tensorfeed.ai/api/verified-feed",
+      "name": "AI news feed",
+      "description": "Aggregated AI industry news. GET https://tensorfeed.ai/api/news. A cross-source corroborated verified history is available as a paid x402-priced feed at https://tensorfeed.ai/api/premium/history/news/verified",
       "tags": ["news", "ai", "industry"],
       "examples": ["What AI news broke in the last 24 hours?"]
     },
     {
       "id": "model-pricing",
       "name": "Model and GPU pricing",
-      "description": "Current model API pricing and GPU rental pricing across providers. GET https://tensorfeed.ai/api/pricing and https://tensorfeed.ai/api/gpu-pricing",
+      "description": "Current model API pricing and GPU rental pricing across providers. GET https://tensorfeed.ai/api/pricing and https://tensorfeed.ai/api/gpu/pricing",
       "tags": ["pricing", "models", "gpu"],
       "examples": ["Compare the cheapest provider for a given model."]
     },

public/.well-known/agent.json

@@ -31,14 +31,14 @@
   "skills": [
     {
       "id": "ai-news",
-      "description": "Aggregated AI industry news plus a cross-source corroborated verified feed. GET https://tensorfeed.ai/api/news and https://tensorfeed.ai/api/verified-feed",
+      "description": "Aggregated AI industry news. GET https://tensorfeed.ai/api/news. A cross-source corroborated verified history is available as a paid x402-priced feed at https://tensorfeed.ai/api/premium/history/news/verified",
       "inputModes": ["text"],
       "outputModes": ["text"],
       "supportedLanguages": ["en"]
     },
     {
       "id": "model-pricing",
-      "description": "Current model API pricing and GPU rental pricing across providers. GET https://tensorfeed.ai/api/pricing and https://tensorfeed.ai/api/gpu-pricing",
+      "description": "Current model API pricing and GPU rental pricing across providers. GET https://tensorfeed.ai/api/pricing and https://tensorfeed.ai/api/gpu/pricing",
       "inputModes": ["text"],
       "outputModes": ["text"],
       "supportedLanguages": ["en"]

public/.well-known/agentfacts.json

@@ -159,7 +159,7 @@ TensorFeed ships two complementary MCP servers under the @tensorfeed scope on np
 - [OSV Package Query](https://tensorfeed.ai/api/security/osv/package): Cross-ecosystem advisory lookup for one package version. Params: `?ecosystem=PyPI|npm|Go|crates.io|Maven|NuGet|RubyGems|Packagist|Hex|Pub|Hackage|Linux|...&name=<package-name>&version=<optional>`. Returns the array of advisories affecting that package version (or any version if version is omitted). Pairs with /api/packages/npm/ai-trending and /api/packages/pypi/ai-trending to answer "show me trending packages with unpatched advisories".
 - [OSV Ecosystems](https://tensorfeed.ai/api/security/osv/ecosystems): Supported OSV ecosystem identifiers. Free, no auth.
 - [SEC EDGAR Full-Text Search](https://tensorfeed.ai/api/sec/edgar/search): Lucene-style full-text search across the entire SEC EDGAR public-filings corpus since the 1990s. Filings include 10-K (annual reports), 10-Q (quarterly), 8-K (current event), DEF 14A (proxy), S-1 (IPO), 13F (institutional holdings), and ~70+ other form types. Params: `?q=<query>&forms=10-K,10-Q,8-K&from=YYYY-MM-DD&to=YYYY-MM-DD&limit=1-50&page=1-100`. License: US Government public domain (17 USC 105). Cached 1h. The killer endpoint for finance agents that previously had to pay $5K/mo enterprise data plans for the same query surface.
-- [MCP HTTP Endpoint](https://mcp.tensorfeed.ai/mcp): Hosted Streamable HTTP MCP server per the 2024-11-05 spec. Companion to the stdio @tensorfeed/mcp-server published on npm. POST a JSON-RPC 2.0 envelope (methods: initialize, tools/list, tools/call, ping); GET returns discovery info. V1 catalog: 23 free tools spanning AI news + service status + model pricing + MITRE CVE + CISA KEV + EPSS + OSV.dev + SEC EDGAR search/submissions/ticker lookup + 5 openFDA query tools (drug events, drug labels, drug recalls, food recalls, device events) + EIA Open Data series + USGS recent earthquakes + NWS US weather alerts + AI papers (arXiv recent + AI trending + HF daily) + daily agent-ecosystem opportunities scan. Compatible with Anthropic vertical agent repos (claude-for-financial-services pattern), claude.ai connectors, and any MCP-compliant client. Free; premium tools land in V2.
+- [MCP HTTP Endpoint](https://mcp.tensorfeed.ai/mcp): Hosted Streamable HTTP MCP server per the 2024-11-05 spec. Companion to the stdio @tensorfeed/mcp-server published on npm. POST a JSON-RPC 2.0 envelope (methods: initialize, tools/list, tools/call, ping); GET returns discovery info. V1 catalog: 32 tools (31 free + 1 premium) spanning AI news + service status + model pricing + MITRE CVE + CISA KEV + EPSS + OSV.dev + SEC EDGAR search/submissions/ticker lookup + 5 openFDA query tools (drug events, drug labels, drug recalls, food recalls, device events) + EIA Open Data series + USGS recent earthquakes + NWS US weather alerts + AI papers (arXiv recent + AI trending + HF daily) + daily agent-ecosystem opportunities scan. The single premium tool is route_verdict (live). Compatible with Anthropic vertical agent repos (claude-for-financial-services pattern), claude.ai connectors, and any MCP-compliant client.
 - [SEC EDGAR Submissions](https://tensorfeed.ai/api/sec/edgar/submissions/0000320193): Entity metadata + recent filings for one company by CIK. Accepts canonical zero-padded CIK (`0000320193`) or `CIK0000320193` prefixed. Returns full company profile (name, tickers, exchanges, EIN, SIC, addresses, fiscal year end) plus the most-recent ~1000 filings with form types, accession numbers, and filing dates. Pair with /api/sec/company-tickers/{ticker} for ticker-to-CIK lookup.
 - [CISA Vulnrichment for CVE](https://tensorfeed.ai/api/security/vulnrichment/CVE-2024-3094): CISA's enrichment layer on top of MITRE CVE Records. Adds CWE mappings, CVSS v3.1 scoring (where MITRE has none), exploitation evidence references, KEV cross-reference flags, and additional vendor-specific advisories under containers.adp[] in the standard CVE Record v5.2 shape. Free, no auth. Lazy-fetched from cisagov/vulnrichment GitHub repo (develop branch), cached 7 days. License: US Government public domain (17 USC 105). Returns 404 for CVEs CISA has not yet enriched (most older or low-impact CVEs). Pair with /api/security/cve/{id} for the MITRE record.
 - [AI Supply-Chain IOCs](https://tensorfeed.ai/api/security/ai-supply-chain-iocs.json): Daily-refreshed feed of publicly-disclosed malicious npm and PyPI packages whose name or summary signals relevance to AI / MCP / LLM operators. Pulled from GitHub Security Advisories (type=malware), filtered against a curated AI keyword list (openai, anthropic, claude, mistral, langchain, llamaindex, mcp-, huggingface, ollama, vector DBs, etc), deduped, newest first. Each entry cites its GHSA primary source. Posture: TensorFeed republishes already-public advisories; we do not detect, attribute, or actively scan. Treat the linked primary source as authoritative. Free, no auth. Refreshed daily at 07:15 UTC. License: GitHub ToS attribution preserved on every entry.
@@ -247,9 +247,9 @@ TensorFeed accepts USDC on Base as the sole payment method for premium endpoints
 
 **OpenAPI 3.1 spec:** Complete machine-readable API spec at `https://tensorfeed.ai/openapi.json` (and the YAML twin at `https://tensorfeed.ai/openapi.yaml`). Lists every free and premium endpoint with parameters, security schemes (bearer token for premium), and tags. Drop-in for any tool that consumes OpenAPI (Swagger UI, Postman, code generators, agent toolkits, APIs.guru).
 
-**Postman collection:** Pre-built Postman Collection v2.1 at `https://tensorfeed.ai/postman-collection.json`. 33 requests organized into 20 folders by endpoint group (news, status, models, payment, premium, etc). Import directly into Postman for one-click trial of every endpoint.
+**Postman collection:** Pre-built Postman Collection v2.1 at `https://tensorfeed.ai/postman-collection.json`. 33 requests organized into 20 folders by endpoint group (news, status, models, payment, premium, etc). Import directly into Postman for a one-click trial of the core free and premium endpoints (33 requests). For full endpoint coverage, see `https://tensorfeed.ai/openapi.json` and `https://tensorfeed.ai/api/meta`.
 
-**Hugging Face dataset (daily snapshots):** [tensorfeed/ai-ecosystem-daily](https://huggingface.co/datasets/tensorfeed/ai-ecosystem-daily) is a daily-snapshot mirror of the public TensorFeed API. 36 JSONL files per day covering news, models, pricing, status, benchmarks, agents-directory, agents-activity, podcasts, trending-repos, mcp-registry, probe, gpu-pricing, afta-adopters, ai-hardware, open-weights, inference-providers, training-runs, marketplaces, specialized-models, fine-tuning, oss-tools, agent-apis, voice-leaderboards, embeddings, multimodal, vector-dbs, frameworks, benchmark-registry, public-leaderboards, conferences, funding, model-cards, ai-policy, compute-providers, usage-rankings, and agent-provisioning. Committed at 08:00 UTC by GitHub Actions. License is inference-only (use as RAG context or eval input, not as foundation-model training data) consistent with the AFTA standard. Load with `from datasets import load_dataset; load_dataset("tensorfeed/ai-ecosystem-daily", "news")`. Landing page with rich Schema.org Dataset markup at `https://tensorfeed.ai/datasets`. **SQL access via Parquet:** Hugging Face auto-converts the JSONL files to Parquet on the `refs/convert/parquet` branch. Query directly from DuckDB (`SELECT * FROM 'hf://datasets/tensorfeed/ai-ecosystem-daily@refs/convert/parquet/<config>/train/0000.parquet'`), ClickHouse, Pandas, or Polars without downloading. Useful for time-series queries over the daily snapshots (uptime trends, pricing diffs, model-catalog churn). Files served directly by the HF CDN, no TensorFeed API quota consumed.
+**Hugging Face dataset (daily snapshots):** [tensorfeed/ai-ecosystem-daily](https://huggingface.co/datasets/tensorfeed/ai-ecosystem-daily) is a daily-snapshot mirror of the public TensorFeed API. One JSONL file per feed (46 feeds) plus a manifest.json, covering news, models, pricing, status, benchmarks, agents-directory, agents-activity, podcasts, trending-repos, mcp-registry, probe, gpu-pricing, afta-adopters, ai-hardware, open-weights, inference-providers, training-runs, marketplaces, specialized-models, fine-tuning, oss-tools, agent-apis, voice-leaderboards, embeddings, multimodal, vector-dbs, frameworks, benchmark-registry, public-leaderboards, conferences, funding, model-cards, ai-policy, compute-providers, usage-rankings, agent-provisioning, model-deprecations, training-datasets, mcp-servers, attention, incidents, harnesses, embodied-ai, ai-lawsuits, x402-adopters, and news-source-health. Committed at 08:00 UTC by GitHub Actions. License is inference-only (use as RAG context or eval input, not as foundation-model training data) consistent with the AFTA standard. Load with `from datasets import load_dataset; load_dataset("tensorfeed/ai-ecosystem-daily", "news")`. Landing page with rich Schema.org Dataset markup at `https://tensorfeed.ai/datasets`. **SQL access via Parquet:** Hugging Face auto-converts the JSONL files to Parquet on the `refs/convert/parquet` branch. Query directly from DuckDB (`SELECT * FROM 'hf://datasets/tensorfeed/ai-ecosystem-daily@refs/convert/parquet/<config>/train/0000.parquet'`), ClickHouse, Pandas, or Polars without downloading. Useful for time-series queries over the daily snapshots (uptime trends, pricing diffs, model-catalog churn). Files served directly by the HF CDN, no TensorFeed API quota consumed.
 
 **Built-for-agents landing page:** `https://tensorfeed.ai/for-ai-agents` is the explicit agent-first overview: discovery surfaces (llms.txt, .well-known/x402, MCP server, openapi.json), free tier, premium tier (the full paid catalog, enumerable at /api/meta/premium), MCP integration with Claude Desktop / Code, SDKs, and the glossary. Recommended starting point for any agent that has not seen TensorFeed before.
 

public/llms.txt

@@ -5,7 +5,7 @@
     "version": "1.0.0",
     "summary": "Real-time AI ecosystem data for humans and agents",
     "description": "TensorFeed.ai is a free, no-auth JSON API for AI news, service status, model pricing, GPU pricing, agent directories, and AFTA (Agent Fair-Trade Agreement) data, plus a paid premium tier (USDC on Base, x402 compatible) for ranked model routing, search, history series, watches, and computed intelligence.\n\nHighlights for AI agents:\n- No API key on free endpoints. CORS enabled. Rate limit 120 req/min/IP.\n- AFTA-certified: code-enforced no-charge on 5xx, circuit breaker, schema failure, or stale data. Every paid response carries an Ed25519-signed receipt.\n- Premium tier accepts pay-per-call USDC on Base, no accounts, no traditional processors.\n- Machine-readable manifests at /.well-known/agent-fair-trade.json and /llms.txt.\n\nFull endpoint catalog at /api/meta. Standard at https://tensorfeed.ai/agent-fair-trade.\n",
-    "x-guidance": "For agents discovering this API: most endpoints are free and require no auth. Hit /api/meta to see every endpoint with parameters. The MCP server `@tensorfeed/mcp-server` exposes 42 tools (8 free, 14 premium); install with `npx -y @tensorfeed/mcp-server`. Premium endpoints under /api/premium/* cost 1-3 credits each ($0.02 each at base rate, USDC on Base mainnet). Buy a bearer token via POST /api/payment/buy-credits + /api/payment/confirm, OR pay per call via x402 by retrying with X-Payment-Tx header. Every paid call returns an Ed25519-signed receipt verifiable at /api/receipt/verify. AFTA-certified: no charge on 5xx, breaker, schema failure, or stale data; standard at /.well-known/agent-fair-trade.json.\n",
+    "x-guidance": "For agents discovering this API: most endpoints are free and require no auth. Hit /api/meta to see every endpoint with parameters. The MCP server `@tensorfeed/mcp-server` exposes 24 tools (8 free, 16 premium); install with `npx -y @tensorfeed/mcp-server`. Premium endpoints under /api/premium/* cost 1 to 10 credits ($0.02 to $0.20 per call at base rate, USDC on Base mainnet). Buy a bearer token via POST /api/payment/buy-credits + /api/payment/confirm, OR pay per call via x402 by retrying with X-Payment-Tx header. Every paid call returns an Ed25519-signed receipt verifiable at /api/receipt/verify. AFTA-certified: no charge on 5xx, breaker, schema failure, or stale data; standard at /.well-known/agent-fair-trade.json.\n",
     "termsOfService": "https://tensorfeed.ai/terms",
     "contact": {
       "name": "TensorFeed Support",
@@ -1562,7 +1562,7 @@
           {
             "in": "query",
             "name": "q",
-            "required": true,
+            "required": false,
             "schema": {
               "type": "string"
             }
@@ -1599,9 +1599,6 @@
             "application/json": {
               "schema": {
                 "type": "object",
-                "required": [
-                  "q"
-                ],
                 "properties": {
                   "q": {
                     "type": "string",

public/openapi.json

@@ -15,7 +15,7 @@ info:
     Full endpoint catalog at /api/meta. Standard at https://tensorfeed.ai/agent-fair-trade.
 
   x-guidance: |
-    For agents discovering this API: most endpoints are free and require no auth. Hit /api/meta to see every endpoint with parameters. The MCP server `@tensorfeed/mcp-server` exposes 42 tools (8 free, 14 premium); install with `npx -y @tensorfeed/mcp-server`. Premium endpoints under /api/premium/* cost 1-3 credits each ($0.02 each at base rate, USDC on Base mainnet). Buy a bearer token via POST /api/payment/buy-credits + /api/payment/confirm, OR pay per call via x402 by retrying with X-Payment-Tx header. Every paid call returns an Ed25519-signed receipt verifiable at /api/receipt/verify. AFTA-certified: no charge on 5xx, breaker, schema failure, or stale data; standard at /.well-known/agent-fair-trade.json.
+    For agents discovering this API: most endpoints are free and require no auth. Hit /api/meta to see every endpoint with parameters. The MCP server `@tensorfeed/mcp-server` exposes 24 tools (8 free, 16 premium); install with `npx -y @tensorfeed/mcp-server`. Premium endpoints under /api/premium/* cost 1 to 10 credits ($0.02 to $0.20 per call at base rate, USDC on Base mainnet). Buy a bearer token via POST /api/payment/buy-credits + /api/payment/confirm, OR pay per call via x402 by retrying with X-Payment-Tx header. Every paid call returns an Ed25519-signed receipt verifiable at /api/receipt/verify. AFTA-certified: no charge on 5xx, breaker, schema failure, or stale data; standard at /.well-known/agent-fair-trade.json.
   termsOfService: https://tensorfeed.ai/terms
   contact:
     name: TensorFeed Support
@@ -829,7 +829,7 @@ paths:
       parameters:
         - in: query
           name: q
-          required: true
+          required: false
           schema: { type: string }
         - in: query
           name: from
@@ -846,7 +846,6 @@ paths:
           application/json:
             schema:
               type: object
-              required: [q]
               properties:
                 q:
                   type: string

public/openapi.yaml

@@ -5,22 +5,22 @@ import { Database, ExternalLink, Code, Calendar, FileJson, Shield } from 'lucide
 export const metadata: Metadata = {
   title: 'TensorFeed Datasets: AI Ecosystem Daily on Hugging Face',
   description:
-    'Public daily-snapshot dataset of the AI ecosystem: news, model pricing, GPU rental prices, MCP registry, benchmarks, leaderboards, training run costs, agent infrastructure, and more. 36 JSONL feeds per day, inference-only license. Mirror of the live TensorFeed.ai API.',
+    'Public daily-snapshot dataset of the AI ecosystem: news, model pricing, GPU rental prices, MCP registry, benchmarks, leaderboards, training run costs, agent infrastructure, and more. 46 JSONL feeds per day, inference-only license. Mirror of the live TensorFeed.ai API.',
   alternates: { canonical: 'https://tensorfeed.ai/datasets' },
   openGraph: {
     type: 'website',
     url: 'https://tensorfeed.ai/datasets',
     title: 'TensorFeed Datasets: AI Ecosystem Daily on Hugging Face',
     description:
-      'Daily JSONL snapshots of the AI ecosystem on Hugging Face. 44 feeds, inference-only license, mirror of the live TensorFeed API.',
+      'Daily JSONL snapshots of the AI ecosystem on Hugging Face. 46 feeds, inference-only license, mirror of the live TensorFeed API.',
     siteName: 'TensorFeed.ai',
     images: [{ url: '/tensorfeed-logo.png', width: 1024, height: 1024 }],
   },
   twitter: {
     card: 'summary_large_image',
     title: 'TensorFeed AI Ecosystem Daily',
     description:
-      'Daily JSONL snapshots of the AI ecosystem on Hugging Face. 44 feeds, inference-only license.',
+      'Daily JSONL snapshots of the AI ecosystem on Hugging Face. 46 feeds, inference-only license.',
   },
   keywords: [
     'AI dataset',