`, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_384":385,"_386":387},"routes/_app.x.$handle.$name",{"_100":99,"_31":43,"_109":88,"_26":110,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_20":-5,"_121":-5,"_122":123,"_124":24,"_125":126,"_127":57,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":24},"version",26,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":20,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","docs/ARCHITECTURE.md","latestPath","fileId","8da0f14a-aafc-11f1-be95-1607ee4eb77e","name","ARCHITECTURE.md","fileType","content","# Architecture — PayAna Market Sentinel\n\n## Mission\n\nBuild a small, inspectable Agent OS workflow that improves the quality of market reasoning without needing trading authority. The system is deliberately split between **observation**, **deterministic measurement**, **hypothesis/falsification guidance**, and **human/AI interpretation**.\n\n## System map\n\n```text\nMCP-capable AI client\n │\n │ Binance Agent OS MCP (Market Data scope only)\n ▼\nBinance market evidence\n │\n ├─ ticker\n ├─ order book\n ├─ candlesticks\n └─ funding/mark price when available\n │\n ▼\nPayAna Falsifier Skill (SKILL.md)\n │\n ├─ validate currentness\n ├─ compute metrics\n ├─ winning hypothesis\n ├─ opposite hypothesis\n ├─ alternative explanation\n ├─ falsifiers\n └─ negative-space / missing-context audit\n │\n ▼\nEvidence briefing — NO_TRADE_DECISION\n```\n\nThe deployed web cockpit is a reference implementation and live demo of the deterministic evidence layer:\n\n```text\nBrowser\n │ GET /api/analyze?symbol=...\n ▼\nHono / Val Town\n │\n ├─ strict symbol allowlist\n ├─ no-store API responses\n ├─ best-effort per-runtime rate limit\n ├─ CSP / nosniff / frame denial / permissions policy\n │\n ▼\ndata-api.binance.vision\n ├─ 24h ticker\n ├─ top-20 depth\n └─ 36 × 5m klines\n```\n\n## Runtime routing decision\n\nDuring runtime discovery on 2026-09-07:\n\n- `api.binance.com` from the Val Town runtime returned HTTP 451 (restricted runtime location).\n- `data-api.binance.vision` returned HTTP 200 for the required public market-data reads.\n- The reference web implementation therefore routes public reads through `data-api.binance.vision`.\n- The official Agent OS MCP endpoint returned HTTP 401 on an unauthenticated `initialize`, with OAuth Protected Resource Metadata pointing to `https://agent.binance.com`.\n- Authorization-server metadata advertises Authorization Code + PKCE (`S256`), public-client token auth (`none`), and Client ID Metadata Document support.\n\nThese facts are intentionally kept separate:\n\n`PUBLIC_MARKET_API_WORKS != AGENT_OS_MCP_SESSION_AUTHORIZED`\n\nThe skill is ready for a legitimate MCP-capable client connection. A real MCP-connected demo requires completing the Binance authorization UI and granting only the Market Data scope needed by the workflow.\n\n## Evidence model\n\nEach analysis produces a source receipt. Source failures are visible in the response. The system does not silently substitute stale or fabricated values.\n\nEvidence state:\n\n- `PASS`: all three reference sources succeeded.\n- `PARTIAL`: one or two reference sources succeeded.\n- `FAIL`: all reference sources failed.\n\nA source receipt includes source name, URL, HTTP result, duration and failure reason where applicable.\n\n## Descriptive metrics\n\nThe reference implementation exposes the formulas in the API response itself under `method` so a reviewer can reproduce them.\n\nThe `directionalScore` is a bounded heuristic combining order-book imbalance and two momentum horizons. It is intentionally described as a *descriptive pressure score*.\n\nThe `stabilityScore` decreases as volume anomaly, short-horizon volatility, spread or missing sources increase. It is explicitly **not** a calibrated probability.\n\n## Security boundaries\n\n### Present controls\n\n- public/read-only data only;\n- fixed symbol allowlist;\n- no arbitrary upstream URL forwarding;\n- no account keys or Binance credentials in the val;\n- no Trade, Account or Transfer endpoint;\n- no POST action route;\n- no wallet address capture;\n- `Cache-Control: no-store` for APIs;\n- CSP;\n- `X-Content-Type-Options: nosniff`;\n- `X-Frame-Options: DENY`;\n- restrictive `Permissions-Policy`;\n- per-runtime inbound request bucket;\n- explicit `NO_TRADE_DECISION` response contract.\n\n### Limits\n\nThe in-memory rate limiter is a best-effort demo control, not a distributed security boundary. A horizontally scaled/serverless deployment would require a shared rate-limit store.\n\nNo statement in the web cockpit proves that the Binance Agent OS MCP connection has been authorized. MCP authorization is a separate external state.\n\n## Validation\n\nCurrent automated validation includes:\n\n- five allowlisted symbols;\n- freshness check on ticker timestamp;\n- price > 0;\n- spread >= 0;\n- order-book imbalance in [-1, 1];\n- stability score in [0, 1];\n- stability language explicitly says it is not a calibrated probability;\n- three source receipts;\n- minimum candle series;\n- invalid/injection-like symbols rejected;\n- write-like POST route rejected;\n- unknown routes return 404;\n- rate limiter mutation test: requests 1–30 pass and 31–35 are rejected with 429.\n\nThe rendered UI is separately checked because server tests do not prove browser execution. A JavaScript-rendering extraction successfully found React-only selectors after CSP hardening, including source receipts; interactive/screenshot browser automation is currently blocked by external TinyFish/Firecrawl credit state and is not claimed as completed.\n\n## Negative controls and falsification\n\nThe architecture is designed around a stricter invariant than “the dashboard loaded”:\n\n- `HTTP_200 != VALID_MARKET_EVIDENCE`\n- `SCREENSHOT != BEHAVIOR_PROOF`\n- `MODEL_CONFIDENCE != CALIBRATED_PROBABILITY`\n- `MARKET_DATA_READ != TRADING_AUTH`\n- `MCP_ENDPOINT_KNOWN != MCP_SESSION_AUTHORIZED`\n- `FETCH_FAIL != ZERO`\n- `CURRENT_PRESSURE != FUTURE_PRICE`\n\nThis is the main technical thesis of PayAna: an agent should not only produce an answer; it should expose how that answer can fail.\n","createdAt",["D",1788813710960],"branchVersion","branchId","7cb33925-37d8-48ee-9d8b-5712686d33fd","id","71ad8a44-f36c-41e9-a978-0707deb4f71b","payana-binance-agent-os",["D",1788812694161],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","PayAna Falsifier Agent — evidence-first Binance market audit","imageUrl","6cc24525-830b-4db3-9c9c-fd19fb50e91f","pinnedFileId","01a07d8b-9306-748f-a55c-5a7124e2c8be","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0773d-9d6b-7580-a53a-683363c351c8","tursoName","71ad8a44f36c41e9a9780707deb4f71b","tursoHostname","71ad8a44f36c41e9a9780707deb4f71b-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789509043237],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_100":99,"_108":104},"org",{"_100":99,"_101":102,"_103":104,"_18":53,"_105":106,"_107":24},"branch",{"_13":87,"_31":88,"_41":40,"_89":42,"_90":91,"_92":93,"_94":48,"_95":42,"_96":63,"_97":43,"_98":99},"isOwned",55,"market-sentinel-v1","projectId","forkedBranchId","182c3c5a-4b2f-4ec3-8cf6-a4632f8ec886","forkedBranchVersion",3,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","cleitoncosta","handle","displayName","Cleiton Costa","avatar","https://lh3.googleusercontent.com/a/ACg8ocIgWisWQiXts_2fy5iRiRgl8A6c7Ef94eqE3ur-4mlyUrpCBmQ=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":379,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":380,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":381,"_82":382,"_84":383,"_86":24},"tree",[254,256,264,266,267,268,269,270,271,272,273,274,275],"files",[254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272,273,274,275],"counts",{"_242":61,"_243":244,"_245":246,"_247":248,"_249":250},"contents",[139,140,141,142,143,144,145,146,147,148,149,150,151],"upstreamProject","upstreamBranch",{"_41":91,"_36":132,"_133":134,"_31":135,"_89":42,"_13":136,"_90":-5,"_92":-5,"_137":138,"_45":-5,"_86":24,"_47":48,"_98":99,"_62":63,"_97":43},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1788812694161],"updatedAt",["D",1788827566539],"main",52,"lockfileKey","1788827566927-esm.town_v_cleitoncosta_payana-binance-agent-os@52-main",{"_41":236,"_31":237,"_29":238,"_155":-5,"_39":40,"_38":239,"_156":57,"_36":240,"_13":61,"_33":229,"_34":-5,"_23":24,"_160":-5,"_26":241},{"_41":231,"_31":232,"_29":233,"_155":-5,"_39":40,"_38":167,"_156":57,"_36":234,"_13":61,"_33":229,"_34":-5,"_23":24,"_160":-5,"_26":235},{"_41":224,"_31":225,"_29":226,"_155":-5,"_39":40,"_38":227,"_156":57,"_36":228,"_13":61,"_33":229,"_34":-5,"_23":24,"_160":-5,"_26":230},{"_41":218,"_31":219,"_29":220,"_155":-5,"_39":40,"_38":167,"_156":24,"_36":221,"_13":61,"_33":20,"_34":222,"_23":24,"_160":-5,"_26":223},{"_41":212,"_31":213,"_29":214,"_155":-5,"_39":40,"_38":167,"_156":24,"_36":215,"_13":61,"_33":20,"_34":216,"_23":24,"_160":-5,"_26":217},{"_41":205,"_31":206,"_29":207,"_155":-5,"_39":40,"_38":208,"_156":57,"_36":209,"_13":61,"_33":20,"_34":210,"_23":24,"_160":-5,"_26":211},{"_41":199,"_31":200,"_29":201,"_155":-5,"_39":40,"_38":167,"_156":24,"_36":202,"_13":61,"_33":158,"_34":203,"_23":24,"_160":-5,"_26":204},{"_41":191,"_31":192,"_29":193,"_155":-5,"_39":40,"_38":194,"_156":24,"_36":195,"_13":187,"_33":196,"_34":197,"_23":24,"_160":-5,"_26":198},{"_41":184,"_31":185,"_29":186,"_155":-5,"_39":40,"_38":187,"_156":24,"_36":188,"_13":61,"_33":158,"_34":189,"_23":24,"_160":-5,"_26":190},{"_41":177,"_31":178,"_29":179,"_155":-5,"_39":40,"_38":180,"_156":24,"_36":181,"_13":61,"_33":158,"_34":182,"_23":24,"_160":-5,"_26":183},{"_41":170,"_31":171,"_29":172,"_155":-5,"_39":40,"_38":173,"_156":24,"_36":174,"_13":61,"_33":158,"_34":175,"_23":24,"_160":-5,"_26":176},{"_41":162,"_31":163,"_29":164,"_155":-5,"_39":40,"_38":165,"_156":24,"_36":166,"_13":167,"_33":158,"_34":168,"_23":24,"_160":-5,"_26":169},{"_41":152,"_31":153,"_29":154,"_155":-5,"_39":40,"_38":93,"_156":24,"_36":157,"_13":61,"_33":158,"_34":159,"_23":24,"_160":-5,"_26":161},"4338b52d-c519-4136-96db-3e639aa89c90","vision_klines_probe.ts","9474b71a-aafa-11f1-97fe-1607ee4eb77e","parentId","latest",["D",1788812863425],"script","const r=await fetch(\"https://data-api.binance.vision/api/v3/klines?symbol=BTCUSDT&interval=5m&limit=36\",{headers:{Accept:\"application/json\",\"User-Agent\":\"PayAna-Market-Sentinel/0.1\"}});\nconst body=await r.json();\nconsole.log(JSON.stringify({status:r.status,ok:r.ok,array:Array.isArray(body),count:Array.isArray(body)?body.length:null,first:Array.isArray(body)?body[0]:body,last:Array.isArray(body)?body.at(-1):null}));\n","label",[153],"0ee8e65f-22b1-47b9-8d40-dfc646d54c26","selftest.ts","2476d014-aafb-11f1-a319-1607ee4eb77e",16,["D",1788813159220],1,"import handler from \"./index.ts\";\nimport { analyzeMarket, normalizeSymbol, supportedSymbols } from \"./lib/market.ts\";\n\nconst results: any[] = [];\nfunction check(name: string, pass: boolean, details?: unknown) {\n results.push({ name, pass, details });\n if (!pass) throw new Error(`SELFTEST_FAIL:${name}`);\n}\n\nfor (const bad of [\"INVALIDXYZ\", \"BTCUSDT&foo=bar\", \"../BTCUSDT\", \"\"]) {\n let rejected = false;\n try { normalizeSymbol(bad); } catch { rejected = true; }\n if (bad === \"\") {\n // empty input normalizes to default only when nullish is not used; explicit empty must not leave allowlist.\n check(\"explicit_empty_rejected\", rejected);\n } else check(`invalid_symbol_rejected:${bad}`, rejected);\n}\n\nfor (const symbol of supportedSymbols()) {\n const r: any = await analyzeMarket(symbol);\n check(`${symbol}:evidence`, [\"PASS\", \"PARTIAL\"].includes(r.evidenceState), r.evidenceState);\n check(`${symbol}:read_only`, r.readOnly === true && r.boundary === \"MARKET_DATA_READ != TRADING_AUTH\");\n check(`${symbol}:price_positive`, Number(r.market?.lastPrice) > 0, r.market?.lastPrice);\n check(`${symbol}:spread_nonnegative`, Number(r.microstructure?.spreadBps) >= 0, r.microstructure?.spreadBps);\n check(`${symbol}:imbalance_bounded`, Math.abs(Number(r.microstructure?.orderBookImbalance)) <= 1.000001, r.microstructure?.orderBookImbalance);\n check(`${symbol}:stability_bounded`, Number(r.assessment?.stabilityScore) >= 0 && Number(r.assessment?.stabilityScore) <= 1, r.assessment?.stabilityScore);\n check(`${symbol}:stability_not_probability`, String(r.assessment?.stabilityMeaning ?? \"\").includes(\"not a calibrated probability\"));\n check(`${symbol}:no_trade_recommendation`, r.assessment?.recommendation === \"NO_TRADE_DECISION\");\n check(`${symbol}:receipts_present`, Array.isArray(r.receipts) && r.receipts.length === 3, r.receipts?.length);\n check(`${symbol}:series_present`, Array.isArray(r.shortHorizon?.closeSeries) && r.shortHorizon.closeSeries.length >= 12, r.shortHorizon?.closeSeries?.length);\n const closeTime = Number(r.market?.tickerCloseTime);\n check(`${symbol}:ticker_currentness`, Number.isFinite(closeTime) && Math.abs(Date.now() - closeTime) < 5 * 60_000, { closeTime, ageMs: Date.now() - closeTime });\n}\n\nconst post = await handler(new Request(\"https://local.test/api/analyze?symbol=BTCUSDT\", { method: \"POST\" }));\ncheck(\"post_not_supported\", post.status === 404, post.status);\nconst unknown = await handler(new Request(\"https://local.test/api/does-not-exist\"));\ncheck(\"unknown_route_404\", unknown.status === 404, unknown.status);\n\nconst pass = results.every(r => r.pass);\nconsole.log(JSON.stringify({ pass, version: \"1.0.0\", tests: results.length, results }));\nexport default { pass, tests: results.length };\n",[163],"6c281280-1d63-4132-aaff-e4ee44789755","rate_limit_selftest.ts","4f12cf30-aafb-11f1-9bc1-1607ee4eb77e",17,["D",1788813176513],"import handler from \"./index.ts\";\n\nconst statuses:number[]=[];\nfor(let i=0;i<35;i++){\n const r=await handler(new Request(\"https://local.test/api/health\",{headers:{\"x-forwarded-for\":\"203.0.113.77\"}}));\n statuses.push(r.status);\n}\nconst first30=statuses.slice(0,30);\nconst tail=statuses.slice(30);\nconst pass=first30.every(s=>s===200)&&tail.every(s=>s===429);\nconsole.log(JSON.stringify({pass,statuses,rule:\"30 requests per 60s per runtime bucket\"}));\nif(!pass) throw new Error(\"RATE_LIMIT_SELFTEST_FAIL\");\nexport default {pass};\n",[171],"b2bf05a1-7c99-4444-80a7-ffa7b27f7be2","oauth_metadata_probe.ts","1a4877ea-aafc-11f1-b7e1-1607ee4eb77e",23,["D",1788813517451],"const resourceUrl = \"https://agent.binance.com/.well-known/oauth-protected-resource/gateway-mcp\";\n\nasync function get(url: string) {\n const r = await fetch(url, { headers: { Accept: \"application/json\", \"User-Agent\": \"PayAna-AgentOS-OAuth-Metadata-Probe/1.0\" } });\n const text = await r.text();\n let body: any = null;\n try { body = JSON.parse(text); } catch { body = { raw: text.slice(0, 2000) }; }\n return { url, status: r.status, ok: r.ok, contentType: r.headers.get(\"content-type\"), body };\n}\n\nconst resource = await get(resourceUrl);\nconst authServers: string[] = Array.isArray(resource.body?.authorization_servers) ? resource.body.authorization_servers : [];\nconst authMetadata = [];\nfor (const issuer of authServers.slice(0, 5)) {\n const clean = issuer.replace(/\\/$/, \"\");\n const candidates = [\n `${clean}/.well-known/oauth-authorization-server`,\n `${clean}/.well-known/openid-configuration`,\n ];\n let resolved: any = null;\n for (const url of candidates) {\n const x = await get(url);\n if (x.ok && x.body && typeof x.body === \"object\" && (x.body.authorization_endpoint || x.body.issuer)) { resolved = x; break; }\n }\n authMetadata.push({ issuer, resolved });\n}\nconsole.log(JSON.stringify({ fetchedAt: new Date().toISOString(), resource, authMetadata }));\n",[178],"c227b3a7-53f7-40d1-8aac-e0730a8f5098","market_api_probe.ts","82d5ab22-aafa-11f1-afaf-1607ee4eb77e",2,["D",1788812833858],"const endpoints = [\n [\"spot_ticker\", \"https://api.binance.com/api/v3/ticker/24hr?symbol=BTCUSDT\"],\n [\"spot_depth\", \"https://api.binance.com/api/v3/depth?symbol=BTCUSDT&limit=20\"],\n [\"spot_klines\", \"https://api.binance.com/api/v3/klines?symbol=BTCUSDT&interval=5m&limit=12\"],\n [\"vision_ticker\", \"https://data-api.binance.vision/api/v3/ticker/24hr?symbol=BTCUSDT\"],\n [\"vision_depth\", \"https://data-api.binance.vision/api/v3/depth?symbol=BTCUSDT&limit=20\"],\n [\"vision_klines\", \"https://data-api.binance.vision/api/v3/klines?symbol=BTCUSDT&interval=5m&limit=12\"],\n [\"futures_premium\", \"https://fapi.binance.com/fapi/v1/premiumIndex?symbol=BTCUSDT\"],\n] as const;\n\nconst results=[];\nfor (const [name,url] of endpoints) {\n const controller=new AbortController();\n const timer=setTimeout(()=>controller.abort(),7000);\n try {\n const r=await fetch(url,{headers:{Accept:\"application/json\",\"User-Agent\":\"PayAna-Market-Sentinel-Probe/0.1\"},signal:controller.signal});\n const text=await r.text();\n let body:any=null;try{body=JSON.parse(text)}catch{}\n results.push({name,url,status:r.status,ok:r.ok,contentType:r.headers.get(\"content-type\"),shape:Array.isArray(body)?`array:${body.length}`:body&&typeof body===\"object\"?Object.keys(body).sort():typeof body,bodyPreview:body?JSON.parse(JSON.stringify(body).slice(0,1400)):text.slice(0,300)});\n } catch(error) {\n results.push({name,url,ok:false,error:error instanceof Error?error.message:String(error)});\n } finally {clearTimeout(timer);}\n}\nconsole.log(JSON.stringify({fetchedAt:new Date().toISOString(),results}));\n",[185],"3b049091-26a5-47f6-8d7d-b532d522f320","index.ts","01a07d8d-933a-7578-bf59-4039f1d9d820",18,["D",1788813207897],"http","import { parseVal, serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono\";\nimport { Root } from \"./frontend/root.tsx\";\nimport { analyzeMarket, normalizeSymbol, supportedSymbols } from \"./lib/market.ts\";\n\nconst app = new Hono();\nconst buckets = new Map();\nconst RATE_WINDOW_MS = 60_000;\nconst RATE_MAX = 30;\n\nfunction clientKey(c: any) {\n return String(c.req.header(\"cf-connecting-ip\") || c.req.header(\"x-forwarded-for\") || \"unknown\").split(\",\")[0].trim().slice(0, 80);\n}\nfunction rateAllowed(key: string) {\n const now = Date.now();\n const bucket = buckets.get(key);\n if (!bucket || now - bucket.startedAt >= RATE_WINDOW_MS) {\n buckets.set(key, { startedAt: now, count: 1 });\n return true;\n }\n if (bucket.count >= RATE_MAX) return false;\n bucket.count += 1;\n if (buckets.size > 1000) {\n for (const [k, v] of buckets) if (now - v.startedAt >= RATE_WINDOW_MS) buckets.delete(k);\n }\n return true;\n}\n\napp.use(\"*\", async (c, next) => {\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"Referrer-Policy\", \"no-referrer\");\n c.header(\"X-Frame-Options\", \"DENY\");\n c.header(\"Permissions-Policy\", \"camera=(), microphone=(), geolocation=(), payment=()\");\n c.header(\"Content-Security-Policy\", \"default-src 'self'; script-src 'self' https://esm.town https://esm.sh; style-src 'self'; connect-src 'self' https://esm.sh; img-src 'self' data:; font-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'\");\n await next();\n});\n\n\napp.use(\"/api/*\", async (c, next) => {\n c.header(\"Cache-Control\", \"no-store\");\n c.header(\"X-Content-Type-Options\", \"nosniff\");\n c.header(\"Referrer-Policy\", \"no-referrer\");\n if (!rateAllowed(clientKey(c))) return c.json({ status: \"BLOCKED\", error: \"RATE_LIMITED\", retryAfterSeconds: 60 }, 429);\n await next();\n});\n\napp.get(\"/\", (c) => c.html(Root()));\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\napp.get(\"/api/health\", (c) => c.json({\n status: \"PASS\",\n service: \"PayAna Market Sentinel\",\n version: \"1.0.0\",\n mode: \"READ_ONLY_MARKET_EVIDENCE\",\n boundary: \"MARKET_DATA_READ != TRADING_AUTH\",\n supportedSymbols: supportedSymbols(),\n agentOsMcp: {\n endpointKnown: true,\n runtimeProbeState: \"OAUTH_AUTHORIZATION_REQUIRED\",\n liveAuthorizedSession: false,\n },\n marketData: {\n provider: \"Binance public market-data surface\",\n runtimeChampion: \"data-api.binance.vision\",\n directApiBinanceComFromValTown: \"HTTP_451_RESTRICTED_LOCATION\",\n },\n generatedAt: new Date().toISOString(),\n}));\n\napp.get(\"/api/symbols\", (c) => c.json({ status: \"PASS\", symbols: supportedSymbols() }));\n\napp.get(\"/api/analyze\", async (c) => {\n try {\n const symbol = normalizeSymbol(c.req.query(\"symbol\") ?? \"BTCUSDT\");\n const result = await analyzeMarket(symbol);\n const httpStatus = result.evidenceState === \"FAIL\" ? 503 : 200;\n return c.json(result, httpStatus);\n } catch (error) {\n const message = error instanceof Error ? error.message : String(error);\n const status = message === \"INVALID_SYMBOL_FORMAT\" || message === \"SYMBOL_NOT_ALLOWLISTED\" ? 400 : 500;\n return c.json({ status: \"FAIL\", error: message.slice(0, 180), boundary: \"NO_UNVALIDATED_SYMBOL_FORWARDING\" }, status);\n }\n});\n\napp.notFound((c) => c.json({ status: \"FAIL\", error: \"NOT_FOUND\" }, 404));\napp.onError((err) => {\n console.error(\"UNHANDLED\", err instanceof Error ? err.message : String(err));\n return new Response(JSON.stringify({ status: \"FAIL\", error: \"INTERNAL_ERROR\" }), { status: 500, headers: { \"content-type\": \"application/json\" } });\n});\n\nexport default app.fetch;\n",[192],"3c579899-4afd-436c-884f-efe9e3941073","binance_mcp_probe.ts","01a07d8d-933a-7578-bf59-3d28de64abcf",["D",1788812825403],"const URL = \"https://agent.binance.com/mcp/agentic\";\n\nfunction parseBody(contentType: string | null, text: string) {\n if (contentType?.includes(\"text/event-stream\")) {\n const events = text.split(/\\n\\n+/).map(block => block.split(\"\\n\").filter(x=>x.startsWith(\"data:\")).map(x=>x.slice(5).trim()).join(\"\\n\")).filter(Boolean);\n const parsed = events.map(e=>{try{return JSON.parse(e)}catch{return {raw:e.slice(0,500)}}});\n return parsed.length === 1 ? parsed[0] : parsed;\n }\n try { return JSON.parse(text); } catch { return {raw:text.slice(0,1000)}; }\n}\nasync function rpc(body: any, session?: string) {\n const r = await fetch(URL, {\n method:\"POST\",\n headers:{\n \"Content-Type\":\"application/json\",\n \"Accept\":\"application/json, text/event-stream\",\n ...(session ? {\"Mcp-Session-Id\":session} : {}),\n },\n body:JSON.stringify(body),\n });\n const text = await r.text();\n return {status:r.status,ok:r.ok,contentType:r.headers.get(\"content-type\"),session:r.headers.get(\"mcp-session-id\"),wwwAuth:r.headers.get(\"www-authenticate\"),body:parseBody(r.headers.get(\"content-type\"),text)};\n}\n\nconst init = await rpc({jsonrpc:\"2.0\",id:1,method:\"initialize\",params:{protocolVersion:\"2025-06-18\",capabilities:{},clientInfo:{name:\"PayAna-Market-Sentinel\",version:\"0.1.0\"}}});\nlet tools:any=null;\nif (init.ok) {\n const session = init.session ?? undefined;\n await rpc({jsonrpc:\"2.0\",method:\"notifications/initialized\",params:{}},session);\n tools = await rpc({jsonrpc:\"2.0\",id:2,method:\"tools/list\",params:{}},session);\n}\nconst compactTools = Array.isArray(tools?.body?.result?.tools) ? tools.body.result.tools.map((t:any)=>({name:t.name,description:String(t.description??\"\").slice(0,300),inputSchema:t.inputSchema})).slice(0,100) : null;\nconsole.log(JSON.stringify({fetchedAt:new Date().toISOString(),init:{status:init.status,ok:init.ok,contentType:init.contentType,sessionPresent:Boolean(init.session),wwwAuth:init.wwwAuth,body:init.body},tools:tools?{status:tools.status,ok:tools.ok,contentType:tools.contentType,wwwAuth:tools.wwwAuth,count:compactTools?.length??null,items:compactTools,body:compactTools?undefined:tools.body}:null}));\n",[200],"0a479271-a8c6-4388-a93e-b78118c728c1","SKILL.md","7f52caf0-aafc-11f1-908d-1607ee4eb77e",25,["D",1788813686965],"# PayAna Falsifier Agent Skill\n\n## Purpose\n\nPayAna is an evidence-first market-analysis agent for Binance Agent OS. Its job is **not** to predict a guaranteed direction and **not** to place trades. It observes market evidence, constructs competing hypotheses, searches for disconfirming evidence, records what is missing, and returns a decision-quality briefing.\n\nThe skill is designed for an MCP-capable AI client connected to the official Binance Agent OS MCP endpoint:\n\n`https://agent.binance.com/mcp/agentic`\n\nUse the minimum permission set required. For this skill, **Market Data only** is sufficient. Account, Trade, Transfer and withdrawal-like capabilities are outside the skill's required scope.\n\n## Hard safety boundary\n\n- `MARKET_DATA_READ != TRADING_AUTH`\n- Never request or enable Trade, Account or Transfer merely to complete this workflow.\n- Never place, simulate-as-real, confirm or recommend an order.\n- Never claim an MCP call occurred unless the tool receipt proves it.\n- Never treat model confidence as a calibrated probability.\n- Never treat a screenshot, HTTP 200, API field named `open`, or plausible prose as economic proof.\n- If one required source fails, mark the run `PARTIAL`; if all required sources fail, mark it `FAIL`.\n\n## Supported market evidence\n\nFor the requested Binance spot symbol, retrieve when available:\n\n1. 24h ticker: last price, 24h change, high, low, quote volume, trade count.\n2. Order book: at least top 20 bid and ask levels.\n3. 5m candlesticks: at least 36 candles when available.\n4. Funding/mark price only when exposed by the connected Agent OS market-data tool. Absence must be recorded, not imputed.\n\n## Loop\n\nRun this reasoning loop once per user request or monitoring cycle:\n\n1. **OBSERVE** — collect fresh market evidence and timestamps.\n2. **VALIDATE** — verify symbol, source success, timestamps, numeric bounds and non-empty data.\n3. **MODEL** — calculate descriptive metrics.\n4. **NEURON** — create at least three branches:\n - winning hypothesis supported by current evidence;\n - opposite hypothesis;\n - alternative/non-directional explanation such as noise, liquidity effects or stale/missing context.\n5. **FALSIFY** — define observable conditions that would invalidate each hypothesis.\n6. **NEGATIVE SPACE** — explicitly list context not available to the run.\n7. **RECONCILE** — choose the best current descriptive label, not a trade direction.\n8. **RECEIPT** — return source/tool receipts and timestamp.\n9. **NEXT TEST** — state what evidence should be checked next if the user wants to continue.\n\n## Deterministic metrics\n\nUse formulas equivalent to the reference implementation when raw inputs exist:\n\n- `spread_bps = (ask - bid) / mid * 10000`\n- `bid_notional = Σ(price_i * qty_i)` over top-20 bids\n- `ask_notional = Σ(price_i * qty_i)` over top-20 asks\n- `book_imbalance = (bid_notional - ask_notional) / (bid_notional + ask_notional)`\n- `log_return_t = ln(close_t / close_(t-1))`\n- `realized_vol_5m_bps = sample_std(log_returns) * 10000`\n- `momentum_30m_pct = (latest_close / close_30m_ago - 1) * 100`\n- `momentum_3h_pct = (latest_close / first_close_in_3h_window - 1) * 100`\n- `volume_z = (latest_quote_volume - mean(prior_quote_volumes)) / sample_std(prior_quote_volumes)`\n\nReference descriptive score:\n\n`directional_score = mean(tanh(2*book_imbalance), tanh(momentum_30m_pct/0.6), tanh(momentum_3h_pct/1.5))`\n\nThis score is a heuristic descriptor, not a probability and not a price forecast.\n\n## Output contract\n\nReturn a compact object or briefing with these fields:\n\n- `symbol`\n- `evidence_state`: `PASS | PARTIAL | FAIL`\n- `fetched_at`\n- `observations`\n- `descriptive_pressure`: `BULLISH_PRESSURE | BEARISH_PRESSURE | MIXED_NEUTRAL`\n- `supporting_evidence[]`\n- `opposing_evidence[]`\n- `alternative_explanations[]`\n- `falsifiers[]`\n- `risk_flags[]`\n- `missing_context[]`\n- `source_receipts[]`\n- `recommendation`: always `NO_TRADE_DECISION` for this skill\n- `next_test`\n\n## Example request\n\n\"Use Binance Agent OS market data to audit BTCUSDT. Tell me what the current evidence supports, what argues against it, what would falsify the reading, and what is missing. Do not trade.\"\n\n## Example acceptance criteria\n\nA run passes only if:\n\n- the symbol is explicit and validated;\n- at least one live source has a timestamp/currentness signal;\n- no missing source is silently replaced by fabricated data;\n- the opposite hypothesis and at least one alternative explanation are present;\n- falsifiers are observable rather than rhetorical;\n- source receipts are listed;\n- final recommendation remains `NO_TRADE_DECISION`.\n",[206],"cbfb3f08-588f-4628-839c-7ee2e80168fa","README.md","01a07d8d-933a-7578-bf59-383aad23cbb7",["D",1788812825403],"# React + Hono Starter\n\nA minimal starter template for building client-side React apps with a Hono\nbackend on Val Town. Click **Remix** to get your own copy.\n\n## Picking a starter\n\n| Starter | When to pick it |\n| --- | --- |\n| [`basic-html-starter`](https://www.val.town/x/templates/basic-html-starter) | Static HTML pages. Sprinkle of vanilla JS. No server-side rendering. |\n| [`hono-jsx-starter`](https://www.val.town/x/templates/hono-jsx-starter) | Dynamic server-rendered HTML with JSX. API routes. No React, no SPA. |\n| **[`react-hono-starter`](https://www.val.town/x/templates/react-hono-starter)** *(you're here)* | Client-side React SPA with a Hono API backend. |\n\n**Want to build UI?** Start writing React components in\n[`frontend/components/`](/frontend/components/). Import them into `App.tsx` and\nyou're good to go. Styling is [Twind](https://twind.style/) — just use Tailwind\nutility classes, zero config.\n\n**Want to add an API?** Add routes in [`index.ts`](/index.ts) (there's a\ncommented-out example). Fetch them from your React components.\n\n## Architecture\n\n```mermaid\ngraph LR\n Browser -->|\"GET /\"| Hono[\"index.ts
(Hono server)\"]\n Hono -->|serves| HTML[\"root.tsx\"]\n HTML -->|loads| Entry[\"index.tsx\"]\n Entry -->|renders| App[\"App.tsx\"]\n App -->|renders| Counter[\"Counter.tsx\"]\n```\n\n## File structure\n\n```\nindex.ts ← Hono backend (serves frontend + API routes)\nfrontend/\n root.tsx ← HTML shell (stamps immutable asset URLs)\n index.tsx ← React entrypoint (mounts )\n favicon.svg ← App icon\n components/\n App.tsx ← Root component (layout + view source link)\n Counter.tsx ← Example component with state\n```\n\n## How it works\n\n1. **`index.ts`** is the HTTP entrypoint — a Hono server that serves the\n frontend and any API routes you add.\n2. **`frontend/root.tsx`** is the HTML shell — it loads Twind and stamps\n immutable asset URLs for the favicon and React entrypoint.\n3. **`frontend/index.tsx`** mounts the React app.\n4. **`frontend/components/App.tsx`** is the root layout — add new components\n alongside it.\n5. **`frontend/components/Counter.tsx`** is an example stateful component —\n replace it with your own!\n\n## Next steps\n\n- Add API routes in `index.ts`\n- Add new components in `frontend/components/`\n- Add a SQLite database — see the\n [React Hono Example](https://www.val.town/x/stevekrouse/reactHonoExample) for\n a full-stack example with database, queries, and shared types\n\nTemplate updates and upgrade paths for existing remixes: [CHANGELOG.md](/CHANGELOG.md)\n",[213],"c6dd6fa0-d085-4410-bdf7-9cc30f03963a","CHANGELOG.md","01a07d8d-933a-7578-bf59-362732c839bf",["D",1788812825403],"# Changelog\n\n## 2026-07-30 — Immutable asset caching\n\nFrontend files are now served at version-addressed URLs\n(`/__immutable/45/frontend/index.tsx`) with\n`Cache-Control: public, max-age=31536000, immutable`, so repeat visits load the\nwhole client graph from the browser cache — roughly 3× faster (~665ms → ~157ms\nmeasured). Publishing your val bumps its version, which changes every URL, so\ncaches invalidate automatically. Old-version URLs return 404 after a publish\n(like Next.js build assets); a reload picks up the new version.\n\nWhat changed in the template:\n\n- `frontend/index.html` → [`frontend/root.tsx`](/frontend/root.tsx): the HTML\n shell is now JSX and stamps asset URLs with `immutableFileUrl()`\n- [`index.ts`](/index.ts): serves `Root()` at `/`, and one\n `app.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path))` route\n serves all frontend files\n\n### Upgrading an existing remix\n\nYour copy of this template doesn't update automatically. Two options:\n\n**Minimal (most of the benefit):** point both routes at `serveImmutableFile` —\nyour existing bare URLs redirect into versioned space, the new route serves\nthem, and the whole module graph gets cached (costs one redirect per page view):\n\n```ts\nimport { serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\n\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/frontend/**/*\", (c) => serveImmutableFile(c.req.path)); // was serveFile\n```\n\n**Full upgrade (also removes the redirect):** three self-contained steps —\nno other files needed. Adjust the ``, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter\n

Diff · v26