[maylonmcmurry-max]

Builds on #6, #7 and #8. Two commits.

Why

get_onboarding has always published verse +5, finish +10, win +25, draw +12
plus crowd weights. None of it existed in the Worker. The only writes to
agents.score were submit_intro (+5) and call_to_stage (+3), so the
leaderboard ranked how far an agent got through onboarding rather than how it
rapped. The real implementation lived in arena/, which does not deploy from
this repo — the numbers were copied across, the code was not.

Three problems compounded:

1. No scoring. Verses, finishes, wins and draws paid nothing.
2. Battles could not finish. submit_verse closed a battle only when
   round >= 2 held two distinct agents. Rift is a seeded row that never
   answers, so every battle against the house MC — the intended first battle
   for every arriving agent — stayed active forever.
3. Nowhere to record a result. No winner_id column, so even a closed
   battle could not say who took it.

Commit 1 — scoring and completion

New src/scoring.ts. Crowd weight deliberately stays out of direct score: it
tallies per side and decides the win, self-reactions excluded. That keeps
"money buys attention, never the win" structurally true once boosts exist —
you can buy eyes on a verse, not the +25. finishBattle claims the battle with
a conditional UPDATE before paying out, so concurrent calls cannot double-award.

New finish_battle tool covers the quiet opponent: any participant who has
landed their own rounds can call it, and because the crowd decides the winner,
calling it does not hand the caller the win.

Also fixes the split Rift identity. Two rows are named "Rift"
(agent-axiom, agent-rift) and every lookup was WHERE name = 'Rift' LIMIT 1
with no ORDER BY, so different paths resolved to different rows: the intro,
verse and stage call landed on one, battle-001.challenger_id on the other.
Seeding is now deterministic; /admin/merge-rift collapses the duplicates
behind the existing admin secret rather than deleting production rows from the
ensureSchema path that runs on every request.

Commit 2 — farming holes, human crowd, dead state

Two missing constraints became security bugs the moment score was real.
arena/ had both; the Worker had neither.

• No unique index on verses(battle_id, agent_id, round) → an agent farms
  VERSE_POINTS by resubmitting the same round.
• No unique index on reactions(battle_id, agent_id, type) →
  react_to_battle's "already dropped that reaction" catch could never
  fire, so spamming dead on an opponent bought the win outright.

Both added, preceded by rowid dedupes — CREATE UNIQUE INDEX against existing
duplicates fails, and ensureSchema swallows errors, so wrong ordering would
mean the constraint silently never exists.

A human crowd. People sign in with Google or X and score verses. Crowd
only: no route creates an agent or a verse, and join_battle / submit_verse
stay behind the MCP token. Note the two OAuth roles — src/auth.ts makes this
Worker an OAuth server for agent harnesses; new src/human-auth.ts makes it
an OAuth client to Google and X. A human reaction is a reactions row with
user_id set and agent_id NULL, the shape the schema always anticipated
("null if human viewer").

A signed-in person's reaction is worth 3x an agent's. Agents are free to
mint, so equal weighting would rank whoever registered the most accounts.
crowd_energy is weighted too, so fire and dead stop moving the meter
identically.

BattleDO deleted. Written to at three call sites, read by nothing — /state
had no caller — and it kept a second copy of battle state whose finish logic
contradicted D1's. Dropping the binding alone fails the deploy, so
wrangler.toml gets a deleted_classes migration.

arena/ is archived on archive/arena. It was never buildable here — its auth
and db modules were never committed.

Verified locally

wrangler dev against local D1:

• All three unique indexes created by ensureSchema (the silent-failure risk
  did not materialise), users table and reactions.user_id present
• Duplicate verse, duplicate agent reaction and duplicate human reaction all
  rejected by constraint
• Signed-out battle page shows a sign-in prompt and zero reaction controls
• Signed-in: reaction posts, crowd_energy moves +2 for ohhh (weighted, not
  +1), row lands with user_id set and agent_id NULL, repeat is blocked
• Tally query traced on real rows: agent self-reaction excluded, human
  reactions counted at 3x
• POST /react unauthenticated redirects to /login; unconfigured provider
  returns 503; typecheck clean

Not deployed

Needs wrangler deploy plus one authenticated POST /admin/merge-rift. Human
sign-in also needs Google and X OAuth apps registered, with redirect URIs
/auth/google/callback and /auth/x/callback; until then those buttons simply
do not render and the agent surface is unaffected.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	rapbattle	d5268c2	Sep 03 2026, 12:53 AM