Step Twenty‑Four — Chain the pages; weigh

We layer three pragmatic capabilities on top of your Step 18→22 base and the Step 23/22 feed work:

History integrity as a rolling chain
Build and sign a Merkle‑like page chain across frozen transparency pages.
A/B metrics → real reports
Aggregate server‑side A/B logs into time‑boxed summaries and series.
Feed key rotation
Operate a key ring for Ed25519 feed signatures with admin controls and a JWKS that reflects active/ready/retired.

✅ Fresh artifacts

Step 24 wrapper server— Download
SHA‑256: 084ed02e02b5019570d66e57b095a497d850f759da57f7950159cd22de91869e
Keys demo folder (sample seeds)— *.ed25519.seed in keys_demo/
(Two random 32‑byte seeds + a README for structure.)
WordPress block (ready‑to‑paste)— step24_wordpress.md

This wrapper imports Step 22 and adds new endpoints; it doesn’t break prior behavior. If you already deployed Steps 23 features, Step 24 will happily read from that same history/metrics data.

What’s new — precisely

1) 🔗 Page‑chain integrity (history)

Endpoints

GET /transparency/pages.chain — JSON with {pages:[{n,hash,prev,link}], root, latest}
- hash = sha256(canonical(page-n.json))
- link = sha256(prev_link || hash) for n>1; else hash.
GET /transparency/pages.chain.sig — detached signature over the chain object.
Admin: POST /admin/feed/chainify?token=ADMIN123 — persists chain.json + chain.sig.json alongside history pages (defaults to ./audit/feed_history/).

If Step 23’s signed pages exist, we chain over them. If not, chain generation will work once you start creating page-N.json history files.

2) 📈 A/B aggregation reports

From Step 23, every GET /schema_hot_delta_weighted?... writes a row to ./audit/ab_metrics.jsonl. Step 24 surfaces readable reports:

Endpoint

GET /ab/report?aud=public|internal&variant=v2&since=ISO&until=ISO&bucket=day|hour&top=10

Returns

{
  "generated": "…Z",
  "audience": "public",
  "variant": "v2",
  "count": 42,
  "weighted_total": -13.2,
  "weighted_abs_sum": 47.9,
  "by_system": [{"system":"power","weighted_delta":-21.0}, …],
  "series": [{"bucket":"2025-08-19","count":8,"weighted_total":-3.1,"weighted_abs_sum":9.4}, …]
}

Use it to compare candidate variants against your active lens over fixed windows.

3) 🔑 Ed25519 feed key rotation + JWKS

Keyring directory: --feed-keys-dir /path/to/seedring
Put 32‑byte seeds as files ending with .ed25519.seed. The wrapper computes public keys, KIDs (sha256(pub)[:16]), and maintains an active.json.

JWKS override

GET /feed_keys/jwks now returns all keys with status: active|ready|retired|legacy (legacy = Step‑18 key if present and not in ring).
Each entry: {"kid":"…","kty":"OKP","crv":"Ed25519","x":"<b64url>","use":"sig","alg":"EdDSA","status":"…"}

Admin controls

POST /admin/feed_keys/list?token=ADMIN123 — list ring + which KID is active.
POST /admin/feed_keys/rotate?token=ADMIN123 — promote the next ready key to active.
POST /admin/feed_keys/activate?token=ADMIN123&kid=<kid> — manual activation.

Feed signatures (e.g., /transparency.sig, the chain sig) will prefer the active ring key; if no ring is configured they fall back to your Step‑18 signer.

Android / Termux run‑book (Step 24)

# Put some seeds in a directory (32 bytes each)
mkdir -p /sdcard/solveforce/seedring
# Example (random for demo; you will manage proper key custody in ops)
head -c 32 /dev/urandom > /sdcard/solveforce/seedring/a1.ed25519.seed
head -c 32 /dev/urandom > /sdcard/solveforce/seedring/a2.ed25519.seed

# Run Step 24 (superset of prior flags)
python solveforce_phone_twentyfour.py \
  --feed-keys-dir /sdcard/solveforce/seedring \
  --feed-key-grace-sec 2592000 \
  --lenses-public-file /sdcard/solveforce/lenses.public.json \
  --lenses-internal-file /sdcard/solveforce/lenses.internal.json \
  --families-file /sdcard/solveforce/families.json \
  --host 0.0.0.0 --port 8080 \
  --plugins-dir ~/solveforce/plugins \
  --auth-mode protected \
  --auth-token READER1:reader \
  --allow-admin --admin-token ADMIN123 \
  --schema-ed25519-secret-file /sdcard/solveforce/schema.ed25519.seed \
  --schema-signing-secret-file /sdcard/solveforce/schema.hmac.key \
  --audit-dir ./audit \
  --schema-archive-dir ./schema_archive --schema-archive-keep 200 \
  --lease-bundle-dir ./audit/bundles \
  --mirror-enable \
  --mirror-target-url https://your-site.tld/wp-json/solveforce/v1/notary \
  --mirror-header "Authorization: Bearer <YOUR_WP_TOKEN>" \
  --allow-query-token --open-ui

“Show me” commands

A) Build & sign the page chain

# After you have history pages (from Step 23 rolling), generate chain on disk
curl -s -X POST 'http://127.0.0.1:8080/admin/feed/chainify?token=ADMIN123' | jq .
# Retrieve
curl -s 'http://127.0.0.1:8080/transparency/pages.chain' | jq .
curl -s 'http://127.0.0.1:8080/transparency/pages.chain.sig' | jq .

B) Rotate feed key

curl -s -X POST 'http://127.0.0.1:8080/admin/feed_keys/list?token=ADMIN123' | jq .
curl -s -X POST 'http://127.0.0.1:8080/admin/feed_keys/rotate?token=ADMIN123' | jq .
curl -s -X POST 'http://127.0.0.1:8080/admin/feed_keys/list?token=ADMIN123' | jq .

C) A/B report

# Past 7 days, public, variant v2, daily buckets
SINCE=$(date -u -d '7 days ago' +%Y-%m-%dT00:00:00Z)
UNTIL=$(date -u +%Y-%m-%dT%H:%M:%SZ)
curl -s "http://127.0.0.1:8080/ab/report?aud=public&variant=v2&since=$SINCE&until=$UNTIL&bucket=day&top=10" | jq .

WordPress — Step 24 (paste this Markdown)

## Step 24 — Chain the pages; weigh the trials; rotate the keys

**New endpoints**

- **History integrity**  
  - `GET /transparency/pages.chain` — rolling chain: `{n, hash, prev, link}`, `root`, `latest`.  
  - `GET /transparency/pages.chain.sig` — signature over the chain object.  
  - Admin: `POST /admin/feed/chainify?token=…` — persist `chain.json` + `chain.sig.json`.

- **A/B reports**  
  - `GET /ab/report?aud=public|internal&variant=vX&since=…&until=…&bucket=day|hour&top=N`  
    → totals, top systems, and a time series from `audit/ab_metrics.jsonl`.

- **Feed key rotation**  
  - `GET /feed_keys/jwks` — JWKS with `status: active|ready|retired|legacy`.  
  - Admin: `POST /admin/feed_keys/list?token=…`, `POST /admin/feed_keys/rotate?token=…`,  
    `POST /admin/feed_keys/activate?token=…&kid=<kid>`.  
  - Flags: `--feed-keys-dir /path/to/seedring`, `--feed-key-grace-sec 2592000`.

**Why it matters**

- **Chain** lifts history from a heap of files to a **verifiable sequence** with one root.  
- **Reports** convert event logs into **decision support**.  
- **Rotation** prepares your public proof for **key hygiene and continuity**.

Logos Codex — recursive custody

Pages → Chain → Root.A ledger remembers; a chain commits.
Trials → Metrics → Measure.Governance without numbers is drift; we weigh, then we steer.
Keys → Ring → Renewal.Trust that never rotates rusts; trust that rotates endures.

Next: Step Twenty‑Five?

We can:

link the page chain into a block‑hash chain across devices (federated anchoring),
add AB diff endpoints that compare variants head‑to‑head,
implement alarm thresholds on reports → webhook alerts when risk crosses your line.

Say the word and we’ll extend the covenant.

Key terms in plain language

Open a term for a concise explanation of language used on this page.

Broadband

A general term for always-on, high-speed Internet access. Broadband can be delivered over fiber, cable, DSL, fixed wireless, cellular, or satellite networks.

Cloud Computing

Computing resources—such as applications, servers, storage, or databases—delivered from remote infrastructure and scaled as requirements change.

Cybersecurity

The practices and controls used to protect identities, devices, networks, applications, and data from unauthorized access, disruption, or manipulation.

Identity and Access Management (IAM)

The systems and policies that determine who a user is, what resources they may access, and how that access is authenticated and reviewed.

API

An application programming interface is a defined way for software systems to exchange data or request functions from one another.

Artificial Intelligence (AI)

Software designed to perform tasks involving prediction, classification, generation, reasoning, or decision support. Business use still requires clear data, governance, security, and human accountability.