chore(scrub): remove WRI formula copies from public code + canary TODO - #64
Merged
Merged
Conversation
The real leak #46 missed — but NOT what it first looked like. The v2 production formula (wayforth_rank_v2.py, ranker.py) is GITIGNORED (private); those are not public. What WAS public: the SIMPLER heuristic formula copied into FIVE tracked files — catalog.py (a LIVE /search router), plus crawler health_monitor / backfill_v2 / backfill_v7 / fix_backfill — each exposing the weights (base 50, tier +20/+5, failures +20/+10, x402 +5, payment +min(*2,8)). Scrubbed: every public copy now defers to the private rank service (RANK_SERVICE_URL, recalculated via promoter.run_rank_recalculate) and returns an interim placeholder — no signal weights in any public container. Renamed compute_wri_simple -> _interim_score and run_wri_recalculate -> run_rank_recalculate; scrubbed promoter prose. KEPT the output-contract names (wri_score, X-Wayforth-WRI headers, *_wri_alert webhooks, boost_wri_bonus) — already public via the gateway API, same call as the mcp scrub. Also removed the unannounced-gap TODO(canary) framing from deps_live_proof.py. ACCEPTANCE: git grep over tracked (public) code = ZERO formula/weights/compute_wri fingerprints. wayforth-ts + x402 repos: clean (code search). Full suite green (593). NOT in this PR (separate decision): the trade-secret NAME 'WayforthRank'/'WRI' still appears in ~10 docs/migrations/tests — some intentional boundary-disclosure (CONTRIBUTING/.gitignore/admin assert 'the formula is private'), some signal-revealing (CHANGELOG lists the 8 signals). Reported for a scope decision before touching docs. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
WayforthOfficial
added a commit
that referenced
this pull request
Jun 27, 2026
…ocs (#65) Follow-up to #64. Scrubs the trade-secret NAME only where it REVEALS HOW RANKING WORKS (per the signal-revealing-vs-IP-assertion split): • CHANGELOG.md — dropped the enumerated 8 signal fields + generalized the name • infra/migrations 006/045/058 — 'WayforthRank data pipeline/signal data' -> 'Ranking …' • examples/README.md — 'WayforthRank scoring' -> 'Reliability scoring' • scripts/data-fixes/…dedup — dropped 'WayforthRank v2' from the context note KEPT (intentional IP signposting — asserts the trade secret is deliberately private, good posture, NOT a leak): CONTRIBUTING.md, .gitignore, routers/admin/rank.py, and tests/test_pioneer_boost.py (references the gitignored compute_wri_v2 by name in a private-by-default stub-when-absent pattern; exposes no formula). Docs/SQL-comments only — no code, no behavior change. After this, WayforthRank/WRI appears in tracked code ONLY in those 4 intentional locations. Co-authored-by: MytelligentPRV <assulindor@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Staged for review — the formula scrub (#1) + canary (#2). No merge.
Correction first (important)
My initial headline — "the full v2 formula is public" — was wrong.
wayforth_rank_v2.pyandranker.py(the real formulas) are gitignored/private (.gitignore:48-49) — a working-tree file isn't a public file. The crown-jewel v2 algorithm is not exposed.What WAS public (and is now scrubbed) — the simpler heuristic, copied into 5 tracked files
Your "assume another copy" was right three times over: the simple weight formula (base 50, tier +20/+5, failures +20/+10, x402 +5, payment +min(×2,8)) was in:
apps/api/routers/search/catalog.py— a live/searchrouter (the one that mattered most)apps/crawler/health_monitor.py,backfill_v2.py,backfill_v7.py,fix_backfill.pyAll now defer to the private rank service (
RANK_SERVICE_URL) and return an interim placeholder — no signal weights in any public container. Renamedcompute_wri_simple→_interim_score,run_wri_recalculate→run_rank_recalculate; scrubbedpromoter.pyprose. Kept the output-contract names (wri_score,X-Wayforth-WRIheaders,*_wri_alertwebhooks,boost_wri_bonus) — already public via the gateway API, same distinction as the mcp scrub. Also removed theTODO(canary)unannounced-gap framing.Acceptance — grep-clean proof
git grepover tracked (public) code for formula/weights/compute_wri*= ZERO (the kept output-contract names excluded).wayforth-ts+x402repos: clean (code search returned nothing). Full suite green: 593 passed.NOT in this PR — a scope decision for you (the NAME, not the formula)
WayforthRank/WRIstill appears in ~10 docs/migrations/tests, which splits into:CONTRIBUTING.md,.gitignore,admin/rank.pyassert the formula is private ("the ranking engine is proprietary closed-source", "weights stay out of this public container"). That's good posture, not a leak.CHANGELOG.mdlists the 8 signal fields that feed the ranking;examples/README.md, migrations 006/045/058, a data-fix script name the pipeline.test_pioneer_boost.pyreferences the gitignoredcompute_wri_v2(it stubs it when absent).Your call on how far to scrub the name (everywhere, or keep the "it's private" assertions and scrub only the signal-revealing ones) — I didn't touch docs/migrations unilaterally.
🤖 Generated with Claude Code