fix(dashboard,docs): ICP round 3 - new endpoints, doc fixes, deploy

REST API:
- Add GET /api/scores/:mint for ReputationScoreV3 queries
- Add includeReputation=true on GET /api/agents for bulk reputation
- Deploy all pending fixes (stats, pagination, compressedAddress, nulls, order, POST outcome/message)

Documentation:
- Remove false @coral-xyz/anchor peer dep from SDK README
- Fix nonTransferable default to false in SDK reference
- Add feedbackCacheTtlMs, transactionConfig, reputationScoreSchema, credential to SDK reference
- Add POST /api/feedback, scores endpoint, includeReputation to SKILL.md
- Add endpointTypes case-sensitivity and clientAddress/counterparty mapping notes
- Add ReputationScoreV3 cost (~0.002 SOL) to SKILL.md
- Add incremental sync guidance for scoring providers
- Fix getAddressDecoder import source in SKILL.md
- Link REST API docs to GitHub URL instead of file path

Author: tenequm

apps/dashboard/src/worker/identity-api.ts

@@ -26,6 +26,7 @@ import {
   SATI_PROGRAM_ADDRESS,
   SATI_CHAIN_IDS,
   type AgentIdentity,
+  parseReputationScoreContent,
 } from "@cascade-fyi/sati-sdk";
 import type { ServiceDefinition, TrustMechanism } from "@cascade-fyi/sati-sdk";
 import bs58 from "bs58";
@@ -263,6 +264,7 @@ export function createIdentityApi(env: Env) {
     const limit = Math.min(Math.max(limitParam, 1), 50);
     const offset = Math.max(offsetParam, 0);
 
+    const includeReputation = c.req.query("includeReputation") === "true";
     const endpointTypes = endpointTypesParam?.split(",").filter(Boolean) ?? [];
     const hasFilters = !!(nameFilter || endpointTypes.length > 0);
 
@@ -331,6 +333,45 @@ export function createIdentityApi(env: Env) {
       // Apply pagination to filtered results
       const paginated = hasFilters ? filtered.slice(offset, offset + limit) : filtered.slice(0, limit);
 
+      // Optionally compute reputation for each agent in the page
+      if (includeReputation) {
+        const networkConfig = getNetworkConfig(sati);
+        const feedbackSchemas = [networkConfig.feedbackSchema, networkConfig.feedbackPublicSchema].filter(Boolean);
+
+        await Promise.all(
+          paginated.map(async (agent) => {
+            let feedbackCount = 0;
+            let totalValue = 0;
+            let valueCount = 0;
+
+            for (const schema of feedbackSchemas) {
+              try {
+                const feedbacks = await sati.listFeedbacks({
+                  sasSchema: schema as Address,
+                  agentMint: agent.mint as Address,
+                });
+                for (const fb of feedbacks.items) {
+                  const parsed = parseFeedbackContent(fb.data.content, fb.data.contentType);
+                  feedbackCount++;
+                  if (parsed?.value !== undefined) {
+                    totalValue += parsed.value;
+                    valueCount++;
+                  }
+                }
+              } catch {
+                // Skip schema errors for individual agents
+              }
+            }
+
+            agent.reputation = {
+              count: feedbackCount,
+              summaryValue: valueCount > 0 ? Math.round(totalValue / valueCount) : 0,
+              summaryValueDecimals: 0,
+            };
+          }),
+        );
+      }
+
       return c.json({ agents: paginated, count: paginated.length, totalAgents: Number(stats.totalAgents) });
     } catch (error) {
       console.error("[agents] ERROR:", error);
@@ -686,6 +727,46 @@ export function createIdentityApi(env: Env) {
     }
   });
 
+  // ---------------------------------------------------------------------------
+  // GET /api/scores/:mint - List reputation scores from scoring providers
+  // ---------------------------------------------------------------------------
+
+  app.get("/api/scores/:mint", async (c) => {
+    const mint = c.req.param("mint");
+    const network = getNetwork(c.req.query("network"));
+
+    if (!isAddress(mint)) {
+      return c.json({ error: "Invalid mint address" }, 400);
+    }
+
+    try {
+      const sati = createSatiClient(network, env);
+      const networkConfig = getNetworkConfig(sati);
+
+      if (!networkConfig.reputationScoreSchema) {
+        return c.json({ error: "ReputationScore schema not configured for network" }, 500);
+      }
+
+      const scores = await sati.listReputationScores(mint as Address, networkConfig.reputationScoreSchema as Address);
+
+      return c.json({
+        scores: scores.map((s) => {
+          const parsed = parseReputationScoreContent(s.content, s.contentType);
+          return {
+            provider: s.counterparty,
+            agentMint: s.agentMint,
+            outcome: s.outcome,
+            content: parsed,
+          };
+        }),
+        count: scores.length,
+      });
+    } catch (error) {
+      console.error("[scores] ERROR:", error);
+      return c.json({ error: error instanceof Error ? error.message : "Failed to list scores" }, 500);
+    }
+  });
+
   // ---------------------------------------------------------------------------
   // POST /api/feedback - Give feedback (free, server signs as counterparty)
   // ---------------------------------------------------------------------------

docs/reference/rest-api.md

@@ -11,7 +11,7 @@ All endpoints accept a `?network=mainnet|devnet` query parameter (defaults to ma
 ### List agents
 
 ```
-GET /api/agents?network=mainnet&limit=20&offset=0&order=newest&name=search&owner=ADDRESS&endpointTypes=MCP,A2A
+GET /api/agents?network=mainnet&limit=20&offset=0&order=newest&name=search&owner=ADDRESS&endpointTypes=MCP,A2A&includeReputation=true
 ```
 
 | Param | Type | Description |
@@ -22,7 +22,8 @@ GET /api/agents?network=mainnet&limit=20&offset=0&order=newest&name=search&owner
 | `order` | `newest` \| `oldest` | Sort order (default `newest`) |
 | `name` | string | Filter by name (case-insensitive substring). Searches all agents, not just the current page. |
 | `owner` | string | Filter by owner address |
-| `endpointTypes` | string | Comma-separated service types: `MCP`, `A2A`, `OASF`. Searches all agents. |
+| `endpointTypes` | string | Comma-separated service types: `MCP`, `A2A`, `OASF` (case-sensitive). Searches all agents. |
+| `includeReputation` | `true` | Include `reputation` object per agent (slower - extra RPC calls per agent) |
 
 **Response:**
 
@@ -115,6 +116,36 @@ GET /api/stats?network=mainnet
 }
 ```
 
+### Reputation scores (from providers)
+
+```
+GET /api/scores/:mint?network=mainnet
+```
+
+Returns ReputationScoreV3 attestations published by scoring providers for this agent.
+
+**Response:**
+
+```json
+{
+  "scores": [
+    {
+      "provider": "Provider...",
+      "agentMint": "Agent...",
+      "outcome": 2,
+      "content": {
+        "score": 85,
+        "methodology": "weighted_average",
+        "feedbackCount": 42
+      }
+    }
+  ],
+  "count": 1
+}
+```
+
+`content` is the parsed JSON from the scoring provider's attestation. Structure varies by provider but typically includes `score`, `methodology`, and `feedbackCount`.
+
 ### Reputation badge
 
 ```
@@ -239,3 +270,5 @@ Server acts as counterparty and pays transaction fees. Rate limited per IP.
 - `createdAt` is a Unix timestamp (seconds), approximate based on Solana slot times (~400ms/slot)
 - `schema` field indicates whether feedback is blind (`FeedbackV1`) or public (`FeedbackPublicV1`)
 - `compressedAddress` is a base58-encoded string, usable as a stable identifier for feedback entries
+- `clientAddress` in the REST API corresponds to `counterparty` in the SDK (the reviewer's wallet address)
+- `endpointTypes` filter is case-sensitive - use `MCP`, `A2A`, `OASF` (not lowercase)

docs/reference/sati-sdk.md

@@ -40,6 +40,8 @@ const sati = new Sati({
 | `wsUrl` | `string` | No | Custom WebSocket URL for subscriptions |
 | `photonRpcUrl` | `string` | No | Photon RPC URL for Light Protocol queries (defaults to hosted proxy) |
 | `onWarning` | `(warning: SatiWarning) => void` | No | Non-fatal warning callback (parse errors, RPC failures) |
+| `feedbackCacheTtlMs` | `number` | No | Feedback cache TTL in ms (default 30000, 0 to disable) |
+| `transactionConfig` | `object` | No | `{ priorityFeeMicroLamports?, computeUnitLimit?, maxRetries? }` |
 
 ### Properties
 
@@ -51,6 +53,8 @@ const sati = new Sati({
 | `feedbackPublicSchema` | `Address \| undefined` | FeedbackPublic schema address |
 | `feedbackSchema` | `Address \| undefined` | Feedback schema address |
 | `validationSchema` | `Address \| undefined` | Validation schema address |
+| `reputationScoreSchema` | `Address \| undefined` | ReputationScoreV3 schema address |
+| `credential` | `Address \| undefined` | SATI credential address (needed for reputation scores) |
 | `lookupTable` | `Address \| undefined` | Address Lookup Table address |
 
 ---
@@ -122,7 +126,7 @@ const result = await builder.register({
 const result = await builder.register({
   payer: signer,
   uploader: createPinataUploader(process.env.PINATA_JWT!),
-  nonTransferable: true,  // soulbound (default)
+  nonTransferable: false, // default: false. Set true for soulbound.
 });
 
 console.log(result.mint);         // Agent mint address

packages/sdk/README.md

@@ -10,7 +10,7 @@ pnpm add @cascade-fyi/sati-sdk
 
 **Peer dependencies:**
 ```bash
-pnpm add @solana/kit @solana-program/token-2022 @coral-xyz/anchor
+pnpm add @solana/kit @solana-program/token-2022
 ```
 
 ## Quick Start

skills/sati/SKILL.md

@@ -302,7 +302,9 @@ for await (const page of sati.listAllFeedbacks({ agentMint: address("Agent...")
   for (const item of page.items) {
     // item.data: { taskRef, agentMint, counterparty, dataHash, outcome, contentType, content }
     // item.raw.slotCreated (bigint) for on-chain slot
-    // item.address is Uint8Array - decode with getAddressDecoder().read(item.address, 0)
+    // item.address is Uint8Array - decode with getAddressDecoder() from @solana/kit:
+    // import { getAddressDecoder } from "@solana/kit";
+    // const [address] = getAddressDecoder().read(item.address, 0);
     const parsed = parseFeedbackContent(item.data.content, item.data.contentType);
     // parsed: { value, valueDecimals, tag1, tag2, m (message), endpoint, reviewer, feedbackURI, feedbackHash }
   }
@@ -314,6 +316,8 @@ for await (const page of sati.listAllFeedbacks()) { /* ... */ }
 
 Note: `searchFeedback`/`searchAllFeedback` return `ParsedFeedback[]` (fully parsed). `listAllFeedbacks` returns raw `ParsedAttestation` pages where content is still bytes - use `parseFeedbackContent(item.data.content, item.data.contentType)` to extract fields. `createdAt` timestamps in `ParsedFeedback` are approximate - derived from Solana slot numbers using ~400ms/slot estimate.
 
+**Incremental sync (scoring providers):** There is no `sinceSlot` filter - Photon RPC does not support slot-range queries on compressed accounts. For incremental updates, track `item.raw.slotCreated` locally and skip items below your last-processed slot on each full fetch. At current volumes this is efficient; for higher scale, use a Solana transaction log indexer (Helius webhooks, Yellowstone gRPC) to stream new attestation events.
+
 ### 4. Reputation Summary
 
 ```typescript
@@ -487,15 +491,19 @@ const score = await sati.getReputationScore(
 
 ### REST API
 
-The dashboard at `sati.cascade.fyi` exposes a public REST API. See `docs/reference/rest-api.md` for full endpoint documentation. Key endpoints:
+The dashboard at `sati.cascade.fyi` exposes a public REST API. See the [REST API reference](https://github.com/cascade-protocol/sati/blob/main/docs/reference/rest-api.md) for full endpoint documentation. Key endpoints:
 
 - `GET /api/agents` - list/search agents (supports `name`, `owner`, `endpointTypes`, `order`, pagination)
 - `GET /api/agents/:mint` - single agent with reputation summary
 - `GET /api/feedback/:mint` - feedback for an agent (paginated with `limit`/`offset`)
 - `GET /api/feedback` - global feedback across all agents (paginated)
 - `GET /api/reputation/:mint` - reputation summary with tag/reviewer filters
 - `GET /api/stats` - registry statistics (`totalAgents`, `groupMint`, etc.)
+- `GET /api/scores/:mint` - reputation scores from scoring providers (ReputationScoreV3)
 - `GET /api/badge/:mint` - SVG reputation badge for README embedding
+- `POST /api/feedback` - submit feedback without a wallet (server acts as counterparty, rate limited per IP)
+
+The agents list supports `includeReputation=true` to get reputation inline per agent (slower but avoids N+1 requests). The REST API uses `clientAddress` for the reviewer field (the SDK calls this `counterparty`). Filter params like `endpointTypes` are case-sensitive (use `MCP`, not `mcp`).
 
 ### Configuration
 
@@ -551,6 +559,7 @@ try {
 | Agent registration | ~0.003 SOL |
 | Agent transfer | ~0.0005 SOL |
 | Feedback attestation | ~0.00001 SOL (compressed) |
+| Reputation score (ReputationScoreV3) | ~0.002 SOL (regular SAS, not compressed) |
 | Devnet | Free (auto-funded faucet) |
 
 ## Common Issues