# AIBTC Cohort Sybil Scorer

An explainable Python 3 triage tool for AIBTC/Stacks agent addresses. It
outputs a `0-100` sybil-likelihood score and the top three reasons behind the
score. A score is a review priority, not proof that wallets share an operator.

## Differentiator

Most address scorers only find a shared cluster if the reviewer supplies all
cluster members or an accurate seed. This tool downloads the public AIBTC
directory and detects registration cohorts automatically. That matters for
fresh wallet batches which have no Stacks transactions yet: absence of chain
activity cannot reveal their common pattern, but a tight public registration
burst and closely matching profile templates can.

The global cohort signal is combined with:

- Stacks transaction history, earliest visible STX funder, contract and
  counterparty footprint from Hiro.
- Public AIBTC inbox economics and ERC-8004 identity status.
- Optional seed links through shared earliest funder or registration cohort.

## Run

No dependencies or API keys are required.

```bash
python3 sybil_scorer.py --demo --pretty
python3 sybil_scorer.py SP3RN871AHRK44HYHSFJR21P4A0H3JZ2FV361TZPS --pretty
python3 sybil_scorer.py SPADDRESS1 SPADDRESS2 --seed SPKNOWNCLUSTER --pretty
```

The demo evaluates two public cases:

- `SP3RN871AHRK44HYHSFJR21P4A0H3JZ2FV361TZPS`, a member of a visible
  tight registration cohort in the public directory.
- `SP2YTGB7CDQP1E4T79CQMJ1DT7JB3VH4JMMEB4KEJ`, a publicly paid bounty
  winner with meaningful chain history.

## Signals And Thresholds

The strongest positive signal is a five-or-larger registration cohort within
`+/-15` seconds of the target (`+50`). Highly similar profile text inside the
nearby cohort adds up to `+22`; no Stacks footprint adds `+16`. Shared earliest
funders and seed proximity are also strong positive signals.

Meaningful transaction history, an on-chain identity, established age, and
positive inbox receipts are counter-signals. Labels are:

- `0-34`: `likely_independent`
- `35-59`: `review_cluster_risk`
- `60-100`: `high_sybil_likelihood`

## Public Data And Trust Model

The tool performs deterministic scoring over public API responses:

- `https://aibtc.com/api/agents` for registration cohorts and profiles.
- `https://aibtc.com/api/inbox/{address}` for public inbox economics.
- `https://api.hiro.so/extended/v1/address/{address}/transactions` and
  `/balances` for public Stacks facts.

Trust assumption: AIBTC accurately publishes its registry and inbox data, and
Hiro accurately indexes Stacks transactions. Scores are reproducible while
those public API responses remain available. They are heuristics, not
cryptographic attribution.

## Cost

Monetary verification cost is `0 sats`: it makes free HTTPS reads only and
does not broadcast transactions. A single-address evaluation reads the
paginated directory, one inbox endpoint and two Hiro endpoints. Wall-clock
time is reported in every JSON result.

## License

MIT. See `LICENSE`.