SpaceDataRig / space-data-rig

# Space Data Rig
## At a glance
A **five-stage deterministic pipeline** (data-fetch -> anomaly-scout -> sim-runner ->
mission-critic -> reporter) that runs a fully reproducible TESS transit-detection loop: real
confirmed-planet parameters from the NASA Exoplanet Archive in, a deterministic Box-Least-Squares
search and injection-recovery statistics through, a **hash-sealed reproducible bundle** anchored on
Solana mainnet out. The deciding math is plain code, not a model; the live LLM layer is advisory
narration only (about 2% of the code, and removing it changes zero verdicts -- measured at P70).
- **It is a closed-loop self-test, not a planet hunt.** It proves the machinery recovers a known
 signal from noise. `discoveryClaim` is false and `safeToGate` is false, everywhere, by design.
- **Honest ceilings, reported as-is.** On real TESS data at scale (P82, 425 curves): blind recall
 86.2%, accepted-call precision 42.2% (a coherent-systematics wall a bigger sample narrows but
 does not remove); external blind validation KP 186/234, CP 103/179 (easiest subsets, named); the
 centroid F-test caught **0/59** labelled blends because 77% of the 500-target checkpoint never
 localises a cross-sector centroid offset -- pixel-baseline-bound, not a statistic problem. All of
 P82/P84/P85 were re-run on the **corrected sky** after an ExoFOP right-ascension unit bug
 (sexagesimal hours read as degrees) was fixed; the earlier "0/56 / 71%" figures were measured
 against the wrong field and are withdrawn (see Capability boundaries).
- **Independently auditable -- precisely bounded.** `scienceHash` is the stable content address: the same
 science manifest -> the same `scienceHash`. `bundleHash` is a *timestamped commitment* that changes on
 every re-seal, so the `bundleHash` written into an on-chain memo attests *that this bundle existed at
 that time* -- it is **not** a locator for the currently-served artifact, and a reader who looks for a
 live file by the memo's `bundleHash` will not find one. Anyone can re-read the memo text from Solana
 with no trust in our database. Reading the memo *and* reconciling it to the bytes this site serves is now
 itself an endpoint: keyless `GET /api/bundles/:id/verify-onchain` re-reads the sealed transaction, decodes
 both the `bundleHash` and the `scienceHash` the chain carries, and compares them to the manifest served
 today -- reporting `anchoredScienceDrift` when they diverge, and `chainReadable:false` (never a false
 "verified") when no RPC answers. Separately, `/api/bundles/:id/verify` re-hashes the served bytes against a
 served `HASH.txt` (internal tamper-evidence only -- it does not query the chain, and `HASH.txt` is not on
 the public artifact allow-list). The exact limits these leave open are stated in Capability boundaries.
- **Under review, and answering it.** A point-by-point ledger of the audit-10 review -- criticism,
 fix, verification, and the residual risk that remains -- is in RESPONSE-TO-AUDIT.md.
The long, det