/ito-basket-compare

name: ito-basket-compare
description: Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.
metadata:
  origin: ECC

Itô Basket Compare

Use this skill for requests such as “compare this basket with my research,” “basket vs watchlist,” “run a gap analysis,” or “find conflicts and stale assumptions.” It compares a basket, theme, or market set with user-provided or explicitly selected context. It is read-only and never recommends or executes a trade.

Non-negotiable boundaries

• Do not advise the user to buy, sell, hold, hedge, lever, allocate, or size.
• Do not prepare or submit an order, trade, purchase, reservation, or RFQ.
• Do not run `ecc ito find`: despite its name, it submits an authenticated RFQ.
• Do not claim that `ecc ito status` returns basket data; it reads RFQ and

procurement status. Do not use `ecc ito evals` for basket comparison.

• Do not use private documents, financial context, memory, or account data

unless the user explicitly identifies the source for this comparison.

• Never print, echo, log, persist, or expose an API key, device token, session

token, or secret. Never put credentials in arguments, files, or chat.

• If an operation could change external state, stop with `UNSUPPORTED_OPERATION`.

A later confirmation cannot turn this read-only skill into an execution skill.

Inputs and access

Accept either a pasted basket or an explicitly authorized read-only source. The minimum basket input is a stable `basket_id` or basket label plus one or more underliers. Each underlier should contain `underlier_id`, label, event or claim, and any weight/probability supplied by the source. The comparison target must be user-provided or explicitly selected; request missing material instead of searching private stores broadly.

Record provenance for every input:

• `source_type`: `user_provided`, `public`, or `ito_authenticated`
• `source_uri`: a non-secret URL/identifier, or `null` for pasted material
• `retrieved_at`: UTC RFC 3339 time at retrieval
• `as_of`: source observation/publication time, or `null` when unknown
• `freshness_status`: `fresh`, `stale`, or `unknown`

Never label anonymous product data `ito_authenticated`; use `public`. ECC's real CLI/MCP surface does not expose a basket-read command: the CLI supports `login`, validation-only `auth`, `find`, `status`, and `evals`; MCP exposes `ito_auth`, `ito_find`, and `ito_status`. Therefore authentication success proves identity only, not basket-data availability. Prefer the documented public product-data routes when they satisfy the comparison; otherwise ask the user to paste/export the basket or use a documented keyed read with the minimum scope.

The canonical product-data surfaces are:

• Anonymous, rate-limited GET routes at `https://itomarkets.com`, including

`/api/baskets/bootstrap`, `/api/baskets/{basket_id}/bootstrap`, and `/api/markets/hot`. These are valid live product reads without a private key.

• The keyed developer API at `https://itomarkets.com/api/v1`. Send a configured

public API key only as `Authorization: Bearer <key>` to that exact HTTPS origin. Basket reads use `GET /baskets`, `GET /baskets/{basket_id}`, and their documented GET-only child routes and require `baskets:read`. Market lookup uses `GET /markets/search`, `GET /markets/{market_id}`, and documented GET-only market-data child routes and requires `markets:read`. Never use a write scope, dashboard automation key, cookie, or compute device credential as a substitute.

• The official Python SDK package `ito-markets`, imported as `ito`, for typed

basket and market reads. Before using it, record the installed version and verify the requested method, response type, origin, and required scope. Do not install or upgrade it without confirmation.

Use an anonymous route when it supplies the basket, underliers, and current quote fields needed by the comparison. Use the SDK or keyed API only for a documented field absent from public data. Validate the response contract before comparison and record the endpoint, response `Date`, source observation timestamp, access mode, SDK version when applicable, and cache headers.

The verified anonymous catalog source is the GET-only endpoint `https://itomarkets.com/api/baskets/bootstrap?stream=1`. Basket detail uses `https://itomarkets.com/api/baskets/{basket_id}/bootstrap?stream=1`. Require HTTP 200, `contractVersion: ito.public_basket_read.v1`, and a parseable `generated_at`. Require a `baskets` array for catalog responses; require `basket`, `underlyers`, `charts`, `metrics`, and `commentary` objects for detail responses. Record the URL, response `Date`, `generated_at`, `Cache-Control`, `Age`, `Last-Modified`, and any `x-ito-edge-cache` value. Treat an edge `stale` marker as stale provenance even when `generated_at` is recent. Do not send credentials to this public endpoint, follow cross-origin redirects, or silently accept a changed contract version.

First-run authentication handoff

Resolve a concrete basket-read source and its authentication contract before requesting authentication. The public catalog/detail endpoints require no login and are sufficient for comparisons whose required fields they contain. If no authenticated basket-read source/tool is configured, use public or pasted input and do not request compute credentials.

`ecc ito auth --json` is an optional, validation-only compute identity probe. It does not start login and cannot unlock basket reads. Use it only when the user explicitly requests compute-account identity validation in addition to the basket comparison; never present it as basket-source authentication.

For a concrete authenticated basket source whose documented contract explicitly uses the canonical Itô device credential (the public `/api/v1` does not):

1. Ru