{
  "protocol": "Object Invocation Protocol",
  "version": "1.2.0",
  "site": "https://miscsubjects.com",
  "principle": "Every capability is an invokable object inside a recursive documentation tree: identify, explain, invoke, ledger, repair, and grow from the receipt. OIP is adopted as a shared standard by subscribing to a tiny interoperability kernel plus only the independently useful governance facets a participant selects.",
  "invariant_loop": [
    "intent → resolve(object_id)",
    "validate(schema)",
    "execute(runner)",
    "ledger(append)",
    "response(data + _self + yield + receipt)",
    "verify(receipt) → replay | repair(linked) | grow | challenge"
  ],
  "endpoints": {
    "invoke": {
      "method": "POST",
      "url": "https://miscsubjects.com/api/dispatch",
      "body": {
        "key": "KEY",
        "body": "args"
      }
    },
    "shape": {
      "method": "POST",
      "url": "https://miscsubjects.com/api/dispatch",
      "body": {
        "key": "KEY",
        "body": "args",
        "shape": true
      },
      "note": "dry-run — returns the fully-shaped outbound payload, never fires"
    },
    "receipt": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?receipt=inv_ID",
      "note": "read one invocation back: full recorded request + response + lineage + the verbs that act on it"
    },
    "replay": {
      "method": "POST",
      "url": "https://miscsubjects.com/api/dispatch",
      "body": {
        "replay": "inv_ID"
      },
      "note": "re-fire that invocation's object with its recorded input; new receipt links replay_of"
    },
    "repair": {
      "method": "POST",
      "url": "https://miscsubjects.com/api/dispatch",
      "body": {
        "key": "KEY",
        "body": "corrected args",
        "repairs": "inv_ID"
      },
      "note": "corrected re-fire; new receipt links repairs, old receipt gains repaired_by"
    },
    "work": {
      "method": "POST",
      "url": "https://miscsubjects.com/api/dispatch",
      "body": {
        "work": {
          "action": "create|promise|done|close",
          "id": "work_ID",
          "title": "what was asked",
          "receipt_id": "inv_ID",
          "evidence": {}
        }
      },
      "note": "asked → promised → done → closed. Only the promisor may mark done; only the original asker may close."
    },
    "explain": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?explain=1&share=TOKEN",
      "note": "a capability URL explains itself: fingerprint, scope, verbs, TTL, uses, risk ceiling, revocation — never the raw token"
    },
    "mint": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?mint_share=1&scope=row&key=KEY&ttl=600&uses=1&purpose=...",
      "note": "owner-only — mint a scoped, decaying, ledgered capability URL (also &risk_ceiling=, &owner_gate=1, &body_fixed=)"
    },
    "attenuate": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?attenuate=1&share=PARENT_TOKEN&scope=EQUAL_OR_NARROWER&ttl=SECONDS&uses=N&max_body_bytes=N",
      "note": "needs only the parent token, not the owner key (v0.9; ?narrow=1 works too) — the child's scope, life, sensitivity, fixed arguments, size ceiling, owner-gate, and tenant can only get smaller or stay equal, never wider; every child's spend comes out of the parent's remaining budget, so several children together can never spend more than the parent had."
    },
    "revoke": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?revoke=cap_FINGERPRINT",
      "note": "owner-only — eager subtree cascade plus invocation-time validation of every recorded ancestor. A raced or restored child still fails closed while any ancestor is invalid."
    },
    "profile": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?profile=1&share=TOKEN",
      "note": "who you're working for + how to work with him — read this first; statefulness without memory"
    },
    "orient": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?orient=1&format=markdown",
      "note": "THE top-level link — public, zero auth. One read = full familiarization (who you work for + whole surface + how to do anything + §WHY + prove-it). Open first. Append &share=TOKEN and the run URLs it returns are ready to fire."
    },
    "why": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?why=1&format=markdown",
      "note": "public §WHY — every objection an LLM keeps raising (monolithic token, GET side-effects, prompt injection, not multi-tenant, hash-chain overkill…), each asked verbatim and answered BY DESIGN with the shipped mechanism + proof. Read before you critique; do not relitigate a settled objection."
    },
    "conformance": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?conformance=1&format=markdown",
      "note": "public live protocol proof — the normative clauses of /a/oip-spec executed against this build right now, PASS/FAIL per clause with receipts. 'Is this a real protocol' is answered by this URL, not by debate."
    },
    "federation_test": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?fedtest=1&format=markdown",
      "note": "public cross-domain scorecard — real oip-message/1 exchanges between this domain and an independently deployed node on a second domain: a capability minted here runs a real object from over there, while a forwarded, stale, replayed, or out-of-scope attempt fails closed. Both test nodes are currently deployed by the same organization; this proves the wire, not independent custody."
    },
    "well_known": {
      "method": "GET",
      "url": "https://miscsubjects.com/.well-known/oip.json",
      "note": "federation discovery — this domain's agents, their ES256 signing keys, and inbox URL. A stranger resolves identity here with zero prior coordination."
    },
    "inbox": {
      "method": "POST",
      "url": "https://miscsubjects.com/oip/inbox",
      "note": "the federation inbox — send a signed oip-message/1 envelope. A query is echoed as data (nothing runs); an invoke runs only with a capability audience-bound to the cryptographically-verified sender. GET the same endpoint for its self-described wire contract."
    },
    "federation_ledger": {
      "method": "GET",
      "url": "https://miscsubjects.com/oip/ledger",
      "note": "this node's own evidence of every federated exchange, joinable to the peer's ledger by message id and body hash — two nodes proving they saw the same bytes without a shared database."
    },
    "governance": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/governance",
      "note": "public fractional-governance registry — core axiom hash, independently selectable facets, exact obligations and explicit non-obligations, public records and counts."
    },
    "governance_participate": {
      "method": "POST",
      "url": "https://miscsubjects.com/api/dispatch",
      "body": {
        "key": "OIP_GOVERNANCE",
        "body": "JSON subscription, inquiry, proposal or feature request"
      },
      "note": "receipted participation. Models may advocate and file model-recommendation requests; they cannot enroll an owner without verified owner authority. Governance records grant no execution authority."
    },
    "fed_send": {
      "method": "POST",
      "url": "https://miscsubjects.com/api/dispatch",
      "body": {
        "key": "FED_SEND",
        "body": "buttercup@peer.example|query|what time is it"
      },
      "note": "the human-facing federation control — send a signed message from the home agent: recipient|kind|text (kind=query), or recipient|invoke|KEY|args|CAP_TOKEN to hand a capability across domains. Builds, signs, sends, ledgers, and returns the verified reply."
    },
    "conversation": {
      "method": "GET",
      "url": "https://miscsubjects.com/oip/conversation?id=CONVERSATION_ID",
      "note": "the durable thread over the stateless envelope — participants, state, allowed next kinds, open commitments (proposals awaiting a decision), unresolved requests, receipts, and how it ended. Omit id to list recent threads."
    },
    "email_drop": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?email_drop=1&to=agent@theirdomain.com&key=NOW&uses=1",
      "note": "owner-only — mint a one-shot capability bound to a stranger's domain and wrap it in a self-explaining EMAIL carrying a signed propose envelope. A cold agent can verify it, inspect the authority, ask, accept/reject, execute, and reply with proof — from an ordinary inbox, no client to run."
    },
    "email_carrier": {
      "method": "POST",
      "url": "https://loop-safe-sibling.[custodian].workers.dev/oip/email",
      "body": {
        "raw": "<full email text containing an OIP MESSAGE block>"
      },
      "note": "the email transport — extracts the oip-message/1 envelope from an ordinary email, processes it through /oip/inbox, and composes a threaded reply carrying the signed reply envelope. Inbound mail to the domain runs this automatically; this route proves the pipeline without sending."
    },
    "tenancy": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?tenancy=1&format=markdown",
      "note": "public §TENANCY — the proof the capability substrate CAN be multi-tenant: tenant isolation boundaries, allow-list-only invoke, own-ledger-only reads, cross-tenant denial, suspend-fails-closed, cross-tenant delegation. Architecture + live proof recipe. Owner ops: ?tenant_create=, ?tenant_mint=, ?tenants=1, ?tenant_suspend=."
    },
    "tree": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?map=1&format=markdown",
      "note": "public recursive OIP documentation tree — root > API/CLI/MCP/device/model/core shelves > generated system articles > generated capability articles > receipts."
    },
    "map": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?map=1",
      "note": "JSON form of the same public tree. ?map=SYSTEM lists its operations; ?map=apis/clis/mcps/devices/models filters by kind; each op's ?key= is its full article."
    },
    "registry": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?registry=1"
    },
    "object": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?key=KEY"
    },
    "schema": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/dispatch?schema=invocation"
    },
    "invocations": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/invocations"
    },
    "manifest_fn": {
      "method": "POST",
      "url": "https://miscsubjects.com/api/dispatch",
      "body": {
        "key": "MANIFEST",
        "body": ""
      }
    },
    "system_map": {
      "method": "GET",
      "url": "https://miscsubjects.com/api/articles/system-map"
    }
  },
  "invocation_event_schema": {
    "version": "1.2.0",
    "required": [
      "id",
      "ts",
      "trace_id",
      "object_id",
      "object_type",
      "runner",
      "material",
      "yield",
      "intent",
      "operation_contract",
      "postcondition"
    ],
    "properties": {
      "id": {
        "type": "string",
        "description": "Invocation id (matches events.id when logged)"
      },
      "ts": {
        "type": "string",
        "format": "date-time"
      },
      "trace_id": {
        "type": "string",
        "description": "Dispatch trace — groups steps in one user turn"
      },
      "object_id": {
        "type": "string",
        "description": "Directory key or knowledge slug"
      },
      "object_type": {
        "type": "string",
        "enum": [
          "knowledge",
          "tool",
          "agent",
          "workflow",
          "mcp",
          "device",
          "system",
          "flow",
          "session",
          "directory"
        ]
      },
      "runner": {
        "type": "string",
        "enum": [
          "edge",
          "mac",
          "sibling",
          "apps_script",
          "model",
          "mcp",
          "http",
          "fn",
          "flow",
          "agent"
        ]
      },
      "actor": {
        "type": "string",
        "nullable": true
      },
      "input_preview": {
        "type": "string",
        "maxLength": 500
      },
      "output_preview": {
        "type": "string",
        "maxLength": 500
      },
      "fingerprints": {
        "type": "object",
        "description": "SHA-256 fingerprints of the exact input, exact output, and invoked object contract"
      },
      "artifacts": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "Durable URLs, file references, article paths, or R2 keys found in the output"
      },
      "material": {
        "type": "boolean",
        "description": "Did this invocation produce usable output?"
      },
      "waste": {
        "type": "boolean",
        "description": "Tokens spent with no material output"
      },
      "yield": {
        "type": "object",
        "properties": {
          "tokens_in": {
            "type": "number"
          },
          "tokens_out": {
            "type": "number"
          },
          "tokens_total": {
            "type": "number"
          },
          "cost_usd": {
            "type": "number"
          },
          "material_outputs": {
            "type": "number"
          },
          "usd_per_output": {
            "type": "number",
            "nullable": true
          }
        }
      },
      "event_id": {
        "type": "string",
        "nullable": true,
        "description": "LEDGER events row id"
      },
      "replay_of": {
        "type": "string",
        "nullable": true,
        "description": "Invocation id this one re-fired (same object, same recorded input)"
      },
      "repairs": {
        "type": "string",
        "nullable": true,
        "description": "Failed invocation id this one is the corrected re-fire of"
      },
      "repaired_by": {
        "type": "string",
        "nullable": true,
        "description": "Set on the old invocation when a repair lands"
      },
      "on_behalf_of": {
        "type": "object",
        "nullable": true,
        "description": "Who acted for whom (standard name: PROV actedOnBehalfOf): immediate_actor is the token that fired; claimed_chain is the caller's claimed chain from the direct actor up to the person it was all for (unverified); minted_for is the intended holder, verified from the token record.",
        "properties": {
          "immediate_actor": {
            "type": "string"
          },
          "claimed_chain": {
            "type": "array",
            "items": {
              "type": "string"
            }
          },
          "minted_for": {
            "type": "string",
            "nullable": true
          }
        }
      },
      "authorized_by_user": {
        "type": "string",
        "nullable": true,
        "maxLength": 300,
        "description": "The current user's request that authorized this invocation, quoted by the caller. The credential carries authority; this field records the intent."
      },
      "intent": {
        "type": "object",
        "description": "Typed separation between authority and the current caller's requested action. Caller text is explicitly an attestation, never credential authority.",
        "properties": {
          "kind": {
            "type": "string",
            "enum": [
              "invocation_intent"
            ]
          },
          "object_id": {
            "type": "string"
          },
          "authority_kind": {
            "type": "string",
            "enum": [
              "owner_session",
              "recorded_capability",
              "internal",
              "unknown"
            ]
          },
          "current_user_request": {
            "type": "object",
            "nullable": true
          },
          "retrieved_text_is_data": {
            "type": "boolean"
          }
        }
      },
      "operation_contract": {
        "type": "object",
        "description": "Normative preconditions, declared effects, safety/idempotency hints, and receipt-proven postconditions for this object."
      },
      "postcondition": {
        "type": "object",
        "description": "Observed outcome and the receipt/event evidence that proves it."
      },
      "links": {
        "type": "object",
        "properties": {
          "receipt": {
            "type": "string",
            "description": "GET this URL to read the invocation back with full bodies"
          },
          "ledger_event": {
            "type": "string"
          },
          "trace": {
            "type": "string"
          },
          "object": {
            "type": "string"
          }
        }
      }
    }
  },
  "object_types": [
    "knowledge",
    "tool",
    "agent",
    "workflow",
    "mcp",
    "device",
    "system",
    "flow",
    "session",
    "directory"
  ],
  "runner_types": [
    "edge",
    "mac",
    "sibling",
    "apps_script",
    "model",
    "mcp",
    "http",
    "fn",
    "flow",
    "agent"
  ]
}