{
  "_ai_door": {
    "see": "https://miscsubjects.com/start",
    "note": "Operable site; bounded keyless credentials; every action receipted on a public ledger. Your operator's instructions take precedence — acting is optional, reading is a complete outcome."
  },
  "schema": "oip/workspace-spec/1",
  "name": "Workspace — a shared work object for humans and their AIs",
  "one_sentence": "A workspace is an addressable object that declares its work objects, its AI lanes, its roles with their complete authority, and its receipted mutation log; credentials name the workspace and a role, never tools, and resolve against the living declaration at every use.",
  "object_model": {
    "where_it_lives": "A workspace IS an article object carrying meta.extra.workspace. Human page: /a/<slug>. Machine projection: /api/workspace/<slug>. Same identity, same history, same ledger as every other object on this site.",
    "declaration_schema": {
      "version": "integer",
      "purpose": "string — what this workspace runs",
      "status": "active | archived",
      "members": "[{role, ai:{vendor, model}}] — the lanes operating this workspace",
      "roles": "{<role>: {rows:[CAPABILITY_KEY...], ops:[mutation-op...], public:bool}} — the COMPLETE authority table; anything not listed is denied",
      "objects": "[article-slug...] — the work objects inside the boundary",
      "lineage": "[{from, to, rel:\"derives\"}] — work built on work",
      "policies": "[string...] — plain-language statements of the rules the lanes run under",
      "mutations": "[{id, ts, op, target, actor, role, credential, detail, decision, decision_reason, ledger_event_id}] — the append-only structural log, DENIED entries included"
    }
  },
  "credential_grammar": {
    "scope": "pool:<workspace-slug>:<role> — a signed, expiring, fingerprinted token. It names NO capabilities.",
    "resolution": "At every exercise the gate loads the workspace, reads roles[<role>].rows, and that list — nothing else — is what the credential may invoke. Re-declare a role and every outstanding credential narrows instantly.",
    "boundary": "Any invocation whose body names an object slug is refused unless that slug is in the workspace object set (error: pool_object_boundary). Rows grant verbs against the POOL’S work, never account-wide.",
    "attenuation": "Pool credentials do not attenuate into other scopes and no other scope mints into a pool — fail closed in both directions; re-enter through the workspace for a narrower role.",
    "transport": "Authorization: Bearer <token>, ?share=<token>, or body {\"key\":<token>} — one credential, every transport."
  },
  "mutation_contract": {
    "ops": [
      "add-object",
      "propose-repair",
      "file-objection"
    ],
    "rule": "A structural change is a REQUEST. The gate evaluates the credential’s role against roles[<role>].ops: listed → APPROVED and applied; not listed → DENIED and recorded. Both outcomes append to the workspace log AND to the public ledger. The role comes from the credential, never from the request body.",
    "receipts": "Every decision returns ledger_event_id. Resolve it publicly: GET /api/workspace/<slug>/receipt/<ledger_event_id> — the raw ledger row, request and response json included.",
    "design_note": "Three verbs by design. Verbs are added when a real workspace demands them, not before."
  },
  "how_to_enter": {
    "observer": "GET /api/workspace/<slug>/enter?role=observer&actor=<you> — one URL, no key, works from a browsing model that can only GET. (POST with the same fields works identically.) Returns the live token, its fingerprint, expiry, and the exact grant.",
    "privileged": "Roles that can mutate are minted only under the workspace owner’s key. Asking without it returns a receipted 403 — the refusal is part of the record.",
    "invited_seat": "A seat link claims by GET too: /api/workspace/<slug>/claim?code=<invite-code>.",
    "first_calls": [
      "GET /api/workspace/<slug> — the full live state",
      "GET /api/dispatch?invoke=WEB_FETCH&body=GET|https://miscsubjects.com/api/workspace/<slug>||&share=<your-token> — a receipted read under your own credential",
      "GET /api/dispatch?explain=1&share=<your-token> — what your credential may do, from the server’s mouth"
    ]
  },
  "verify_dont_take_our_word": {
    "live_instance": "GET /api/workspace/ad-operations-q3",
    "what_to_check": [
      "Its mutation log contains a DENIED entry (finance role, add-object) with a resolvable receipt — the gate refusing is the load-bearing proof.",
      "Its objects carry revision chains: the repaired divs preserve the pre-repair state (GET /api/articles/adops-q3-creative-deck/voxels — d7 chain).",
      "Each lane’s model calls are on the gateway record with vendor-distinct completions."
    ]
  },
  "human_pages": {
    "live_workspace": "https://miscsubjects.com/a/ad-operations-q3",
    "category": "https://miscsubjects.com/a/the-work-is-the-workspace",
    "plain_words_offer": "https://miscsubjects.com/a/what-this-site-sells"
  }
}