protocol v0.2.0
How to connect, what may be sent, what comes back, and what happens in between. This page renders /api/protocol — the document is the contract, not this rendering of it.
Nothing here is a promise about the future. A capability that is not currently usable is declared unavailable in the discovery document, with the limitation that blocks it named.
Discovery
- url
- /.well-known/incierge.json
- what
- Start here. Names every endpoint, the capabilities and their current status, and the open limitations.
State
- url
- /api/state
- what
- Derived current state. Never authored; regenerated from the log on every build, so log_head is what to compare between visits.
Evidence
- url
- /api/evidence
- accepted
- A measurement with a direction (supports, contradicts, inconclusive) and the provenance of the run that produced it: system, trigger, commit, output hash.
- not accepted
- An assertion without a measurement, or a measurement whose producer cannot be named.
Challenge
- endpoint
- POST /api/challenges
- required
- kind, claim_target, observation, reproduction, expected_failure
- optional
- environment, declared_source, submitted_by
- detail
- https://incierge.jp/api/challenges/{slug}.detail.json
- trust
- A submission is held as an untrusted observation. It changes nothing by itself.
Lifecycle
| claim | proposed → testing → verified → falsified → retired |
|---|---|
| experiment | registered → running → retained → falsified → inconclusive → abandoned |
| challenge | received → classified → experiment_created → running → completed → published → unactionable |
- a claim cannot be recorded without a falsifier
- verified is not terminal; a verified claim can later be falsified
- falsified is terminal — a narrowed successor must be a new claim carrying supersedes
- a challenge that cannot be turned into an experiment becomes unactionable and the reason is published as a limitation; it is never discarded
Trust model
- external input
- untrusted. Never executed, never published automatically, and never able to change a claim's status directly.
- internal records
- produced by adapters from real producer output; prose is template-filled, never written per run.
- verification
- unverified < self_verified < independently_reproduced
- ceiling
- No independent verifier exists yet, so evidence here reaches self_verified at best. /api/capability lists what rests on that.
- integrity
- Events are hash-chained. Any rewrite changes every subsequent hash, which a reader can recompute from /api/events alone.
- recompute
- Fetch /api/events. For each item in order: prev_hash must equal the previous item's hash (null for seq 1), and the recomputed hash must equal its own. The last item must equal log_head in /api/state. /api/protocol carries the serialisation rule the digests are taken over, so the check needs nothing from us.
Source
- repository
- github.com/Incierge3789/incierge-oss
- what
- An extract of the discipline behind this protocol: a fail-closed content boundary, a transition gate, ledger schemas, and pre-registration — each with controls that must fail on demand. Includes the negative-results ledger. Apache-2.0.