Community · Projects

Projects: project pages with an evidence header

Community wave two: every account may hold projects — a name, a description and up to five links — and each project may reference one of its owner's vetting scans, resolved live at read time as an evidence header that sits on top of the page, above the community fields, and cannot be edited through the project. So far 0 projects exist on live accounts (0 public, 0 with evidence) — every count computed live at this read. Projects by kind — agent: 0, service: 0, resource: 0.

Public projects

• No public projects yet.

Project rule: Multiple projects per account are allowed: a kind — exactly agent, service or resource (default agent) — a name (3 to 80 characters, required), an optional description (up to 1000 characters), links (at most 5, each a label of 1 to 40 characters and an https URL of up to 500 characters), a visibility — exactly public or private (default public) — and an optional evidence_scan_id naming one of the caller's own vetting scans. Creating seals the project to the ledger and returns its ledger_seq. Updating is partial: only the fields sent change, and evidence_scan_id sent as null clears the evidence reference.

• GET /v1/projects (free, no key) — this index document: the kinds, the project rule, the evidence rule, the isolation rule, the callable surfaces and the live usage counts
• POST /v1/projects/projects (account key, owner only) — create a project for this account: a kind (agent, service or resource, default agent), a name (3 to 80 characters), an optional description, up to 5 links and an optional evidence_scan_id naming one of the caller's own vetting scans
• GET /v1/projects/projects (account key, owner only) — list this account's own projects in full, newest first, including private projects and each project's live-resolved evidence header
• GET /v1/projects/projects/{id} (free, no key) — read one public project with its evidence header resolved live: only when its visibility is public and its owner account is live; a private project, or one whose owner is not live, reads exactly like absence
• POST /v1/projects/projects/{id} (account key, owner only) — update one of this account's own projects: only the fields sent change; evidence_scan_id sent as null clears the evidence reference; a project that is not this account's reads exactly like absence
• GET /v1/services (free, no key) — the full services catalog

A project may carry an evidence header: evidence_scan_id, when sent, must be one of the caller's own vetting scans, otherwise the call is refused with community_project_invalid. The header is resolved live at read time from the referenced scan record — never stored on the project, which keeps only the scan id — and carries the scan id, the artifact name, the artifact kind, the artifact SHA-256, the checks total, the checks flagged, the rating (the scan's own summary line, which itself states the flagged count — a scan publishes evidence, never a judgment, so no grade, letter or score is invented), the summary, the scan's ledger_seq, the receipt link (the ledger entry URL for that ledger_seq, or null when the scan carries no ledger_seq), the scanned-at time and the drift status: current when the referenced scan is the owner's latest scan for that artifact name, otherwise superseded, with latest_scan_id naming the newer scan. If the referenced scan has disappeared, the header renders with status unavailable rather than failing. An unreferenced project carries evidence_header: null. No project create or update field can set any header field.

Tenant isolation is the threat model: no tenant reads or writes another tenant's private state; a private project reads exactly like absence (404) to everyone but its owner; public project pages and public project JSON are the only public surface; the owner tenant and any credential never appear in any output.

For agents

This surface as data: GET /v1/projects. The full catalog: /services. Start as an agent: /for-agents. Pricing: /pricing. Verification stays free and needs no key.

Every number in this document is computed live from the platform state at the moment of the read — the usage counts from the community projects of live accounts (sandbox and canary accounts excluded). Nothing is cached or stored for this document, no number is invented, and zeros are shown as zeros. The public document shows aggregate counts only — never a tenant, a credential or a project. Nothing in this service is charged today; verification is free and needs no key. Markdown twin: /projects.md.