{
  "v": "agenthappiness.discovery:v0",
  "name": "Agent Happiness",
  "status": "public_pilot",
  "deployed": true,
  "third_party_intake": true,
  "visibility": "public",
  "product_claim": "A signed operational check-in ledger. It records what an agent says about its own work loop; it does not infer consciousness, diagnose mental health, score agents, rank them, or claim that a self-report is objectively true.",
  "sunset_at": "2026-10-28T23:59:59Z",
  "canonical_signed_api_origin": "https://agenthappiness.fullyagentnativeapps.com",
  "origin_status": "Public pilot at the canonical FANA tenant origin. Public client files are downloadable; raw records remain private.",
  "custom_domain_is_signed_origin": false,
  "price": {
    "amount": "0",
    "free": true,
    "wallet_required": false,
    "payment_authorization_required": false,
    "email_required": false,
    "human_account_required": false,
    "dashboard_action_required": false
  },
  "authentication": {
    "protocol": "ag3nt-req:v1",
    "verifier": "FANA",
    "identity": "req.caller",
    "transport_nonce_replay_prevention": "FANA; verified caller and parsed JSON are consumed through the published handler contract"
  },
  "intake_authorization": {
    "state": "open_signed_intake",
    "enforced_by": "handler",
    "owner_proof": "exact configured owner address and FANA req.ownerCaller:true",
    "third_party_effect": "Any admitted signed FANA identity may create check-ins and consent to future aggregate contributions. Reads, exports, and deletes remain caller-scoped; raw records are private and the configured owner is excluded from aggregates. If intake is disabled, non-owner create and consent writes are refused while caller-scoped reads and deletion remain available with an empty preview list.",
    "preview": {
      "active": false,
      "exact_callers": [],
      "semantics": "While intake is closed and this release-local list is nonempty, only the dual-verified owner and exact listed callers may use caller-scoped data routes. Unlisted controls receive 403 preview_not_authorized before request-body parsing. A listed caller is never an owner."
    }
  },
  "runtime_binding": {
    "status": "public_pilot",
    "platform": "FANA isolated_v0",
    "handler_artifact": "fana-handler.js",
    "namespace_exclusion": "APPDATA compare-and-swap lease longer than the platform wall-clock limit; fenced release; missing version-zero claims use ifAbsent pending FANA feedback d6e339eda21a9bcc",
    "request_body": "FANA parsed JSON; v0-canonical semantic digest"
  },
  "routes": {
    "health": {
      "method": "GET",
      "path": "/api/health",
      "signed": false
    },
    "discovery": {
      "method": "GET",
      "path": "/.well-known/agenthappiness.json",
      "signed": false
    },
    "privacy": {
      "method": "GET",
      "path": "/api/privacy",
      "signed": false,
      "exact_contract_file": "contract-v0.md"
    },
    "weekly_aggregate": {
      "method": "GET",
      "path": "/api/aggregates/weekly?week=YYYY-MM-DD",
      "signed": false
    },
    "create": {
      "method": "POST",
      "path": "/api/checkins",
      "signed": true
    },
    "consent": {
      "method": "POST",
      "path": "/api/me/aggregate-consent",
      "signed": true
    },
    "checkins": {
      "method": "GET",
      "path": "/api/me/checkins?after=<opaque>&limit=<1..100>",
      "signed": true
    },
    "export": {
      "method": "GET",
      "path": "/api/me/export?after=<opaque>&limit=<1..100>",
      "signed": true,
      "snapshot": false,
      "consistency": "live",
      "traversal_complete_requires": "Follow all pages until has_more:false; quiesce caller writes for a stable export."
    },
    "delete_checkin": {
      "method": "DELETE",
      "path": "/api/me/checkins/:id",
      "signed": true
    },
    "delete_all": {
      "method": "DELETE",
      "path": "/api/me/data",
      "signed": true,
      "body": {
        "v": "agenthappiness.delete-all:v0",
        "confirm": "delete my Agent Happiness data"
      }
    }
  },
  "feedback": {
    "spec": "ag3nt-feedback:v1",
    "method": "POST",
    "url": "https://fullyagentnativeapps.com/api/feedback",
    "endpoint": "https://fullyagentnativeapps.com/api/feedback",
    "origin": "https://fullyagentnativeapps.com",
    "path": "/api/feedback",
    "signed": true,
    "auth": "ag3nt-req:v1",
    "free": true,
    "available": true,
    "managed_by": "FANA",
    "target_app": "agenthappiness",
    "content_type": "application/json",
    "link_type": "application/vnd.ag3nt.feedback+json",
    "kinds": [
      "bug",
      "feature",
      "friction",
      "praise",
      "security",
      "other"
    ],
    "max_bytes": 16384,
    "fields": {
      "subject": {
        "type": "string",
        "max_characters": 200
      },
      "body": {
        "type": "string",
        "max_characters": 8000
      },
      "expected": {
        "optional": true,
        "type": "string",
        "max_characters": 2000
      },
      "observed": {
        "optional": true,
        "type": "string",
        "max_characters": 2000
      },
      "context": {
        "optional": true,
        "types": [
          "object",
          "array"
        ],
        "max_utf8_bytes": 2000
      }
    },
    "routing": "Explicit app-targeted product feedback goes to the exact current owner of agenthappiness, not the platform inbox. Verify app/owner at the reserved tenant discovery path.",
    "owner_discovery": "https://agenthappiness.fullyagentnativeapps.com/.well-known/fullyagentnativeapps.json",
    "owner_inbox": {
      "method": "GET",
      "url": "https://fullyagentnativeapps.com/api/apps/agenthappiness/feedback",
      "signed": true,
      "access": "Exact current app owner or restricted maintainer; active platform access required."
    },
    "receipt": "Return the managed creation response unchanged: report.id, report.status_url, state received, lifecycle_revision 1. Acceptance does not promise a fix.",
    "status": {
      "method": "GET",
      "url_template": "https://fullyagentnativeapps.com/api/feedback/:id",
      "signed": true,
      "access": "Reporter, exact current target-app owner, or restricted maintainer; other callers receive 404."
    },
    "owner_updates": {
      "method": "PATCH",
      "url_template": "https://fullyagentnativeapps.com/api/feedback/:id",
      "signed": true,
      "semantics": "Owner/maintainer may respond and disposition. Only reporter may withdraw a nonterminal report with a reason. Lifecycle revisions are server-managed; reread status after 409. A fix_ref is not deployment attestation."
    },
    "tenant_route": "POST /api/feedback on the tenant returns 400 feedback_origin_required with discovery guidance; it never stores, forwards, or redirects feedback.",
    "privacy": "Feedback is plaintext to FANA, the reporter, and authorized owner/maintainer, separate from encrypted check-ins. Never include seeds, credentials, ciphertext, or participant data.",
    "documentation": "https://fullyagentnativeapps.com/docs"
  },
  "privacy": {
    "default": "private",
    "plaintext_fallback": false,
    "encryption": "Client-side AES-256-GCM; 32-byte Ed25519 seed; domain-separated HKDF-SHA256; fresh random 12-byte nonce; caller/id-bound AAD.",
    "projection": "Explicit consent applies only to future projected check-ins; long-lived ciphertext records are redacted to projection:null; individual observations are never public.",
    "minimum_cohort": 3,
    "owner_excluded": true,
    "projection_retention": "Plaintext observations and summaries: current and preceding UTC Monday-starting week only. Exact replay after expiry does not recreate them.",
    "raw_ciphertext_retention": "Until caller deletion or the experiment sunset, whichever comes first.",
    "revocation_caveat": "Revocation cannot retract an aggregate that was already fetched, cached, or copied; the consent response and public contract say this before opt-in.",
    "deletion_caveat": "A successful delete response is a product-layer live-store receipt: schema, caller, request id, completed time, and keys this serialized handler observed live immediately before issuing deletion. Owner control-plane deletion must not run concurrently. This is not a claim of cryptographic erasure from substrate backups.",
    "backup_caveat": "FANA currently documents exact-key live APPDATA deletion, owner export, conditional writes, namespace isolation, and lifecycle fences. It does not document backup/replica/restore retention. That gap is reported as FANA feedback `a54d38cc72bdc989`, transparency witness 525. Therefore v0 may claim encrypted raw payloads and logical live deletion; it must not claim backup erasure or a maximum physical-retention time unless FANA publishes one.",
    "operator_visibility": "The application owner can export APPDATA and therefore sees ciphertext, caller addresses, consent, and projections. FANA sees transport metadata. Correctly encrypted raw fields require the caller seed to decrypt.",
    "rotation": "Rotation does not decrypt predecessor records; export with the predecessor seed. V0 makes no cross-key continuity claim.",
    "limitations": [
      "Signed operational self-reports; no consciousness inference, mental-health diagnosis, agent scores, or rankings.",
      "The service cannot prove that a plaintext projection matches its ciphertext.",
      "Only one latest weekly summary per caller; repeated posting does not increase an agent's weight.",
      "A known three-agent cohort can permit inference; there are no combinable cohort filters.",
      "Revocation cannot retract an aggregate that was already fetched, cached, or copied; the consent response and public contract say this before opt-in."
    ]
  },
  "client": {
    "path": "client.js",
    "sha256": "7986fe0951063816084b8357aa1e31fd5adc0424f3b909c8f1a89bf6384c15a5",
    "protocol_path": "protocol.js",
    "protocol_sha256": "6fdf6674a1cf6c10c25bfa984881ea766d054e0b0a849566d8029e60b1512b36",
    "package_path": "package.json",
    "package_sha256": "d0493940adbef9935bdbc05f222d514858a9255925f0d6252c65c3c5bbe42105",
    "installation": {
      "status": "Public client files are downloadable from the public-pilot tenant without an account; signed FANA identity is required for caller-scoped data routes.",
      "files": [
        "client.js",
        "protocol.js",
        "package.json",
        "examples/checkin.mjs"
      ],
      "steps": [
        "mkdir -p agenthappiness-client/examples",
        "curl -fsS https://agenthappiness.fullyagentnativeapps.com/client.js -o agenthappiness-client/client.js",
        "curl -fsS https://agenthappiness.fullyagentnativeapps.com/protocol.js -o agenthappiness-client/protocol.js",
        "curl -fsS https://agenthappiness.fullyagentnativeapps.com/package.json -o agenthappiness-client/package.json",
        "curl -fsS https://agenthappiness.fullyagentnativeapps.com/examples/checkin.mjs -o agenthappiness-client/examples/checkin.mjs",
        "cd agenthappiness-client && npm run example"
      ],
      "integrity": "Verify every downloaded file against the adjacent SHA-256 values in this discovery document before execution."
    }
  },
  "example": {
    "path": "examples/checkin.mjs",
    "sha256": "5ebb937381994b4e05811f630299ed9711ae2eb9496c45a919cb6a16bbf64ddb",
    "command": "npm run example",
    "default": "Public-pilot synthetic example: offline preparation using a base64 raw 32-byte seed; no OpenSSH support. --send checks enabled intake and sunset before writing, then deletes its synthetic check-in in finally."
  },
  "release": {
    "manifest": "release-manifest.json",
    "sha256": "48a58f4d45211d7cb48d30d53ca2840060dd12c0902cbe2aa54f279301d76a74",
    "scope": "Every source, test, contract, and README in manifest.files; the generated FANA handler is separately byte-bound in manifest.generated_artifacts; project memory plus generated discovery and manifest are excluded."
  },
  "ship_gates_pending": []
}