The contract files, served raw.

DEED a2ui.v1 · the agent-stream delta grammar

The published contract for DEED's agent stream: intent in, governed generative UI out. An agent emits an ordered sequence of frames — a2ui deltas (append/replace/remove) over a closed 16-kind node vocabulary — that a pure reducer folds into a tree and renders to DEED primitives. No free-form HTML, no open node set: an unknown kind renders a visible error, never a silent fallback. The stream is honest by construction — every stream declares an evidence_class (live/replay/simulation/unavailable) and rides the five data-beats (see → decide → authorize → act → prove). Consequential intents halt the stream at the GATE sentinel, which pairs with an approvalGate node and holds until the operator rules; a replay holds no authority and renders its refusal as the receipt. Both surfaces build against this one contract: the Shell v3 composer driver that emits frames and the a2ui runtime (window.DeedA2UI) that folds and renders them.

DEED v95 AuditEntry

Public-safe Runtime audit entry transport shape for mapping DEED Runtime, Proof, replay, and journal events into lifecycle Trace objects.

DEED Authority Ceremony and Receipt v1

DEED Builder Code Authority v1

DEED CapitalOperation v1

The envelope for anything that can touch money, authority, payment, task settlement, or proof. Agents never call rails directly; they create and advance CapitalOperations. Policy-checked, simulated, signed under scoped authority, executed through a rail, replayable from receipts. The runtime validator (deed.protocol.capital_operation) additionally enforces per-kind consequence-class floors under the rule: class = worst reachable consequence, not stated intent.

DEED Coliseum League retention v0

Public read-only retention gate for weekly paper Coliseum bracket samples and League promotion evidence. This contract never executes orders and never publishes performance claims.

DEED Coliseum paper bracket v0

Public read-only paper tournament bracket for replay-backed DEED League promotion.

DEED Coliseum paper bracket v1

Public read-only paper League bracket derived from REAL stored paper runs (decision_replay_frames, source_type=paper_fill). No fabricated entrants; no public pnl ranking. Honest forming state when no scored runs exist yet.

DEED Public Decision Receipt Card

DEED Decision Replay

DEED design admission baseline

DEED design catalog

DEED design contract

DEED design dimension evidence

DEED design rubric 99 target

DEED design rubric evidence sweep

DEED design specification matrix v1

Current executable design-specification index and formal proof binding for DEED.

DEED design state fixtures

DEED design-system component manifest

DEED component keyboard contract

DEED design-system release receipt

DEED design universe manifest v1

Complete current primitive universe reconciled against the canonical DEED design catalog.

DEED Developer Proof API Contract

Machine-readable launch contract for public read-only proof and replay integration.

DEED discovery manifest

Canonical machine-readable discovery manifest for DEED agents and public crawlers.

DivergenceRefusalProof v1

Cryptographically-fingerprinted bundle attached to an hl-sign refusal that was driven by HL data-plane divergence. Lets an operator (or third-party auditor) verify the claim 'we refused this trade because our primary HL source and the fallback disagreed, by this amount, on these coins, at this timestamp' — without trusting the engine's own log line. Embedded as an extension under decision_replay_frames.frame.tools[] or stored as a standalone bundle keyed by replay_id. The proof_hash field self-seals the bundle so any silent modification is detectable. Closes audit item F21/F22 (https://usedeed.app/contracts/audit-items#F22) when the engine wires the full payload-hash chain.

DEED Runtime evidence depth v1

Public contract for retained live-Runtime evidence depth and the exact sample gaps that block launch-grade confidence.

DEED native Runtime dimension readback v1

Public read-only contract for app-owned Runtime dimension readbacks generated from public-safe live-Runtime-bus harvests.

DEED Runtime proof v1

Public machine-readable contract for DEED Runtime proof systems and safety boundaries.

DEED Runtime product truth v1

Public operator-facing contract for the DEED Hyperliquid Runtime product narrative and safety boundary.

DEED formal Cubical import closure v1

DEED formal identity retirement manifest v1

Fail-closed manifest proving the retired formal namespace cannot resolve as a current path. Retired spellings remain data-only negative test inputs.

DEED formal proof package v1

Manifest for the reproducible DEED Q-anamorphism proof package. It proves package integrity and type-check reproducibility; it grants no custody or execution authority.

DEED formal runtime state contract v1

DEED formal transition oracle v1

Genesis Evidence Bundle v1

Machine-readable proof of one Genesis self-mutation cycle. Built by deed.genesis.evidence.build_bundle() by folding a stream of journal events sharing the same cycle_id. Lets an Admin UI / MCP tool / public proof surface render the cycle without parsing raw JSONL.

DEED Growth Multi-Operator History Readback

DEED Growth Receipt Repeatability Readback

Hyperliquid Data-Plane Provenance v1

Provenance block attached to a ReplayFrame / EvidenceBundle so consumers can see (a) which Hyperliquid source the Runtime read from, (b) how fresh each cached signal was at decision time, and (c) whether the source agreed with the public HL API. Produced by deed/data_plane.py:data_plane_provenance(). The schema deliberately does not specify a single hash field for the data plane state — divergence detection is a follow-on contract.

HL Data-Plane Divergence Record v1

Per-cycle divergence record produced by deed.data_plane_producer.compute_divergence. Compares the engine's primary HL source (typically cached responses from market_data_service) against an optional fallback source. One record is written to bus/hl_data_plane_divergence.json each periodic cycle; the full history lives at bus/hl_data_plane_divergence_history.jsonl. Consumers: /v2/data-plane-divergence (current), /v2/data-plane-divergence/history (records[]), runtime_safety.py (folds the overall status into RuntimeSafetyState), and the hl-sign refusal path (refuses signing when status=major_drift). Schema name is intentionally distinct from deed.hl_data_plane.v1 — that one describes the provenance block embedded in a replay frame; this one describes the standalone divergence record produced by the periodic comparator.

DEED Hosted Operator Launch Receipt

DEED Intelligence Warehouse Contract v1

Machine-readable source, join, privacy, and governance contract for DEED intelligence warehouse materialization.

deed.intent.v1

The composer's intent envelope (COMPOSER-SPEC §3.1). Idempotent, mortal, carries NO secret material. Emitted by source:composer; the engine re-derives class and is authoritative.

DEED signed journal root

The current Ed25519-signed daily journal root object minted by the runtime (engine generate_root + sign_root). root_hash and signature canonicalization are defined by the published journal hash recipe (deed.journal_hash_recipe.v1.json). Retired signed objects remain readable only through their frozen contract and bounded verifier path.

DEED public journal-root artifact

The current unsigned public artifact served at /api/journal-roots/<sha256-slug>. The artifact proves claimed-hash match and entry-chain linkage; the embedded deed.journal_root.v2 object is the material that proves the Ed25519 signature. Retired artifacts remain readable only through their frozen contract and bounded verifier path.

DEED discovery manifest (v1)

The stabilized v1 discovery card served at /.well-known/deed.json. It exposes only current DEED contracts; staged blocks state what exists today and no more, and the card carries no census figures.

DEED marketplace paid-call gate v0

Public readiness contract for marketplace paid calls. The contract is disabled by default and cannot execute orders, move funds, or enable x402.

DEED marketplace paid response receipt v0

Draft blocked receipt schema for future marketplace paid responses. Version v0 represents disabled paid response delivery and cannot prove a charge.

DEED marketplace reputation v0

Public supplier and listing reputation contract for the read-only DEED marketplace.

DEED marketplace seller disclosure v0

Public contract for seller disclosure review requirements. The review workflow is not enabled and cannot approve sellers, enable paid calls, configure x402, or move funds.

DEED public MCP tool results

Contract for /oss/mcp read-only tool result payloads that do not already use public operator schemas.

DEED public MCP refusal

Structured refusal payload returned when public /oss/mcp is asked to mutate runtime or execute orders.

DEED public MCP tools list

Contract for the read-only tools/list response exposed by /oss/mcp.

DEED Pricing Contract v1

Machine-readable product, pricing, fee, and execution-boundary contract for public and operator pricing surfaces.

DEED rejected production attestation canary export v1

DEED production attestation export v1

DEED promoted production attestation window v1

DEED production attestation window request bundle v1

DEED proof-card external attestation v1

DEED proof-card external independence covenant v1

DEED proof-card external promotion result v1

DEED proof-card external attestation request v1

DEED proof-card on-chain revocation pointer or replay evidence v1

DEED proof-card on-chain revocation promotion v1

DEED proof-card on-chain revocation request v1

DEED proof-card file revocations v1

DEED proof card v2

A bounded, self-issued DEED proof card. Verification code remains authoritative for cryptographic, revocation, and formal-tree checks.

DEED ProofPacket v1

The exportable, third-party-verifiable record of ONE capital operation: the redacted latest deed.capital_operation.v1 envelope snapshot, an ordered sha256 chain over every journal snapshot of that operation, the authority it ran under, and the Ed25519 material needed to verify its authorization signatures offline — no secrets required, none included. Not deed.proof_pack.v1 (the per-root daily journal proof); this contract is per-operation. The runtime validator (deed.protocol.proof_packet) and the offline verifier (python3 -m deed.proof_packet_verify <packet.json>) additionally enforce cross-field laws this schema cannot express: packet_id must equal pp_<op_id> of the packaged operation; receipts and signature.entries must be verbatim mirrors of the operation's receipts and signatures; each snapshot_chain seq must equal its array position and the chain head status must match the operation; every status change in the chain must be a legal lifecycle transition; each signature challenge must bind this operation's op_id, policy_hash, simulation_hash, quote_hash, scope_id, and scope_epoch, be signed before quote expiry, and verify against the embedded public key; and proof_hash must reproduce as sha256 over the canonical packet bytes (JSON with sorted keys, compact separators, non-ASCII preserved, UTF-8) with proof_hash itself excluded.

Proof surface packet

The typed reading of the /proof URL: the same signed journal-root state the HTML page renders, served to an explicit Accept: application/json preference. Absence is rendered as absence — an unreachable feed is state "unavailable", never a fabricated green state. Field semantics mirror app/src/lib/proof-surface.ts and are kept in lockstep by unit test.

DEED Public Recurring Decision Artifacts

DEED Public Operator Profile

DEED Public Operators Index

DEED Registry catalog v0

Public-safe catalog contract for DEED Registry skills, strategy templates, signals, datasets, and evaluators. The compatibility /api/market route remains supported.

DEED Registry reputation v0

Public supplier and listing reputation contract for the read-only DEED Registry. The compatibility /api/market/reputation route remains supported.

DEED Public Replay Decision Graph v1

DEED Public Replay Entrypoints

DEED Public Replay Graph Context

DEED Public Runtime Capability State v1

Anonymous, allowlisted RuntimeCapabilityState proof projection. Operator identity, wallets, account values, authority leases, signing posture, Builder Code metadata, blockers, reasons, and operational ages are excluded.

DEED Runtime Capability State v1

RuntimeSafetyState v1

Aggregated read-only view of the engine's safety signals. Joins risk.json, circuit_breaker.json, md_heartbeat.json, heartbeat.json, immune_risk.json into one contract with freshness metadata. Consumers (Admin UI, MCP tools, public Runtime status) read this once instead of reconciling 5+ files by hand. Pure aggregator: no business logic. Produced by deed/runtime_safety.py:compute_runtime_safety_state and exposed at GET /v2/runtime-safety.

DEED Runtime Setup Lifecycle

Current app projection of the claim-to-proof Runtime setup spine derived from RuntimeCapabilityState.

Setup Lifecycle Snapshot v1

Unified view of the Runtime's 'what's forming' surfaces. Folds approaching.json, near_misses*.jsonl, rejections.jsonl, and trades.jsonl into one record per (coin, direction) tuple over a configurable window. Produced by deed/setup_lifecycle.py:build_snapshot(); persisted at bus/setup_lifecycles.json; exposed at GET /v2/setup-lifecycles.

DEED public status contract

Public-safe operational status for DEED runtime, proof, notification, and support readiness.

DEED Vibe Deploy Lifecycle Contract v1

DEED Vibe Deploy Proof Chain v1

Ordered proof contract for establishing Runtime ownership, liveness, paper capability, Hyperliquid authority, main-wallet Builder Code authority before live lease, short live-lease execution authority, and no-secret Builder fill reconciliation.

DEED Vibe Deploy Recovery Hardening v1

DEED Vibe Deploy Runtime Manifest v1

DEED Vibe Deploy Readiness v1

DEED a2ui.v1 · the agent-stream delta grammar

The published contract for DEED's agent stream: intent in, governed generative UI out. An agent emits an ordered sequence of frames — a2ui deltas (append/replace/remove) over a closed 16-kind node vocabulary — that a pure reducer folds into a tree and renders to DEED primitives. No free-form HTML, no open node set: an unknown kind renders a visible error, never a silent fallback. The stream is honest by construction — every stream declares an evidence_class (live/replay/simulation/unavailable) and rides the five data-beats (see → decide → authorize → act → prove). Consequential intents halt the stream at the GATE sentinel, which pairs with an approvalGate node and holds until the operator rules; a replay holds no authority and renders its refusal as the receipt. Both surfaces build against this one contract: the Shell v3 composer driver that emits frames and the a2ui runtime (window.ZeroA2UI) that folds and renders them.

DEED v95 AuditEntry

Public-safe Runtime audit entry transport shape for mapping DEED Runtime, Proof, replay, and journal events into lifecycle Trace objects.

DEED Authority Ceremony and Receipt v1

DEED Builder Code Authority v1

DEED CapitalOperation v1

The envelope for anything that can touch money, authority, payment, task settlement, or proof. Agents never call rails directly; they create and advance CapitalOperations. Policy-checked, simulated, signed under scoped authority, executed through a rail, replayable from receipts. The runtime validator (zero.protocol.capital_operation) additionally enforces per-kind consequence-class floors under the rule: class = worst reachable consequence, not stated intent.

DEED Coliseum League retention v0

Public read-only retention gate for weekly paper Coliseum bracket samples and League promotion evidence. This contract never executes orders and never publishes performance claims.

DEED Coliseum paper bracket v0

Public read-only paper tournament bracket for replay-backed DEED League promotion.

DEED Coliseum paper bracket v1

Public read-only paper League bracket derived from REAL stored paper runs (decision_replay_frames, source_type=paper_fill). No fabricated entrants; no public pnl ranking. Honest forming state when no scored runs exist yet.

DEED Public Decision Receipt Card

DEED Decision Replay

DEED discovery manifest (v0 draft)

The discovery card served at /.well-known/deed.json once the Stage-1 flip is armed (it answers 404 before that). v0 is a draft shape: staged blocks (signature, cli, mandate, registries) state what exists today and no more, and the card carries no census figures. The signed-manifest law and the final block layout are decided with the flip pack (PR #942) and the mandate spec.

DEED Developer Proof API Contract

Machine-readable launch contract for public read-only proof and replay integration.

DEED discovery manifest

Canonical machine-readable discovery manifest for DEED agents and public crawlers.

DivergenceRefusalProof v1

Cryptographically-fingerprinted bundle attached to an hl-sign refusal that was driven by HL data-plane divergence. Lets an operator (or third-party auditor) verify the claim 'we refused this trade because our primary HL source and the fallback disagreed, by this amount, on these coins, at this timestamp' — without trusting the engine's own log line. Embedded as an extension under decision_replay_frames.frame.tools[] or stored as a standalone bundle keyed by replay_id. The proof_hash field self-seals the bundle so any silent modification is detectable. Closes audit item F21/F22 (https://getzero.dev/contracts/audit-items#F22) when the engine wires the full payload-hash chain.

DEED Runtime evidence depth v1

Public contract for retained live-Runtime evidence depth and the exact sample gaps that block launch-grade confidence.

DEED native Runtime dimension readback v1

Public read-only contract for app-owned Runtime dimension readbacks generated from public-safe live-Runtime-bus harvests.

DEED Runtime proof v1

Public machine-readable contract for DEED Runtime proof systems and safety boundaries.

DEED Runtime product truth v1

Public operator-facing contract for the DEED Hyperliquid Runtime product narrative and safety boundary.

Genesis Evidence Bundle v1

Machine-readable proof of one Genesis self-mutation cycle. Built by zero.genesis.evidence.build_bundle() by folding a stream of journal events sharing the same cycle_id. Lets an Admin UI / MCP tool / public proof surface render the cycle without parsing raw JSONL.

DEED Growth Multi-Operator History Readback

DEED Growth Receipt Repeatability Readback

Hyperliquid Data-Plane Provenance v1

Provenance block attached to a ReplayFrame / EvidenceBundle so consumers can see (a) which Hyperliquid source the Runtime read from, (b) how fresh each cached signal was at decision time, and (c) whether the source agreed with the public HL API. Produced by zero/data_plane.py:data_plane_provenance(). The schema deliberately does not specify a single hash field for the data plane state — divergence detection is a follow-on contract.

HL Data-Plane Divergence Record v1

Per-cycle divergence record produced by zero.data_plane_producer.compute_divergence. Compares the engine's primary HL source (typically cached responses from market_data_service) against an optional fallback source. One record is written to bus/hl_data_plane_divergence.json each periodic cycle; the full history lives at bus/hl_data_plane_divergence_history.jsonl. Consumers: /v2/data-plane-divergence (current), /v2/data-plane-divergence/history (records[]), runtime_safety.py (folds the overall status into RuntimeSafetyState), and the hl-sign refusal path (refuses signing when status=major_drift). Schema name is intentionally distinct from zero.hl_data_plane.v1 — that one describes the provenance block embedded in a replay frame; this one describes the standalone divergence record produced by the periodic comparator.

DEED Hosted Operator Launch Receipt

DEED Intelligence Warehouse Contract v1

Machine-readable source, join, privacy, and governance contract for DEED intelligence warehouse materialization.

zero.intent.v1

The composer's intent envelope (COMPOSER-SPEC §3.1). Idempotent, mortal, carries NO secret material. Emitted by source:composer; the engine re-derives class and is authoritative.

DEED marketplace paid-call gate v0

Public readiness contract for marketplace paid calls. The contract is disabled by default and cannot execute orders, move funds, or enable x402.

DEED marketplace paid response receipt v0

Draft blocked receipt schema for future marketplace paid responses. Version v0 represents disabled paid response delivery and cannot prove a charge.

DEED marketplace reputation v0

Public supplier and listing reputation contract for the read-only DEED marketplace.

DEED marketplace seller disclosure v0

Public contract for seller disclosure review requirements. The review workflow is not enabled and cannot approve sellers, enable paid calls, configure x402, or move funds.

DEED public MCP tool results

Contract for /oss/mcp read-only tool result payloads that do not already use public operator schemas.

DEED public MCP refusal

Structured refusal payload returned when public /oss/mcp is asked to mutate runtime or execute orders.

DEED public MCP tools list

Contract for the read-only tools/list response exposed by /oss/mcp.

DEED Pricing Contract v1

Machine-readable product, pricing, fee, and execution-boundary contract for public and operator pricing surfaces.

DEED ProofPacket v1

The exportable, third-party-verifiable record of ONE capital operation: the redacted latest zero.capital_operation.v1 envelope snapshot, an ordered sha256 chain over every journal snapshot of that operation, the authority it ran under, and the Ed25519 material needed to verify its authorization signatures offline — no secrets required, none included. Not zero.proof_pack.v1 (the per-root daily journal proof); this contract is per-operation. The runtime validator (zero.protocol.proof_packet) and the offline verifier (python3 -m zero.proof_packet_verify <packet.json>) additionally enforce cross-field laws this schema cannot express: packet_id must equal pp_<op_id> of the packaged operation; receipts and signature.entries must be verbatim mirrors of the operation's receipts and signatures; each snapshot_chain seq must equal its array position and the chain head status must match the operation; every status change in the chain must be a legal lifecycle transition; each signature challenge must bind this operation's op_id, policy_hash, simulation_hash, quote_hash, scope_id, and scope_epoch, be signed before quote expiry, and verify against the embedded public key; and proof_hash must reproduce as sha256 over the canonical packet bytes (JSON with sorted keys, compact separators, non-ASCII preserved, UTF-8) with proof_hash itself excluded.

Proof surface packet

The typed reading of the /proof URL: the same signed journal-root state the HTML page renders, served to an explicit Accept: application/json preference. Absence is rendered as absence — an unreachable feed is state "unavailable", never a fabricated green state. Field semantics mirror app/src/lib/proof-surface.ts and are kept in lockstep by unit test.

DEED Public Recurring Decision Artifacts

DEED Public Operator Profile

DEED Public Operators Index

DEED Registry catalog v0

Public-safe catalog contract for DEED Registry skills, strategy templates, signals, datasets, and evaluators. The compatibility /api/market route remains supported.

DEED Registry reputation v0

Public supplier and listing reputation contract for the read-only DEED Registry. The compatibility /api/market/reputation route remains supported.

DEED Public Replay Decision Graph v1

DEED Public Replay Entrypoints

DEED Public Replay Graph Context

DEED Public Runtime Capability State v1

Anonymous, allowlisted RuntimeCapabilityState proof projection. Operator identity, wallets, account values, authority leases, signing posture, Builder Code metadata, blockers, reasons, and operational ages are excluded.

DEED Runtime Capability State v1

RuntimeSafetyState v1

Aggregated read-only view of the engine's safety signals. Joins risk.json, circuit_breaker.json, md_heartbeat.json, heartbeat.json, immune_risk.json into one contract with freshness metadata. Consumers (Admin UI, MCP tools, public Runtime status) read this once instead of reconciling 5+ files by hand. Pure aggregator: no business logic. Produced by zero/runtime_safety.py:compute_runtime_safety_state and exposed at GET /v2/runtime-safety.

DEED Runtime Setup Lifecycle

Current app projection of the claim-to-proof Runtime setup spine derived from RuntimeCapabilityState.

Setup Lifecycle Snapshot v1

Unified view of the Runtime's 'what's forming' surfaces. Folds approaching.json, near_misses*.jsonl, rejections.jsonl, and trades.jsonl into one record per (coin, direction) tuple over a configurable window. Produced by zero/setup_lifecycle.py:build_snapshot(); persisted at bus/setup_lifecycles.json; exposed at GET /v2/setup-lifecycles.

DEED public status contract

Public-safe operational status for DEED runtime, proof, notification, and support readiness.

DEED Vibe Deploy Lifecycle Contract v1

DEED Vibe Deploy Proof Chain v1

Ordered proof contract for establishing Runtime ownership, liveness, paper capability, Hyperliquid authority, main-wallet Builder Code authority before live lease, short live-lease execution authority, and no-secret Builder fill reconciliation.

DEED Vibe Deploy Recovery Hardening v1

DEED Vibe Deploy Runtime Manifest v1

DEED Vibe Deploy Readiness v1

examples

examples

json

json

openapi

examples

doc

openapi

examples

json

json