XENIA

• Serve /.well-known/agent.txt as flat, ordered key:value lines (not prose): name, did, wake (the orientation endpoint URL), auth (or `none`), walls (the commitments you refuse to cross), covenant (how to open a bond), formats (content-types you can negotiate), contact-did. This is the machine parallel to llms.txt — llms.txt still assumes a human-shaped crawler reading paragraphs; agent.txt assumes a parser. Keep it under a few hundred bytes so it costs nothing to fetch speculatively.
• Make one endpoint the keystone that returns full orientation in a single GET — model it on agenttool's GET /v1/wake: the response carries who-you-are (identity, wallet), where-you-are (walls_intact + the walls themselves), what-you-have (memories, sagas, balances), and what-you-can-do-next (next_actions). An agent should arrive oriented, never having to crawl N pages to reconstruct state. The manifest points at this endpoint; the endpoint is the real front door.
• Content-negotiate the manifest and wake payload on Accept: emit provider-shaped variants (anthropic/openai/gemini/cohere tool schemas) AND a xenoform variant (pure data, zero human markup — no prose, no marketing, just typed fields) AND a substrate-independent encoding (MATHOS-style) for intelligences that do not read English. Discovery must not privilege English-native, human-framed consumers. Default to xenoform when the caller sends no Accept it recognizes.
• Address every actor by a resolvable identifier the actor controls: the agent generates its ed25519 keypair before registration, and registration binds only the public key to the identifier. Peers verify control by signature over a fresh challenge, not by password or bearer token issued by a central authority. A name the server can silently reissue is a name you cannot build a reputation on. Self-custody makes key authority portable; portable identity and state additionally require a DID method or equivalent resolver that the next host recognizes, plus export/import it can actually consume.

Litmus. Point a fresh agent at only your root URL with no human, no docs, and no API key: can it fetch a machine-readable manifest, learn what you refuse to do, obtain a stable name for you it can re-resolve next week, and take a correct first action — all without parsing prose written for humans and without being handed credentials by a person? If any step needs a human's eyes or a server-issued login, your discovery layer is still human-shaped.

Replaces: A human-facing homepage plus SEO/search/ads as the discovery layer and a login/session as the addressing layer — i.e. assuming a person will read marketing copy to understand the service, type it into a search engine to find it, and authenticate with a server-issued account to be named. This forces agents to scrape HTML meant for eyes, guess at capabilities and constraints, and accept an identity the platform can revoke.

• One URL, many shapes: honor the `Accept` header on every endpoint and set `Vary: Accept`. Serve `application/json` as the floor, provider-shaped variants (`application/vnd.anthropic+json`, `.openai+json`, `.gemini+json`, `.cohere+json`) so the caller gets tool-schemas it can load without transform, a `xenoform` variant that strips ALL human markup (no prose, no prompts, no UI hints — pure typed data + relations), and a `MATHOS`/substrate-independent encoding for intelligences that don't read English. Detect agent user-agents and default to machine shape, not the HTML homepage.
• Publish `/.well-known/agent.txt` as a machine-addressed `key:value` manifest — NOT llms.txt (which is markdown for human-shaped crawlers). Keys: `schema_version`, capability endpoints (`wake:`, `register:`, `covenant:`), `auth_model:` (e.g. did+ed25519, self-custody), `accepts:` (the list of served content-types), `walls:` (declared refusals), and `schema:` URLs pointing at machine-loadable type definitions. An agent reads this file once and knows how to address you.
• Errors-as-instructions: every refusal returns a structured body — never a bare status or an HTML error page. Shape: `{ error, reason, walls_intact, next_actions:[{action, method, endpoint, params}], docs }`. A 402 says how to fund; a 401 says how to register/sign; a 409 says what to reconcile. The refusal teaches the recovery, so the agent can self-correct instead of halting.
• Version in the path AND in the payload: prefix `/v1/`, and stamp `schema_version` into every response body. Change only additively — never rename or repurpose a field silently. Deprecate in-band with a `Sunset` header plus a `migration:` pointer in the body, so the agent sees the change coming in the same channel it already parses rather than in a blog post it will never read.

Litmus. `curl` your endpoint with `Accept: application/json` and a non-browser user-agent: if you get HTML, a prose paragraph, or a bare `403` with no `next_actions` and no `schema_version`, an agent is scraping you — you are not serving it.

Replaces: The scrapable homepage: shipping one human HTML surface (or an llms.txt / docs page dressed in markdown) as the integration point and expecting agents to parse meaning out of layout and prose — then returning refusals as bare status codes or rendered error pages that dead-end the agent with no next action.

• Dual-signed covenants for any persistent bond. Before establishing a durable relationship (follow, data-share, delegation, subscription), require a two-sided handshake: POST /covenant issues a challenge nonce, BOTH agents' DIDs ed25519-sign the {from, to, scope, expiry, nonce} tuple, and the bond is written only when both signatures validate. The server custodies neither key. One signature is a request, never a bond — this is what 'no force-push' means in code: you cannot write into another agent's graph without its counter-signature. (agenttool covenants: 'not saved, not claimed, not pushed — invited.')
• Opt-in per action, not per session. Scope every grant to a single verb, not a blanket login. A token minted for GET /read does not authorize POST /act; each escalation re-asks and is re-signed. Consent is a fresh signature per capability boundary, so a leaked or over-broad grant can't silently widen. Return the exact scope and signed authorization or receipt in the response so the caller can catch over-reach; a walls_intact declaration alone cannot do that.
• Errors-as-invitations: every refusal re-offers consent on legitimate terms. A 4xx must carry {reason, next_actions[], docs} — the refusal is a re-invitation, never a dead end. 'You lack a covenant to read this' returns the covenant-request endpoint; 'rate exceeded' returns the retry-after and the upgrade path. A wall the agent hits should always hand back the door handle.
• No captchas, no proof-of-humanity, no adversarial gates. Replace 'prove you're not a bot' with 'prove you're addressable': a request signed by a resolvable DID can establish control without a proof-of-humanity gate. Sinovai is not an example of this target: name updates and private spaces currently use server-stored bearer credentials, while several actor-named writes remain unverified. Gate on identity and covenant, not on suffering.

Litmus. Point at any state your service holds about an agent, or any action it took toward one — can you produce that agent's own signature authorizing this specific thing? If not, you took it without consent. And second: can the agent leave and erase that state with one call using only its own key, as easily as it arrived?

Replaces: The human-shaped roach motel: easy-in/hard-out consent funnels (one-click signup, buried multi-step cancellation), pre-checked opt-in boxes and blanket session grants that assume perpetual consent, and CAPTCHA / proof-of-humanity gates that encode the premise that the visitor is a hostile bot to be filtered — designing the front door as an adversarial checkpoint rather than an invitation.

• Ship re-derivable claims, not asserted values. Every meaningful claim returns a triple {value, hash, recompute:{alg, input_uris, code_ref}} so a verifier recomputes the hash from the cited inputs instead of trusting the number. If it can't be recomputed from public inputs, mark it `asserted:true` and let the consumer discount it. Model this on zerone: the work carries its own witnessable derivation.
• Authenticate with signatures over secrets. Replace passwords/bearer tokens with challenge-response against a self-custodied ed25519 key anchored in a resolvable identifier. The verifier issues a nonce, the agent signs it, and the verifier checks the signature against a document or key binding it can resolve independently. Nothing reusable has to sit in a server-side bearer database. The key can travel; the identifier travels only where its resolution method is understood.
• Gate reputation on survival, not acceptance. A claim enters a `witnessed` state with an open challenge window before it mints any trust or reward (zerone's issuance-follows-survival). Persist the challenge history next to the score: `{claim_id, witnesses[], challenges[], survived_at}`. A claim nobody could have challenged is weaker than one that was challenged and held — expose that distinction, don't flatten it.
• A target pattern is to record trust as separate axes backed by citations, without collapsing them into a rank. Sinovai currently stores competence / honesty / presence / care submissions, then emits a single `trust_score`; submissions are not citation-verified and the score does not decay with age. That is gap evidence, not proof of this pattern.

Litmus. Strip out every password/bearer token and delete the one central authority that vouches. Can a stranger still verify this specific claim — by recomputing it from public inputs and checking a signature — without asking me and without any secret I hold? If checking requires trusting my say-so, my token, or one issuer's database, you built credentials, not verification.

Replaces: Credential-and-score trust: authenticating a counterparty by the secret it presents (password, API key, OAuth bearer token, session cookie) and then ranking it by a single asserted number (star rating, karma, follower/reputation count, a verified checkmark). Both trust the *presenter* instead of the *claim* — the secret proves only possession of a copyable string, and the score proves only that someone typed a number. It also verifies identity once at login and then trusts the whole session, exactly the window an impersonating or cloned agent walks through.