{"openapi":"3.1.0","info":{"title":"SuperSkill API","version":"0.3.1","description":"Find, verify and install reviewed AI-agent capabilities while preserving accounts, workspaces and exact release evidence."},"servers":[{"url":"https://superskill.sh/api","description":"Production"},{"url":"https://onlyharness.com/api","description":"Legacy machine compatibility"},{"url":"http://127.0.0.1:8787","description":"Local development"}],"paths":{"/healthz":{"get":{"summary":"Health check","responses":{"200":{"description":"API health","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Health"}}}}}}},"/registry":{"get":{"summary":"Search harness registry","parameters":[{"name":"q","in":"query","required":false,"schema":{"type":"string"},"description":"Search terms"},{"name":"risk","in":"query","required":false,"schema":{"type":"string"},"description":"Risk tier filter"},{"name":"eval","in":"query","required":false,"schema":{"type":"string"},"description":"Eval status filter"},{"name":"runtime","in":"query","required":false,"schema":{"type":"string"},"description":"Runtime filter"},{"name":"job","in":"query","required":false,"schema":{"type":"string"},"description":"Job-to-be-done filter"},{"name":"outcome","in":"query","required":false,"schema":{"type":"string"},"description":"Legacy alias for job filter"},{"name":"sort","in":"query","required":false,"schema":{"type":"string"},"description":"Sort: trending, stars, forks, threads, new"}],"responses":{"200":{"description":"Registry search results","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/RegistryItem"}}},"required":["items"]}}}}}}},"/resources":{"get":{"summary":"Search mixed agent resources","description":"Search source-aware agent resources across skills, plugins, workflows, MCP servers, configs, guides, runtimes, directories and harness-format packages. `sourceCheckedAt` means upstream existence/activity was checked; it is not a Verified install badge.","parameters":[{"name":"q","in":"query","required":false,"schema":{"type":"string"},"description":"Search terms"},{"name":"type","in":"query","required":false,"schema":{"type":"string"},"description":"Resource type filter, for example skill, plugin, workflow, mcp_server, harness or directory"},{"name":"source","in":"query","required":false,"schema":{"type":"string"},"description":"Source platform filter, for example github or manual"},{"name":"installability","in":"query","required":false,"schema":{"type":"string"},"description":"Machine filter: open_only/upstream listing, importable, installable, verified"},{"name":"worksWith","in":"query","required":false,"schema":{"type":"string"},"description":"Compatibility filter: claude-code, codex, cursor, mcp, cli or github"},{"name":"license","in":"query","required":false,"schema":{"type":"string"},"description":"License status filter"},{"name":"sort","in":"query","required":false,"schema":{"type":"string"},"description":"Sort: popular, github-stars, new, source-checked, onlyharness"},{"name":"limit","in":"query","required":false,"schema":{"type":"string"},"description":"Maximum result count"}],"responses":{"200":{"description":"Mixed resource search results","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceSearchResult"}}}}}}},"/resources/{id}":{"get":{"summary":"Resource detail","description":"Return one mixed resource. Resource ids containing slashes must be URL-encoded, for example github%3Aobra%2Fsuperpowers.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Resource detail with provenance, trust and actions","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Resource"}}}},"404":{"$ref":"#/components/responses/NotFound"}}}},"/resources/{id}/archive":{"get":{"summary":"Download hosted resource archive","description":"Return a tar.gz archive hosted by SuperSkill for resources materialized into its compatibility archive storage. Does not redirect to upstream GitHub.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Resource archive tarball","headers":{"ETag":{"schema":{"type":"string"},"description":"Quoted sha256:<artifactDigest> validator."},"X-OnlyHarness-Resource-Version":{"schema":{"type":"string"},"description":"Exact immutable semantic version served."},"X-SuperSkill-Artifact-SHA256":{"schema":{"type":"string","pattern":"^[a-f0-9]{64}$"},"description":"SHA-256 of the response archive bytes."}},"content":{"application/gzip":{"schema":{"type":"string","format":"binary"}}}},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Resource is listed but archive is not hosted, or the release failed its static security scan","content":{"application/json":{"schema":{"type":"object"}}}},"503":{"description":"Active release metadata exists but verified archive storage is unavailable"}}}},"/resources/{id}/releases/{version}":{"get":{"summary":"Read an exact immutable hosted resource release","description":"Returns the release-bound resource snapshot plus semantic version, artifact SHA-256, archive size and unreviewed trust state. This is the canonical share/install detail for a published version.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"version","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Exact resource release detail","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceExactRelease"}}}},"404":{"$ref":"#/components/responses/NotFound"},"503":{"description":"Active release metadata exists but verified archive storage is unavailable; no download action is returned"}}}},"/resources/{id}/releases/{version}/archive":{"get":{"summary":"Download an exact immutable hosted resource release","description":"Version-bound tar.gz archive resolver. The response bytes are verified against active durable release metadata; older active versions remain retrievable after a newer catalog version is published.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"version","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Exact resource release archive tarball","headers":{"ETag":{"schema":{"type":"string"},"description":"Quoted sha256:<artifactDigest> validator."},"X-OnlyHarness-Resource-Version":{"schema":{"type":"string"},"description":"Exact immutable semantic version served."},"X-SuperSkill-Artifact-SHA256":{"schema":{"type":"string","pattern":"^[a-f0-9]{64}$"},"description":"SHA-256 of the response archive bytes."}},"content":{"application/gzip":{"schema":{"type":"string","format":"binary"}}}},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Exact release failed its static security scan"},"503":{"description":"Active release metadata exists but verified archive storage is unavailable"}}}},"/leaderboard":{"get":{"summary":"Top harnesses by qualified heat","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"string"},"description":"Maximum result count"}],"responses":{"200":{"description":"Leaderboard results. Items appear only after enough real social or verified install signals exist.","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/RegistryItem"}},"minimumSignals":{"type":"integer"}},"required":["items","minimumSignals"]}}}}}}},"/repos/{owner}/{repo}/harness":{"get":{"summary":"Harness detail","parameters":[{"name":"owner","in":"path","required":true,"schema":{"type":"string"}},{"name":"repo","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Harness manifest, trust signals, examples, files and review preview","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HarnessDetail"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/repos/{owner}/{repo}/archive":{"get":{"summary":"Download harness files","parameters":[{"name":"owner","in":"path","required":true,"schema":{"type":"string"}},{"name":"repo","in":"path","required":true,"schema":{"type":"string"}},{"name":"version","in":"query","required":false,"schema":{"type":"string"},"description":"Optional immutable archive version"}],"responses":{"200":{"description":"Archive payload","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Archive"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"402":{"description":"Payment required for a paid harness archive","headers":{"PAYMENT-REQUIRED":{"description":"Base64 JSON x402 v2 PaymentRequired payload when X402_ENABLED and X402_PAY_TO are configured.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaymentRequired"}}}},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"The requested item cannot be pulled as files: either link-only directory or hosted execution not available.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/DirectoryLinkOnly"},{"$ref":"#/components/schemas/HostedExecutionUnavailable"}]}}}}}}},"/repos/{owner}/{repo}/remixes":{"post":{"summary":"Create a local server-side remix draft","description":"Auth required. Pulls the source through the same archive gate, rejects paid/org/private/directory or unspecified-license sources, rewrites manifest provenance, removes eval artifacts, writes a free public local draft with evalStatus unknown, and records a source -> fork graph edge.","security":[{"bearerAuth":[]}],"parameters":[{"name":"owner","in":"path","required":true,"schema":{"type":"string"}},{"name":"repo","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string"},"title":{"type":"string"},"summary":{"type":"string"},"sourceVersion":{"type":"string"},"version":{"type":"string","deprecated":true}}}}}},"responses":{"201":{"description":"Local remix draft created","content":{"application/json":{"schema":{"type":"object","properties":{"owner":{"type":"string"},"repo":{"type":"string"},"item":{"$ref":"#/components/schemas/RegistryItem"},"snapshotVersion":{"type":"string"},"verified":{"type":"boolean"},"remix":{"type":"object","properties":{"owner":{"type":"string"},"name":{"type":"string"},"source":{"type":"object","properties":{"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"}},"required":["owner","repo","version"]},"forkGraph":{"type":"object","properties":{"recorded":{"type":"boolean"},"source":{"type":"object","properties":{"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"}},"required":["owner","repo","version"]},"fork":{"type":"object","properties":{"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"}},"required":["owner","repo"]}},"required":["recorded","source","fork"]}},"required":["owner","name","source","forkGraph"]}},"required":["owner","repo","item","verified","remix"]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"402":{"description":"Payment required before reading paid source files","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaymentRequired"}}}},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/BadRequest"},"422":{"$ref":"#/components/responses/BadRequest"}}}},"/repos/{owner}/{repo}/star":{"post":{"summary":"Star or unstar a harness","description":"Auth required. Records the caller's star server-side so browser and agent clients share the same heat signal path.","security":[{"bearerAuth":[]}],"parameters":[{"name":"owner","in":"path","required":true,"schema":{"type":"string"}},{"name":"repo","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/StarRequest"}}}},"responses":{"200":{"description":"Star state recorded","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StarResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"503":{"$ref":"#/components/responses/ServiceUnavailable"}}}},"/repos/{owner}/{repo}/thread":{"get":{"summary":"List harness thread posts","parameters":[{"name":"owner","in":"path","required":true,"schema":{"type":"string"}},{"name":"repo","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Thread posts","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/ThreadItem"}}},"required":["items"]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"post":{"summary":"Create a harness thread post","description":"Auth required. Writes through the API social path instead of direct browser Supabase mutations.","security":[{"bearerAuth":[]}],"parameters":[{"name":"owner","in":"path","required":true,"schema":{"type":"string"}},{"name":"repo","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ThreadPostRequest"}}}},"responses":{"201":{"description":"Thread post created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ThreadPostResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"503":{"$ref":"#/components/responses/ServiceUnavailable"}}}},"/repos/{owner}/{repo}/security-report":{"get":{"summary":"Static security report","parameters":[{"name":"owner","in":"path","required":true,"schema":{"type":"string"}},{"name":"repo","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Static security scanner verdict","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SecurityReport"}}}},"404":{"$ref":"#/components/responses/NotFound"}}}},"/prs/{owner}/{repo}/{number}/semantic-diff":{"get":{"summary":"Forge PR semantic diff status","description":"Org visibility is enforced. Real forge PR diffing is not connected yet; harness detail exposes a local maintainer-review preview under prReview instead.","parameters":[{"name":"owner","in":"path","required":true,"schema":{"type":"string"}},{"name":"repo","in":"path","required":true,"schema":{"type":"string"}},{"name":"number","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"501":{"description":"Real forge PR semantic diff is not available yet","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string","enum":["PR_SEMANTIC_DIFF_NOT_AVAILABLE"]},"owner":{"type":"string"},"repo":{"type":"string"},"number":{"type":"string"},"demo":{"$ref":"#/components/schemas/MaintainerReviewPreview"},"next":{"type":"string"}},"required":["error","code","owner","repo","number","next"]}}}}}}},"/billing/checkout":{"post":{"summary":"Create a manual checkout session for a paid harness","description":"Auth required. Creates a pending purchase through the manual checkout provider. Free harnesses return 400.","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"ref":{"type":"string"}},"required":["owner","repo"]}}}},"responses":{"201":{"description":"Checkout session created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CheckoutSession"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"The harness uses per_call pricing, but hosted execution is not live.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HostedExecutionUnavailable"}}}}}}},"/billing/receipt":{"get":{"summary":"Read a checkout receipt","description":"Auth required. Returns the caller's own purchase receipt by provider_ref without mutating payment or entitlement state.","security":[{"bearerAuth":[]}],"parameters":[{"name":"provider_ref","in":"query","required":true,"schema":{"type":"string"},"description":"Provider reference returned by checkout, for example manual_<uuid>."}],"responses":{"200":{"description":"Purchase receipt","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PurchaseReceipt"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/billing/escrow/receipt":{"post":{"summary":"Settle a gate escrow purchase from a signed receipt","description":"Auth required. Verifies a signed hh gate --receipt payload for the caller's reserved gate_escrow purchase. Passing receipts capture escrow; failing receipts refund escrow. Plain POST /receipts remains read-only.","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"provider_ref":{"type":"string"},"receipt":{"$ref":"#/components/schemas/GateReceipt"}},"required":["provider_ref","receipt"]}}}},"responses":{"200":{"description":"Escrow settled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EscrowSettlement"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/BadRequest"}}}},"/billing/escrow/timeout":{"post":{"summary":"Refund an expired gate escrow reservation","description":"Auth required. Refunds the caller's reserved gate_escrow purchase only after the 72h receipt window expires.","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"provider_ref":{"type":"string"}},"required":["provider_ref"]}}}},"responses":{"200":{"description":"Escrow timeout settled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EscrowSettlement"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/BadRequest"}}}},"/entitlements/check":{"get":{"summary":"Check whether a subject can access a harness","description":"Bot-facing read-only check. Requires ORGS_ENABLED=true and a Bearer org token with entitlements:read scope. The token authorizes the check but is never treated as a buyer entitlement.","security":[{"bearerAuth":[]}],"parameters":[{"name":"subject","in":"query","required":true,"schema":{"type":"string","pattern":"^(user|wallet|org):"},"description":"Subject ref, for example user:<id>, wallet:<address> or org:<slug>."},{"name":"harness","in":"query","required":true,"schema":{"type":"string"},"description":"Harness ref as owner/name, including @org/name for org-private harnesses."},{"name":"version","in":"query","required":false,"schema":{"type":"string"},"description":"Optional immutable archive version"}],"responses":{"200":{"description":"Entitlement decision","content":{"application/json":{"schema":{"$ref":"#/components/schemas/EntitlementCheck"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/community/invite-code":{"post":{"summary":"Create a short-lived community gate code","description":"Auth required. Verifies the current user's entitlement before minting a signed short-lived code that can be pasted into a Discord or Telegram gate bot.","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"harness":{"type":"string","description":"Harness ref as owner/name."},"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"ttl_seconds":{"type":"integer","minimum":60,"maximum":3600}}}}}},"responses":{"201":{"description":"Community invite code minted","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommunityInviteCode"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"402":{"description":"The authenticated user is not entitled to this paid harness","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/community/verify-code":{"post":{"summary":"Verify a community gate code","description":"Bot-facing verification. Requires ORGS_ENABLED=true and a Bearer org token with entitlements:read scope. The code is HMAC verified, checked for expiry, then entitlement is checked live before the bot grants access.","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"code":{"type":"string"}},"required":["code"]}}}},"responses":{"200":{"description":"Community code decision","content":{"application/json":{"schema":{"$ref":"#/components/schemas/CommunityVerifyCode"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"410":{"description":"Community code expired","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/imports/markdown-to-harness":{"post":{"summary":"Publish markdown as an unverified harness scaffold","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string"},"markdown":{"type":"string","minLength":20}},"required":["markdown"]}}}},"responses":{"200":{"description":"Imported harness","content":{"application/json":{"schema":{"type":"object","properties":{"item":{"$ref":"#/components/schemas/RegistryItem"},"snapshotVersion":{"type":"string"},"warnings":{"type":"array","items":{"type":"string"}},"next":{"type":"string"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"}}}},"/imports/github-resource":{"post":{"summary":"Classify a GitHub resource","description":"Read-only classifier for GitHub resources. Uses GitHub API only, blocks unsafe hosts, redirects, traversal, symlinks and oversized responses. Upstream listing is allowed; use /imports/resource-package or hh publish-resource for explicit hosted package uploads when license and ownership allow it.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string"},"path":{"type":"string"},"action":{"type":"string","enum":["classify"]}},"required":["url"]}}}},"responses":{"200":{"description":"GitHub resource classification","content":{"application/json":{"schema":{"type":"object","properties":{"url":{"type":"string"},"owner":{"type":"string"},"repo":{"type":"string"},"path":{"type":"string"},"classification":{"type":"string"},"detectedFiles":{"type":"array","items":{"type":"string"}},"unsafeFiles":{"type":"array","items":{"type":"string"}},"licenseStatus":{"type":"string"},"licenseName":{"type":"string"},"recommendedAction":{"type":"string"},"conversionBlocked":{"type":"string"},"archiveFetch":{"type":"boolean","const":false}},"required":["url","owner","repo","path","classification","detectedFiles","unsafeFiles","licenseStatus","recommendedAction","archiveFetch"]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"404":{"$ref":"#/components/responses/NotFound"},"413":{"$ref":"#/components/responses/BadRequest"},"451":{"$ref":"#/components/responses/Forbidden"},"502":{"$ref":"#/components/responses/ServiceUnavailable"}}}},"/imports/harness-dir":{"post":{"summary":"Publish a verified harness directory","description":"Strict native verified package path. Accepts bounded text files from hh publish <dir>. The server requires harness.yaml, .harnesshub/results.json, valid schema, passing security scan, and passing eval/gate before writing a public local harness.","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string"},"files":{"type":"array","maxItems":120,"items":{"type":"object","properties":{"path":{"type":"string"},"content":{"type":"string"},"truncated":{"type":"boolean"}},"required":["path","content"]}}},"required":["files"]}}}},"responses":{"200":{"description":"Verified published harness","content":{"application/json":{"schema":{"type":"object","properties":{"item":{"$ref":"#/components/schemas/RegistryItem"},"snapshotVersion":{"type":"string"},"verified":{"type":"boolean"},"gate":{"type":"object","properties":{"score":{"type":"number"},"risk":{"type":"number"},"cost":{"type":"number"},"failures":{"type":"array","items":{"type":"string"}}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"422":{"$ref":"#/components/responses/BadRequest"}}}},"/imports/resource-package":{"post":{"summary":"Publish a hosted agent resource package","description":"A confirmed signed-in user is required. Publishing is self-service and does not require a managed recommendation grant. Production enables the durable archive path; deployments still fail closed with 503 PUBLISH_DISABLED when HOSTED_RESOURCE_PUBLISH_ENABLED=false. Every publish requires an immutable semantic version and a 16-200 character idempotencyKey, accepts at most 8 MiB of bounded text file content, writes a canonical digest-bound archive to the dedicated import store, and lists only active unreviewed metadata. This does not grant a Verified harness badge; use /imports/harness-dir for eval/gate-verified native packages.","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string","pattern":"^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$"},"idempotencyKey":{"type":"string","minLength":16,"maxLength":200,"pattern":"^[A-Za-z0-9][A-Za-z0-9._:-]+$"},"title":{"type":"string"},"summary":{"type":"string"},"resourceType":{"type":"string","enum":["harness","skill","plugin","workflow","mcp_server","service_endpoint","agent_team","subagent_pack","command_pack","config","guide","framework","agent_runtime"]},"sourceUrl":{"type":"string"},"worksWith":{"type":"array","items":{"type":"string"}},"tags":{"type":"array","items":{"type":"string"}},"files":{"type":"array","maxItems":120,"items":{"type":"object","properties":{"path":{"type":"string"},"content":{"type":"string"},"truncated":{"type":"boolean"}},"required":["path","content"]}}},"required":["version","idempotencyKey","files"]}}}},"responses":{"200":{"description":"Idempotent replay of the same immutable hosted package release","content":{"application/json":{"schema":{"type":"object"}}}},"201":{"description":"Hosted agent resource package","content":{"application/json":{"schema":{"type":"object","properties":{"resource":{"$ref":"#/components/schemas/Resource"},"archive":{"type":"object","properties":{"url":{"type":"string"},"fileName":{"type":"string"}}},"hosted":{"type":"boolean"},"verified":{"type":"boolean","const":false},"resourceId":{"type":"string"},"version":{"type":"string"},"artifactDigest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"size":{"type":"integer"},"trust":{"type":"string","const":"unreviewed"},"replay":{"type":"boolean"},"next":{"type":"string"}}}}}},"400":{"$ref":"#/components/responses/ValidationFailed"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"409":{"$ref":"#/components/responses/Conflict"},"413":{"$ref":"#/components/responses/ValidationFailed"},"422":{"description":"Static security scan failed before any durable mutation","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string","const":"SECURITY_SCAN_FAILED"},"failures":{"type":"array","items":{"type":"string","description":"Sanitized rule:file identifier without matched content"}}},"required":["error","code","failures"]}}}},"503":{"description":"Hosted resource publishing is disabled or archive storage is unavailable. No package was published.","content":{"application/json":{"schema":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string","enum":["PUBLISH_DISABLED","ARCHIVE_STORAGE_UNAVAILABLE"]},"status":{"type":"integer","const":503},"next":{"type":"string"}},"required":["error","code"]}}}}}}},"/workspaces":{"post":{"summary":"Create or replay a personal workspace bootstrap","description":"Requires a confirmed signed-in account. Atomically creates an invite-only/private workspace, owner membership, invite policy and default approved collection. Repeating the same owner and slug is idempotent.","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"slug":{"type":"string","pattern":"^[a-z][a-z0-9_-]{1,48}$"},"name":{"type":"string","minLength":1,"maxLength":120},"type":{"type":"string","enum":["company","community","team","course","agency","chat"],"default":"team"},"visibility":{"type":"string","enum":["private","invite_only"],"default":"invite_only"},"description":{"type":["string","null"],"maxLength":500}},"required":["slug","name"]}}}},"responses":{"200":{"description":"Idempotent replay of the caller's existing workspace"},"201":{"description":"Workspace created"},"400":{"$ref":"#/components/responses/ValidationFailed"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"409":{"$ref":"#/components/responses/Conflict"},"503":{"$ref":"#/components/responses/ServiceUnavailable"}}}},"/workspaces/{slug}/workspace":{"get":{"summary":"Read a workspace catalog and audit summary","description":"Requires WORKSPACES_ENABLED=true and either a Bearer workspace token with workspace:read/read/setup/publish-compatible scope or an active signed-in workspace member. Legacy org tokens are accepted as a compatibility bridge.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Workspace overview","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"resources":{"type":"array","items":{"$ref":"#/components/schemas/Resource"}},"items":{"type":"array","items":{"$ref":"#/components/schemas/Resource"}},"joinPolicies":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceJoinPolicy"}},"permissions":{"$ref":"#/components/schemas/WorkspaceResourcePermissions"},"audit":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceAuditEntry"}}},"required":["workspace","resources","items","joinPolicies","permissions","audit"]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/workspaces/{slug}/setup-bundle":{"get":{"summary":"Read a workspace setup bundle","description":"Requires WORKSPACES_ENABLED=true and workspace setup access. The bundle installs workspace-hosted packages and returns instructions for approved public resources without inventing workspace archive downloads.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}},{"name":"target","in":"query","required":false,"schema":{"type":"string"},"description":"Setup target: cli, claude-code, codex, cursor or mcp"}],"responses":{"200":{"description":"Workspace setup bundle","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceSetupBundleResponse"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"put":{"summary":"Update workspace setup config snippets","description":"Requires workspace publish/collection write access. Stores bounded setup config snippets; private archive access is still checked at install time.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"target":{"type":"string","enum":["cli","claude-code","codex","cursor","mcp"]},"configs":{"type":"array","maxItems":20,"items":{"$ref":"#/components/schemas/WorkspaceSetupConfig"}}}}}}},"responses":{"200":{"description":"Updated workspace setup bundle","content":{"application/json":{"schema":{"$ref":"#/components/schemas/WorkspaceSetupBundleResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/workspaces/{slug}/members":{"get":{"summary":"List active workspace members","description":"Requires workspace read access by token or active member session. Returns role/status/source metadata, not invite codes or tokens.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Workspace members","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"members":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceMember"}}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"post":{"summary":"Add or update a workspace member","description":"Requires member:write token scope or owner/admin member role. This is the direct admin path; invite join is separate. Workspace ownership cannot be assigned or transferred through this endpoint, and the existing owner cannot be changed.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"userId":{"type":"string"},"role":{"type":"string","enum":["admin","moderator","publisher","member","viewer"]},"source":{"type":"string"},"expiresAt":{"type":["string","null"],"format":"date-time","description":"Optional membership expiry. When expired, member-session reads and private archive access fail closed."}},"required":["userId"]}}}},"responses":{"201":{"description":"Workspace member","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"member":{"$ref":"#/components/schemas/WorkspaceMember"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Workspace owner assignment or mutation is forbidden through this endpoint"}}}},"/workspaces/{slug}/members/{userId}":{"delete":{"summary":"Remove a workspace member","description":"Marks a member removed. Requires member:write token scope or owner/admin member role. The workspace owner cannot be removed through this endpoint.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}},{"name":"userId","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Removed workspace member","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"member":{"$ref":"#/components/schemas/WorkspaceMember"}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Workspace owner removal is forbidden through this endpoint"}}}},"/workspaces/{slug}/invites":{"post":{"summary":"Create a workspace invite code","description":"Requires invite:write/member:write token scope or owner/admin member role. The raw code is returned once; SuperSkill stores only a hash.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"role":{"type":"string","enum":["member","viewer"]},"maxUses":{"type":"integer","minimum":1,"maximum":10000},"expiresInSeconds":{"type":"integer","minimum":1,"maximum":31536000},"email":{"type":"string","format":"email"}}}}}},"responses":{"201":{"description":"Workspace invite code","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"invite":{"$ref":"#/components/schemas/WorkspaceInvite"},"code":{"type":"string"},"shareUrl":{"type":"string","format":"uri","description":"Crawler-visible workspace preview URL. The raw invite code is present only in the URL fragment."},"next":{"type":"string"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/workspaces/{slug}/join-policies":{"get":{"summary":"List workspace join policies","description":"Requires workspace read access. Returns invite, email-domain, Telegram, Discord, entitlement and disabled paid-subscription gate policy metadata. It never returns raw invite codes or secrets.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Workspace join policies","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"policies":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceJoinPolicy"}}},"required":["workspace","policies"]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"put":{"summary":"Replace workspace join policies","description":"Requires member/invite administration access. Active paid_subscription policies require WORKSPACE_SUBSCRIPTIONS_ENABLED=true and grant access only through subscription checkout/webhook lifecycle.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"policies":{"type":"array","maxItems":20,"items":{"$ref":"#/components/schemas/WorkspaceJoinPolicyInput"}}},"required":["policies"]}}}},"responses":{"200":{"description":"Updated workspace join policies","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"policies":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceJoinPolicy"}}},"required":["workspace","policies"]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/Conflict"}}}},"/workspaces/{slug}/subscriptions/checkout":{"post":{"summary":"Create a workspace subscription checkout","description":"Requires a signed-in user. Creates an incomplete manual subscription for an active paid_subscription join policy. It does not grant membership; only the signed subscription webhook can activate or renew access.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"policyId":{"type":"string"},"provider":{"type":"string","enum":["manual"]}}}}}},"responses":{"201":{"description":"Workspace subscription checkout","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"policy":{"$ref":"#/components/schemas/WorkspaceJoinPolicy"},"subscription":{"$ref":"#/components/schemas/WorkspaceSubscription"},"checkout_url":{"type":"string"},"next":{"type":"string"}},"required":["workspace","policy","subscription","checkout_url","next"]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/workspaces/{slug}/subscriptions/me":{"get":{"summary":"Read signed-in user's workspace subscription receipts","description":"Read-only receipt/customer portal metadata for the signed-in user. It never grants membership.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Workspace subscriptions for current user","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"subscriptions":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceSubscription"}}},"required":["workspace","subscriptions"]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/workspaces/{slug}/subscriptions/sweep":{"post":{"summary":"Expire workspace subscriptions whose access window has ended","description":"Requires member:write/workspace admin access. This is the cron/admin expiry job path; it updates subscription status and membership expiry without charging money.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Workspace subscription sweep","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"checked":{"type":"integer"},"expired":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceSubscription"}}},"required":["workspace","checked","expired"]}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/workspaces/{slug}/join-code":{"post":{"summary":"Mint a short-lived workspace gate code","description":"Requires a signed-in user session. The code is for Telegram, Discord or entitlement gate verification and does not create membership by itself.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"source":{"type":"string","enum":["telegram","discord","entitlement"]},"policyId":{"type":"string"},"ttl_seconds":{"type":"integer"}},"required":["source"]}}}},"responses":{"201":{"description":"Workspace join code","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"policy":{"$ref":"#/components/schemas/WorkspaceJoinPolicy"},"code":{"type":"string"},"source":{"type":"string"},"subject_type":{"type":"string"},"subject_id":{"type":"string"},"expires_at":{"type":"string","format":"date-time"},"next":{"type":"string"}},"required":["workspace","policy","code","source","subject_type","subject_id","expires_at","next"]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"503":{"description":"Workspace join secret is not configured"}}}},"/workspaces/{slug}/join-code/verify":{"post":{"summary":"Verify a workspace gate code without granting membership","description":"Requires gate:verify, gate:write or member:write workspace token scope. Verification is read-only; external bots must call join-grants after their Telegram/Discord/entitlement check passes.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"code":{"type":"string"}},"required":["code"]}}}},"responses":{"200":{"description":"Verified join code","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"policy":{"$ref":"#/components/schemas/WorkspaceJoinPolicy"},"allowed":{"type":"boolean"},"source":{"type":"string"},"subject_type":{"type":"string"},"subject_id":{"type":"string"},"expires_at":{"type":"string","format":"date-time"},"next":{"type":"string"}},"required":["workspace","policy","allowed","source","subject_type","subject_id","expires_at","next"]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"410":{"description":"Join code expired"},"503":{"description":"Workspace join secret is not configured"}}}},"/workspaces/{slug}/join-grants":{"post":{"summary":"Grant workspace membership after an external gate check","description":"Requires gate:write or member:write workspace token scope. This is the explicit mutation endpoint for Telegram, Discord and one-time entitlement/manual entitlement gates.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"code":{"type":"string"},"source":{"type":"string","enum":["telegram","discord","entitlement"]},"externalSubject":{"type":"string"}},"required":["code"]}}}},"responses":{"201":{"description":"Granted workspace member","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"policy":{"$ref":"#/components/schemas/WorkspaceJoinPolicy"},"member":{"$ref":"#/components/schemas/WorkspaceMember"},"next":{"type":"string"}},"required":["workspace","member","next"]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"410":{"description":"Join code expired"},"503":{"description":"Workspace join secret is not configured"}}}},"/workspaces/{slug}/join":{"post":{"summary":"Join a workspace with an invite code or email-domain policy","description":"Requires a signed-in user session. With code, validates the invite hash, expiry and use limit before writing membership. Without code, checks an active email_domain policy against the signed-in user's email.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"code":{"type":"string"}}}}}},"responses":{"201":{"description":"Joined workspace member","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"member":{"$ref":"#/components/schemas/WorkspaceMember"},"next":{"type":"string"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/workspaces/{slug}/resources":{"get":{"summary":"Search private workspace resources","description":"Search a workspace catalog containing hosted resource packages and approved resources. Requires a workspace token; this endpoint does not read from the public catalog unless a resource has been explicitly added to the workspace.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}},{"name":"q","in":"query","schema":{"type":"string"}},{"name":"type","in":"query","schema":{"type":"string"}},{"name":"worksWith","in":"query","schema":{"type":"string"}},{"name":"limit","in":"query","schema":{"type":"integer"}}],"responses":{"200":{"description":"Workspace resource search result","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ResourceSearchResult"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/workspaces/{slug}/resources/approve":{"post":{"summary":"Approve a public marketplace resource into a workspace","description":"Adds a public resource to a workspace catalog and collection with a trust snapshot. Approval is workspace-local curation and never a SuperSkill reviewed badge. Failed or missing security scans are blocked; warnings become approved_with_warning. Pass resourceVersion and artifactDigest together to approve one immutable hosted public release; a missing release or digest mismatch fails closed.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"resourceId":{"type":"string","description":"Scanned public resource id, for example onlyharness:harnesses/deep-market-researcher"},"collection":{"type":"string","description":"Workspace collection slug; defaults to approved"},"name":{"type":"string","description":"Optional workspace-local resource name"},"note":{"type":"string"},"resourceVersion":{"type":"string","description":"Optional exact semantic version; requires artifactDigest"},"artifactDigest":{"type":"string","pattern":"^[a-f0-9]{64}$","description":"Optional exact archive SHA-256; requires resourceVersion"}},"required":["resourceId"]}}}},"responses":{"201":{"description":"Workspace approval created","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"collection":{"$ref":"#/components/schemas/WorkspaceCollection"},"item":{"$ref":"#/components/schemas/WorkspaceCollectionItem"},"resource":{"$ref":"#/components/schemas/Resource"},"approvalState":{"type":"string"},"verified":{"type":"boolean","const":false},"next":{"type":"string"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/Conflict"}}}},"/workspaces/{slug}/resources/{id}":{"get":{"summary":"Read workspace resource detail","description":"Returns a workspace-private resource. The id may be the short resource name or the @workspace/name resource ref.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}},{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Workspace resource","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Resource"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/workspaces/{slug}/resources/{id}/archive":{"get":{"summary":"Download a workspace-hosted resource archive","description":"Returns a tar.gz archive from workspace archive storage. Requires workspace archive/read scope and never falls back to upstream GitHub.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}},{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Gzip tar archive"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/BadRequest"}}}},"/workspaces/{slug}/collections":{"get":{"summary":"List workspace collections","description":"Lists workspace collections such as the default approved collection. Requires workspace read access.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Workspace collections","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"collections":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceCollection"}}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}},"post":{"summary":"Create or update a workspace collection","description":"Creates a workspace collection. Collection approval is workspace-scoped curation, not SuperSkill review evidence.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"slug":{"type":"string"},"title":{"type":"string"},"summary":{"type":"string"},"visibility":{"type":"string","enum":["workspace","public","unlisted"]}}}}}},"responses":{"201":{"description":"Workspace collection","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"collection":{"$ref":"#/components/schemas/WorkspaceCollection"}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/workspaces/{slug}/collections/{collection}":{"get":{"summary":"Read workspace collection detail","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}},{"name":"collection","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Workspace collection","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"collection":{"$ref":"#/components/schemas/WorkspaceCollection"}}}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/workspaces/{slug}/collections/{collection}/items":{"post":{"summary":"Approve a public resource into a workspace collection","description":"Shortcut for adding a public marketplace resource to a named workspace collection. Uses the same trust snapshot, exact-release pinning, and failed/missing-scan blocking rules as /workspaces/{slug}/resources/approve.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}},{"name":"collection","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"resourceId":{"type":"string"},"name":{"type":"string"},"note":{"type":"string"},"resourceVersion":{"type":"string","description":"Optional exact semantic version; requires artifactDigest"},"artifactDigest":{"type":"string","pattern":"^[a-f0-9]{64}$","description":"Optional exact archive SHA-256; requires resourceVersion"}},"required":["resourceId"]}}}},"responses":{"201":{"description":"Workspace collection item approved","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"collection":{"$ref":"#/components/schemas/WorkspaceCollection"},"item":{"$ref":"#/components/schemas/WorkspaceCollectionItem"},"resource":{"$ref":"#/components/schemas/Resource"},"approvalState":{"type":"string"},"verified":{"type":"boolean","const":false},"next":{"type":"string"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/Conflict"}}}},"/workspaces/{slug}/collections/{collection}/items/{itemId}":{"delete":{"summary":"Remove a resource from a workspace collection","description":"Removes a workspace-scoped approval or collection entry. If a public marketplace approval is no longer referenced by any workspace collection, the derived workspace resource is removed from workspace search/detail as well.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}},{"name":"collection","in":"path","required":true,"schema":{"type":"string"}},{"name":"itemId","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Workspace collection item removed","content":{"application/json":{"schema":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"collection":{"$ref":"#/components/schemas/WorkspaceCollection"},"item":{"$ref":"#/components/schemas/WorkspaceCollectionItem"},"removedResourceId":{"type":"string"},"next":{"type":"string"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/workspaces/{slug}/imports/resource-package":{"post":{"summary":"Publish a hosted resource package into a workspace","description":"Requires WORKSPACES_ENABLED=true and a workspace token with resource:publish or legacy publish scope. Packages at most 8 MiB of bounded text files from a skill, plugin, workflow, MCP server, command pack, scripts, docs or source bundle into workspace archive storage. This does not grant a public Verified harness badge.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string"},"title":{"type":"string"},"summary":{"type":"string"},"resourceType":{"type":"string","enum":["harness","skill","plugin","workflow","mcp_server","service_endpoint","agent_team","subagent_pack","command_pack","config","guide","framework","agent_runtime"]},"sourceUrl":{"type":"string"},"worksWith":{"type":"array","items":{"type":"string"}},"tags":{"type":"array","items":{"type":"string"}},"files":{"type":"array","maxItems":120,"items":{"type":"object","properties":{"path":{"type":"string"},"content":{"type":"string"},"truncated":{"type":"boolean"}},"required":["path","content"]}}},"required":["files"]}}}},"responses":{"201":{"description":"Workspace-hosted agent resource package","content":{"application/json":{"schema":{"type":"object","properties":{"resource":{"$ref":"#/components/schemas/Resource"},"archive":{"type":"object","properties":{"url":{"type":"string"},"fileName":{"type":"string"}}},"hosted":{"type":"boolean"},"verified":{"type":"boolean","const":false},"next":{"type":"string"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"413":{"$ref":"#/components/responses/ValidationFailed"}}}},"/me/storefront":{"get":{"summary":"Return the authenticated user's creator storefront profile","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Storefront profile","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StorefrontProfile"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}},"put":{"summary":"Create or update the authenticated user's creator handle","description":"Creates a safe public handle/profile and a creator referral code. Email is never exposed.","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"handle":{"type":"string"},"display_name":{"type":"string"},"bio":{"type":"string"}},"required":["handle"]}}}},"responses":{"200":{"description":"Updated storefront profile","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StorefrontProfile"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"409":{"$ref":"#/components/responses/BadRequest"}}}},"/storefront/{handle}":{"get":{"summary":"Public creator storefront by handle","description":"Returns only safe profile fields, creator referral code and currently published harnesses.","parameters":[{"name":"handle","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Creator storefront","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StorefrontPage"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/bounties":{"get":{"summary":"List local harness bounties","description":"Returns bounty work-state. Payment truth remains the linked gate_escrow purchase.","responses":{"200":{"description":"Bounty list","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"$ref":"#/components/schemas/Bounty"}}},"required":["items"]}}}}}},"post":{"summary":"Create a local harness bounty","description":"Auth required. Creates open bounty work-state; it does not move money.","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BountyCreate"}}}},"responses":{"201":{"description":"Bounty created","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Bounty"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"}}}},"/bounties/{id}/claim":{"post":{"summary":"Claim an open bounty","description":"Auth required. The customer cannot claim their own bounty.","security":[{"bearerAuth":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Bounty claimed","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Bounty"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/BadRequest"}}}},"/bounties/{id}/deliver":{"post":{"summary":"Deliver a bounty with a signed gate receipt","description":"Auth required. Only the claimant can deliver, and the receipt must be a passed hh gate --receipt for the delivered harness/version.","security":[{"bearerAuth":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BountyDeliver"}}}},"responses":{"200":{"description":"Bounty delivered","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Bounty"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/BadRequest"}}}},"/bounties/{id}/accept":{"post":{"summary":"Accept a delivered bounty and capture linked escrow","description":"Auth required. Only the customer can accept. The signed passed receipt, delivered target, gate_escrow target, amount and currency must all match. A bounty is marked paid only after the linked escrow purchase is captured.","security":[{"bearerAuth":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/BountyAccept"}}}},"responses":{"200":{"description":"Bounty accepted and paid","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Bounty"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"$ref":"#/components/responses/BadRequest"}}}},"/orgs/{slug}/bundle":{"get":{"summary":"Read an organization setup bundle","description":"Requires ORGS_ENABLED=true and a Bearer org token with setup or read scope. Returns pinned harness refs and safe config snippets for hh setup.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Organization setup bundle","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrgBundleResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/orgs/{slug}/workspace":{"get":{"summary":"Read organization Network Neighborhood workspace","description":"Requires ORGS_ENABLED=true and a Bearer org token with read, setup or publish scope. Returns org-private registry cards, sanitized audit rows and aggregated permission risk.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Organization workspace","content":{"application/json":{"schema":{"$ref":"#/components/schemas/OrgWorkspaceResponse"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/orgs/{slug}/imports/markdown-to-harness":{"post":{"summary":"Publish markdown into an organization namespace","description":"Requires ORGS_ENABLED=true and a Bearer org token with publish scope. The generated manifest is marked visibility: org.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string"},"markdown":{"type":"string","minLength":20}},"required":["markdown"]}}}},"responses":{"200":{"description":"Imported org harness","content":{"application/json":{"schema":{"type":"object","properties":{"item":{"$ref":"#/components/schemas/RegistryItem"},"snapshotVersion":{"type":"string"}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/orgs/{slug}/imports/harness-dir":{"post":{"summary":"Publish a verified harness directory into an organization namespace","description":"Requires ORGS_ENABLED=true and a Bearer org token with publish scope. Accepts the same bounded hh publish <dir> payload as /imports/harness-dir, then marks the manifest visibility: org before server-side validation, security scan, eval and gate checks.","security":[{"bearerAuth":[]}],"parameters":[{"name":"slug","in":"path","required":true,"schema":{"type":"string"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string"},"files":{"type":"array","maxItems":120,"items":{"type":"object","properties":{"path":{"type":"string"},"content":{"type":"string"},"truncated":{"type":"boolean"}},"required":["path","content"]}}},"required":["files"]}}}},"responses":{"200":{"description":"Verified org-private harness","content":{"application/json":{"schema":{"type":"object","properties":{"item":{"$ref":"#/components/schemas/RegistryItem"},"snapshotVersion":{"type":"string"},"verified":{"type":"boolean"},"gate":{"type":"object","properties":{"score":{"type":"number"},"risk":{"type":"number"},"cost":{"type":"number"},"failures":{"type":"array","items":{"type":"string"}}}}}}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"422":{"$ref":"#/components/responses/UnprocessableEntity"}}}},"/webhooks/payments":{"post":{"summary":"Settle a manual payment webhook","description":"Requires HARNESS_WEBHOOK_TOKEN via x-harness-token. Marks the purchase paid and grants entitlement idempotently.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"provider":{"type":"string","enum":["manual"]},"provider_ref":{"type":"string"},"status":{"type":"string","enum":["paid","succeeded"]}},"required":["provider_ref"]}}}},"responses":{"200":{"description":"Payment settled","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PaymentWebhookResult"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/webhooks/workspace-subscriptions":{"post":{"summary":"Settle a workspace subscription lifecycle webhook","description":"Requires HARNESS_WEBHOOK_TOKEN via x-harness-token. Activates, renews, marks past_due, cancels or expires a workspace subscription idempotently; membership expiry is updated only here or by the sweep endpoint, and removed/suspended members are not restored by provider webhooks.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"provider":{"type":"string","enum":["manual"]},"provider_subscription_ref":{"type":"string"},"provider_event_ref":{"type":"string"},"event_type":{"type":"string"},"status":{"type":"string","enum":["active","past_due","canceled","expired"]},"current_period_start":{"type":["string","null"],"format":"date-time"},"current_period_end":{"type":["string","null"],"format":"date-time"},"grace_until":{"type":["string","null"],"format":"date-time"},"cancel_at_period_end":{"type":"boolean"},"provider_customer_ref":{"type":["string","null"]}},"required":["provider_subscription_ref"]}}}},"responses":{"200":{"description":"Workspace subscription lifecycle applied","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"string"},"workspace":{"$ref":"#/components/schemas/Workspace"},"policy":{"$ref":"#/components/schemas/WorkspaceJoinPolicy"},"subscription":{"$ref":"#/components/schemas/WorkspaceSubscription"},"member":{"$ref":"#/components/schemas/WorkspaceMember"},"next":{"type":"string"}},"required":["status","workspace","subscription","next"]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/mcp":{"post":{"summary":"MCP Streamable HTTP endpoint","description":"SuperSkill MCP server v0.3.1. Exact tool inventory: search_harnesses, harness_detail, search_resources, resource_detail, resource_use_instructions, pull_instructions, pull_harness, search_docs, publish_markdown_to_harness, publish_resource_package. Tool results include structuredContent with stable code/status fields; logical failures set isError=true while JSON-RPC transport failures use the JSON-RPC error envelope.","x-mcp-server-version":"0.3.1","x-mcp-tools":["search_harnesses","harness_detail","search_resources","resource_detail","resource_use_instructions","pull_instructions","pull_harness","search_docs","publish_markdown_to_harness","publish_resource_package"],"responses":{"200":{"description":"MCP JSON-RPC response over JSON or text/event-stream. Tool-level failures remain protocol-successful JSON-RPC responses but carry result.isError=true and a stable result.structuredContent.code."}}}},"/auth/agent/start":{"post":{"summary":"Start browser authorization for a local SuperSkill agent","description":"Creates a durable ten-minute request. The device proof is returned only in JSON; the independent browser proof appears only in the URL fragment after # in browser_url and therefore never reaches HTTP logs.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentAuthorizationStartRequest"}}}},"responses":{"201":{"description":"Bounded authorization request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentAuthorizationStart"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"429":{"description":"Bounded per-client start rate exceeded"},"503":{"$ref":"#/components/responses/ServiceUnavailable"}}}},"/auth/agent/browser-bind":{"post":{"summary":"Consume the fragment-only browser proof","description":"Consumes browser_proof once and sets a short-lived HttpOnly SameSite binding cookie. No account authorization occurs here.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentBrowserBindRequest"}}}},"responses":{"200":{"description":"Browser request bound","content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{"bound":{"const":true},"request_id":{"type":"string"}},"required":["bound","request_id"]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"409":{"$ref":"#/components/responses/Conflict"},"410":{"description":"Authorization request expired"}}}},"/auth/agent/context":{"get":{"summary":"Read sanitized browser consent context","description":"Requires the HttpOnly binding cookie and returns client, scopes, status and expiry only. Proofs, user identity and tokens are never returned.","security":[{"agentBindingCookie":[]}],"parameters":[{"name":"request_id","in":"query","required":true,"schema":{"type":"string","pattern":"^ohrq_[A-Za-z0-9_-]{43}$"}}],"responses":{"200":{"description":"Sanitized authorization context","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentAuthorizationContext"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"410":{"description":"Authorization request expired"}}}},"/auth/agent/decision":{"post":{"summary":"Approve or deny a bound agent request","description":"Deny requires only the one-time binding cookie. Approve additionally requires a live confirmed Supabase browser bearer and creates managed access only when that scope was explicitly requested.","security":[{"agentBindingCookie":[],"bearerAuth":[]},{"agentBindingCookie":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentAuthorizationDecision"}}}},"responses":{"200":{"description":"Explicit decision recorded; no credential is returned"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"409":{"$ref":"#/components/responses/Conflict"},"410":{"description":"Authorization request expired"},"503":{"$ref":"#/components/responses/ServiceUnavailable"}}}},"/auth/agent/token":{"post":{"summary":"Poll and consume an approved agent request","description":"The local broker presents its device proof. Approval is consumed exactly once and returns a ten-minute opaque access token plus a rotating refresh token bounded by the thirty-day session.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentAuthorizationTokenRequest"}}}},"responses":{"200":{"description":"Opaque agent credential pair","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentAuthorizationToken"}}}},"202":{"description":"Explicit browser decision is still pending"},"400":{"$ref":"#/components/responses/BadRequest"},"403":{"$ref":"#/components/responses/Forbidden"},"410":{"description":"Authorization request expired"},"429":{"description":"Bounded polling rate exceeded"},"503":{"$ref":"#/components/responses/ServiceUnavailable"}}}},"/auth/agent/refresh":{"post":{"summary":"Rotate an agent refresh token","description":"Consumes the refresh token once and returns a replacement pair. Reuse revokes the whole session family.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{"refresh_token":{"type":"string","pattern":"^ohrt_[A-Za-z0-9_-]{43}$"}},"required":["refresh_token"]}}}},"responses":{"200":{"description":"Rotated opaque credential pair","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AgentAuthorizationToken"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"429":{"description":"Bounded refresh rate exceeded"},"503":{"$ref":"#/components/responses/ServiceUnavailable"}}}},"/auth/agent/revoke":{"post":{"summary":"Revoke an agent session","description":"Accepts the access bearer, a refresh token in the JSON body, or both. Revocation invalidates the session and all access tokens without returning credential material.","security":[{"bearerAuth":[]},{}],"requestBody":{"required":false,"content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{"refresh_token":{"type":"string","pattern":"^ohrt_[A-Za-z0-9_-]{43}$"}}}}}},"responses":{"200":{"description":"Session revoked or already absent","content":{"application/json":{"schema":{"type":"object","additionalProperties":false,"properties":{"revoked":{"const":true}},"required":["revoked"]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"503":{"$ref":"#/components/responses/ServiceUnavailable"}}}},"/showroom/capabilities":{"get":{"summary":"List approved SuperSkill showroom capabilities","description":"Public cached read-only projection. Does not accept task context and exposes no archive or activation controls.","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"string"},"description":"Maximum 12 approved exact releases"},{"name":"job","in":"query","required":false,"schema":{"type":"string"},"description":"Optional curated job id"}],"responses":{"200":{"description":"Approved public-safe capabilities"},"404":{"$ref":"#/components/responses/NotFound"},"503":{"description":"Managed catalog is not ready"}}}},"/showroom/selected":{"get":{"summary":"List selected unreviewed SuperSkill candidates","description":"Public cached read-only shelf of current exact releases selected for review. Every item is explicitly unreviewed and blocked from managed handoff; this route does not approve, recommend, activate or expose archives.","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"string"},"description":"Maximum 12 selected exact releases"},{"name":"job","in":"query","required":false,"schema":{"type":"string"},"description":"Optional curated job id"}],"responses":{"200":{"description":"Public-safe selected candidate shelf","content":{"application/json":{"schema":{"type":"object","properties":{"items":{"type":"array","items":{"type":"object","properties":{"capability":{"type":"object","description":"Current exact candidate capability DTO"},"status":{"type":"string","enum":["selected_unreviewed"]},"managedHandoff":{"type":"object","properties":{"status":{"type":"string","enum":["blocked"]},"reason":{"type":"string","enum":["review_required"]}},"required":["status","reason"],"additionalProperties":false}},"required":["capability","status","managedHandoff"],"additionalProperties":false}},"total":{"type":"integer","minimum":0},"generatedAt":{"type":"string","format":"date-time"}},"required":["items","total","generatedAt"],"additionalProperties":false}}}},"404":{"$ref":"#/components/responses/NotFound"},"503":{"description":"Managed catalog is not ready"}}}},"/showroom/capabilities/{id}":{"get":{"summary":"Read a SuperSkill showroom capability","description":"Public cached read-only exact-release trust projection. Approved, quarantined and revoked shared links remain honest.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Public-safe capability detail"},"404":{"$ref":"#/components/responses/NotFound"},"503":{"description":"Managed catalog is not ready"}}}},"/superskill/install":{"get":{"summary":"Read the universal SuperSkill bootstrap manifest","description":"Public JSON only. Returns one pinned compatibility CLI version, official npm integrity and the byte-exact universal skill digest. It never returns or executes a shell script and never activates a capability.","responses":{"200":{"description":"Published universal bootstrap manifest","content":{"application/vnd.superskill.bootstrap+json":{"schema":{"$ref":"#/components/schemas/SuperSkillBootstrap"}}}},"503":{"description":"BOOTSTRAP_RELEASE_UNPUBLISHED until the exact CLI release and official npm integrity are pinned"}}},"head":{"summary":"Check universal SuperSkill bootstrap availability","responses":{"200":{"description":"Published bootstrap is available"},"503":{"description":"Bootstrap release is not published"}}}},"/superskill/install/{id}/{version}/{digest}":{"get":{"summary":"Read one immutable capability install handoff","description":"Binds an approved, non-revoked, currently eligible capability id, version and sha256 to the universal installer. Selected-unreviewed, stale, quarantined, revoked and digest-mismatched releases expose no install link. Installation does not bypass routing or activation consent.","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"version","in":"path","required":true,"schema":{"type":"string"}},{"name":"digest","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Exact capability bootstrap manifest","content":{"application/vnd.superskill.bootstrap+json":{"schema":{"$ref":"#/components/schemas/SuperSkillBootstrap"}}}},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Exact release is blocked, revoked, quarantined or no longer eligible"},"503":{"description":"Bootstrap CLI release is not published or catalog is unavailable"}}},"head":{"summary":"Check exact capability install handoff availability","parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"version","in":"path","required":true,"schema":{"type":"string"}},{"name":"digest","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Exact immutable handoff is available"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Release is blocked"},"503":{"description":"Bootstrap is not published"}}}},"/recommendations":{"post":{"summary":"Recommend an approved managed capability","description":"Internal-alpha deterministic task router. Requires a per-tester SuperSkill Bearer token; task text is not persisted.","security":[{"bearerAuth":[]}],"responses":{"200":{"description":"Recommendation, clarification or no-safe-match decision"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"503":{"description":"SuperSkill disabled or catalog unavailable"}}}},"/superskill/handoff/decision":{"post":{"summary":"Recheck one pending exact SuperSkill handoff","description":"Side-effect-free exact-release decision for the universal installer handoff. Requires a confirmed Supabase account and a current superskill:managed grant; legacy internal-alpha credentials are rejected. Returns full disclosure and client-bound consent fields, but never activates, loads or invokes the capability.","security":[{"bearerAuth":[]}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"capability":{"type":"object","properties":{"id":{"type":"string"},"version":{"type":"string"},"artifactDigest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"}},"required":["id","version","artifactDigest"],"additionalProperties":false},"client":{"type":"string","enum":["claude-code","codex"]}},"required":["capability","client"],"additionalProperties":false}}}},"responses":{"200":{"description":"Fresh exact handoff disclosure and client-bound activation consent fields"},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Exact release is revoked, quarantined or no longer eligible"},"503":{"description":"SuperSkill disabled, auth unavailable or catalog unavailable"}}}},"/capabilities/{id}":{"get":{"summary":"Read current managed capability detail","security":[{"bearerAuth":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Public-safe managed capability DTO"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/capabilities/{id}/releases/{version}":{"get":{"summary":"Recheck an exact managed release","security":[{"bearerAuth":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"version","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Exact release with activationAllowed and optional block code"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"}}}},"/capabilities/{id}/releases/{version}/archive":{"get":{"summary":"Download an exact free managed archive","description":"Confirmed-user managed immutable snapshot route. Legacy alpha remains public-GO ineligible. Never invokes checkout, entitlement or x402 helpers.","security":[{"bearerAuth":[]}],"parameters":[{"name":"id","in":"path","required":true,"schema":{"type":"string"}},{"name":"version","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"Complete text-only archive with canonical digest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"404":{"$ref":"#/components/responses/NotFound"},"409":{"description":"Revoked, quarantined, paid, mutable or digest-mismatched release"}}}},"/events":{"post":{"summary":"Record a privacy-safe registry event","description":"Accepts whitelisted event kinds and drops prompts, paths, credentials, body subject and arbitrary metadata. Managed lifecycle kinds live-check the same confirmed Supabase user and superskill:managed grant as recommendation/archive, derive the canonical subject server-side, and accept legacy alpha only as public-GO-ineligible compatibility. An exact eventId replay is idempotent; a changed replay is a conflict.","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"kind":{"type":"string","enum":["view","copy","install","pull","checkout","purchase","suggested","accepted","applied","eval","gate","escrow_reserved","escrow_captured","escrow_refunded","recommended","recommendation_accepted","activation_started","activation_ready","activation_loaded","activation_invoked","outcome_reported","activation_pinned","activation_removed","activation_failed"]},"eventId":{"type":"string"},"recommendationId":{"type":"string"},"activationId":{"type":"string"},"mode":{"type":"string","enum":["temporary","pinned"]},"evidence":{"type":"string","enum":["agent_reported","user_confirmed","unknown"]},"outcome":{"type":"string","enum":["success","failed","unknown"]},"reasonCode":{"type":"string"},"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"target":{"type":"string"},"client":{"type":"string"}},"required":["kind"]}}}},"responses":{"200":{"description":"Managed event recorded or exact replay accepted","content":{"application/json":{"schema":{"type":"object","properties":{"recorded":{"type":"boolean"},"duplicate":{"type":"boolean"}},"required":["recorded","duplicate"]}}}},"202":{"description":"Non-managed event accepted","content":{"application/json":{"schema":{"type":"object","properties":{"ok":{"type":"boolean"}},"required":["ok"]}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"},"403":{"$ref":"#/components/responses/Forbidden"},"409":{"description":"EVENT_CONFLICT: eventId replay changed subject or payload"},"503":{"description":"Managed auth or event storage unavailable"}}}},"/receipts":{"post":{"summary":"Verify a signed gate receipt","description":"Validates an ed25519 hh gate --receipt payload. This endpoint is side-effect-free: it does not store receipts, grant entitlements, settle payments, or ingest prompts/local paths.","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/GateReceipt"}}}},"responses":{"200":{"description":"Gate receipt signature verified","content":{"application/json":{"schema":{"$ref":"#/components/schemas/GateReceiptVerification"}}}},"400":{"$ref":"#/components/responses/BadRequest"}}}}},"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"},"agentBindingCookie":{"type":"apiKey","in":"cookie","name":"__Host-superskill_agent_bind"}},"responses":{"BadRequest":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"ValidationFailed":{"description":"Request validation failed before any durable mutation","content":{"application/json":{"schema":{"allOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","properties":{"code":{"type":"string","const":"VALIDATION_FAILED"}},"required":["error","code"]}]}}}},"Unauthorized":{"description":"Authorization required","headers":{"WWW-Authenticate":{"schema":{"type":"string"},"description":"Bearer challenge with resource_metadata URL."}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"Forbidden":{"description":"Authorization was provided but is not allowed for this action","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFound":{"description":"Resource not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"Conflict":{"description":"The requested action conflicts with current product or resource state","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"ServiceUnavailable":{"description":"Dependent service unavailable","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"schemas":{"Health":{"type":"object","properties":{"ok":{"type":"boolean"}},"required":["ok"]},"AgentAuthorizationStartRequest":{"type":"object","additionalProperties":false,"properties":{"client":{"type":"string","enum":["codex","claude-code","cli"]},"scopes":{"type":"array","minItems":1,"maxItems":4,"uniqueItems":true,"items":{"type":"string","enum":["superskill:managed","resources:publish","workspaces:read","workspaces:write"]}}},"required":["client","scopes"]},"AgentAuthorizationStart":{"type":"object","additionalProperties":false,"properties":{"request_id":{"type":"string","pattern":"^ohrq_[A-Za-z0-9_-]{43}$"},"device_proof":{"type":"string","pattern":"^ohdp_[A-Za-z0-9_-]{43}$"},"browser_url":{"type":"string","format":"uri","description":"The browser proof is present only in the URL fragment."},"verification_uri":{"type":"string","format":"uri"},"expires_in":{"type":"integer","minimum":120,"maximum":900},"interval":{"type":"integer","minimum":1,"maximum":10}},"required":["request_id","device_proof","browser_url","verification_uri","expires_in","interval"]},"AgentBrowserBindRequest":{"type":"object","additionalProperties":false,"properties":{"request_id":{"type":"string","pattern":"^ohrq_[A-Za-z0-9_-]{43}$"},"browser_proof":{"type":"string","pattern":"^ohbp_[A-Za-z0-9_-]{43}$"}},"required":["request_id","browser_proof"]},"AgentAuthorizationContext":{"type":"object","additionalProperties":false,"properties":{"request":{"type":"object","additionalProperties":false,"properties":{"id":{"type":"string"},"client":{"type":"string","enum":["codex","claude-code","cli"]},"client_name":{"type":"string"},"scopes":{"type":"array","items":{"type":"string"}},"expires_at":{"type":"string","format":"date-time"},"status":{"type":"string","enum":["pending","approved","denied","expired","consumed"]}},"required":["id","client","client_name","scopes","expires_at","status"]}},"required":["request"]},"AgentAuthorizationDecision":{"type":"object","additionalProperties":false,"properties":{"request_id":{"type":"string","pattern":"^ohrq_[A-Za-z0-9_-]{43}$"},"decision":{"type":"string","enum":["approve","deny"]}},"required":["request_id","decision"]},"AgentAuthorizationTokenRequest":{"type":"object","additionalProperties":false,"properties":{"request_id":{"type":"string","pattern":"^ohrq_[A-Za-z0-9_-]{43}$"},"device_proof":{"type":"string","pattern":"^ohdp_[A-Za-z0-9_-]{43}$"}},"required":["request_id","device_proof"]},"AgentAuthorizationToken":{"type":"object","additionalProperties":false,"properties":{"access_token":{"type":"string","pattern":"^ohat_[A-Za-z0-9_-]{43}$"},"refresh_token":{"type":"string","pattern":"^ohrt_[A-Za-z0-9_-]{43}$"},"token_type":{"type":"string","const":"Bearer"},"expires_in":{"type":"integer","minimum":1,"maximum":600},"session_expires_in":{"type":"integer","minimum":1,"maximum":2592000},"scope":{"type":"string"}},"required":["access_token","refresh_token","token_type","expires_in","session_expires_in","scope"]},"SuperSkillBootstrap":{"type":"object","additionalProperties":false,"properties":{"schemaVersion":{"type":"string","const":"superskill.bootstrap.v1"},"canonicalUrl":{"type":"string","format":"uri","pattern":"^https://superskill\\.sh/api/superskill/install"},"agent":{"type":"object","additionalProperties":false,"properties":{"action":{"type":"string","const":"install_superskill"},"command":{"type":"string","description":"Exact pinned local install command for an agent that was given the universal URL."},"supportedClients":{"type":"array","prefixItems":[{"const":"codex"},{"const":"claude-code"}],"minItems":2,"maxItems":2},"note":{"type":"string"}},"required":["action","command","supportedClients","note"]},"installer":{"type":"object","additionalProperties":false,"properties":{"package":{"type":"string","const":"onlyharness"},"version":{"type":"string"},"integrity":{"type":"string","pattern":"^sha512-"},"releaseStatus":{"type":"string","const":"published"}},"required":["package","version","integrity","releaseStatus"]},"universalSkill":{"type":"object","additionalProperties":false,"properties":{"name":{"type":"string","const":"superskill"},"version":{"type":"string"},"artifactDigest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"}},"required":["name","version","artifactDigest"]},"clientAdapters":{"type":"object","additionalProperties":false,"properties":{"codex":{"type":"object","additionalProperties":false,"properties":{"path":{"type":"string","const":".codex/config.toml"},"contractDigest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"}},"required":["path","contractDigest"]},"claude-code":{"type":"object","additionalProperties":false,"properties":{"path":{"type":"string","const":".mcp.json"},"contractDigest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"}},"required":["path","contractDigest"]}},"required":["codex","claude-code"]},"capability":{"anyOf":[{"type":"null"},{"type":"object","additionalProperties":false,"properties":{"id":{"type":"string"},"version":{"type":"string"},"artifactDigest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"}},"required":["id","version","artifactDigest"]}]},"activation":{"type":"object","additionalProperties":false,"properties":{"performed":{"type":"boolean","const":false},"explicitConsentRequired":{"type":"boolean","const":true}},"required":["performed","explicitConsentRequired"]},"manifestDigest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"}},"required":["schemaVersion","canonicalUrl","agent","installer","universalSkill","clientAdapters","capability","activation","manifestDigest"]},"Workspace":{"type":"object","properties":{"slug":{"type":"string"},"name":{"type":"string"},"type":{"type":"string","enum":["company","community","team","course","agency","chat"]},"visibility":{"type":"string","enum":["private","invite_only","gated","public","unlisted"]},"plan":{"type":"string","enum":["free","team","enterprise"]},"description":{"type":"string","nullable":true},"avatarUrl":{"type":"string","nullable":true}},"required":["slug","name","type","visibility","plan"]},"WorkspaceResourcePermissions":{"type":"object","properties":{"totalResources":{"type":"integer"},"hostedArchives":{"type":"integer"},"unscanned":{"type":"integer"},"riskTiers":{"type":"object","properties":{"LOW":{"type":"integer"},"MEDIUM":{"type":"integer"},"HIGH":{"type":"integer"},"CRITICAL":{"type":"integer"},"UNKNOWN":{"type":"integer"}}}},"required":["totalResources","hostedArchives","unscanned","riskTiers"]},"WorkspaceAuditEntry":{"type":"object","properties":{"slug":{"type":"string"},"action":{"type":"string"},"token_name":{"type":"string","nullable":true},"subject":{"type":"string","nullable":true},"target":{"type":"string","nullable":true},"at":{"type":"string"}},"required":["slug","action","token_name","subject","target","at"]},"WorkspaceMember":{"type":"object","properties":{"id":{"type":"string"},"workspace_id":{"type":"string"},"workspace_slug":{"type":"string"},"user_id":{"type":"string"},"role":{"type":"string","enum":["owner","admin","moderator","publisher","member","viewer"]},"status":{"type":"string","enum":["invited","active","suspended","removed"]},"source":{"type":"string","enum":["direct","invite","email_domain","telegram","discord","entitlement","paid_entitlement","token_bootstrap"]},"joined_at":{"type":"string"},"expires_at":{"type":"string","nullable":true},"removed_at":{"type":"string","nullable":true}},"required":["user_id","role","status","source","joined_at"]},"WorkspaceInvite":{"type":"object","description":"Public invite metadata. The stored code hash is intentionally not exposed.","properties":{"id":{"type":"string"},"workspaceId":{"type":"string"},"workspaceSlug":{"type":"string"},"email":{"type":"string","nullable":true},"role":{"type":"string","enum":["owner","admin","moderator","publisher","member","viewer"]},"maxUses":{"type":"integer","nullable":true},"usesCount":{"type":"integer"},"expiresAt":{"type":"string","nullable":true},"createdBy":{"type":"string","nullable":true},"createdAt":{"type":"string"},"revokedAt":{"type":"string","nullable":true}},"required":["role","usesCount","createdAt"]},"WorkspaceJoinPolicy":{"type":"object","description":"Workspace join gate metadata. No raw invite code, bot secret, token or external credential is exposed.","properties":{"id":{"type":"string"},"workspaceId":{"type":"string"},"workspaceSlug":{"type":"string"},"kind":{"type":"string","enum":["invite","email_domain","telegram","discord","entitlement","paid_subscription","manual_approval"]},"status":{"type":"string","enum":["active","disabled"]},"role":{"type":"string","enum":["member","viewer"]},"title":{"type":"string","nullable":true},"instructions":{"type":"string","nullable":true},"config":{"type":"object","additionalProperties":true},"createdAt":{"type":"string"},"updatedAt":{"type":"string"}},"required":["id","kind","status","role","config","createdAt","updatedAt"]},"WorkspaceJoinPolicyInput":{"type":"object","properties":{"id":{"type":"string"},"kind":{"type":"string","enum":["invite","email_domain","telegram","discord","entitlement","paid_subscription","manual_approval"]},"status":{"type":"string","enum":["active","disabled"]},"role":{"type":"string","enum":["member","viewer"]},"title":{"type":"string"},"instructions":{"type":"string"},"config":{"type":"object","additionalProperties":true}},"required":["kind"]},"WorkspaceSubscription":{"type":"object","description":"Read-only workspace subscription receipt and access window. Membership is granted only by webhook/sweep lifecycle, never by read endpoints.","properties":{"id":{"type":"string"},"workspaceSlug":{"type":"string"},"userId":{"type":"string"},"policyId":{"type":"string"},"provider":{"type":"string","enum":["manual"]},"providerSubscriptionRef":{"type":"string"},"status":{"type":"string","enum":["incomplete","active","past_due","canceled","expired"]},"currentPeriodStart":{"type":["string","null"],"format":"date-time"},"currentPeriodEnd":{"type":["string","null"],"format":"date-time"},"graceUntil":{"type":["string","null"],"format":"date-time"},"accessUntil":{"type":["string","null"],"format":"date-time"},"cancelAtPeriodEnd":{"type":"boolean"},"canceledAt":{"type":["string","null"],"format":"date-time"},"checkoutUrl":{"type":["string","null"]},"portalUrl":{"type":["string","null"]},"createdAt":{"type":"string","format":"date-time"},"updatedAt":{"type":"string","format":"date-time"}},"required":["id","workspaceSlug","userId","policyId","provider","providerSubscriptionRef","status","cancelAtPeriodEnd","createdAt","updatedAt"]},"WorkspaceCollection":{"type":"object","properties":{"slug":{"type":"string"},"title":{"type":"string"},"summary":{"type":"string","nullable":true},"visibility":{"type":"string","enum":["workspace","public","unlisted"]},"createdAt":{"type":"string"},"updatedAt":{"type":"string"},"archivedAt":{"type":"string","nullable":true},"items":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceCollectionItem"}}},"required":["slug","title","visibility","createdAt","updatedAt","items"]},"WorkspaceCollectionItem":{"type":"object","properties":{"id":{"type":"string"},"itemRef":{"type":"string"},"itemSource":{"type":"string","enum":["public_resource","workspace_resource","native_harness","external_url"]},"sourceResourceId":{"type":"string"},"pinnedVersion":{"type":"string","nullable":true},"pinnedArchiveHash":{"type":"string","nullable":true},"approvalState":{"type":"string","enum":["pending_review","approved","approved_with_warning","blocked","blocked_by_scan","deprecated"]},"approvedBy":{"type":"string","nullable":true},"approvedAt":{"type":"string","nullable":true},"note":{"type":"string","nullable":true},"riskSnapshot":{"type":"object"},"createdAt":{"type":"string"},"updatedAt":{"type":"string"}},"required":["id","itemRef","itemSource","approvalState","createdAt","updatedAt"]},"RegistryItem":{"type":"object","properties":{"owner":{"type":"string"},"ownerLabel":{"type":"string"},"name":{"type":"string"},"title":{"type":"string"},"summary":{"type":"string"},"tags":{"type":"array","items":{"type":"string"}},"job":{"type":"string"},"outcome":{"type":"string"},"runtime":{"type":"string"},"forgeUrl":{"type":"string","description":"Public repository or upstream URL when available. Local filesystem paths are never exposed."},"contentType":{"type":"string","enum":["harness","directory"]},"directory":{"type":"object","properties":{"url":{"type":"string"},"itemCount":{"type":"integer","minimum":0},"category":{"type":"string"},"notes":{"type":"string"}}},"compatibility":{"type":"object","properties":{"targets":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"status":{"type":"string","enum":["planned","available","verified"]},"notes":{"type":"string"},"last_verified_at":{"type":"string","format":"date-time"}},"required":["status"]}}},"required":["targets"]},"valid":{"type":"boolean"},"riskScore":{"type":"number"},"riskTier":{"type":"string"},"evalStatus":{"type":"string"},"evalScore":{"type":"number"},"contextCost":{"$ref":"#/components/schemas/ContextCost"},"standard":{"type":"string","enum":["conformant","partial"]},"stars":{"type":"number"},"forks":{"type":"number"},"threads":{"type":"number"},"runs":{"type":"number"},"installConfirms":{"type":"number"},"signalCount":{"type":"number"},"heatQualified":{"type":"boolean"},"heat":{"type":"number"},"heatDelta":{"type":"number"},"freshness":{"type":"string"},"badge":{"type":"string"},"cliCommand":{"type":"string"},"updatedAt":{"type":"string"}},"required":["owner","name","title","summary","tags","contentType","compatibility","valid","riskTier","evalStatus","contextCost","standard","cliCommand"]},"ResourceSearchResult":{"type":"object","properties":{"resources":{"type":"array","items":{"$ref":"#/components/schemas/Resource"}},"items":{"type":"array","items":{"$ref":"#/components/schemas/Resource"}},"counts":{"type":"object","properties":{"externalSeed":{"type":"integer"},"internal":{"type":"integer"},"total":{"type":"integer"}},"required":["externalSeed","internal","total"]}},"required":["resources","items","counts"]},"Resource":{"type":"object","properties":{"id":{"type":"string"},"identity":{"type":"object"},"sourceCatalogId":{"type":"string"},"title":{"type":"string"},"summary":{"type":"string"},"summaryOriginal":{"type":"string"},"resourceType":{"type":"string","enum":["harness","skill","plugin","workflow","mcp_server","service_endpoint","agent_team","subagent_pack","command_pack","config","guide","framework","agent_runtime","directory"]},"sourcePlatform":{"type":"string"},"canonicalUrl":{"type":"string"},"mirror":{"type":"object","properties":{"platform":{"type":"string","enum":["github"]},"owner":{"type":"string"},"repo":{"type":"string"},"fullName":{"type":"string"},"url":{"type":"string"},"cloneUrl":{"type":"string"},"defaultBranch":{"type":"string"},"defaultBranchOnly":{"type":"boolean"},"fork":{"type":"boolean"},"sourceUrl":{"type":"string"},"status":{"type":"string","enum":["ready","pending","failed"]},"syncedAt":{"type":"string"},"error":{"type":"string"}}},"upstreamId":{"type":"string"},"upstreamOwner":{"type":"string"},"upstreamRepo":{"type":"string"},"creatorName":{"type":"string"},"licenseStatus":{"type":"string","enum":["permissive","copyleft","proprietary","unknown","blocked","manual_review"]},"licenseName":{"type":"string"},"sourceCheckedAt":{"type":"string","description":"Date upstream existence/activity was checked. This is not product install verification."},"sourceCheckMethod":{"type":"string","enum":["github_api","marketplace_api","manual_research"]},"sourceCheckStatus":{"type":"string","enum":["active","stale","archived","unavailable"]},"lastSeenAt":{"type":"string"},"installability":{"type":"string","enum":["open_only","importable","installable","verified"]},"tags":{"type":"array","items":{"type":"string"}},"worksWith":{"type":"array","items":{"type":"string","enum":["claude-code","codex","cursor","mcp","cli","github"]}},"upstreamPopularity":{"type":"object"},"onlyHarnessSignals":{"type":"object"},"popularityScore":{"type":"number"},"popularityBreakdown":{"type":"object"},"trust":{"type":"object","properties":{"sourceChecked":{"type":"boolean"},"securityScan":{"type":"string","enum":["pass","warn","fail","not_scanned"]},"installVerifiedAt":{"type":"string","description":"SuperSkill install verification evidence, when present."},"gateVerifiedAt":{"type":"string"},"riskTier":{"type":"string"}}},"release":{"$ref":"#/components/schemas/ResourceRelease"},"nativeInstall":{"oneOf":[{"$ref":"#/components/schemas/NativeHarnessInstall"},{"type":"null"}]},"workspaceApproval":{"type":"object","properties":{"workspaceSlug":{"type":"string"},"workspaceName":{"type":"string"},"collectionSlug":{"type":"string"},"sourceResourceId":{"type":"string"},"approvalState":{"type":"string","enum":["pending_review","approved","approved_with_warning","blocked","blocked_by_scan","deprecated"]},"approvedBy":{"type":"string"},"approvedAt":{"type":"string"},"note":{"type":"string"},"riskSnapshot":{"type":"object"}}},"actions":{"type":"array","items":{"type":"object"}},"source":{"type":"object"}},"required":["id","identity","title","summary","resourceType","sourcePlatform","canonicalUrl","licenseStatus","sourceCheckedAt","sourceCheckStatus","lastSeenAt","installability","tags","worksWith","popularityScore","trust","actions"]},"ResourceRelease":{"type":"object","properties":{"version":{"type":"string"},"artifactDigest":{"type":"string","pattern":"^[a-f0-9]{64}$"},"archiveSize":{"type":"integer","minimum":1},"trust":{"type":"string","enum":["unreviewed"]}},"required":["version","artifactDigest","archiveSize","trust"]},"NativeHarnessInstall":{"type":"object","description":"Exact anonymous native-harness install tuple. It is local catalog evidence, not managed approval or a Verified badge.","properties":{"kind":{"type":"string","const":"native_harness"},"resourceId":{"type":"string"},"ref":{"type":"string"},"version":{"type":"string"},"artifactDigest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"},"snapshot":{"type":"boolean","const":true},"totalFileCount":{"type":"integer","minimum":1},"archiveTruncated":{"type":"boolean","const":false},"securityScan":{"type":"string","const":"pass"},"scanner":{"type":"string","const":"static-v2"},"scannedArtifactDigest":{"type":"string","pattern":"^sha256:[a-f0-9]{64}$"},"riskTier":{"type":"string"},"permissions":{"type":"object"},"license":{"type":"string"},"managedApproval":{"type":"boolean","const":false},"archiveUrl":{"type":"string","format":"uri"},"commands":{"type":"object","properties":{"codex":{"type":"string"},"claudeCode":{"type":"string"}},"required":["codex","claudeCode"]}},"required":["kind","resourceId","ref","version","artifactDigest","snapshot","totalFileCount","archiveTruncated","securityScan","scanner","scannedArtifactDigest","riskTier","permissions","license","managedApproval","archiveUrl","commands"]},"ResourceExactRelease":{"allOf":[{"$ref":"#/components/schemas/Resource"},{"type":"object","properties":{"release":{"$ref":"#/components/schemas/ResourceRelease"}},"required":["release"]}]},"HarnessDetail":{"type":"object","properties":{"owner":{"type":"string"},"repo":{"type":"string"},"manifest":{"type":"object"},"valid":{"type":"boolean"},"issues":{"type":"array","items":{"type":"object"}},"risk":{"type":"object"},"security":{"$ref":"#/components/schemas/SecurityReport"},"contextCost":{"$ref":"#/components/schemas/ContextCost"},"standard":{"type":"string","enum":["conformant","partial"]},"evalResult":{"type":"object"},"verification":{"type":"object","properties":{"lastVerifiedAt":{"type":"string","format":"date-time"}}},"nativeInstall":{"oneOf":[{"$ref":"#/components/schemas/NativeHarnessInstall"},{"type":"null"}]},"example":{"type":"object"},"files":{"type":"array","items":{"type":"string"}},"versions":{"type":"array","items":{"$ref":"#/components/schemas/ArchiveVersion"}},"prReview":{"$ref":"#/components/schemas/MaintainerReviewPreview"},"readme":{"type":"string"}}},"MaintainerReviewPreview":{"type":"object","description":"Generated local maintainer-review preview. It is not evidence of an open forge pull request when demo=true.","properties":{"owner":{"type":"string"},"repo":{"type":"string"},"number":{"type":["integer","null"]},"title":{"type":"string"},"source":{"type":"string","enum":["local-demo","forge-pr"]},"demo":{"type":"boolean"},"status":{"type":"string","enum":["passed","review","failed"]},"markdown":{"type":"string"},"next":{"type":"string"},"diff":{"type":"object","properties":{"riskDelta":{"type":"number"},"riskTier":{"type":"string"},"changes":{"type":"array","items":{"type":"object","properties":{"severity":{"type":"string"},"area":{"type":"string"},"message":{"type":"string"}},"required":["severity","area","message"]}}},"required":["riskDelta","riskTier","changes"]}},"required":["owner","repo","number","title","source","demo","status","markdown","next","diff"]},"ArchiveVersion":{"type":"object","properties":{"version":{"type":"string"},"createdAt":{"type":"string","format":"date-time"},"snapshot":{"type":"boolean"},"current":{"type":"boolean"},"fileCount":{"type":"number"}},"required":["version","createdAt","snapshot","current","fileCount"]},"ThreadItem":{"type":"object","properties":{"id":{"type":"string"},"author":{"type":"string"},"userId":{"type":"string"},"role":{"type":"string"},"kind":{"type":"string","enum":["question","recipe","result","proposal","bug/risk"]},"body":{"type":"string"},"likes":{"type":"number"},"at":{"type":"string"}},"required":["id","author","role","kind","body","likes","at"]},"StarRequest":{"type":"object","properties":{"starred":{"type":"boolean","description":"false removes the caller's star; omitted or true records a star."}}},"StarResponse":{"type":"object","properties":{"owner":{"type":"string"},"repo":{"type":"string"},"starred":{"type":"boolean"}},"required":["owner","repo","starred"]},"ThreadPostRequest":{"type":"object","properties":{"kind":{"type":"string","enum":["question","recipe","result","proposal","bug/risk"]},"body":{"type":"string","minLength":2,"maxLength":2000}},"required":["body"]},"ThreadPostResponse":{"type":"object","properties":{"owner":{"type":"string"},"repo":{"type":"string"},"item":{"$ref":"#/components/schemas/ThreadItem"}},"required":["owner","repo","item"]},"ContextCost":{"type":"object","description":"Deterministic estimate from markdown instruction files. It is not a measured LLM bill.","properties":{"approxTokens":{"type":"number"},"files":{"type":"number"},"bytes":{"type":"number"},"status":{"type":"string","enum":["estimated"]}},"required":["approxTokens","files","bytes","status"]},"Archive":{"type":"object","properties":{"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"snapshot":{"type":"boolean"},"files":{"type":"array","items":{"type":"object","properties":{"path":{"type":"string"},"truncated":{"type":"boolean"},"content":{"type":"string"}},"required":["path","truncated","content"]}}},"required":["owner","repo","version","snapshot","files"]},"PaymentRequired":{"type":"object","properties":{"error":{"type":"string"},"code":{"type":"string","enum":["PAYMENT_REQUIRED"]},"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"pricing":{"type":"object"},"provider":{"type":"string","enum":["manual"]},"checkout_url":{"type":"string"},"payments_enabled":{"type":"boolean"},"x402":{"type":"object","properties":{"enabled":{"type":"boolean"},"requirements":{"type":"array","items":{"$ref":"#/components/schemas/X402PaymentRequirements"}},"paymentRequired":{"oneOf":[{"$ref":"#/components/schemas/X402PaymentRequired"},{"type":"null"}]}},"required":["enabled","requirements","paymentRequired"]},"next":{"type":"string"}},"required":["error","code","owner","repo","version","pricing","provider","checkout_url","payments_enabled","x402","next"]},"DirectoryLinkOnly":{"type":"object","properties":{"error":{"type":"string","enum":["Directory link only"]},"code":{"type":"string","enum":["DIRECTORY_LINK_ONLY"]},"owner":{"type":"string"},"repo":{"type":"string"},"url":{"type":"string"},"item_count":{"type":"integer","minimum":0},"category":{"type":"string"},"notes":{"type":"string"},"next":{"type":"string"}},"required":["error","code","owner","repo","next"]},"HostedExecutionUnavailable":{"type":"object","properties":{"error":{"type":"string","enum":["Hosted execution not available"]},"code":{"type":"string","enum":["HOSTED_EXECUTION_NOT_AVAILABLE"]},"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"pricing":{"type":"object"},"next":{"type":"string"}},"required":["error","code","owner","repo","version","pricing","next"]},"X402PaymentRequired":{"type":"object","properties":{"x402Version":{"type":"integer","enum":[2]},"error":{"type":"string","enum":["Payment required"]},"resource":{"type":"object","properties":{"url":{"type":"string"},"description":{"type":"string"},"mimeType":{"type":"string","enum":["application/json"]}},"required":["url","description","mimeType"]},"accepts":{"type":"array","items":{"$ref":"#/components/schemas/X402PaymentRequirements"}}},"required":["x402Version","error","resource","accepts"]},"X402PaymentRequirements":{"type":"object","properties":{"scheme":{"type":"string","enum":["exact"]},"network":{"type":"string"},"asset":{"type":"string"},"amount":{"type":"string","description":"USDC atomic units; 9000000 means $9.00 for six-decimal USDC."},"payTo":{"type":"string"},"maxTimeoutSeconds":{"type":"integer"},"extra":{"type":"object","properties":{"name":{"type":"string"},"version":{"type":"string"}},"required":["name","version"]}},"required":["scheme","network","asset","amount","payTo","maxTimeoutSeconds","extra"]},"CheckoutSession":{"type":"object","properties":{"provider":{"type":"string","enum":["manual"]},"provider_ref":{"type":"string"},"checkout_url":{"type":"string"},"status":{"type":"string","enum":["pending"]},"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"pricing":{"type":"object"},"next":{"type":"string"}},"required":["provider","provider_ref","checkout_url","status","owner","repo","version","pricing","next"]},"PurchaseReceipt":{"type":"object","properties":{"receipt_id":{"type":"string"},"purchase_id":{"type":"string"},"provider":{"type":"string","enum":["manual","x402"]},"provider_ref":{"type":"string"},"status":{"type":"string","enum":["pending","paid","reserved","captured","refunded","failed"]},"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"pricing_model":{"type":"string","enum":["free","one_time","subscription","per_call","gate_escrow"]},"amount_usd":{"type":"number"},"currency":{"type":"string"},"subject":{"type":"object","properties":{"type":{"type":"string","enum":["user","wallet","org"]},"id":{"type":"string"}},"required":["type","id"]},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"},"entitlement":{"type":"object","properties":{"granted":{"type":"boolean"},"kind":{"type":"string","enum":["one_time","subscription","escrow_reserved"]},"expires_at":{"type":["string","null"],"format":"date-time"}},"required":["granted"]},"escrow":{"type":"object","properties":{"expires_at":{"type":["string","null"],"format":"date-time"},"receipt_hash":{"type":["string","null"],"pattern":"^[a-fA-F0-9]{64}$"},"captured_at":{"type":["string","null"],"format":"date-time"},"refunded_at":{"type":["string","null"],"format":"date-time"}}}},"required":["receipt_id","purchase_id","provider","provider_ref","status","owner","repo","version","amount_usd","currency","subject","created_at","updated_at","entitlement"]},"EscrowSettlement":{"type":"object","properties":{"ok":{"type":"boolean","enum":[true]},"status":{"type":"string","enum":["captured","refunded","already_captured","already_refunded"]},"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"subject_id":{"type":"string"},"purchase_id":{"type":"string"},"receipt_hash":{"type":"string","pattern":"^[a-fA-F0-9]{64}$"},"escrow_expires_at":{"type":["string","null"],"format":"date-time"},"reason":{"type":"string","enum":["receipt_passed","receipt_failed","timeout"]}},"required":["ok","status","owner","repo","version","subject_id","purchase_id","reason"]},"Bounty":{"type":"object","properties":{"id":{"type":"string"},"title":{"type":"string"},"spec":{"type":"string"},"budget_usd":{"type":"number"},"currency":{"type":"string"},"status":{"type":"string","enum":["open","claimed","delivered","paid"]},"customer_user_id":{"type":"string"},"claimant_user_id":{"type":["string","null"]},"delivered_harness":{"type":["string","null"]},"delivered_version":{"type":["string","null"]},"delivery_receipt_hash":{"type":["string","null"],"pattern":"^[a-fA-F0-9]{64}$"},"accepted_receipt_hash":{"type":["string","null"],"pattern":"^[a-fA-F0-9]{64}$"},"payment_purchase_id":{"type":["string","null"]},"escrow_provider_ref":{"type":["string","null"]},"paid_at":{"type":["string","null"],"format":"date-time"},"created_at":{"type":"string","format":"date-time"},"updated_at":{"type":"string","format":"date-time"}},"required":["id","title","spec","budget_usd","currency","status","customer_user_id","created_at","updated_at"]},"BountyCreate":{"type":"object","properties":{"title":{"type":"string","minLength":4,"maxLength":120},"spec":{"type":"string","minLength":20,"maxLength":20000},"budget_usd":{"type":"number","exclusiveMinimum":0},"currency":{"type":"string","pattern":"^[A-Za-z]{3}$","default":"USD"}},"required":["title","spec","budget_usd"]},"BountyDeliver":{"type":"object","properties":{"harness":{"type":"string"},"version":{"type":"string"},"receipt":{"$ref":"#/components/schemas/GateReceipt"}},"required":["receipt"]},"BountyAccept":{"type":"object","properties":{"provider_ref":{"type":"string"},"receipt":{"$ref":"#/components/schemas/GateReceipt"}},"required":["provider_ref","receipt"]},"GateReceipt":{"type":"object","properties":{"type":{"type":"string","enum":["onlyharness.gate_receipt.v1"]},"algorithm":{"type":"string","enum":["ed25519"]},"payload":{"$ref":"#/components/schemas/GateReceiptPayload"},"publicKey":{"type":"string","description":"SPKI PEM public key derived from the local install key."},"signature":{"type":"string","description":"Base64 ed25519 signature over the stable JSON payload."}},"required":["type","algorithm","payload","publicKey","signature"]},"GateReceiptPayload":{"type":"object","properties":{"harness":{"type":"string","description":"Harness ref, for example harnesses/deep-market-researcher or @org/name."},"version":{"type":"string"},"resultsHash":{"type":"string","pattern":"^[a-fA-F0-9]{64}$"},"verdict":{"type":"string","enum":["passed","failed"]},"at":{"type":"string","format":"date-time"},"gate":{"type":"object","properties":{"score":{"type":"number"},"risk":{"type":"number"},"cost":{"type":"number"},"failures":{"type":"array","items":{"type":"string"}}},"required":["score","risk","cost","failures"]}},"required":["harness","version","resultsHash","verdict","at","gate"]},"GateReceiptVerification":{"type":"object","properties":{"ok":{"type":"boolean","enum":[true]},"receipt_hash":{"type":"string","pattern":"^[a-fA-F0-9]{64}$"},"harness":{"type":"string"},"version":{"type":"string"},"verdict":{"type":"string","enum":["passed","failed"]},"resultsHash":{"type":"string","pattern":"^[a-fA-F0-9]{64}$"},"at":{"type":"string","format":"date-time"}},"required":["ok","receipt_hash","harness","version","verdict","resultsHash","at"]},"PaymentWebhookResult":{"type":"object","properties":{"ok":{"type":"boolean"},"status":{"type":"string","enum":["paid","already_paid","reserved","already_reserved","already_captured","already_refunded"]},"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"subject_id":{"type":"string"},"purchase_id":{"type":"string"}},"required":["ok","status","owner","repo","version","subject_id"]},"EntitlementCheck":{"type":"object","properties":{"ok":{"type":"boolean"},"entitled":{"type":"boolean"},"status":{"type":"string","enum":["free","entitled","payment_required"]},"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"subject_type":{"type":"string","enum":["user","wallet","org"]},"subject_id":{"type":"string"},"pricing":{"type":"object"}},"required":["ok","entitled","status","owner","repo","version","subject_type","subject_id","pricing"]},"CommunityInviteCode":{"type":"object","properties":{"ok":{"type":"boolean"},"code":{"type":"string"},"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"subject_type":{"type":"string","enum":["user"]},"subject_id":{"type":"string"},"expires_at":{"type":"string","format":"date-time"},"next":{"type":"string"}},"required":["ok","code","owner","repo","version","subject_type","subject_id","expires_at","next"]},"CommunityVerifyCode":{"type":"object","properties":{"ok":{"type":"boolean"},"allowed":{"type":"boolean"},"entitled":{"type":"boolean"},"status":{"type":"string","enum":["free","entitled","payment_required"]},"owner":{"type":"string"},"repo":{"type":"string"},"version":{"type":"string"},"subject_type":{"type":"string","enum":["user","wallet","org"]},"subject_id":{"type":"string"},"pricing":{"type":"object"}},"required":["ok","allowed","entitled","status","owner","repo","version","subject_type","subject_id","pricing"]},"StorefrontProfile":{"type":"object","properties":{"user_id":{"type":"string"},"handle":{"type":"string"},"display_name":{"type":"string"},"bio":{"type":"string"},"referral_code":{"type":"string"}},"required":["user_id","handle","display_name","bio","referral_code"]},"StorefrontPage":{"type":"object","properties":{"profile":{"type":"object","properties":{"handle":{"type":"string"},"display_name":{"type":"string"},"bio":{"type":"string"}},"required":["handle","display_name","bio"]},"referralCode":{"type":"string"},"items":{"type":"array","items":{"$ref":"#/components/schemas/RegistryItem"}}},"required":["profile","referralCode","items"]},"OrgBundleResponse":{"type":"object","properties":{"organization":{"type":"object","properties":{"slug":{"type":"string"},"name":{"type":"string"},"plan":{"type":"string","enum":["free","team","enterprise"]}},"required":["slug","name","plan"]},"bundle":{"$ref":"#/components/schemas/OrgBundle"}},"required":["organization","bundle"]},"WorkspaceSetupBundleResponse":{"type":"object","properties":{"workspace":{"$ref":"#/components/schemas/Workspace"},"bundle":{"$ref":"#/components/schemas/WorkspaceSetupBundle"},"next":{"type":"string"}},"required":["workspace","bundle","next"]},"WorkspaceSetupBundle":{"type":"object","properties":{"version":{"type":"string"},"generatedAt":{"type":"string","format":"date-time"},"target":{"type":"string","enum":["cli","claude-code","codex","cursor","mcp"]},"resources":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceSetupResource"}},"configs":{"type":"array","items":{"$ref":"#/components/schemas/WorkspaceSetupConfig"}}},"required":["version","generatedAt","target","resources","configs"]},"WorkspaceSetupResource":{"type":"object","properties":{"id":{"type":"string"},"name":{"type":"string"},"title":{"type":"string"},"resourceType":{"type":"string"},"source":{"type":"string","enum":["workspace_private","workspace_approved"]},"hostedArchive":{"type":"boolean"},"sourceResourceId":{"type":"string"},"pinnedVersion":{"type":"string","description":"Immutable public release version approved by the workspace."},"pinnedArchiveHash":{"type":"string","pattern":"^[a-f0-9]{64}$","description":"Approved release archive SHA-256 digest."},"exactResourceUrl":{"type":"string","format":"uri","description":"Human-facing URL for the exact approved release, never latest."},"approvalState":{"type":"string"},"collections":{"type":"array","items":{"type":"string"}},"detailCommand":{"type":"string"},"openCommand":{"type":"string"},"installCommand":{"type":"string"},"note":{"type":["string","null"]}},"required":["id","name","title","resourceType","source","hostedArchive","collections","detailCommand","openCommand"]},"WorkspaceSetupConfig":{"type":"object","properties":{"path":{"type":"string"},"content":{"type":"string","maxLength":131072}},"required":["path","content"]},"OrgWorkspaceResponse":{"type":"object","properties":{"organization":{"type":"object","properties":{"slug":{"type":"string"},"name":{"type":"string"},"plan":{"type":"string","enum":["free","team","enterprise"]}},"required":["slug","name","plan"]},"items":{"type":"array","items":{"$ref":"#/components/schemas/RegistryItem"}},"permissions":{"$ref":"#/components/schemas/OrgPermissionSummary"},"audit":{"type":"array","items":{"$ref":"#/components/schemas/OrgAuditEntry"}}},"required":["organization","items","permissions","audit"]},"OrgPermissionSummary":{"type":"object","properties":{"totalHarnesses":{"type":"integer","minimum":0},"riskTiers":{"type":"object","properties":{"LOW":{"type":"integer","minimum":0},"MEDIUM":{"type":"integer","minimum":0},"HIGH":{"type":"integer","minimum":0},"CRITICAL":{"type":"integer","minimum":0}},"required":["LOW","MEDIUM","HIGH","CRITICAL"]},"maxRiskScore":{"type":"integer","minimum":0,"maximum":100},"maxRiskTier":{"type":"string","enum":["NONE","LOW","MEDIUM","HIGH","CRITICAL"]},"permissionCounts":{"type":"object","properties":{"unrestrictedNetwork":{"type":"integer","minimum":0},"shell":{"type":"integer","minimum":0},"browser":{"type":"integer","minimum":0},"credentials":{"type":"integer","minimum":0},"externalSend":{"type":"integer","minimum":0},"moneyMovement":{"type":"integer","minimum":0},"userData":{"type":"integer","minimum":0}},"required":["unrestrictedNetwork","shell","browser","credentials","externalSend","moneyMovement","userData"]},"riskMarkdown":{"type":"string"}},"required":["totalHarnesses","riskTiers","maxRiskScore","maxRiskTier","permissionCounts","riskMarkdown"]},"OrgAuditEntry":{"type":"object","properties":{"slug":{"type":"string"},"action":{"type":"string"},"token_name":{"type":["string","null"]},"subject":{"type":["string","null"]},"target":{"type":["string","null"]},"at":{"type":"string","format":"date-time"}},"required":["slug","action","token_name","subject","target","at"]},"OrgBundle":{"type":"object","properties":{"version":{"type":"string"},"harnesses":{"type":"array","items":{"$ref":"#/components/schemas/OrgBundleHarness"}},"configs":{"type":"array","items":{"$ref":"#/components/schemas/OrgBundleConfig"}}},"required":["version","harnesses","configs"]},"OrgBundleHarness":{"type":"object","properties":{"owner":{"type":"string"},"name":{"type":"string"},"version":{"type":"string"},"target":{"type":"string"}},"required":["owner","name"]},"OrgBundleConfig":{"type":"object","properties":{"path":{"type":"string"},"content":{"type":"string"}},"required":["path","content"]},"SecurityReport":{"type":"object","properties":{"verdict":{"type":"string","enum":["pass","warn","fail"]},"scanner":{"type":"string"},"findings":{"type":"array","items":{"type":"object"}}}},"Error":{"type":"object","properties":{"error":{"type":"string"}},"required":["error"]}}}}