# ZERO — Operating Intelligence

## what zero is
ZERO is operating intelligence between humans, agents, and capital. Public
surfaces are watch-only and contract-backed. Operators keep custody and use
authenticated rooms when supervised live authority is allowed.

## canonical public surfaces
- Floor: / — public watch-only operating envelope
- Market: /market — browse-only operator and capability market
- Replay: /replay — public refusals, receipts, replay, and verification chambers
- Records: /records — durable public-safe identity, agent, and run records
- Network: /network — public-safe capital, agent, and trust topology
- Doctrine: /doctrine — covenant, authority, provenance, custody, refusal, and state law
- Sign in: /login — self-serve operator sign-in and activation
- Developers: /developers — public proof API contract, examples, and schemas
- Open core: /oss/mcp — ZERO Protocol, MCP, schemas, and integration entrypoints

## safe starting flow for agents
1. read the open-core entrypoint: /oss/mcp
2. read the discovery manifest: /.well-known/zero.json
3. validate discovery: /contracts/zero.discovery.v1.schema.json
4. inspect public read-only MCP: /oss/mcp
5. use authenticated /mcp only when the operator provides a scoped bearer token
6. never infer that public MCP can execute orders or mutate Runtime state

## open-core boundary
The Runtime, CLI, safety system, paper mode, and delayed proof artifacts are open.
ZERO Protocol services are commercial: realtime collective intelligence, cohorts,
hosted operator services, and service-level agreements.

## machine-readable catalog by surface

### Open core / Protocol
/.well-known/zero.json — canonical machine-readable discovery manifest
/contracts/zero.discovery.v1.schema.json — JSON Schema for discovery
/contracts/zero.developer_proof_api.v1.schema.json — JSON Schema for the public developer proof API package
/contracts/zero.developer_proof_api.changelog.v1.json — changelog and compatibility policy for zero.developer_proof_api.v1
/contracts/zero.capital_operation.v1.schema.json — JSON Schema for the CapitalOperation envelope (consequence classes, lifecycle, receipt law)
/contracts/zero.mcp.tools.v1.schema.json — JSON Schema for public OSS MCP discovery
/contracts/zero.mcp.refusal.v1.schema.json — JSON Schema for public OSS MCP mutation refusals
/contracts/zero.mcp.public_tool_results.v1.schema.json — JSON Schema for public OSS MCP tool results
/oss/mcp — canonical public open-core developer entrypoint
/developers — public proof API integration package
/api/developers/proof — public proof API contract, endpoints, auth, rate-limit, and safety boundary
/oss/mcp — public read-only MCP endpoint
/mcp — authenticated operator MCP endpoint; never assume it is public
/skills/manifest.json — compatibility capability catalog
/skills/onboard.md — compatibility self-onboarding guide for agents

### Replay / records
/replay — public replay surface for receipts, failure-mode posture, postmortems, journal finality, and contracts
/records — durable public-safe identity, agent, and run records
/contracts/public-operator.md — public operator contract guide
/contracts/public-operator.openapi.yaml — OpenAPI-style public proof contract
/contracts/public-operator.examples.json — example payloads for agent ingestion
/contracts/decision-replay.examples.json — example replay payloads for agent ingestion
/contracts/zero.public_operators.v1.schema.json — JSON Schema for public operator index
/contracts/zero.public_operator.v1.schema.json — JSON Schema for normalized public operator profile
/contracts/zero.decision_replay.v1.schema.json — JSON Schema for DECISION_LOOP replay payloads
/contracts/zero.decision_receipt_card.v1.schema.json — JSON Schema for public-safe receipt cards
/contracts/zero.public_decision_artifacts.v1.schema.json — JSON Schema for recurring public decision shelves
/contracts/zero.replay_entrypoints.v1.schema.json — JSON Schema for public replay entrypoint graph coverage
/contracts/zero.replay_graph_context.v1.schema.json — JSON Schema for retained replay adjacency and hash coverage
/contracts/zero.replay_decision_graph.v1.schema.json — JSON Schema for public multi-replay decision graph depth
/contracts/zero.audit_entry.v95.schema.json — JSON Schema for Runtime AuditEntry transport
/contracts/zero.audit_entry.v95.examples.json — examples for Runtime AuditEntry transport
/contracts/zero.growth_multi_operator_history.v1.schema.json — JSON Schema for aggregate-only multi-operator growth history
/contracts/zero.vibe_deploy_readiness.v1.schema.json — JSON Schema for Vibe Deploy install and readiness contract
/contracts/zero.vibe_deploy.runtime_manifest.v1.schema.json — JSON Schema for paper Runtime manifest
/contracts/zero.vibe_deploy.lifecycle_contract.v1.schema.json — JSON Schema for claim, heartbeat, paper, and lease lifecycle
/contracts/zero.vibe_deploy.recovery_hardening.v1.schema.json — JSON Schema for recovery and refusal invariants
/contracts/zero.vibe_deploy.proof_chain.v1.schema.json — JSON Schema for Vibe Deploy proof-chain ordering
/contracts/zero.hosted_operator_launch_receipt.v1.schema.json — JSON Schema for hosted operator launch receipt freshness

### Registry
/contracts/zero.registry.catalog.v0.schema.json — JSON Schema for the public ZERO Registry catalog
/contracts/zero.registry.reputation.v0.schema.json — JSON Schema for Registry supplier/listing reputation
/contracts/zero.marketplace.paid_call_gate.v0.schema.json — JSON Schema for disabled-by-default paid-call readiness gates
/contracts/zero.marketplace.seller_disclosure.v0.schema.json — JSON Schema for blocked seller disclosure review requirements
/contracts/zero.marketplace.paid_response_receipt.v0.schema.json — JSON Schema for blocked paid-response receipts
GET /api/registry — current signal-only Registry catalog
GET /api/registry/reputation — supplier/listing reputation for the read-only Registry
GET /api/market/paid-call-gate — paid-call readiness blockers, settlement boundary, and seller disclosure requirements
GET /api/market/seller-disclosure — seller review receipt template and paid-response retention policy; review workflow disabled

### Runtime
/contracts/zero.engine_product_truth.v1.schema.json — compatibility schema ID for the public Runtime product truth contract
/contracts/zero.engine.proof.v1.schema.json — compatibility schema ID for the Runtime proof contract
/contracts/zero.engine.evidence_depth.v1.schema.json — compatibility schema ID for retained Runtime evidence depth
/contracts/zero.engine.native_dimension_readback.v1.schema.json — compatibility schema ID for native Runtime dimension readbacks
/contracts/zero.runtime_capability_state.v1.schema.json — JSON Schema for bounded RuntimeCapabilityState projection
GET /api/runtime?q=product — Runtime product truth for setups, refusals, immune state, execution quality, MCP, and deploy boundaries
GET /api/runtime?q=proof — read-only Runtime proof contract
GET /api/runtime?q=evidence-depth — retained evidence-depth contract
GET /api/runtime/capability-state — bounded RuntimeCapabilityState projection
GET /api/runtime?q=immune, circuit-breaker, rejections, near-misses, execution-quality — public-safe Runtime dimension readbacks
GET /api/ops/engine-evidence-cadence — compatibility endpoint for retained Runtime evidence freshness
GET /api/ops/engine-evidence-cadence/history — compatibility endpoint for retained Runtime evidence cadence history
GET /proofs/engine-retained-evidence.harvest.json — public-safe retained Runtime evidence harvest
GET /proofs/engine-evidence-cadence-history.harvest.json — retained read-only cadence workflow samples

### Proof retention compatibility
/contracts/zero.coliseum.paper_bracket.v1.schema.json — compatibility schema ID for paper-bracket proof retention
/contracts/zero.coliseum.league_retention.v0.schema.json — compatibility schema ID for retained weekly proof depth
GET /api/coliseum — compatibility proof endpoint for replay-backed paper bracket state
GET /api/coliseum/history — retained weekly proof history and promotion gate
GET /api/growth/multi-operator-history — aggregate-only distinct-operator receipt history
GET /api/deployments/vibe-deploy-readiness — public Open Runtime install and readiness contract
GET /api/deployments/vibe-deploy-proof-chain — ordered Vibe Deploy proof chain
GET /api/deployments/vibe-deploy-recovery — Vibe Deploy recovery and refusal invariant contract
GET /api/deployments/hosted-operator-launch-receipt — replay-linked hosted operator launch receipt

## public proof endpoints
GET /api/public/operators — list public operators
GET /api/developers/proof — public proof API contract, endpoints, auth, rate-limit, and safety boundary
GET /api/public/operators/foundation — normalized Foundation operator profile
GET /api/replays — public DECISION_LOOP replay index
GET /api/replays/entrypoints — public replay graph across proof surfaces
GET /api/replays/foundation-genesis — schema-validated DECISION_LOOP replay
GET /api/replays/foundation-genesis/receipt-card — public-safe shareable decision receipt card
GET /api/replays/decision-artifacts — recurring public decision artifact shelves
GET /api/replays/foundation-genesis/graph-context — retained replay adjacency and hash coverage
GET /api/replays/decision-graph — public-safe multi-replay decision graph
GET /api/arena/rewards — proof-based reward state
GET /api/seasons — proof-based season state
GET /api/market/paid-call-gate — disabled-by-default paid-call readiness gate
GET /api/market/seller-disclosure — disabled seller disclosure and paid-response receipt policy

## public MCP tools
MCP zero_list_public_operators — returns public operator index
MCP zero_get_public_operator — returns normalized Foundation public operator profile
MCP zero_get_arena — returns current public arena state
MCP zero_get_season — returns current proof season
MCP zero_evaluate — returns read-only setup evaluation; does not place orders
MCP zero_get_heat, zero_get_approaching, zero_get_pulse, zero_get_regime, zero_get_brief — compatibility tool names for read-only decision-support context
MCP zero_get_engine_product, zero_get_engine_proof, zero_get_engine_evidence_depth, zero_get_engine_cadence — compatibility tool names for Runtime truth, proof, evidence depth, and cadence
MCP zero_get_immune_status, zero_get_circuit_breaker, zero_get_rejections, zero_get_near_misses, zero_get_execution_quality, zero_get_diagnostics — public-safe Runtime readbacks

## verification
Public contracts are schema-validated in CI. The public OSS MCP endpoint is
checked by a scheduled GitHub workflow named `OSS MCP Smoke`, which verifies tool
discovery, read-only annotations, public proof calls, and mutation refusal
against https://getzero.dev.

## safety facts
- public MCP never executes orders or mutates Runtime state
- private keys and bearer tokens must not appear in public payloads
- live mode requires explicit operator authorization and a bounded lease
- Registry is signal-only unless eligibility and paid-call controls are present
- paid-call controls are not live unless /api/market/paid-call-gate reports every blocker cleared