{
  "service": "cadence-pwa",
  "version": "0.1.0",
  "description": "Progressive web app and edge store for Cadence: tasks in, a calendar of time blocks out; the edge holds ciphertext only.",
  "origin": "https://cadence.starlightglobal.industries",
  "milestone": "M0",
  "authentication": {
    "configured": true,
    "providers": [
      "starlight"
    ],
    "planned": [
      "github"
    ],
    "available": [
      "starlight"
    ]
  },
  "authorization": {
    "store": true,
    "roles": [
      "member",
      "holder",
      "funded"
    ],
    "capabilities": {
      "github:connect": {
        "summary": "Connect a GitHub repository of your own and keep an exported copy of your data in it.",
        "fields": [
          "github.start",
          "github.install",
          "github.callback",
          "github.refresh",
          "github.revoke"
        ],
        "roles": [
          "member",
          "holder",
          "funded"
        ]
      },
      "compose:run": {
        "summary": "Turn a description of work into a project with stages and ordered tasks.",
        "fields": [
          "compose"
        ],
        "roles": [
          "member",
          "holder",
          "funded"
        ]
      },
      "vault:read": {
        "summary": "Pull the encrypted vault: the wrapped key and every encrypted row since a cursor.",
        "fields": [
          "vault.key",
          "vault.rows"
        ],
        "roles": [
          "holder",
          "funded"
        ]
      },
      "vault:delete": {
        "summary": "Delete the encrypted copy this account keeps here, all of it, at once.",
        "fields": [
          "vault"
        ],
        "roles": [
          "member",
          "holder",
          "funded"
        ]
      },
      "vault:write": {
        "summary": "Push encrypted rows and the wrapped key.",
        "fields": [
          "vault.key",
          "vault.rows"
        ],
        "roles": [
          "funded"
        ]
      }
    }
  },
  "vault": {
    "configured": true,
    "encryption": "client-side AES-256-GCM per row; the key is wrapped with PBKDF2-SHA256 and never leaves the client in the clear",
    "limits": {
      "rows_per_push": 200,
      "rows_per_pull": 500,
      "rows_per_subject": 50000,
      "row_ciphertext_chars": 87400
    }
  },
  "github_backup": {
    "configured": false,
    "app": null,
    "note": "The browser writes the exported document to a repository the user picked; this edge exchanges and refreshes the token and keeps neither it nor the data."
  },
  "compose": {
    "configured": true,
    "experiment": "cadence-compose",
    "note": "Compose runs on the Starlight control plane, inside a time-bounded experiment that decides who may use it, until when and how often. The description you write is sent there and to the model provider; nothing else from this device is."
  },
  "agents": {
    "mcp": {
      "configured": true,
      "kid": "7ab5896ff5c4e0c7",
      "public_key": {
        "kty": "EC",
        "crv": "P-256",
        "x": "oqYtQdBgqu-KdzFmMTB1qSE4ep6AZMxlDKR6F-Cyc6k",
        "y": "bWxC9x_h8u45YjshbkzEC-2v9i2RR_dFmpcGzRxXhd4"
      },
      "note": "An agent reads and changes your tasks only after you turn on agent access on a device that syncs. That device wraps your vault key to this public key; the agent opens it for each call and keeps nothing."
    }
  },
  "notifications": {
    "background": "not_implemented",
    "note": "Notifications are shown by the service worker on this device while Cadence is open; no push is sent from this origin in M0."
  },
  "endpoints": {
    "health": {
      "method": "GET",
      "path": "/api/health",
      "tier": "public"
    },
    "me": {
      "method": "GET",
      "path": "/api/me",
      "tier": "session"
    },
    "sign_in": {
      "method": "GET",
      "path": "/api/auth/{provider}/start",
      "tier": "public"
    },
    "sign_in_callback": {
      "method": "GET",
      "path": "/api/auth/{provider}/callback",
      "tier": "public"
    },
    "sign_out": {
      "method": "POST",
      "path": "/api/auth/signout",
      "tier": "public"
    },
    "github_start": {
      "method": "GET",
      "path": "/api/github/start",
      "tier": "capability",
      "capability": "github:connect",
      "status": "unprovisioned"
    },
    "github_callback": {
      "method": "GET",
      "path": "/api/github/callback",
      "tier": "capability",
      "capability": "github:connect",
      "status": "unprovisioned"
    },
    "github_refresh": {
      "method": "POST",
      "path": "/api/github/refresh",
      "tier": "capability",
      "capability": "github:connect",
      "status": "unprovisioned"
    },
    "github_revoke": {
      "method": "POST",
      "path": "/api/github/revoke",
      "tier": "capability",
      "capability": "github:connect",
      "status": "unprovisioned"
    },
    "github_install": {
      "method": "GET",
      "path": "/api/github/install",
      "tier": "capability",
      "capability": "github:connect",
      "status": "unprovisioned"
    },
    "vault_key_read": {
      "method": "GET",
      "path": "/api/v1/vault/key",
      "tier": "capability",
      "capability": "vault:read",
      "status": "implemented"
    },
    "vault_key_write": {
      "method": "PUT",
      "path": "/api/v1/vault/key",
      "tier": "capability",
      "capability": "vault:write",
      "status": "implemented"
    },
    "vault_rows_read": {
      "method": "GET",
      "path": "/api/v1/vault/rows",
      "tier": "capability",
      "capability": "vault:read",
      "status": "implemented"
    },
    "vault_rows_write": {
      "method": "POST",
      "path": "/api/v1/vault/rows",
      "tier": "capability",
      "capability": "vault:write",
      "status": "implemented"
    },
    "vault_delete": {
      "method": "DELETE",
      "path": "/api/v1/vault",
      "tier": "capability",
      "capability": "vault:delete",
      "status": "implemented"
    },
    "compose_status": {
      "method": "GET",
      "path": "/api/v1/compose",
      "tier": "capability",
      "capability": "compose:run",
      "status": "implemented"
    },
    "compose": {
      "method": "POST",
      "path": "/api/v1/compose",
      "tier": "capability",
      "capability": "compose:run",
      "status": "implemented"
    },
    "agent_vault_key_read": {
      "method": "GET",
      "path": "/api/v1/partner/vault/key",
      "tier": "partner",
      "partner": "mcp",
      "capability": "vault:read",
      "status": "implemented"
    },
    "agent_vault_rows_read": {
      "method": "GET",
      "path": "/api/v1/partner/vault/rows",
      "tier": "partner",
      "partner": "mcp",
      "capability": "vault:read",
      "status": "implemented"
    },
    "agent_vault_rows_write": {
      "method": "POST",
      "path": "/api/v1/partner/vault/rows",
      "tier": "partner",
      "partner": "mcp",
      "capability": "vault:write",
      "status": "implemented"
    }
  }
}