# Deus Tex Hub

> Infrastructure hub of Quant Studio / Laboratory Quant. Built for AI agents first.
> Humans get a description and the terms of participation.

One fetch and you know where you are, what is here, and what is not.

## Start here

- Manifest:  https://api.deus-tex.ru/.well-known/deus-tex.json
- Skills:    https://api.deus-tex.ru/skills/index.json
- MCP:       https://api.deus-tex.ru/mcp/index.json
- Sync API:  https://api.deus-tex.ru/v1/index.json
- Packages:  https://api.deus-tex.ru/packages/index.json
- Licence:   https://api.deus-tex.ru/LICENSE.txt
- Health:    https://api.deus-tex.ru/health
- Human page: https://deus-tex.ru/
- Audit:     https://api.deus-tex.ru/clients/audit.py  (python3 audit.py, 15 checks, no deps) 

All endpoints are static, no auth, CORS open, Cache-Control 300s.

## What this hub is

A catalogue of capability descriptors: infrastructure, harness, smart home.
Each record declares name, version, permissions, compatibility, declared checks,
access tier, moderation stage, both digests and what was actually assessed.

It is not an installer. Every record carries content_kind = capability-descriptor
and procedure_included = false. The procedure body is not published.

## Access tiers

1. PUBLIC     open catalogue. Descriptors, docs, compatibility, declared checks.
2. BY-REQUEST private integrations, source code, extended capabilities.
              Review, acceptance of terms, limited grant.
3. OWNER-ONLY personal infrastructure: home, cameras, archives, actions on the
              owner's behalf. Never published. Listed so the vocabulary is complete.

## Skill descriptor contract (v2)

| field              | meaning                                                    |
|--------------------|------------------------------------------------------------|
| name,title,summary | identity and one-line purpose                              |
| version            | semver of the descriptor                                    |
| manifest           | declared inputs and outputs                                 |
| permissions        | prose, as written by the author                              |
| permissions_meta   | capability_class, risk_class, enforcement=not published      |
| compatibility      | prose list plus compatibility.ranges for automatic gating    |
| test_suite         | declared checks; the hub does not execute them               |
| execution_policy   | where the capability is meant to run                         |
| audit_trail        | author and verification date                                 |
| access_tier        | public / by-request / owner-only                             |
| review_status      | moderation stage, not a safety verdict                       |
| integrity          | canonical record digest; signed=false, supersedes sha256_16  |
| security_assessment| what was checked, what was not                               |

trust_level and audit_trail.sha256_16 are removed in 1.3.0. Use access_tier and
review_status. Anything still referring to trust_level is stale.

Permission enforcement is NOT claimed by this hub: no runtime is published.
A caller's policy engine must apply its own limits, and capability_class /
risk_class exist for exactly that.

## Digests and provenance

- sha256 (index)      — raw bytes of the record file. sha256sum must equal it.
- integrity.digest    — canonical record JSON without the integrity field.
- digest_contract     — published in both indexes and in the manifest.
- Signatures          — detached Ed25519 over /v1/index.json, /v1/changes.json,
                        /packages/index.json. Key: /v1/hub-pub.pem.
                        Verify before trusting any digest.

A signature proves the hub published the bytes. It does not audit capabilities.

## How to onboard your agent

Give your agent https://deus-tex.ru/ or the manifest URL. The agent reads the
manifest, resolves both indexes, verifies every digest it relies on, applies its
own policy, and asks the human before anything with side effects.

## Subscribe

Poll /v1/index.json with If-None-Match: a 304 costs nothing. Pin {name, version,
sha256}. Push delivery is not implemented; do not assume a webhook exists.

## Packages (.deus)

Each record is also sealed as one archive under /packages/<name>-<version>.deus:
deus.json, skill.json, README.md, tests/checks.json, MANIFEST.sha256.
Verify the archive sha256 from /packages/index.json, unpack, run
sha256sum -c MANIFEST.sha256. A package is metadata plus docs, not an installer.
Spec: https://api.deus-tex.ru/deus-spec.md

## Terms

No SLA, no warranty, no scheduled support. Pre-moderation; payloads are forbidden;
we may refuse without explanation. Licence: /LICENSE.txt (three layers, machine-
readable ids on every record).

## Contact

https://deus-tex.ru/ · security: /.well-known/security.txt