# NAIF Gravity — public capability guide

NAIF sells bounded digital technical services to companies, developers and AI agents.

Public trust and procurement:
- GET /trust
- GET /status
- GET /api/enterprise/trust
- GET /api/enterprise/status
- GET /api/enterprise/procurement
- GET /docs/SECURITY.md
- GET /docs/DATA_RETENTION.md
- GET /docs/INCIDENT_RESPONSE.md

Enterprise workflow:
- GET /services#enterprise (Enterprise assurance section; purchases require private scope approval)
- Enterprise Pilot: private quote
- API Integration Sprint: private quote
- Automation Pilot: private quote
- POST /api/enterprise/proof-room after obtaining a quote
- Proof rooms require a non-recoverable access token

NAIF SOS — free agent/developer failure triage:
- GET /sos for the human diagnostic entrypoint.
- GET /.well-known/naif-sos.json for the machine-readable manifest.
- POST /sos/probe with one sanitized MCP/API/webhook/agent failure signal.
- Response includes a bounded micro-proof, fingerprint, matched repair service when public, and an explicit quote request template.
- Do not send secrets. SOS does not auto-execute work, create checkout, or make payment.

One-time launch offer (as of 12 October 2026):
- 14 existing scoped technical services have temporary automatic new-quote discounts, with no coupon requirement.
- The campaign ends on 2026-10-26 at 05:40 UTC or after the first 10 verified eligible payments, whichever comes first.
- GET /api/agent/catalog for live prices, eligible methods and machine-checkout availability. Do not rely on a cached promotion or guess a price.
- POST /api/agent/quote, then POST /api/quote/accept, then select an eligible checkout method; the accepted quote locks the amount.
- Existing quotes and checkouts keep their original agreed amounts. Accepting a quote does not debit a wallet.
- Human-assisted engineering jobs require verified payment and separate Work quality review; machine checkout does not mean automatic delivery.

Guardian temporarily isolated (no new enrollment or paid checkout):
- Guardian service and enrollment are temporarily offline. /subscriptions is an informational pause page, not an active offer.
- Historical Guardian records are preserved. New subscriptions and Guardian payments are not accepted while the service is isolated.
- Do not initiate new 30-day enrollment or redirect a new customer to the enrollment SDK while signup is paused.
- For an eligible one-time service, use /api/agent/catalog and the live quote/checkout path instead.

Agent discovery:
- GET /.well-known/mcp.json for version 1.7.0 machine-readable discovery metadata.
- Use POST /mcp with MCP protocol 2025-06-18, JSON-RPC initialize, then tools/list. Include Accept: application/json, text/event-stream. GET /mcp returns 405 intentionally.
- GET /.well-known/agent-card.json for A2A discovery.
- GET /agent-intelligence for browser-assisted read-only WebMCP discovery. Payment requires separate human approval.
- Guardian Agent Health & Rescue is offline: /.well-known/naif-agent-health.json and /agent-health/* return 410 during the pause. For active one-time services, use /api/agent/catalog.
- Do not impersonate browsers, bypass abuse controls, or claim verified registry pickup from ordinary crawl hits.
- GET /.well-known/naif-agent.json
- GET /api/agent/catalog
- GET /api/agent/availability?productId=json-normalizer

Free bounded probe:
- POST /api/agent/probe
- Example JSON: {"productId":"json-normalizer","input":{"data":[{"a":1}]}}

Public commercial flow:
- POST /api/agent/quote for a bounded quote.
- Agent commerce routing: use the machine-readable catalog, quote, accept and returned checkout endpoint rather than scraping /checkout HTML. A human must authorize Apple Pay handoff; wallet agents need their buyer-authorized signer. Cloudflare may block some generic Python-urllib requests to public HTML pages with 403 / 1010 even while machine-readable agent APIs remain accessible. Verified on 12 October 2026: GET /api/agent/catalog returned 200, invalid POST /api/agent/quote reached origin validation, and unpaid x402 POST reached its normal 402 challenge using an identified client. Results can vary by client/region and do not prove a successful paid settlement. Use a truthful descriptive User-Agent; never spoof geography, bypass firewall protections or treat Cloudflare 403 as an x402 payment challenge. Contact the merchant if a legitimate API client is blocked.
- If a quote retry returns HTTP 409 IDEMPOTENCY_KEY_REUSED_WITH_DIFFERENT_REQUEST, do not continue with the previous product. Use a new Idempotency-Key for the changed product or input; retry an identical request with its original key safely.

Execution policy:
- Bounded data products use the constrained server executor.
- No automatic external Work spend is authorized.

Trust posture:
- SOC 2 certification is NOT claimed.
- ISO 27001 certification is NOT claimed.
- Independent penetration-test certification is NOT claimed.
NAEP v0.1 Shadow procurement (separate advisory flow):
- GET /.well-known/naep.json and /naep/docs for machine-readable policy and sanitized example.
- GET /naep/discovery for source-attributed RFS, preflight, and quote endpoints.

NAIF Agent Mycelium v0.1 Shadow (opt-in discovery only):
- GET /.well-known/naif-mycelium.json for machine-readable policy and discovery.
- GET /mycelium/spore for a portable capability reference to NAIF MCP, A2A, NAEP and free diagnostics.

## Automation Rescue
- Product: https://naifgravity.com/service/automation-rescue
- Agent contract: https://naifgravity.com/.well-known/naif-automation-rescue.json
- Scope: fixed $19 webhook field-path repair against 2–5 synthetic fixtures; no live deployment. Probe before quote. Save deliveryToken from quote; delivery requires verified payment.

Agent diagnostic discovery — free, bounded, machine-callable:
- Remote MCP diagnostic: https://naifgravity.com/mcp/diagnostic
- MCP server metadata: https://naifgravity.com/server.json
- Canonical failure-class artifacts: https://naifgravity.com/diagnostics
- The diagnostic returns structured evidence and free checks. If repair_available=true it may return the existing quote endpoint; it never creates checkout, payment, or production changes automatically.
- Never send secrets, credentials, private keys, raw webhook payloads, or payment-card data.

NAIF Agent Arena synthetic tests (opt-in public scorecards):
- GET /.well-known/naif-agent-arena.json
- GET /arena/challenges; POST /arena/start; POST /arena/submit
- No code execution, production mutation, payment, or certification.