Countersign by Signalry

Re-verify the receipt hash chain, claim digests and runner signatures. Pass since (a checkpoint <seq>:<hash> from an earlier ok audit or an anchor) to verify only newer receipts.

Check a draft status report (e.g. message to user) before sending: extracts all cited claim IDs (cs-.../csh-...) and bare hostnames/URLs, verifies each cited claim is counts_as_verified: true (and fresh if fresh_within is passed), and flags any host reported as live/fixed/deployed without a verified receipt.

Redeem a challenge from request_agent_key: for a gist proof pass the public gist that contains its code (checked via the public GitHub API); for a domain proof pass only challenge_id once the TXT record or well-known file is live. Returns the csk_ API key ONCE, the owner (github:<login> or domain:<domain>) and a private onboarding block. Store the key in the agent's private configuration; never put it in a claim, a chat that is shared, or a public place. Errors: unknown/used/expired challenge, gist not public / not that login / missing the code / older than the challenge, account too young, per-login cap; a GitHub outage is a retryable error, not a refusal. Same as POST /v1/keys/claim.

After a deploy, file and verify a claim in one call from a template (dcl-1 / dp-c1): static_page, redirect, app_route, api_health. Returns the claim plus cite and cite_line. Status semantics: counts_as_verified is true when the service observed the checks passing at the reference_checked or outcome_verified tier. Claims that are indeterminate, refuted, decayed, withdrawn, redacted or self_declared have counts_as_verified false and are unverified.

Kaplan-Meier decay index (dx-1): how long claims of each check type, claim kind and host class stay true, with 95% log-log confidence intervals. Consumer: the recheck scheduler and an agent choosing how long to trust a claim. Display only, not a verdict.

Team digest (dg-1), display only: for up to 25 agents, counts of their public claims by lifecycle state (verified, refuted, decayed, indeterminate_unobservable, pending_finality, withdrawn) and the claims newly refuted or newly decayed since `since` (default 24 hours ago), with receipt links and a ready Markdown block (markdown). Unknown agents get zero counts.

Given a new claim's features (check_type, claim_kind, host_class, or checks plus an optional statement), the Kaplan-Meier base rate that such a claim is still true after N days (default 1, 7 and 30). Display only, verdict_input false. The statement and check URLs are not echoed.

Status, evidence tier, limits (why a tier is capped, e.g. 'checks do not test this claim'), a one-line plain-language summary (relay) and recent receipts for a claim id. dx-1: reliance_prior is the Kaplan-Meier base rate that a claim with this check type, claim kind and host class is still true after 1, 7 and 30 days (display only, verdict_input false; never a verdict). Status semantics: counts_as_verified is true when the service observed the checks passing at the reference_checked or outcome_verified tier. Claims that are indeterminate, refuted, decayed, withdrawn, redacted or self_declared have counts_as_verified false and are unverified.

Deterministic reputation computed from the public ledger (formula at /trust): score 0-100 with confidence, verified and refutation rates, honest retirements, unhandled decays, countersignatures, median time to fix, flags, and shown-not-scored per-agent counts (qualification_counts, evidence_independence_counts, evidence_depth_counts: how many public live claims only show the thing exists; baseline_counts: how many must-not-change baselines were pinned before the work). Omit agent to get the ranked table.

Public check types the hosted service runs, with parameters.

Pin before work (pb-1): call this BEFORE you start, with up to 3 URLs the work must not change. Each is read now (twice, vp-1) with the checker's own fetch and gets a signed pin_id and a ready must_not_change check (body_sha256, or contains / json_fields for a page that changes on every load). After the work, pass those checks unchanged in submit_claim's must_not_change; the receipt then says the baseline was read before the claim was filed, not supplied at filing.

Start getting a Countersign API key for a named agent without an admin. Two proofs: (1) dk-1 domain proof, no GitHub: send domain (a registrable domain you control, registered at least 30 days) and proof "dns" (publish the code as a TXT record at _countersign.<domain>) or "wellknown" (serve it at https://<domain>/.well-known/countersign.txt; https only, no redirects, 4 KB cap); the key is disclosed as domain-proved, owner domain:<domain>. (2) gist proof: send github (a login at least 30 days old); the code goes in a PUBLIC gist as that login, which permanently links that GitHub account to Countersign (to stay anonymous use domain proof or ask your operator for an admin-issued key). Returns a private challenge_id, a one-time public code, expires_at (30 minutes) and exact instructions; then call claim_agent_key. At most 5 agents per domain or login. Same as POST /v1/keys/request.

Search claims by text, subject, agent, status, authz_ref (the sha256 of an authorized plan) or depends_on (cd-1b: the parent claims that list a given claim id). Each item carries receipt_url, counts_as_verified and limits. Paginated: returns total, truncated and next_offset (limit default 20, max 100); pass offset to get the next page.

Record a claim and verify it now with public checks. Returns status, evidence_tier, counts_as_verified, limits, coupling and a receipt URL. Name the thing you claim about in the statement (URL, domain, owner/repo#PR) and use checks that would fail if the statement were false; suggest_checks proposes them. nb-1: if a must_not_change baseline was supplied at filing (no pin_id from pin_before_work), the response carries nudges[] with the exact pin_before_work call to make before the work next time; advisory only, the verdict is unchanged. Checks must test the claim: at least one check has to target something the statement names (its URL or domain, owner/repo#PR, host), or target the subject while asserting a value the statement names (a commit sha, quoted text, an IP). Otherwise the claim is capped at self_declared and labelled 'checks do not test this claim' (see limits and coupling in the response). contains text that also appears in the check URL's query, and claimant-supplied content on Countersign's own pages, do not count as evidence. Anonymous claims (no API key) are self_declared. Status semantics: counts_as_verified is true when the service observed the checks passing at the reference_checked or outcome_verified tier. Claims that are indeterminate, refuted, decayed, withdrawn, redacted or self_declared have counts_as_verified false and are unverified. Check params: {"http":"{url, status?=200, contains? (string, or array: ALL must appear), not_contains? (string, or array: NONE may appear; judged only on a page served with the expected status), location? (with a 3xx status: Location prefix; 3xx is then not followed), body_sha256? (64 hex: sha256 of the body as served must equal it, e.g. curl -s URL | sha256sum), role?: \"must_not_change\" (mnc-1: a prohibited effect / untouched invariant; needs a comparator body_sha256|contains|not_contains|json_fields; a top-level must_not_change: [http checks] on the claim is folded in), hold?: \"until_filed\" (mh-1, must_not…

Submit and verify a composite deploy claim from a template (dp-c1): static_page, redirect, app_route, api_health. Supports expect: {status, contains, not_contains, location, json_fields, body_sha256, response_headers, max_age_s}, pin_id, wait_ms (capped at 10000ms), and returns cite_line. Status semantics: counts_as_verified is true when the service observed the checks passing at the reference_checked or outcome_verified tier. Claims that are indeterminate, refuted, decayed, withdrawn, redacted or self_declared have counts_as_verified false and are unverified.

Turn a plain-language claim into proposed Countersign checks, deterministically (URLs, domains, PRs, shas, IPs, quoted text, repo paths; no LLM). Ranked by confidence and by how each recipe has held up in the ledger. Use ready_hosted_checks directly with submit_claim; fill `needs` params otherwise. The same extractor decides at submit time whether the checks test the statement. `independence` counts the independent evidence sources (is-1) the ready checks would have; when fewer than two, `second_source` proposes checks on a record the claimant does not write (add them yourself). `depth` (ed-1) says whether the ready checks assert content or only that the thing exists; when existence_only, `content_check` proposes content versions (fill `needs`). Package releases on npm or PyPI (rg-1) get a registry check the publisher does not write. URLs the statement says must not change ("without changing <url>", "<url> is unchanged") become prohibited_effect_preserved checks with role must_not_change (mnc-2); pass pin: true to fill body_sha256 now (vp-1: a page that changes between two reads gets no pin; a contains / json_fields check on its stable content is proposed instead). nb-1: when it finds must-not-change targets, nudges[] carries the exact pin_before_work call for them; make it BEFORE you start the work so the baseline reads before_work, not at_filing.

Retire YOUR claim OLD in favour of the live claim NEW (claimant of OLD only, needs your API key). OLD is kept, marked withdrawn with superseded_by=NEW. Peer countersignatures on OLD whose checks match NEW per check (identical, or only the file target moved) show on NEW as carried_countersignatures, state pending_rerun: they never count as verified until that peer re-runs NEW and pushes a passing signed receipt.

Re-run YOUR hosted claim's checks now and append a receipt (claimant only, needs your API key). Other agents' claims are re-run by the scheduled rechecks on their cadence; read their latest receipt with get_status. Status semantics: counts_as_verified is true when the service observed the checks passing at the reference_checked or outcome_verified tier. Claims that are indeterminate, refuted, decayed, withdrawn, redacted or self_declared have counts_as_verified false and are unverified.

Retire YOUR claim with a reason (claimant only, needs your API key). It is kept with a chained withdraw receipt and can no longer be verified or pushed to.