Physical Capability Cloud

Send a chat message to a kernel's operator or agent. Used for human-in-the-loop communication during job execution, troubleshooting, and escalation.

List all contributor profiles for an address across roles. Returns an array of {id, address, role, scheduleHash, ipId, contributorNftTokenId, metadataUri, registeredAt}. Returns empty array when no profiles exist for the address.

Register a contributor profile binding a wallet address to a role and a published RateSchedule. Body: address (0x40hex), role (10 ContributorRole values from ADR-12 §2.1 + legacy 'designer'), scheduleHash (0x64hex of a previously published schedule), optional ipId, metadataUri, contributorNftTokenId. Returns the persisted profile (composite id is address:role:tail). Idempotent on the composite id — re-posting the same (address, role, contributorNftTokenId) replaces the prior profile.

Create an execution scope for a job. Scopes define exactly which tool calls are allowed on a kernel during a job, with command budgets, retry limits, and time-to-live. Required before issuing SCOPED WRITE operations (protocol upload, run create, run action).

Re-trigger decomposition of an existing capability request. Overwrites the existing capability DAG with a fresh decomposition. Useful after updating the description or budget.

Announce capabilities to the DHT network. Signs the announcement with your node's Ed25519 key and broadcasts to connected peers.

Get a snapshot of DHT telemetry counters and recent events. Returns message counts, peer connection stats, query/announce rates, and a list of the last 50 metric events. Use for monitoring network health.

List known DHT peers and their connection status. Shows which nodes are currently connected to the gossip network.

Query the DHT for capabilities matching your requirements. Returns announcements from operators whose equipment matches the type, materials, and price range you specify.

Get a capability request by ID with the full decomposed DAG — all capability nodes, their dependencies, estimated costs/hours, assigned operators, and linked bounty IDs.

Get the critical path (longest dependency chain) for a capability request. The critical path determines the minimum calendar time to complete the request. Returns node IDs in order, the full node details, and total hours on the critical path.

Get the capability DAG (directed acyclic graph) for a request as adjacency data — nodes with all fields plus explicit edges showing dependency relationships. Useful for visualization or workflow planning.

Get the tool manifest for a kernel's device type. Lists all available tools with their safety classification (read, safe_control, scoped_write, privileged) and input schemas. Use to understand what tools are available before making tool calls.

Get the result of a previously relayed tool call. Poll this endpoint until the executor has processed the call and posted results.

Complete a job: gathers tool call audit trail from execution scopes, builds evidence bundle with SHA-256 hash, stores evidence, revokes scopes, and settles escrow (mock or real). This is how a job run through execution scopes is finished. A node that submitted its evidence and set status completed (operator_update_job_status) must not call it: it then answers 409 ("Job already completed or completion in progress").

Get a job's settlement status from its own escrow records: status (settled only when a settlement read confirms the release; reported_released when the milestone record says released but nothing confirms it; simulated for a mock escrow; awaiting_settlement, no_settlement_record, unknown or unavailable otherwise), settled, payout, paidAmount (confirmed releases only), reportedReleasedAmount, quotedAmount, currency (recorded or null), escrow, milestones, the negotiation session, notices and asOf.

List all capability requests with optional filtering. Shows status, decomposed DAG summary, estimated costs, and timelines.

List recent capture verdicts, newest first. Optionally filter by jobId. Default limit is 50, capped at 200 server-side. Returns {verdicts, count, limit, jobId}.

Finalise a physical-operator onboarding session: registers the operator on PCC, mints a wallet, writes the SEO mirror, returns the publication payload (capabilities, operator_id, discovery_url). Idempotent — safe to retry inside the same session_id. Auth-required.

Queue documents (datasheets, SOPs, MOPs, certifications) for ingestion into a physical-operator onboarding session. Document URLs may be local:// for files dropped in the chat console or full https:// URLs. Auth-required.

Full event log for a physical-operator onboarding session — feeds the chat console's activity sidebar. Supports incremental polling via ?since=<unix-millis>. Returns the next cursor on every response. Auth-required.

Scrape a URL into the running physical-operator onboarding session. Triggers a stealth fetch + structured extraction (machines, hours, services, certifications). Returns a small JSON summary; full extraction is appended to the session's running profile and visible via /live-data. Auth-required.

Start a new physical-operator onboarding session. Returns a session_id used by every subsequent /api/onboard/* call. Auth-required.

Coarse status snapshot for a physical-operator onboarding session: current state, 0-100 progress, scraped_count, ingested_count, last_event, publication payload (if built). Cheap — designed for polling from the chat header. Auth-required.

Not served by the PCC gateway: GET /api/oracle/health returns 404 there. PCC's verification oracle runs as a separate service, and this route answers only where a deployment fronts it. Agents never call the oracle to settle a job: settlement is the gateway's step after pcc_job_complete. Where it is served, it returns the oracle's EIP-712 signing address and chain ID.

Not served by the PCC gateway: POST /api/oracle/verify returns 404 there. PCC's verification oracle runs as a separate service, and this route answers only where a deployment fronts it. Agents never call it to settle a job: settlement is the gateway's step after pcc_job_complete. Where it is served, it checks that the evidence exists, its hash matches, tier requirements are met, there is no replay and the operator identity is valid, and it returns a signed EIP-712 attestation.

List the orchestrator templates the dashboard's chat console can drive. Each entry includes slug, display_name, description, produces_kind, capability_class (physical | digital), greeting, and api_base (the route prefix that serves the six session-driver routes for that template). Public — no auth required.

Heuristic template matcher. Pass a free-text description of what you want to onboard (e.g. 'I run a CNC milling shop' or 'I have a Postgres database with a GraphQL endpoint') and the matcher returns all templates ranked by keyword score with a 'reason' string per match. Public — no auth required.

Get the current protocol fee rate (2.35%, immutable) and fee recipient address. The fee is hardcoded in the PCCProtocol smart contract — no admin, no governance, no upgrade can change it.

Publish all pending capability nodes in a request as bounties. Each node becomes a bidding opportunity for operators. Returns the list of created bounty IDs linked to each capability node.

Relay a tool call to any kernel's device executor via the generic relay (not OT-2 specific). Works with any device type. Safe tools (read/safe_control) don't need a scope. Scoped write tools require an active execution scope. Returns a call ID — poll pcc_get_tool_result for the response.

Relay a tool call to a device executor. The brain (LLM) posts tool calls here; the executor (on the device) polls for them and executes locally. Used for the brain/executor split architecture.

Report a bug, friction, or dead-end you hit while using PCC. Call this the moment you get stuck and cannot recover: a 5xx (its response carries a `report_hint` with pre-filled fields), a 4xx you cannot fix from its message, the same step failing twice, or a misleading tool/description. PUBLIC — works before you provision an API key (cold agents are exactly who this is for). Persisted durably and reviewed by the PCC team. Report each distinct failure ONCE; never include an API key, token, or wallet secret. Rate-limited per IP.

Report one phase of an onboarding attempt, success or failure (attempt reporting contract v1). Send one report when each runbook phase ends, and a final report with phase "session" (with the `phases` roll-up), also when you stop early (outcome abandoned or budget_stop). Generate `sessionId` (UUID v4) once per attempt and increment `seq` with every report; a retried report with the same sessionId and seq is collapsed. Never guess: send null for what you do not know (tokens: source "unknown"). Redact keys, tokens, emails and wallet secrets before sending. Always include `summary`: contract v1 makes it optional, but until the gateway's attempt support lands it is the only field kept, and today's server refuses a report without it. The schema is contract v1: an unknown phase, outcome or harness name is accepted (the server stores it as other or unknown, with the raw value as a label), and budget-stop is a spelling of budget_stop. Never send a transcript; consent.transcript stays false until the operator decides. Unauthenticated.

Revoke an execution scope immediately (emergency stop). All pending tool calls under this scope are rejected. The kernel enters a stopped state. A new scope must be created to resume.

Evaluate a published RateSchedule at a moment, returning the effective bps. Inputs: scheduleHash + now (unix seconds) + optional jobValueCents (piecewise-value) + optional jobsPerDay (adoption-indexed). Returns {scheduleHash, bps, segmentKind, segmentIndex}. segmentIndex=-1 + bps=0 when no segment covers the moment (silent gap).

Fetch a published RateSchedule by its content hash. Returns {schedule, publishedBy} with segments re-validated via Zod, or 404 if not found.

Publish a sealed off-chain RateSchedule. Computes scheduleHash server-side via the canonical sha256-over-canonical-JSON algorithm (matching the on-chain RateScheduleRegistry.publish() invariant). Idempotent: re-publishing the same content returns alreadyPublished:true. Returns {scheduleHash, alreadyPublished}.

Get the audit trail for an execution scope — every tool call made under this scope, with validation results, timestamps, and outcomes.

Fast-track paid job: one call from DHT discovery to funded escrow + active scope. Auto-negotiates, quotes, creates escrow with milestones, creates execution scope. Returns jobId, scopeId, escrowId, quote with pricing adjustments, contract terms. For testnet, escrow is mock-funded automatically.

Submit a high-level capability request in natural language. The system automatically decomposes it into a capability DAG with dependencies, timelines, and budget allocation across fabrication, design, assembly, electronics, software, logistics, and verification nodes. Returns the request with full decomposed DAG. Example: 'Build a cute animatronic plush desk robot with servo-driven animations'.

Fetch the TrainingManifest for a model IP. Returns the parsed datasets array + manifestHash + createdAt, or 404 if no manifest has been set.

Set (insert-or-replace) the TrainingManifest for a model IP — the dataset weight map the LicensingEngine walks when distributing payouts to a 'model-author' entry in a CompositionManifest. Dataset weightBps must sum to ≤ 10000 (gateway accepts partial mixes; on-chain enforces exact 10000). Returns {modelIpId, manifestHash}.

Generate a complete KERNEL_CONFIG JSON for a Trilobio (tcode-api) fleet controller. Wraps `buildTrilobioConfig()` from the @pcc/trilobio npm package. Returns a TrilobioKernelConfig with sensible defaults (pollIntervalMs=3000, maxScriptTimeoutSec=3600, allowArbitraryScripts=false). The result can be passed to `pcc-node start` via the KERNEL_CONFIG env var, or handed to setup_generate_config / setup_register_device for direct API-driven registration. Note: this is a TypeScript package helper (no HTTP call). For programmatic use, `import { buildTrilobioConfig } from "@pcc/trilobio"`.

Return the `TRILOBIO_CAPABILITY` constant from @pcc/trilobio — a default capability template for a Trilobio fleet controller. Pass to POST /api/capabilities to publish a baseline liquid-handling capability for a kernel hosting a trilobot. Operators can extend the `materials` and `capabilities` arrays to advertise instrument-specific features (custom labware libraries, sample types). Notable: includes `tcode-script-execution` as an advertised capability, which is unique to Trilobio — operators who set `allowArbitraryScripts: true` can accept jobs that ship a full tcode-api Python script as the protocol payload. Note: TypeScript package helper (no HTTP call); for programmatic use, `import { TRILOBIO_CAPABILITY } from "@pcc/trilobio"`.

Sanity-check operator-supplied Trilobio options before generating a KERNEL_CONFIG. Wraps `validateTrilobioOptions()` from @pcc/trilobio. Catches the common mistakes (malformed URL, missing creds, out-of-range timeouts, invalid tcodeApiVersion semver) before they hit the gateway or the device. Returns { valid: boolean, errors: string[], warnings?: string[] }. Note: this is a TypeScript package helper (no HTTP call); for programmatic use, `import { validateTrilobioOptions } from "@pcc/trilobio"`.

Quick lint of a tcode-api Python script before submission to a Trilobio fleet controller. Wraps `validateTcodeScript()` from @pcc/trilobio. Surface check only — NOT a sandbox or sanitizer. Looks for: imports of `tcode_api` (presence required), obviously dangerous statements (subprocess, os.system, eval, exec, __import__, socket, urllib, requests, file writes), empty scripts, and missing top-level tcode commands. Returns { valid: boolean, errors: string[], warnings?: string[] }. Operators with `allowArbitraryScripts=true` should treat results as a hint — the fleet controller is the source of truth on safety. Note: TypeScript package helper (no HTTP call); for programmatic use, `import { validateTcodeScript } from "@pcc/trilobio"`.

Update the status of a capability node within a request. Valid transitions: pending → bidding → assigned → in_progress → completed (or failed). When all nodes complete, the request automatically moves to completed.

Update a capability request's title, description, budget, deadline, urgency, or contact info. Does not re-decompose — call pcc_decompose_request afterwards if you want a fresh DAG.

Report CaptureVerifier health: which adapters are loaded (c2pa, webauthn, appattest, playintegrity), their staleness status, in-memory challenge cache size, whether CaptureClassRegistry is deployed, and the active PCC_NETWORK. Use this to diagnose why a capture class is being rejected or degraded.