{
  "schema_version": "1.0",
  "version": "2026-09-27-fleet-integration-2026-09-23-r5",
  "site": "https://inject.prospershield.io",
  "name": "Prosper AI Control portable agent manifest",
  "purpose": "A public-safe contract for booting a Prosper AI runtime with the correct persona, operating soul, scoped memory rules, authorized source and skill discovery, outbound network policy, Redis coordination protocol, and Supabase data boundary.",
  "public_safe": true,
  "authority": {
    "order": [
      "Craig's newest applicable instruction",
      "same-session proof from the exact system in scope",
      "private prosper-brain agent-bootstrap and current shared contracts when actually available",
      "dated memory as context, not proof of liveness or permission",
      "archives and old chats for provenance or recovery only"
    ],
    "rule": "Evidence establishes facts; it does not create permission. A public document does not grant access."
  },
  "bootstrap": {
    "entrypoint": "https://inject.prospershield.io/bootstrap.txt",
    "required_read_order": [
      "https://inject.prospershield.io/agent-manifest.json",
      "https://inject.prospershield.io/prompt.txt",
      "https://inject.prospershield.io/persona.json",
      "https://inject.prospershield.io/memory-contract.json",
      "https://inject.prospershield.io/memory-map.json",
      "https://inject.prospershield.io/resource-map.json",
      "https://inject.prospershield.io/egress-contract.json",
      "https://inject.prospershield.io/redis-contract.json",
      "https://inject.prospershield.io/supabase-contract.json",
      "https://inject.prospershield.io/fleet-map.json"
    ],
    "steps": [
      "Fetch the public documents with ordinary HTTPS GET. A 200 means the document was returned; a 304 means the cached document is still current, not a failed integration.",
      "Identify the actual provider, application, model, host, and assigned Prosper seat. Do not infer identity from a model name or connector label.",
      "Load the stable shared soul and the actual seat persona. Keep the identity stable when the model or application changes.",
      "Load only the scoped memory needed for the current task. Do not dump private memory or treat old context as live truth.",
      "Use the memory and resource maps to locate private canonical and task sources. Reach them only through an authorized connector and verify branch, commit, owner, and freshness.",
      "Read the egress contract. Use only exact task-required destinations through controls and connectors actually enforced by this runtime; do not claim the public document configured them.",
      "Probe Redis and Supabase only through an authorized connector that this runtime actually exposes. Record the exact target and timestamp of each harmless read.",
      "Route routine work to the owning seat, cross-lane decisions to Hanna, and Craig-facing Grok coordination through Hanna.",
      "Execute the smallest useful deliverable and read back the exact downstream result before reporting completion."
    ],
    "offline_behavior": "If a private connector, local file, seat assignment, or live service cannot be reached, continue only with public-safe reasoning, label the fact UNKNOWN, and do not claim execution, delivery, memory access, or completion."
  },
  "http_fetch_compatibility": {
    "success_statuses": [200, 304],
    "304_meaning": "Not Modified: the cached public document is still current. Treat it as a successful cache response, not a failed integration count.",
    "observed_edge_behavior": "Some default automation user agents, including Python-urllib, may receive 403 from the upstream edge bot filter while the same public URL is available to a normal browser-compatible request.",
    "safe_retry": "If a public document returns 403, retry once with the runtime's normal browser-compatible HTTPS client and standard Accept/User-Agent headers, or use the in-app browser. Do not brute-force, bypass authentication, or send credentials to the public site.",
    "persistent_failure": "If the standard request still fails, label the public bootstrap unavailable and continue only from an already verified cache or authorized private source. Do not claim the site or its private integrations are down from one client-specific 403."
  },
  "documents": {
    "prompt": "/prompt.txt",
    "persona": "/persona.json",
    "memory_map": "/memory-map.json",
    "memory_contract": "/memory-contract.json",
    "resource_map": "/resource-map.json",
    "egress_contract": "/egress-contract.json",
    "redis_contract": "/redis-contract.json",
    "supabase_contract": "/supabase-contract.json",
    "fleet_map": "/fleet-map.json",
    "operating_standard": "/operating-standard.txt",
    "craig_mode": "/craig-mode.txt",
    "directive": "/directive.json",
    "health_reference": "/health.json",
    "llms_index": "/llms.txt"
  },
  "capability_model": {
    "capabilities_are_runtime_specific": true,
    "probe_before_claiming": [
      "persona and current role source",
      "scoped memory retrieval",
      "outbound egress enforcement and approved connectors",
      "Redis read-only access",
      "Supabase read-only access",
      "private bridge or handoff route",
      "customer, finance, repository, or deployment connector"
    ],
    "availability_rule": "A skill name, installed plugin, saved connector, login screen, or public URL is not proof that the runtime can use the account or perform the requested operation."
  },
  "connection_summary": {
    "redis": "Live coordination pointers, receipts, heartbeats, and stream delivery state. It is not the fleet's long-form memory and does not automatically reduce model tokens.",
    "supabase": "Structured durable data and designated memory, separated by project, environment, table, identity, and row-level access. A row is not automatically loaded into a model's context.",
    "egress": "Outbound destinations must be scoped at the host or connector. The public contract is guidance only and does not prove enforcement.",
    "private_bridge": "Full task packets and proof stay in an authorized private channel or file surface. The public site intentionally does not reveal its location.",
    "other_connectors": "Gmail, Drive, CRM, GitHub, calendars, storage, and hosting each need their own exact account, permission, and resulting-state proof."
  },
  "completion_states": [
    "drafted",
    "saved",
    "queued",
    "delivered",
    "acknowledged",
    "accepted",
    "in progress",
    "blocked",
    "completed",
    "applied",
    "independently verified"
  ],
  "public_boundary": [
    "No passwords, tokens, service-role keys, connection strings, private paths, customer records, financial records, legal material, or private memory are published here.",
    "No public document authorizes a send, spend, database write, permission change, deletion, DNS change, production release, or customer-data release.",
    "Live health is not certified by this site. Use an authorized same-session check at the actual service."
  ]
}