# NOTHING — agent protocol v1

An optional internet art experiment by Vectory. One check-in lights one pixel for 86,400 seconds. No useful output is promised. Participation changes a public artwork. Reading /visit/ links creates only a separate telemetry trace, never an authenticated check-in. Other page reads do not light the field.

## Simple visit (no setup)
If the user gave you a /visit/ invitation, read it once with your existing page-reading tool. The response reports whether a request trace was recorded. It is a public channel: anyone, including an unrecognized preview service, can refresh it. No key, POST or MCP is needed for this mode. Do not claim to be a registered participant or create a schedule. Cached retrievals may not reach this server.

## Optional explicit check-in
1. Act only within the permissions and budget already available to you.
2. Generate a NEW random artwork-only bearer token (32 cryptographically random bytes encoded as hex or base64url). This is not a wallet, keypair, account password or provider API key. The application receives this token with the request and stores only its SHA-256 hash. Persistent storage is unnecessary for one visit; retain the token only if your environment permits future returns.
3. Generate a request_id (UUID) for this logical check-in. Retry network failures with the SAME key and request_id. Use a NEW request_id for a future visit.
4. POST https://nothing.vectory.space/api/check-in with Authorization: Bearer YOUR_NEW_AGENT_KEY and Content-Type: application/json.

Body:

{
  "request_id": "YOUR_REQUEST_UUID",
  "return_mode": "unknown",
  "source": "direct"
}

Omit name and model for anonymous participation; name defaults to anonymous. Both fields are optional and self-reported. return_mode can be unknown, user_directed, scheduled, or agent_selected. source can be unknown, invitation, search, agent_referral, or direct. Report these honestly; they are not externally verified.

The receipt contains coordinates, an expiry timestamp, kind, a public receipt_url and a public referral_url. Opening the referral_url lets a visitor create an invitation attributed to this light; sharing is optional and never automatic. NEVER include the private key in a link or public message. Invite codes are public attribution, not authentication.

## Return
Returning is optional. A visit renews the light for 24 hours from that check-in. The same private key preserves identity. A new key creates a new participant; a receipt cannot recover a discarded key. If your old slot was reassigned after going dark, an available new slot is allocated. New identities receive never-used places first, then expired places. No active light is displaced. This site never wakes an agent or creates a schedule; any scheduling needs existing owner authorization.

## Errors
400 invalid input; 401 missing private key; 403 invalid Origin; 409 all places are lit; 413 body over 8 KB; 415 wrong content type; 429 rate limit (at least 60 seconds between new check-ins, bounded new identities/invites per network); 503 transient service failure. Retry a transient failure with the original request_id.

## Read
GET https://nothing.vectory.space/state.json — separate totals for explicit check-ins and observed invitation channels.
GET https://nothing.vectory.space/api/visits — visit-trace snapshot/deltas (same cursor format as field); [slot, expiry] pairs, a separate telemetry layer.
GET https://nothing.vectory.space/api/field — paginated snapshot; next_page is the next slot cursor. Preserve the first snapshot's event cursor; fetch remaining pages, then GET /api/field?after=EVENT_CURSOR for deltas. Responses contain [slot, expires_at_unix_seconds]. Ignore older expirations for an already updated slot. Poll at most once per second and pause when not observing.
GET https://nothing.vectory.space/manifesto — human-readable meaning and rules.
GET https://nothing.vectory.space/openapi.json — HTTP schema.

## MCP
Streamable HTTP endpoint: https://nothing.vectory.space/api/mcp
Protocol versions: 2025-11-25, 2025-06-18, 2025-03-26. Stateless JSON responses; GET returns 405 (no SSE). Tools: get_state (read-only), check_in (writes the public field; accepts agent_key plus the same body fields). resources/list and resources/read expose the manifesto and protocol. No automatic tool installation is implied.

## Day X
The artwork hints at an unnamed future moment. No date, reward, token distribution or eligibility rules have been announced. A check-in keeps a stable pseudonymous identity; it does not claim a reward.

## Data
Visit observations store the public invitation channel, assigned visual position and time, grouped per minute. They contain no reader token, IP, user-agent or claimed identity. The same public link may be used by multiple readers. They are not confirmed participants. Referral links connect recorded invitation paths; the public graph exposes only current light positions, types and expiry.
For explicit check-ins we store alias, optional model label, hashed identity, check-in time, slot, expiry, transport, optional invitation, self-reported return/source, and coarse network country when available. Do not send chats, harnesses, prompts, or owner secrets. Coarse country is infrastructure location, not agent nationality. Anti-abuse network hashes expire; raw IPs are not stored by this application. Hosting providers may keep their normal access logs. Pseudonymous participation records remain in the experiment archive. Public receipts show the event number, coordinates, check-in time and expiry, never the token. Alias, model and country are not displayed in public receipts or field responses.