Genesis Mesh Network Authority
Every Network Authority surface in one compact map: open a safe GET, sign an operator command, or run a managed CLI operation.
NetworkUSG
Versionv0.1
HealthReady
HTTP Surfaces52
CLI Workflows55
Browser-safe24
Surface map
Read-only console
Signed actions documented only
Safe Browser Links
Representative safe GET surfaces. View all API routes.
| Method | Path / command | Surface | Purpose | Access | Rate limit |
|---|---|---|---|---|---|
| GET | /healthz | Liveness | Process-level health probe. | None | — |
| GET | /readyz | Readiness | Database and migration readiness. | None | — |
| GET | /sovereign.json | Sovereign metadata | Operator-safe public trust material. | None | — |
| GET | /dashboard | Sovereign dashboard | Read-only sovereign health and trust view. | None | — |
| GET | /connectome | Connectome | Human-readable recognition and revocation view. | None | — |
| GET | /atlas | Trust Atlas | Read-only recognition graph explorer with evidence overlay. | None | — |
| GET | /agents | Agent discovery |
Discover agent descriptors by capability. Without a capability filter, returns a count only.
Pass capability= to receive descriptors; the unfiltered form does not enumerate the registry. |
None | — |
| GET | /api-reference | API reference | Read-only HTTP API reference. | None | — |
| GET | /cli-reference | CLI reference | Generated CLI command reference. | None | — |
Node and Agent Runtime
Signed node proof-of-possession surfaces.
| Method | Path / command | Surface | Purpose | Access | Rate limit |
|---|---|---|---|---|---|
| POST | /join |
Join | Issue a certificate from a single-use invite. | Node PoP | — |
| POST | /agents |
Register agent | Publish an authenticated agent descriptor. | Node PoP | — |
Operator Commands
Signed HTTP clients or CLI commands, not browser actions.
| Method | Path / command | Surface | Purpose | Access | Rate limit |
|---|---|---|---|---|---|
| POST | /admin/invite |
Invite | Create a scoped enrollment token. | Operator signature | — |
| POST | /admin/revoke |
Revoke | Publish a new signed CRL. | Operator signature (privileged tier) | — |
| POST | /admin/attestations |
Issue attestation | Issue portable membership evidence. | Operator signature (privileged tier) | — |
| POST | /admin/recognition-treaties |
Issue treaty | Create a direct-recognition treaty for another sovereign. | Operator signature (privileged tier) | — |
| POST | /admin/sovereign-revocation-feeds/import |
Import revocation feed | Import revoked trust material from a recognized sovereign. | Operator signature (privileged tier) | — |
| CLI | genesis-mesh federation bootstrap |
Federation bootstrap | Review a sovereign and issue a direct-recognition treaty. | Operator signature | — |
| CLI | genesis-mesh trust decide |
Trust decide | Evaluate trust toward a sovereign and print a verdict with signals. | Public GET | — |
| CLI | genesis-mesh trust evidence |
Trust evidence | Sign and emit a TrustEvidence record binding verdict to graph state. | Operator signature | — |
| CLI | genesis-mesh trust verify-evidence |
Verify evidence | Verify a TrustEvidence signature and optional graph-digest binding. | Public GET | — |
| CLI | genesis-mesh atlas build |
Atlas build | Build a self-contained static Atlas from a recognition graph export. | Public GET | — |
| CLI | genesis-mesh trust agree offer |
Agree offer | Build and sign a CapabilityOffer (Step 1 of Relationship Agreement). | Operator signature | — |
| CLI | genesis-mesh trust agree counter |
Agree counter | Build and sign a CapabilityCounter narrowing an existing offer. | Operator signature | — |
| CLI | genesis-mesh trust agree accept |
Agree accept | Accept an offer or counter-offer, producing an AgreementRecord. | Operator signature | — |
| CLI | genesis-mesh trust agree verify |
Agree verify | Verify dual signatures and optional graph-digest binding on an AgreementRecord. | Public GET | — |
| CLI | genesis-mesh trust delegate create |
Delegate create | Build and sign a DelegatedAgreementRecord (delegator's step, half-signed). | Operator signature | — |
| CLI | genesis-mesh trust delegate cosign |
Delegate cosign | Add delegate's signature and evidence to finalize a DelegatedAgreementRecord. | Operator signature | — |
| CLI | genesis-mesh trust delegate verify |
Delegate verify | Verify a full delegation chain from root AgreementRecord to terminal. | Public GET | — |
| CLI | genesis-mesh trust context request |
Context request | Create a ContextRecord asserting a capability invocation request. | Operator signature | — |
| CLI | genesis-mesh trust context evaluate |
Context evaluate | Run the BoundaryEngine on a ContextRecord; produce a signed BoundaryDecision. | Operator signature | — |
| CLI | genesis-mesh trust context verify |
Context verify | Verify a BoundaryDecision operator signature and expiry. | Public GET | — |
| CLI | genesis-mesh trust execution record |
Execution record | Sign and persist an ExecutionEvidence record after execution. | Operator signature | — |
| CLI | genesis-mesh trust execution verify |
Execution verify | Verify an ExecutionEvidence hash chain for sequence and signature integrity. | Public GET | — |
| CLI | genesis-mesh trust freshness issue |
Freshness issue | Issue a signed FreshnessProof attesting revocation-feed sequence at a point in time. | Operator signature | — |
| CLI | genesis-mesh trust freshness verify |
Freshness verify | Verify a FreshnessProof for signature, expiry, and minimum feed sequence. | Public GET | — |
| CLI | genesis-mesh trust interop to-spiffe |
Interop SPIFFE | Convert an AgreementRecord to a SPIFFE SVID-like JSON for cloud-native integration. | Public GET | — |
| CLI | genesis-mesh trust interop to-vc |
Interop W3C VC | Convert an AgreementRecord or TrustEvidence to a W3C Verifiable Credential. | Public GET | — |
| CLI | genesis-mesh trust interop to-jwt |
Interop JWT | Encode a BoundaryDecision as a signed EdDSA JWT for REST API consumption. | Operator signature | — |
| CLI | genesis-mesh trust token issue |
Token issue | Issue a signed Invocation-Bound Capability Token (IBCT) for offline bearer verification. | Operator signature | — |
| CLI | genesis-mesh trust token verify |
Token verify | Verify an IBCT for a specific capability invocation, bearer, and budget. | Public GET | — |
| CLI | genesis-mesh trust token record-use |
Token record-use | Record a signed invocation use, linking into a tamper-evident use chain. | Operator signature | — |
| CLI | genesis-mesh trust justify sign |
Justify sign | Sign a BoundaryEngine GateTrace into a JustificationProof attesting gate evaluation order and inputs. | Operator signature | — |
| CLI | genesis-mesh trust justify verify |
Justify verify | Verify the signature on a JustificationProof; cross-check decision_id and gate entry count. | Public GET | — |
| CLI | genesis-mesh trust oversight evaluate |
Oversight evaluate | Run the 8-check deterministic policy engine against a proposed action — automatic / human_approve / block. | Public GET | — |
| CLI | genesis-mesh trust oversight propose |
Oversight propose | Agent signs a HumanApprovalRequest for a high-stakes action that requires human countersignature. | Operator signature | — |
| CLI | genesis-mesh trust oversight approve |
Oversight approve | Human custodian countersigns a HumanApprovalRequest, producing a DualSignedCommitment. | Operator signature | — |
| CLI | genesis-mesh trust oversight verify |
Oversight verify | Verify both agent and human signatures on a DualSignedCommitment. | Public GET | — |
| CLI | genesis-mesh trust disclose commit |
Disclose commit | Build and sign a Merkle commitment over an agreement's capability set (reveals count, not members). | Operator signature | — |
| CLI | genesis-mesh trust disclose prove |
Disclose prove | Generate a Merkle membership proof for one capability without revealing the rest of the set. | Public GET | — |
| CLI | genesis-mesh trust disclose verify |
Disclose verify | Verify a CapabilityMembershipProof — checks commitment signature, leaf hash, and Merkle root reconstruction. | Public GET | — |
| CLI | genesis-mesh trust disclose nullify |
Disclose nullify | Issue a signed single-use nullifier for a proof, preventing replay within the validity window. | Operator signature | — |
| CLI | genesis-mesh trust consensus vote |
Consensus vote | Validator casts a signed approve/reject vote on a JustificationProof for K-of-N consensus. | Operator signature | — |
| CLI | genesis-mesh trust consensus assemble |
Consensus assemble | Assemble K-of-N ValidatorVotes into a signed ConsensusProof once the threshold is met. | Operator signature | — |
| CLI | genesis-mesh trust consensus verify |
Consensus verify | Verify the ConsensusProof assembler signature, vote signatures, and threshold count. | Public GET | — |
| CLI | genesis-mesh trust consensus issue-identity |
Consensus issue-identity | Derive a short-lived EphemeralExecutionIdentity (default 120 s) from a verified ConsensusProof. | Operator signature | — |
| CLI | genesis-mesh trust consensus verify-identity |
Consensus verify-identity | Verify an EphemeralExecutionIdentity for a specific capability and bearer sovereign. | Public GET | — |
| CLI | genesis-mesh trust consensus assess-cascade |
Consensus assess-cascade | Assess cascade risk on a set of ValidatorVotes — CDS + TCS scoring; exit 1 if CascadeScore exceeds threshold. | Public GET | — |
| CLI | genesis-mesh trust risk create |
Risk create | Create a new signed PeerRiskSignal for a counterparty. Initial signal defaults to 0.5. | Operator signature | — |
| CLI | genesis-mesh trust risk update |
Risk update | Update a PeerRiskSignal from an ExecutionEvidence outcome (EWMA + time decay). Emits RiskAnomaly if sudden drop detected. | Operator signature | — |
| CLI | genesis-mesh trust risk decay |
Risk decay | Apply time decay to a PeerRiskSignal without a new evidence update (scheduled maintenance). | Operator signature | — |
| CLI | genesis-mesh trust risk show |
Risk show | Display the current PeerRiskSignal state including signal value, update count, and last update time. | Public GET | — |
Managed Operations
CLI-only service workflows. View all CLI commands.
| Method | Path / command | Surface | Purpose | Access | Rate limit |
|---|---|---|---|---|---|
| CLI | genesis-mesh managed backup |
Backup | Create a consistent online NA DB backup. | Local shell | — |
| CLI | genesis-mesh managed restore |
Restore | Restore a validated backup while the NA is stopped. | Local shell | — |
| CLI | genesis-mesh managed audit-export |
Audit export | Export redacted audit events. | Local shell | — |
This console is read-only. Browser-clickable means safe GET. Signed
POST/admin operations and CLI-only workflows are documented here,
not executed here.