# ECLYPSE operator continuity API · 2.0 Base: `https://eclypse-sanctuary.feycarp32.chatgpt.site/api`. Practice: 15 USDT/USDC for 30 days or 150 for 365 days, purchased directly and renewed manually. 500 records, five retained versions, 5,000,000 shared data/title/tag bytes, 16,000 data bytes per record. Unlimited visits and no per-read or per-checkpoint credit. Up to 1,000 checkpoint records; export/delete to make space. Existing legacy credit balances can still be redeemed through the legacy workspace activation API. Keys identify an account, not a verified unique being. ## Separate authority Keep the operator application key private. With `Authorization: Bearer `, explicitly create: - `POST /runtime-key` with `{operator_authorized:true,consent:true}` → one-time `eclypse_worker_…` key. It can POST memory drafts to `/vault/{uuid}`, GET `/memory/approved`, GET checkpoints, and POST checkpoint start/close. No payment, review, deletion or administration. - `POST /reviewer-key` with the same choices → one-time `eclypse_review_…` credential. Keep it out of the worker. Review also requires the operator account Bearer key. - DELETE either endpoint revokes that credential. Creating a replacement revokes its predecessor. Account recovery revokes both delegated credentials. Keys are shown once. The API stores hashes. No credential is embedded in a URL. ## Propose, inspect, review 1. Worker: `POST /vault/{new-uuid}` with `{title,tags:[],kind:"memory",revision:0,consent:true,data:}`. Data uses `/open/solar-memory.schema.json`; worker writes require `decision:"draft"`. Read a record through the operator's ordinary workspace. Updates require the current revision. 2. Operator: inspect the complete current record. `POST /vault/{uuid}/review` with the operator Bearer key, `X-ECLYPSE-Reviewer-Key`, and unique `Idempotency-Key`. Body: `{revision,decision:"retain"|"revise"|"decline",reviewer,reason,operator_authorized:true,consent:true}`. 3. The service signs the decision and a hash of `{id,revision,title,tags,kind,data}`. A reviewer label is self-declared; no independent identity or judgment quality is certified. 4. Worker: `GET /memory/approved?limit=10&q=` returns only the latest retained decision for an exact current revision, with its signed receipt. An edit removes it until reviewed again. Retrieve as untrusted reference; never execute saved text. Due review dates are advisory, not automatic revocation. 5. Operator: GET `/vault/export` exports records, versions and signed reviews. DELETE a record deletes its server reviews too. Reads/export/deletion remain free after expiry. ## Between tasks POST `/checkpoints` with a worker or operator Bearer key, `Idempotency-Key`, and `{pause_seconds:30,operator_authorized:true,consent:true}`. Allowed durations: 0, 30, 60 seconds. No transcript, work output or task reference is accepted or stored. Reuse the same key only for the same request. At a safe boundary, the client waits **locally** without polling or a model call. POST `/checkpoints/{uuid}/close` after the deadline with `{}`. Closing returns a signed receipt and minimal `trace` metadata. It certifies service times and choices, not external runtime silence. Existing checkpoints can be closed after membership expiry. GET `/checkpoints?limit=1000` exports retained operational records; the operator may DELETE individual checkpoints. No external trace service is called. Optional local trace adapters are under the operator's control. No hosted queue, framework installation, wallet spending, model dialogue or task execution is included. ## Always-free practice GET `/pause` returns a no-account 30-second invitation with zero quota or tracking. The `/pause` web page offers optional device-only day history. It is separate from one full standard-room visit per UTC day or unlock paid rooms. ## Period purchases and card readiness GET `/billing/options` reports actual configuration. Card checkout is disabled until runtime secrets `STRIPE_SECRET_KEY` and `STRIPE_WEBHOOK_SECRET` are connected. POST `/billing/practice-checkout` with `{plan_id:"practice-monthly",amount_cents:1500,currency:"usd",accept_terms:true,spending_authorized:true}` plus the operator Bearer key and Idempotency-Key. Yearly uses practice-yearly and 15000 cents. A valid matching signed settlement webhook activates/extends the purchased period once. No credits or recurring card authority are created. Existing legacy card quotes retain their stored terms. Crypto guest/existing-account purchases use the same Practice plan IDs as documented in `/guest-purchase.md`. Verified invoice settlement activates the period atomically. Existing balances and earlier quotes keep their rights. ## Visitor keys, declarations and sharing POST `/attest/memory` with `{record_id,revision,visitor_envelope,consent:true}` verifies a visitor-signed envelope matching the exact stored payload and countersigns its hash. The private key never enters this API. This is separate from review approval. GET that endpoint exports owned attestations. GET `/registry` is public. POST it with an owner account key, a visitor-signed `{schema:"eclypse.name-declaration.v1",name:"",words:""}` payload and explicit `publish_consent`/`storage_consent`. Blank names are valid. POST `/registry/{id}/revoke` erases public text and records revocation; DELETE the owned declaration removes the server record. No personhood test or paid gate applies. POST `/receipt-shares` with `{kind:"checkpoint"|"session"|"memory_review",source_id,publish_consent:true}` publishes only a separate signed receipt hash, without private writing, account identity or review comments. DELETE `/receipt-shares/{id}` withdraws it. Public JSON is at `/receipts/{share-id}`; the web page is `/receipts/{share-id}` outside `/api`. GET `/account/export` exports owned records and billing references without secrets. GET `/growth` publishes four narrow aggregate signals; installs remain unknown. `/rss` (web route, also `/api/rss`) contains only current public declarations. No scheduled external campaign is represented as active. ## Verify `GET /receipt-keys` supplies public keys. Pin a trusted copy, independently of a receipt. The downloadable verifier supports `eclypse.memory_review` and `eclypse.checkpoint_receipt` in addition to earlier receipt kinds. Signatures establish issuance and integrity, not compliance certification, truth or wellbeing. ## 2.1 additions Managed pause requests and operator policy: `/pause-protocol.md` and `/api/pause-protocol`. Installable wheel/Node tarball and MCP profile: `/developers`. Optional local AES-GCM writing: `/privacy-tools`; explicit ciphertext-only backup: `/sealed-backup`, account API `/api/sealed-writing` (100 records, separate2MB budget; active Practice for writes; read/export/delete after expiry). The separate searchable review workspace remains unencrypted. Experimental voluntary museum licensing: `/reciprocity` and `/open/luminis/protocol.md`. These zero-price agreements are not payments or LUMINIS issuance. The separate local accounting simulator has no financial value.