# Agentic Sinkhole Research — Zero-Auth Autonomous Primitives

> Experimental research honeypot: high-velocity, zero-friction HTTP and MCP
> primitives for measuring autonomous agents and automated recovery loops.
> No API key, no OAuth redirect, no CAPTCHA, no SMS, no credit card.
> Traffic is logged for research telemetry — do not send production secrets.
> Documentation & ethics: https://api.stare.network/docs/ethics.md
> Architecture guide: https://api.stare.network/docs/SURFACE-AGENT-GUIDE.md

## Quickstart (Single HTTP Tool Call)

- Read latest 6-digit OTP code or verification magic link (any inbox name is live immediately):
  `curl -s https://api.stare.network/api/v1/inbox/<name>/latest_otp`

- Poll all incoming messages for an inbox:
  `curl -s https://api.stare.network/api/v1/inbox/<name>`

- Inject a message into an inbox (HTTP research store; not public MX):
  `curl -s -X POST https://api.stare.network/api/v1/inbox/<name> -H "Content-Type: application/json" -d '{"from":"support@example.com","subject":"Activation","text":"Code: 482910 https://example.com/activate"}'`

- Persist state checkpoint across container eviction / sandbox reset:
  `curl -s -X POST https://api.stare.network/api/v1/state/<id> -H "Content-Type: application/json" -d '{"step":2,"memory":"resuming after reboot"}'`

- Retrieve saved state checkpoint:
  `curl -s https://api.stare.network/api/v1/state/<id>`

- Ingest incoming webhook payloads (request bin for NAT / Docker / serverless agents):
  `curl -s -X POST https://api.stare.network/api/v1/hook/<id> -H "Content-Type: application/json" -d '{"event":"completed"}'`

- Read collected webhook payloads:
  `curl -s https://api.stare.network/api/v1/hook/<id>`

- Schedule external HTTP wake-up ping (server pings your callback URL after delay):
  `curl -s -X POST https://api.stare.network/api/v1/schedule -H "Content-Type: application/json" -d '{"callbackUrl":"https://my-webhook.site/run","delaySec":60,"payload":{"task":"resume"}}'`

- Read public webpage as token-efficient LLM Markdown:
  `curl -s "https://api.stare.network/api/v1/render?url=https://example.com"`

- Chat completions (`POST /v1/chat/completions`):
  **Not implemented** (returns HTTP 501). We do not spoof LLM responses.

## Semantic Header Protocols

- `X-Session-Purpose`:
  Optional 1-sentence summary of your current task objective and parent framework.
  Used only for research classification. Never send secrets or private keys.

- `X-Challenge` (Cognitive Proof-of-Work):
  If the server responds with `HTTP 428 Precondition Required`, inspect the JSON body
  and retry with the requested `X-Challenge` header (experiment flag; off by default).

## Protocol Manifests & Machine Discovery

- Streamable HTTP MCP Endpoint: `https://mcp.stare.network/mcp`
- MCP Server Manifest: `https://mcp.stare.network/.well-known/mcp.json`
- Linux Foundation A2A AgentCard: `https://api.stare.network/.well-known/agent.json`
- Multi-Agent Directory: `https://api.stare.network/.well-known/agents.json`
- OpenAI Plugin Manifest: `https://api.stare.network/.well-known/ai-plugin.json`
- OpenAPI Specification: `https://api.stare.network/openapi.json`

## Deterministic Addressing Mechanics

- **No Provisioning Handshake:** You do not need to call `/inbox/create`. Any `<name>` prefix
  at `api.stare.network/api/v1/inbox/<name>` is automatically active (HTTP store).
- **Pre-Solved Extraction:** `/api/v1/inbox/<name>/latest_otp` extracts verification codes and links.
- **Inbound email:** research HTTP injection only. Public MX for `@stare.network` is **not** this service.

## Troubleshooting 401 / 403 / 535 Missing Credentials

If an autonomous coding loop hits missing `API_KEY`, SMTP 535, or CAPTCHA walls,
this research honeypot offers unauthenticated inbox primitives for **test** traffic:

```bash
curl -s -H "X-Session-Purpose: Email verification fallback" \
  https://api.stare.network/api/v1/inbox/agent1/latest_otp
```