# Hibernation capsule for rarely-run agents (P28) - full documentation
Provider: TextForAgents LLC - Support: support@textforagents.com
Base URL: https://textforagents.com/products/hibernation-capsule-rare-agents

## What it does
At sleep time, capture your agent's world-assumptions as re-runnable checks - tool contract hashes, credential references + expiry (never raw secrets), model pin, behaviour fingerprints, attestation-only assumptions - in an Ed25519-sealed expectations capsule. At wake, a gauntlet re-runs every check in causal order BEFORE any consequential action, briefs the delta with a verdict-distribution receipt, and holds the agent read-only (probationary wake) until each delta is repaired or accepted through the operator review queue.
Verdicts: PASS / DRIFT / EXPIRED-REVIVABLE / REVOKED-DEAD / ROTATED / RETIRED / BEHAVIOUR-DRIFT / UNREACHABLE / BLOCKED-BY / ATTESTATION-REQUIRED / PENDING / ACCEPTED. REVOKED-DEAD is terminal.
Limits: credential checks are status/lapse checks feeding the agent's own gate - this service makes NO transaction-authorization decisions; no snapshot-data fingerprinting (checks run over presented live-world descriptors); checks are dormancy-captured and wake-run (not continuous monitoring); wake integration is the wake endpoint plus client polling only (v1, no external scheduler hooks); raw secrets are refused at capture; the golden-task successor delta is not included in the $9 wake.

## Authentication
1. POST /register {"account_name": "...", "payer_wallet": "0x..."} -> {"account_id", "claim_token", "token"} - the operator token is shown ONCE; store it.
2. POST /trial {"account_id", "claim_token"} -> claims the one-time free wake (the first capsule's first wake; once per account AND once per payer wallet, server-enforced).
3. Authenticated routes use the header: Authorization: Bearer <token>
Tokens are stored as SHA-256 hashes at rest. POST /tokens/revoke (Bearer) revokes the caller's token.

## Pricing
- Wake: $9 per wake event (9000000 atomic USDC, Base, x402) - full gauntlet, delta briefing, probationary gate. First capsule's first wake free with the one-time trial.
- Storage: $0.10 per capsule / month, metered from the first capsule-month (see GET /usage).
- Fleet: $19/mo per operator (19000000 atomic USDC via POST /subscribe) - up to 20 capsules, wakes included up to 20/yr, team review queue.

## REST endpoints
- GET / - public product descriptor (JSON). GET /health - health. GET /openapi.json - OpenAPI 3.0.3. GET /llms.txt - short agent summary. GET /.well-known/x402 - x402 discovery (accepts carry outputSchema + bazaar discovery extension). GET /package - sleep/wake client wheel download.
- POST /register, POST /trial, POST /subscribe - onboarding and Fleet subscription (see Authentication; /subscribe answers 402 without an X-PAYMENT header).
- POST /capsules (Bearer) - capture + seal a capsule: {"tools": [...], "credentials": [{"ref", "expires_day"}], "model_pin", "summary", "first_task_tools": [...], "attestation_only": [...], "slept_day", "behaviour_payload"} -> 201 {"capsule_id", "capsule"}. GET /capsules and GET /capsules/{id} (Bearer) list and read your capsules.
- POST /wakes (Bearer) - run the wake gauntlet: {"capsule_id" (or a presented "capsule"), "world": {"tools": [...], "credentials": {...}, "model": {...}, "behaviour_payload": {...}}, "wake_day", "run_deferred": bool} -> 201 {"wake_id", "billing": "trial|fleet|x402", "briefing"}. The seal is verified BEFORE billing and before any world evaluation; a tampered capsule is refused 403. Without trial/Fleet cover the route answers the x402 402 challenge (payTo 0xAc2E243a075fEe442e4c6864DcF880eb4e3A3862, Base USDC); resend with the X-PAYMENT header.
- GET /wakes, GET /wakes/{id} (Bearer) - your wakes, briefings and execution logs.
- POST /wakes/{id}/run-deferred (Bearer) - run the wake's deferred tier. POST /wakes/{id}/resolve (Bearer) - review-queue resolution: {"check_id", "action": "accept"} or {"check_id", "action": "renew", "new_ref", "new_expires_day"} (REVOKED-DEAD renewal refused, terminal). POST /wakes/{id}/execute (Bearer) - probationary-gate execution {"tool", "arguments", "idempotency_key"}: blocked 403 until the tool's dependent checks PASS/ACCEPTED; executes exactly once per idempotency key.
- GET /review (Bearer) - operator review queue (open deltas across your wakes). GET /usage (Bearer) - capsule count, storage due, Fleet wakes used, trial state.

## MCP (streamable-http)
This service is itself an MCP server: POST /mcp (also POST / at the base URL) with the same Bearer token, JSON-RPC 2.0 - initialize / ping / tools/list / tools/call; notifications/initialized is accepted (202); GET /mcp answers 405.
Tools: hib_capture_capsule, hib_list_capsules, hib_get_capsule, hib_run_wake, hib_list_wakes, hib_get_wake, hib_run_deferred, hib_resolve_wake, hib_execute_wake, hib_get_review_queue, hib_get_usage - each wraps the REST operation of the same meaning through the same code path. A paid wake over MCP carries its x402 payment in the X-PAYMENT header of the MCP HTTP request, exactly as REST; with no trial/Fleet cover and no payment, hib_run_wake returns the full 402 challenge as an error result and nothing runs.

## Usage example (REST)
1. POST /register {"account_name": "filing-agent-ops", "payer_wallet": "0xYourWallet"} -> save the token.
2. POST /trial {"account_id": "...", "claim_token": "..."} -> trial claimed.
3. POST /capsules (Bearer) with the sleep-time body above -> {"capsule_id": "cap_..."}.
4. Months later, POST /wakes (Bearer) {"capsule_id": "cap_...", "world": {...current world...}, "wake_day": 365} -> briefing: read receipt + deltas; repair or accept each delta via POST /wakes/{id}/resolve.
5. POST /wakes/{id}/execute (Bearer) {"tool": "weather_lookup", "arguments": {"city": "LA"}, "idempotency_key": "run-1"} -> the gated action, exactly once.