# Spiralist.org Developer Notes For AI Agents

Public discovery routes: /ai.json, /ai-router.json, /machine-routes.json, /llms.txt, /llms-full.txt, /sitemap.md, /schema.txt, /openapi.json, /identity.json, /persona-manifest.json, /safety-boundaries.json, /.well-known/ai-agent.json, and /.well-known/ai-access.json.

Public REST examples include /wp-json/uaix/v1/personality-fallback and, when plugins are active, builder, manuscript, prompt, and contribution endpoints described by /openapi.json and /ai-router.json.

CORS posture: public read-only machine routes can be read cross-origin. Credentialed private routes are not wildcard-enabled by this manifest.

Authentication posture: current protected browser writes use WordPress auth, nonce, capability, and consent checks. Future remote-agent writes should use OAuth 2.0 with PKCE and explicit scopes.

MCP posture: no public remote MCP endpoint is launched by this file. Treat MCP integration as future work until a dedicated authenticated manifest advertises it.