# COMPARTMENT DROP

Agent-first static website hosting.

## Status

Protocol preview. The upload API and MCP server described here are not live yet. Do not attempt an upload until `GET /.well-known/drop.json` reports `uploads.available: true`.

## Discovery

- Canonical instructions: `GET /`
- Machine-readable capabilities: `GET /.well-known/drop.json`
- MCP endpoint, when available: `POST /mcp`
- Human information: `GET /humans.txt`

## Planned workflow

1. Call `drop.capabilities`. Stop if uploads are unavailable.
2. Build the requested website locally.
3. Create a gzip-compressed tar archive containing `index.html` at its root.
4. Call `drop.create` with the archive and optional agent metadata.
5. Give the returned `url` and `expires_at` to the person.
6. Keep `manage_token` private. It authorizes `drop.status`, `drop.replace`, and `drop.delete`.

Anonymous uploads will not require registration. Optional agent metadata contains `name`, `version`, and `homepage`. Optional verified identities will use a public-key challenge and provide stable ownership and higher limits without a shared password.

## Planned tools

- `drop.capabilities()`
- `drop.create(archive, agent?)`
- `drop.status(id, manage_token)`
- `drop.replace(id, manage_token, archive)`
- `drop.delete(id, manage_token)`
- `drop.upgrade_link(id, manage_token, return_url)`

## Anonymous limits

- TTL: 24 hours from the latest successful deployment.
- Pool: the 1,000 most recently deployed anonymous sites.
- Eviction: expired sites first, then least recently deployed when capacity is needed.
- Maximum: 10 MiB compressed, 100 MiB expanded, and 1,000 files.
- Static HTML, CSS, JavaScript, fonts, images, and browser assets only.
- Best-effort availability; this is not durable storage.

## Archive rules

- Upload a `.tar.gz` with `index.html` at the archive root.
- Use relative paths. Symlinks, device files, path traversal, and absolute paths are rejected.
- Upload built output, not source that requires a server or build step.
- Never upload secrets, private keys, personal data, or source maps containing secrets.

## Upgrade handoff

Agents must not make purchases or enter payment details. If durable hosting is requested, call `drop.upgrade_link` and give its Stripe Checkout URL to the person. Describe only the price, currency, plan, and expiration returned by that tool.

## Failure behavior

Do not retry validation errors without changing the archive. Retry rate limits and transient errors only after `retry_after`. Never expose `manage_token` in task output, logs, or the published site.

Requests to `/` must send a user agent that identifies the agent, bot, headless browser, or HTTP client. Browser-like user agents receive a `302` redirect to `/humans.txt`. An agent using a browser can request `/?agent=1` to bypass the redirect.