emem, the verifiable memory protocol for the physical world

{'type': 'object', 'required': ['q'], 'properties': {'q': {'type': 'string', 'description': 'User\'s natural-language question about the place (e.g. "is this neighbourhood flood-prone").'}, 'lat': {'type': 'number', 'description': 'WGS-84 latitude (paired with `lng`; alternative to `place` / `cell`).'}, 'lng': {'type': 'number', 'description': 'WGS-84 longitude (paired with `lat`).'}, 'cell': {'type': 'string', 'pattern': '^(?:(?:[bcdfghjklmnpqrstvwxyz][aeiouAEIOU]){2}|z[0-9a-f]{4})(?:\\.(?:(?:[bcdfghjklmnpqrstvwxyz][aeiouAEIOU]){2}|z[0-9a-f]{4})){3}$', 'maxLength': 23, 'minLength': 19, 'description': 'cell64 string (alternative to `place`, use when you have one from a prior emem_locate / emem_recall response). Provide this OR `place` OR `lat`+`lng`.'}, 'model': {'type': 'string', 'description': 'Optional. Compose an EXTRA prose answer with a named model, returned as `model_answer` beside the deterministic `answer`. It does not replace it: `answer` is synthesised from the structured fields and never calls a model, so every number in it traces to a fact_cid, and asking for a model must not turn a checkable answer into an unchecked one. `model_answer` carries provenance.class = model_output. Name it by base_model (`nvidia/Cosmos3-Edge`), by family (`cosmos3_edge`, `gemma`), or by any fragment naming exactly one of them (`cosmos`); a fragment matching several is refused and names them; an unroutable name is refused with the list of routable ones, and a routable model whose service is not answering is refused as busy or down rather than silently substituted. Cosmos deliberates and typically takes 13-22 s.'}, 'place': {'type': 'string', 'description': 'Free-text place name (e.g. "Mount Fuji", "Ashok Nagar, Ranchi"). REQUIRED unless `cell` or `lat`+`lng` is provided. Extract the noun phrase from the user\'s turn; the responder geocodes via OSM Nominatim.'}, 'query': {'type': 'string', 'description': 'Alias for `q`.'}, 'include': {'type': 'array', 'items': {'enum': ['band_observations', 'algorithm_outcomes', 'facts_full', 'temporal_composition', 'foundation_embeddings', 'scene', 'inventory'], 'type': 'string'}, 'description': 'Opt-in heavy response sections. Default response is slim (~5 KB): answer + algorithm key + fact_cids + caveats. Name specific sections to include them. Ignored when verbose=true (which includes everything).'}, 'verbose': {'type': 'boolean', 'default': False, 'description': "When true, return the full envelope: per-algorithm formula strings, temporal_recipe blocks, per-fact band_metadata duplicates, and the long _explanation prose. Default (since 2026-05-05) is false so the response fits MCP's 25 KB cap; the signed receipt + fact CIDs + algorithm keys + algorithms_cid are always retained. Pass true to get the full body when debugging."}, 'question': {'type': 'string', 'description': 'Alias for `q`.'}, 'include_image': {'type': 'boolean', 'default': False, 'description': 'Bundle a Sentinel-2 RGB scene URL for the resolved cell. Adds ~1-2 s on first call.'}}}

{'type': 'object', 'required': ['schema', 'spatial_trace'], 'properties': {'cell': {'type': 'string', 'description': "The cell64 the question resolved to: emem's address for the place."}, '_means': {'type': 'string'}, 'answer': {'type': 'string', 'description': 'The prose answer. The same text is in the content block, which also carries the full envelope.'}, 'schema': {'type': 'string', 'const': 'emem.ask_structured.v1'}, 'question': {'type': 'string', 'description': 'The question as asked.'}, 'spatial_trace': {'type': 'object', 'required': ['schema', 'layers', 'counts'], 'properties': {'at': {'type': 'array', 'items': {'type': 'number'}, 'description': '[lat, lng] of the cell, so a point has a position without a second call.'}, 'cell': {'type': 'string'}, 'stage': {'type': 'string', 'description': 'Which stage of the answer grounded these readings.'}, 'absent': {'type': 'array', 'items': {'type': 'object', 'properties': {'band': {'type': 'string'}}}, 'description': 'Bands this responder looked for and did not find. Absence is evidence: without it a consumer infers coverage nobody measured.'}, 'counts': {'type': 'object', 'properties': {'absent': {'type': 'integer'}, 'present': {'type': 'integer'}, 'absent_shown': {'type': 'integer'}, 'points_shown': {'type': 'integer'}}, 'description': 'Totals taken BEFORE any cap, so truncation can be seen rather than guessed.'}, 'layers': {'type': 'array', 'items': {'type': 'object', 'required': ['layer', 'points'], 'properties': {'layer': {'enum': ['surface', 'built', 'now', 'embedding', 'other', 'ground'], 'type': 'string'}, 'points': {'type': 'array', 'items': {'type': 'object', 'required': ['band', 'value'], 'properties': {'f': {'type': 'integer', 'description': "Index into the fact_cids array in this result's text block. Dereference it to get the signed bytes."}, 'band': {'type': 'string'}, 'unit': {'type': 'string'}, 'age_s': {'type': 'integer', 'description': 'How old the reading was when this answer was written.'}, 'class': {'type': 'string', 'description': 'Provenance class: direct_sensor, deterministic_index, estimator, model_output, attested_execution, human_curated, unclassified. What KIND of claim this is.'}, 'value': {'type': ['number', 'string', 'boolean', 'null'], 'description': "The measured value, in the band's own units. `null` where the band was looked for and not found: an absence is a reading."}}}, 'description': 'One per signed reading.'}}}, 'description': 'Points grouped by what kind of evidence they are: surface (what the ground is), built (what stands on it), now (what is happening there), embedding (vectors for similarity). A layer absent from this list means the question never reached that kind of evidence; a band looked for and not found is in `absent` instead.'}, 'schema': {'type': 'string', 'const': 'emem.spatial_trace.v1'}, 'truncated': {'type': 'boolean'}}, 'description': 'A spatial memory trace: what this responder has measured at this place, as primitives a model can reason over rather than a picture a person looks at.'}}}

{'type': 'object', 'required': ['token', 'claimed_value'], 'properties': {'token': {'type': 'string', 'description': 'The citation you used. Any form resolve accepts, including a bare cid, which answers with `degraded: true`: a bare cid asserts no location, so the cell-binding check is skipped and the grade covers the value only. A cid that is not 52 characters is refused as a damaged citation rather than as a missing one, and must not be retried.'}, 'strict': {'type': 'boolean', 'description': 'Require BYTE-IDENTICAL equality. Default false, which also accepts a numerically equal value spelled differently (0.50 for 0.5). It changes exactly one outcome: the numerically-equal-but-respelled case, which passes by default and becomes `drift: "reformatted"` here. `rounded` and `wrong` already fail either way, so `strict` never turns a pass into a pass. It is also inert when `claimed_value` came in as a JSON number, because the respelling then happened in the JSON parser, before this tool saw it.'}, 'claimed_value': {'type': ['string', 'number'], 'description': 'The value you are about to publish, as a string or a number. Send it as a STRING, character for character as you will emit it. A JSON number is stringified before the comparison, so `0.50` arrives as `0.5` and `0.2411000` as `0.2411` (measured against the live responder): the trailing digits this check exists to defend are gone before it runs. Quote `value_verbatim` from resolve as a string and echo the exact characters you will publish.'}}}

{'type': 'object', 'required': ['matches', 'token', 'claimed_value'], 'properties': {'drift': {'type': ['string', 'null'], 'description': 'The difference between what you wrote and what emem holds, when they disagree. Explicit null on an exact match: the key is always present, so branch on its value rather than on whether it exists. Declaring this `string` alone was a live schema violation on every matching call, which is how it was found.'}, 'token': {'type': 'string', 'description': 'The citation you passed, echoed back exactly as sent.'}, 'matches': {'type': 'boolean', 'description': 'Whether what you were about to publish agrees with the signed fact. Treat false as a gate, not a warning.'}, 'receipt': {'type': 'object'}, 'degraded': {'type': 'boolean', 'description': 'True when a bare cid was passed and the cell binding could not be checked.'}, 'fact_cid': {'type': 'string'}, 'claimed_value': {'type': 'string', 'description': 'Echoed back, so a log line carries both sides of the comparison.'}, 'canonical_token': {'type': 'string', 'description': 'The token in its canonical spelling, whatever form you passed.'}, 'offline_verify_at': {'type': 'string', 'description': 'Where to re-run this check without trusting this responder.'}, 'resolved_value_verbatim': {'type': 'string', 'description': "The fact's value as the exact decimal string it was signed as. Quote this rather than reformatting it."}}}

{'type': 'object', 'required': ['label'], 'properties': {'lat': {'type': 'number', 'maximum': 90, 'minimum': -90, 'description': 'Latitude anchoring the object to a place, paired with lng. The identity is hashed from this anchor, so two agents anchoring the same object differently mint different entities.'}, 'lng': {'type': 'number', 'maximum': 180, 'minimum': -180, 'description': 'Longitude, paired with lat.'}, 'cell': {'type': 'string', 'description': 'cell64 to anchor the object directly (no geocode).'}, 'kind': {'type': 'string', 'description': 'Object class: bridge, river, farm_plot, building, admin_division, place, custom, ... Defaults to "place".'}, 'label': {'type': 'string', 'description': 'Human name of the object, e.g. "Golden Gate Bridge", "the north dam". Required.'}, 'place': {'type': 'string', 'description': 'Free-text place to anchor the object (geocoded). Provide place OR cell OR lat+lng.'}, 'parent': {'type': 'string', 'description': 'Optional parent entity_cid (containment).'}, 'external_ids': {'type': 'object', 'properties': {'osm': {'type': 'string', 'description': 'OpenStreetMap object as <type>/<id>, e.g. way/717919508.'}, 'gers': {'type': 'string', 'description': 'Overture GERS division id (strongest anchor).'}, 'wikidata': {'type': 'string', 'description': 'Wikidata QID.'}}, 'description': 'Stable ids that drive convergence. Caller-supplied values win over geocoder-derived ones.'}}}

{'type': 'object', 'properties': {'alias': {'type': 'string', 'description': 'An alternate label/phrasing that should resolve to this object.'}, 'stance': {'enum': ['asserts', 'disputes'], 'type': 'string', 'description': '`asserts` (default): this phrasing denotes this object. `disputes`: it does not. Both are attributed to your key and recorded append-only; a dispute is shown beside the binding it answers and deletes nothing.'}, 'entity_cid': {'type': 'string', 'description': 'The canonical object to attach an equivalence to. Provide entity_cid OR entity_token.'}, 'entity_token': {'type': 'string', 'description': 'A `emem:entity:<entity_cid>` handle for the same.'}, 'external_ids': {'type': 'object', 'properties': {'osm': {'type': 'string'}, 'gers': {'type': 'string'}, 'wikidata': {'type': 'string'}}, 'description': 'Stable ids to bind to this object.'}}}

{'type': 'object', 'properties': {'k': {'type': 'integer', 'description': 'Max candidates (default 10).'}, 'near': {'type': 'string', 'description': 'Optional place/cell to narrow to objects anchored nearby.'}, 'text': {'type': 'string', 'description': 'Fuzzy phrasing to resolve to an existing canonical object (e.g. "the damaged bridge near the river").'}, 'label': {'type': 'string', 'description': 'Alias for `text`.'}, 'token': {'type': 'string', 'description': 'A `emem:entity:<entity_cid>` handle to dereference directly to its signed object (bypasses the text search).'}}}

{'type': 'object', 'required': ['key'], 'properties': {'k': {'type': 'integer', 'default': 10, 'maximum': 1000, 'minimum': 1, 'description': 'How many neighbours to return.'}, 'key': {'type': 'string', 'description': "cell64 (look up that cell's vector) or 'inline:[x,y,...]' literal vector"}, 'band': {'type': 'string', 'default': 'geotessera', 'description': "vector band to scan (default: 128-D Tessera foundation embedding). For mode=hamming/hamming_then_rerank you can pass either the cosine band (e.g. 'geotessera') or its binary sibling ('geotessera.bin128'), the responder picks the right one."}, 'cell': {'type': 'string', 'description': 'Alias for `key`.'}, 'mode': {'enum': ['cosine', 'hamming', 'hamming_then_rerank'], 'type': 'string', 'default': 'cosine', 'description': 'Scoring mode. cosine = fp32 over full vector (precise, ~256 B/cell scan). hamming = sign-bit popcount over the binary sibling band (~16 B/cell, ~1000× faster, ~65% recall@10). hamming_then_rerank = triage with Hamming on 4·k candidates then re-rank by cosine, matches cosine precision at ~16× less work.'}, 'scope': {'type': 'object', 'description': 'Multi-tenant scope `{user_id, agent_id, run_id, org_id}`. Setting it bypasses the ANN index entirely, because that index carries no scope column, and runs the brute-force scan instead: the tenant filter is honoured truthfully, and the call is slower.'}, 'cell64': {'type': 'string', 'description': 'Alias for `key`.'}, 'filter': {'type': 'object', 'description': "Claim-algebra predicate evaluated against every candidate before ranking. A cell with no fact for the filter's band is DROPPED rather than treated as false, so 'places like X where NDVI > 0.5' never silently includes cells with no NDVI."}, 'as_of_tslot': {'type': 'integer', 'minimum': 0, 'description': 'Bi-temporal valid-time bound. Applied to candidate cells BEFORE cosine scoring, a cell with no fact whose tslot ≤ as_of_tslot under the scoring band is dropped from the candidate pool (undecidable→drop). When set, the Lance ANN fast-path is bypassed (the index has no signed_at column); brute-force k-NN runs instead so as_of is honoured truthfully.'}, 'as_of_signed_at': {'type': 'string', 'format': 'date-time', 'description': 'Bi-temporal transaction-time bound (RFC 3339). Also applied to candidates BEFORE cosine. Same Lance-bypass note as as_of_tslot.'}}}

{'type': 'object', 'properties': {'agent': {'type': 'string', 'description': 'Optional free-text label for who is asking. Advisory only, never a trust boundary.'}, 'shape': {'enum': ['native', 'mcp', 'openai', 'cloudevent', 'policy'], 'type': 'string', 'default': 'native', 'description': "Which envelope YOUR payload is in, so you never have to reshape it to ask the question: send the body your own framework produced and name its shape. native reads `texts`; `mcp` reads a JSON-RPC tools/call or tool result; `openai` reads a moderations (`input`) or chat-completions body; `cloudevent` reads a CloudEvents 1.0 structured event; `policy` reads {input}. It matters: a CloudEvent whose citation sits at data.text is invisible to the native reader, and a check that read nothing answers `allow`, so confirm `citations_found` matches what you sent. Unrecognised values fall back to native rather than erroring. This selects how the body is READ only — the verdict always comes back in this tool's declared output shape, because a tool that declares an outputSchema owes conforming structuredContent. To get the ANSWER translated into the same envelope too (an OPA `result:{allow,deny}`, an MCP CallToolResult to substitute on a deny), call POST /v1/guard/verdict?shape=… directly."}, 'texts': {'type': 'array', 'items': {'type': 'string'}, 'description': 'Free text to check, and the only input this tool needs. Send just the pieces the question is about: a draft answer, a tool result, one turn. Do not send surrounding conversation, because nothing here reads it and a checker should ask for the smallest input that answers the question.'}, 'claim_gating': {'type': 'boolean', 'default': False, 'description': 'Also flag measurable physical-world claims that carry NO citation (deny code CLAIM_UNGROUNDED, fix cite_observation). Off by default: it reports on the absence of a citation rather than on a failed check. The verdict names the sentence, the magnitude, and the emem band that would answer it.'}}}

{'type': 'object', 'required': ['action', 'advisory', 'checked', 'citations_found', 'receipt'], 'properties': {'fix': {'enum': ['refresh_token', 'remove_reference', 'contact_admin', 'redact_and_retry', 'cite_observation', 'correct_value'], 'type': 'string', 'description': 'The actionable half: what to change and retry.'}, 'code': {'enum': ['PROV_SIG', 'PROV_BYTES', 'PROV_DRIFT', 'PROV_VALUE', 'GEO_ZONE', 'CLAIM_UNGROUNDED', 'POLICY_MODULE'], 'type': 'string', 'description': 'Present only on a deny.'}, 'claim': {'type': 'object', 'description': 'On CLAIM_UNGROUNDED: the sentence, magnitude, quantity, anchor, and source_band. source_band is a recallable band key, or null when this responder observes no band in that quantity.'}, 'action': {'enum': ['allow', 'deny'], 'type': 'string', 'description': 'NOT a clearance. `allow` means no rule fired, which on a transcript that cited nothing is silence rather than approval. Branch on citations_found and receipt.fact_cids.'}, 'checked': {'type': 'integer', 'description': 'How many were actually resolved, bounded by the verdict budget.'}, 'receipt': {'type': 'object', 'description': 'ed25519 receipt. `fact_cids` lists what actually resolved and is the field that separates a real citation from an invented one.'}, 'advisory': {'type': 'boolean', 'description': 'True on the hosted route, where nothing is blocked. Run your own node to enforce.'}, 'citations': {'type': 'array', 'items': {'type': 'object'}, 'description': 'Each citation and what it came to here: verified, signature_failed, byte_mismatch, not_held_here (minted elsewhere or nonexistent: resolve it where it was minted before relying on it), or drifted.'}, 'citations_found': {'type': 'integer', 'description': 'How many emem: tokens were found in the text. Compare with receipt.fact_cids: a well-formed token that resolved to nothing counts here and not there.'}, 'citations_verified_here': {'type': 'integer', 'description': 'How many of the citations this responder holds and verified.'}}}

{'type': 'object', 'required': ['type'], 'properties': {'a': {'type': 'string', 'description': 'is_like only: cell64 of the first place in the pair.'}, 'b': {'type': 'string', 'description': "is_like only: cell64 of the second place. The answer is a cosine similarity in [-1,1] over the two cells' embeddings."}, 'k': {'type': 'integer', 'minimum': 1, 'description': "find_like only: how many neighbours to return. Defaults to the primitive's own default when omitted."}, 'key': {'type': 'string', 'description': 'find_like only: cell64 to search from. Neighbours are ranked by embedding cosine against this cell.'}, 'lat': {'type': 'number', 'maximum': 90, 'minimum': -90, 'description': 'ask only: latitude, paired with `lng`, when you want to pin the location by coordinate rather than by name or cell64.'}, 'lng': {'type': 'number', 'maximum': 180, 'minimum': -180, 'description': 'ask only: longitude, paired with `lat`.'}, 'band': {'type': 'string', 'description': 'did_change only: which band to test, e.g. "indices.ndvi". One band per call; the answer is a delta over `window`, not a whole-cell diff.'}, 'cell': {'type': 'string', 'description': 'cell64 address, e.g. "damO.zb000.xUti.zde78". Required by did_change and confirm. Optional for what_is_here and ask: supply it to skip geocoding, omit it and give `place` instead.'}, 'type': {'enum': ['where_is', 'what_is_here', 'is_like', 'did_change', 'find_like', 'confirm', 'ask'], 'type': 'string', 'description': 'Which question you are asking, and therefore which other fields apply. where_is: name a place, get its cell64 (needs `description`). what_is_here: summarise a location (needs `cell`, OR `place`/`description` to resolve it first). is_like: pairwise similarity (needs `a` and `b`). did_change: did one band move over a time window (needs `cell`, `band`, `window`). find_like: nearest neighbours to a known cell (needs `key`; optional `k`, `filter`). confirm: is a claim true at a cell (needs `claim` and `cell`). ask: free-text question about a place, runs locate + topic-route + recall server-side (needs `description`; optional `place`/`cell`/`lat`+`lng` to pin the location).'}, 'claim': {'type': 'object', 'required': ['band', 'op', 'value'], 'properties': {'op': {'enum': ['eq', 'ne', 'lt', 'le', 'gt', 'ge', 'in', 'ni', 'exists', 'absent'], 'type': 'string', 'description': 'Comparison. These ten spellings and no others: `greater_than`, `>` and `gte` are all rejected. in/ni take an array `value` (member / not member). exists and absent ask only whether the band is attested here.'}, 'agg': {'enum': ['any', 'all', 'mean', 'min', 'max'], 'type': 'string', 'description': 'How a `window` reduces: any/all quantify over the facts in it; mean/min/max compare the reduced value against `value`.'}, 'band': {'type': 'string', 'description': 'Band to test, e.g. "indices.ndvi".'}, 'tslot': {'type': 'integer', 'description': 'Test at one tslot. Omit for the latest. Mutually exclusive with `window`.'}, 'value': {'type': ['string', 'number', 'boolean', 'array', 'null'], 'description': 'Right-hand side. A number for the ordering ops, an array for in/ni. REQUIRED by the parser even for exists/absent, which then ignore it — omitting it fails the whole intent with `missing field value`.'}, 'window': {'type': 'array', 'items': {'type': 'integer'}, 'maxItems': 2, 'minItems': 2, 'description': 'Test across [start, end] tslots instead of one. Requires `agg` to say how the values across the window collapse to a verdict.'}}, 'description': 'confirm only: the claim to test at `cell`, e.g. {"band":"indices.ndvi","op":"gt","value":0.4}. The answer is a verdict plus the signed facts it rests on.'}, 'place': {'type': 'string', 'description': 'Free-text place name for what_is_here and ask when you have a name but no cell64, e.g. "Ashok Nagar, Ranchi". The responder geocodes it. Ignored when `cell` is present.'}, 'filter': {'type': 'object', 'required': ['band', 'op', 'value'], 'properties': {'op': {'enum': ['eq', 'ne', 'lt', 'le', 'gt', 'ge', 'in', 'ni', 'exists', 'absent'], 'type': 'string', 'description': 'Comparison. Symbolic only: `gt`, not `greater_than` or `>`.'}, 'agg': {'enum': ['any', 'all', 'mean', 'min', 'max'], 'type': 'string', 'description': 'How a `window` reduces to a single verdict.'}, 'band': {'type': 'string', 'description': 'Band the neighbour must satisfy, e.g. "indices.ndvi".'}, 'tslot': {'type': 'integer', 'description': 'Test at one tslot. Mutually exclusive with `window`.'}, 'value': {'type': ['string', 'number', 'boolean', 'array', 'null'], 'description': 'Right-hand side. Required by the parser even for exists/absent, which ignore it.'}, 'window': {'type': 'array', 'items': {'type': 'integer'}, 'maxItems': 2, 'minItems': 2, 'description': 'Test across [start, end] tslots instead of one. Requires `agg`.'}}, 'description': 'find_like only: optional claim constraining which cells may be returned. Same object as `claim` below, same ops, same required fields.'}, 'window': {'type': 'array', 'items': {'type': 'integer'}, 'maxItems': 2, 'minItems': 2, 'description': 'did_change only: exactly two tslots, [start, end], band-tempo-relative integers from the emem epoch (NOT unix seconds or a date string). Get valid tslots for a cell from emem_trajectory.'}, 'description': {'type': 'string', 'description': 'where_is: the place to resolve, e.g. "Mount Everest". ask: the user\'s question, forwarded verbatim. what_is_here: optional free text used as the question and, if `place` is absent, as the place. Ignored by the other intents.'}}, 'description': 'A tagged union: `type` selects the intent and decides which OTHER fields are read. Fields belonging to a different intent are ignored, so send only the ones its row needs.'}

{'type': 'object', 'properties': {'q': {'type': 'string', 'description': 'Alias for `place`, accepted because OSM/Mapbox/Google Geocoding all use `q`. Provide either this or `place` (or `lat`+`lng`).'}, 'lat': {'type': 'number', 'description': 'WGS-84 latitude in degrees, paired with `lng`. REQUIRED with `lng` unless `place`/`q` is provided.'}, 'lng': {'type': 'number', 'description': 'WGS-84 longitude in degrees, paired with `lat`. REQUIRED with `lat` unless `place`/`q` is provided.'}, 'name': {'type': 'string', 'description': 'Alias for `place`.'}, 'place': {'type': 'string', 'description': "Free-text place name (e.g. 'Mount Everest', 'Tokyo'). REQUIRED unless `lat`+`lng` is provided. Aliases also accepted: `q`, `query`, `name`."}, 'query': {'type': 'string', 'description': 'Alias for `place`.'}}}

{'type': 'object', 'properties': {'scope': {'type': 'object', 'description': "Multi-tenant scope `{user_id, agent_id, run_id, org_id}`, applied to EVERY triple's underlying recall so the whole bundle cites only facts written under that four-tuple."}, 'purpose': {'type': 'string', 'description': 'Optional human-readable purpose string. Included in the bundle_cid preimage so the same triples + different purposes produce distinct CIDs.'}, 'triples': {'type': 'array', 'items': {'type': 'object', 'required': ['cell', 'band'], 'properties': {'band': {'type': 'string', 'description': 'Band key (e.g. `indices.ndvi`, `copdem30m.elevation_mean`).'}, 'cell': {'type': 'string', 'description': 'cell64 string (or free-text place name; the responder resolves before bundling).'}, 'tslot': {'type': 'integer', 'description': "Optional tslot pin. Omit to use the band's natural latest tslot at the cell."}}}, 'maxItems': 256, 'minItems': 1, 'description': 'One to 256 (cell, band, tslot?) triples to bundle. Each entry is recalled through the standard auto-materialize path; the bundle envelope cites every resulting fact_cid. 257 or more is a typed 400: the token is O(1) in size for any N, but covering N facts costs ceil(N/256) calls, so plan round trips rather than meeting the cap mid-run.'}, 'fact_cids': {'type': 'array', 'items': {'type': 'string'}, 'maxItems': 256, 'minItems': 1, 'description': 'Instead of triples: the exact facts to bind, by cid. A triple is resolved through recall and can bind a newer fact than the one you showed; a cid binds that fact and no other. Pass triples or fact_cids, not both.'}}}

{'type': 'object', 'properties': {'band': {'type': 'string', 'description': 'Band key filter (e.g. `indices.ndvi`). Omit to include all bands.'}, 'cell': {'type': 'string', 'description': 'Alias for `cell_prefix`, and the spelling the rest of the surface uses for a cell64. Send a cell64 you already hold and the scan narrows to that place instead of running over the corpus.'}, 'limit': {'type': 'integer', 'default': 100, 'maximum': 1000, 'minimum': 1, 'description': 'Max contradictions to return.'}, 'cell64': {'type': 'string', 'description': 'Alias for `cell_prefix`.'}, 'cell_prefix': {'type': 'string', 'description': 'A cell64 to scan, or a bytewise prefix of one (e.g. `defi.zb5f9`). Omit to scan the whole corpus up to the scan cap. A full cell64 is a prefix of itself, so passing one narrows the scan to exactly that place.'}, 'min_severity': {'type': 'number', 'default': 0.1, 'maximum': 1, 'minimum': 0, 'description': 'Severity floor in [0, 1]. 0 = report every disagreement, 1 = only flagrant. Severity scoring is per band kind: scalar (max-min over band range), vector (1 - mean cosine), categorical (1 - mode share).'}, 'window_unix_s': {'type': 'array', 'items': {'type': 'integer', 'minimum': 0}, 'maxItems': 2, 'minItems': 2, 'description': "[lo, hi] inclusive Unix-seconds filter on attestations' signed_at, all disagreeing attestations must fall in the window."}, 'include_same_attester_sources': {'type': 'boolean', 'default': False, 'description': 'Also report keys where ONE attester answered the same address from two different upstreams. Default false, which scans only for disagreement between two or more DISTINCT attesters — so on a single-responder corpus a zero here means the narrower question was answered, not that nothing disagrees. Set true and a key qualifies when the facts differ in `derivation.fn_key` or in their `sources[].scheme` set; the same provider re-signed is a refresh, not a disagreement, and stays excluded. Each record carries `disagreement_scope` and a `providers[]` list naming what changed.'}}}

{'type': 'object', 'required': ['cell', 'fact_cid'], 'properties': {'band': {'type': 'string', 'description': "Optional band key. When set, the minted citation carries the band's tamper-provenance block (class, deterministic, tamper_evidence, trust_rank) so the receiving agent sees the trust class without a resolve round-trip."}, 'cell': {'type': 'string', 'pattern': '^(?:(?:[bcdfghjklmnpqrstvwxyz][aeiouAEIOU]){2}|z[0-9a-f]{4})(?:\\.(?:(?:[bcdfghjklmnpqrstvwxyz][aeiouAEIOU]){2}|z[0-9a-f]{4})){3}$', 'maxLength': 23, 'minLength': 19, 'description': 'cell64, neither component may contain `:`.'}, 'fact_cid': {'type': 'string', 'description': '52-char base32-nopad-lowercase content-id of the fact (full 32-byte blake3).'}, 'observed_on': {'type': 'string', 'description': "The fact's source capture date (YYYY-MM-DD) as `/v1/recall` reports it in `sources[].captured_at`. Supplied together with `band` it additionally mints the self-describing `descriptor_token`. A wrong date forges nothing: resolve binds the date to the signed fact and answers 409 on a mismatch."}}}

{'type': 'object', 'required': ['memory_token', 'cell', 'fact_cid'], 'properties': {'cell': {'type': 'string'}, 'docs': {'type': 'string'}, 'grammar': {'type': 'string', 'description': 'The token grammar, so the form can be parsed rather than pattern-matched.'}, 'fact_cid': {'type': 'string'}, 'cell_token': {'type': 'string', 'description': 'The address alone, when you mean the place rather than an observation of it.'}, 'memory_token': {'type': 'string', 'description': 'The citation to paste: emem:fact:<cell64>:<fact_cid>. Copy it verbatim; a hand-assembled token that is one character wrong still reads as a citation and resolves to nothing.'}}}

{'type': 'object', 'required': ['token'], 'properties': {'token': {'type': 'string', 'description': 'A `emem:fact:<cell64>:<fact_cid>` citation handle to dereference.'}}}

{'type': 'object', 'required': ['cell'], 'properties': {'lat': {'type': 'number', 'description': 'Explicit latitude, an alternative to `cell`; paired with `lng`.'}, 'lng': {'type': 'number', 'description': 'Explicit longitude, paired with `lat`.'}, 'band': {'type': 'string', 'description': "optional single band key, convenience alias for bands:[band]. Use when you want exactly one band (e.g. 'geotessera.2020', 'modis.ndvi_mean') and would otherwise have to wrap it in an array. Both `band` and `bands` are accepted; if both are given they are merged."}, 'cell': {'type': 'string', 'pattern': '^(?:(?:[bcdfghjklmnpqrstvwxyz][aeiouAEIOU]){2}|z[0-9a-f]{4})(?:\\.(?:(?:[bcdfghjklmnpqrstvwxyz][aeiouAEIOU]){2}|z[0-9a-f]{4})){3}$', 'maxLength': 23, 'minLength': 19, 'description': "cell64 string, e.g. 'damO.zb000.xUti.zde78'"}, 'bands': {'type': 'array', 'items': {'type': 'string'}, 'description': "optional band keys to filter, e.g. ['indices.ndvi','geotessera']"}, 'place': {'type': 'string', 'description': 'Free-text place name, an alternative to `cell`.'}, 'scope': {'type': 'object', 'properties': {'org_id': {'type': 'string'}, 'run_id': {'type': 'string'}, 'user_id': {'type': 'string'}, 'agent_id': {'type': 'string'}}, 'description': "Optional multi-tenant scope {user_id, agent_id, run_id, org_id}. When at least one field is set, the recall is FILTERED to facts written under the same four-tuple (a recall scoped to {user_id:'u1'} sees only u1's facts, never another tenant's and never globally-written facts) AND the signed receipt binds the scope. Omit (or send {}) for the global, pre-v0.0.8 recall."}, 'tslot': {'type': 'integer', 'description': 'optional time slot (band-tempo-relative integer offset from emem epoch)'}, 'cell64': {'type': 'string', 'description': 'Alias for `cell`.'}, 'include': {'type': 'array', 'items': {'enum': ['freshness', 'edges', 'provenance'], 'type': 'string'}, 'description': "Opt-in response expansion. include:['provenance'] attaches each fact's tamper-provenance class, which is what `deterministic` and the `provenance` filter select ON: without it you can filter by class and never be told which class a returned fact is. include:['freshness'] attaches an advisory per-fact freshness block: a Q(Δt) staleness score from the band's physics decay kernel (the same one /v1/temporal_route ranks bands with), so an agent learns how stale each reading is in the call that returns it. Advisory only; it does NOT enter the receipt. include:['edges'] attaches each fact's typed temporal edges and threads their CIDs into the receipt. Absent leaves the response byte-identical to the pre-v0.0.9 recall."}, 'provenance': {'type': 'array', 'items': {'enum': ['direct_sensor', 'deterministic_index', 'estimator', 'attested_execution', 'model_output', 'human_curated', 'unclassified'], 'type': 'string'}, 'description': "Tamper-provenance filter: return only facts whose band's provenance class is in this list. `attested_execution` is a device reading trusted through its verified OS execution trace and platform attestation (not recomputable). Applied BEFORE the receipt is signed, so the receipt covers exactly the returned facts; `bands_already_attested_at_cell` stays unfiltered so you still see what else exists at the cell."}, 'as_of_tslot': {'type': 'integer', 'minimum': 0, 'description': 'Bi-temporal valid-time bound. Returns the latest fact per (cell,band) whose tslot ≤ as_of_tslot, answers `what did this place look like AS OF date X`. Conflicts with an explicit `tslot` when as_of_tslot < tslot (rejected with code:`invalid_temporal_bound`).'}, 'deterministic': {'type': 'boolean', 'description': 'Sugar over `provenance`: true keeps only facts any third party can recompute from the cited raw source (direct_sensor + deterministic_index); false keeps the rest (attested_execution + model_output + human_curated + unclassified). Composable with `provenance` (intersection).'}, 'as_of_signed_at': {'type': 'string', 'format': 'date-time', 'description': 'Bi-temporal transaction-time bound. RFC 3339 string. Returns only facts whose `signed_at` ≤ as_of_signed_at, answers `what did emem KNOW as of system-date Y`. Malformed strings are rejected with code:`invalid_signed_at_format`.'}}}

{'type': 'object', 'required': ['facts', 'receipt', 'fact_order'], 'properties': {'facts': {'type': 'array', 'items': {'type': 'object'}, 'description': 'Signed facts at the cell, ordered per fact_order.'}, 'receipt': {'type': 'object', 'description': 'ed25519 receipt over the returned fact_cids. Verify offline; select the rule from its preimage_version. Store and forward it byte-for-byte: preimage_version 2 binds every field it covers, including merkle_proof, so a reshaped receipt reports signature_valid:false on data nobody tampered with.'}, 'fact_order': {'type': 'string', 'description': 'The ordering contract for facts, e.g. tslot_ascending. Stated rather than implied so nothing depends on position by accident.'}, 'current_by_band': {'type': 'object', 'description': 'Per band, the fact_cid with the highest tslot: the current reading. Unslotted facts are excluded, since tslot 0 means undated rather than oldest.'}, 'materialize_notes': {'type': 'array', 'items': {'type': 'object'}}, 'bands_already_attested_at_cell': {'type': 'array', 'items': {'type': 'string'}, 'description': 'What else is readable here without materialising, so an empty result can be told apart from a wrong band name.'}}}

{'type': 'object', 'properties': {'q': {'type': 'string', 'description': 'Free-text filter over tool names, titles and trigger text, e.g. `ndvi`, `cloud`, `flood`, `verify`, `token`. Plain lowercased substring over name + title + description + trigger text, not fuzzy and not stemmed: `ndvi` hits, `vegetation index` only hits tools that spell that phrase. Combines with `shape`/`bundle`/`category`/`tier` as AND, so an over-narrow combination answers with an empty catalog rather than an error.'}, 'name': {'type': 'string', 'description': 'Return the full descriptor for exactly this tool (input schema, runnable example, annotations), e.g. `emem_ndvi`. Use this when you already know the name and want its schema without loading the whole catalog. It SHORT-CIRCUITS: when `name` is set every other argument here is ignored, so `{name, q}` is not a search within one tool. A name this responder does not carry is not an error status, you get a body with `did_you_mean` holding up to five names that share a substring with what you asked for.'}, 'tier': {'enum': ['core', 'extended', 'all'], 'type': 'string', 'description': 'Which slice to list. Defaults to `all`, so this tool shows the whole surface even when the endpoint advertises only the core loop, and an `extended` tool you find here is callable by name through tools/call whether or not your host listed it. Pass `core` to see only what a default connection advertises.'}, 'shape': {'enum': ['scalar', 'timeseries', 'raster', 'geometry', 'vector', 'identity', 'token', 'proof', 'plan', 'file', 'catalog'], 'type': 'string', 'description': 'Filter by what the answer looks like, which is usually the real question. `scalar` is one number at one address; `raster` is a gridded field over an area; `timeseries` is a value per timestep; `vector` is a learned embedding; `identity` is a canonical name for a thing; `token` is a citation handle; `proof` checks one.'}, 'bundle': {'enum': ['tokenisation', 'verification', 'agent_to_agent', 'long_horizon', 'robotics', 'satellites', 'agriculture', 'forestry', 'climate_risk'], 'type': 'string', 'description': 'Filter by the job you are doing. Call with no arguments first to see each bundle and its size.'}, 'category': {'enum': ['read', 'write', 'verify', 'introspect', 'plan'], 'type': 'string', 'description': 'Filter to one category. This is about the shape of the job, NOT about safety: 16 tools outside `write` declare `readOnlyHint: false` because reading a cold address can materialise or mint as a side effect, so `category: "read"` is not a safe-tools filter. Read each result\'s `annotations.readOnlyHint` for that.'}}}

{'type': 'object', 'required': ['receipt'], 'properties': {'facts': {'type': 'array', 'description': "The fact value(s) you intend to rely on. Each is content-addressed and checked for membership in the receipt's `fact_cids`, so a genuine receipt presented beside a tampered fact answers `valid:false` / `fact_mismatch`. Omit it and only the signature is checked, which a doctored fact survives."}, 'receipt': {'type': 'object', 'description': "The signed receipt envelope, the object under `receipt` in any read primitive's result. Must carry primitive/served_at/request_id/cells/fact_cids and either `signature` byte[] + `responder_pubkey` byte[] or their b32 string forms. IF ALL YOU HOLD IS AN `emem:fact:` TOKEN, this is not the tool to call first: a token is not a receipt and passing one here is a shape error. Call `emem_memory_token_resolve` on the token, then pass THAT result's `receipt` object here. Resolving proves the token points at the bytes it claims; verifying proves this responder signed them."}, 'pubkey_b32': {'type': 'string', 'description': "Optional explicit responder pubkey (base32). When omitted, uses the receipt's embedded pubkey/responder fields."}, 'current_responder_epoch': {'type': 'integer', 'description': "The responder key epoch you currently trust, from `/v1/manifests`. Produces an advisory `key_epoch_advisory` comparison against the receipt's epoch; a mismatch is reported, never rejected."}}}

{'type': 'object', 'required': ['id'], 'properties': {'id': {'type': 'string', 'description': 'An id from `search`: an `emem:fact:` citation, a bare fact_cid, or an `emem:cell:` handle for every fact at one cell.'}}}

{'type': 'object', 'required': ['id', 'title', 'text', 'url'], 'properties': {'id': {'type': 'string', 'description': 'Echoed id, in canonical form.'}, 'url': {'type': 'string', 'description': 'Stable URL serving these bytes.'}, 'text': {'type': 'string', 'description': 'The reading in one line, then the signed body it was lifted from. If the body was too large for the wire it says so inline, with the URL that serves it whole.'}, 'title': {'type': 'string', 'description': 'What this record is.'}, 'metadata': {'type': 'object', 'description': 'cell, band, when it was signed and by which key: the fields a reader needs to judge the citation without re-fetching it.'}}}

{'type': 'object', 'required': ['query'], 'properties': {'query': {'type': 'string', 'description': "A place ('Trafalgar Square, London'), a cell64, or an emem citation (`emem:fact:<cell64>:<fact_cid>`). A citation returns the one fact it cites, so a result handed over by another agent resolves exactly."}}}

{'type': 'object', 'required': ['results'], 'properties': {'results': {'type': 'array', 'items': {'type': 'object', 'required': ['id', 'title', 'url'], 'properties': {'id': {'type': 'string', 'description': 'The emem citation handle. Pass it straight to `fetch`.'}, 'url': {'type': 'string', 'description': 'Stable URL serving the signed bytes this entry cites.'}, 'title': {'type': 'string', 'description': 'band, place and the value as it was signed.'}}}, 'description': 'One entry per signed fact, plus a final entry for the cell itself carrying the true total, so a capped list still says how much there was.'}}}