Workspace Governance

curl -X POST https://api.prysm1.com/v1/workspace/readiness \
  -H "Authorization: Bearer prysm_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "workspace_id": "ws-myrepo",
    "project_name": "MyApp",
    "stack": ["python", "fastapi"],
    "protected_paths": ["backend/eval/", ".env"],
    "require_handoffs": true,
    "require_risk_gate": true
  }'

import httpx

client = httpx.Client(headers={"Authorization": "Bearer prysm_sk_..."})
resp = client.post("https://api.prysm1.com/v1/workspace/readiness", json={
    "workspace_id": "ws-myrepo",
    "project_name": "MyApp",
    "stack": ["python", "fastapi"],
    "protected_paths": ["backend/eval/", ".env"],
    "require_handoffs": True,
    "require_risk_gate": True,
})
print(resp.json()["score"], resp.json()["rating"])

{
  "object": "repo.readiness",
  "version": "repo-readiness-v0.1",
  "score": 75,
  "rating": "good",
  "earned_weight": 75,
  "total_weight": 100,
  "checks": [
    {"id": "has_project_name", "label": "Project name declared", "weight": 10, "passed": true},
    {"id": "has_protected_paths", "label": "Protected paths declared", "weight": 15, "passed": true}
  ],
  "recommendations": [
    {"id": "has_tests", "label": "Test suite declared", "weight": 10, "rec": "Add test_runner to manifest."}
  ]
}

All workspace endpoints require Bearer token authentication.

The Workspace Governance API gives agentic tools a shared vocabulary for expressing what a repo is configured to allow, protect, and audit. A workspace manifest (the common input) is a lightweight JSON object — no files on disk, no agent running — so every call is pure and deterministic.

POST /v1/workspace/readiness

Score a repo manifest on Agentic Control Plane maturity (0–100). Use this to gate deployments, generate a shareable readiness badge, or surface the highest-leverage improvements.

POST https://api.prysm1.com/v1/workspace/readiness · Auth required

Request Body

string

required

Unique identifier for this workspace. Anchors the signed handoff ledger.

string

Human-readable project name (appears in generated AGENTS.md / CLAUDE.md).

string[]

Technology stack (e.g. ["python", "fastapi", "react"]). Used to tailor generated instructions.

string[]

Paths that require elevated approval before an agent can write to them (e.g. ["backend/eval/", ".env", "go.sum"]).

string[]

Shell commands that must never be executed in this workspace (e.g. ["rm -rf", "git push --force"]).

boolean

Whether agents must create a signed handoff entry before handing off context.

boolean

Whether agents must pass the risk gate before executing agentic actions.

Response

string

repo.readiness

integer

0–100 readiness score.

string

excellent | good | fair | poor | critical

object[]

Per-check breakdown: id, label, weight, passed.

object[]

Highest-weight failing checks, sorted by impact.

integer

Sum of weights for passing checks.

integer

Sum of all check weights (the denominator).

string

Scoring algorithm version.

curl -X POST https://api.prysm1.com/v1/workspace/readiness \
  -H "Authorization: Bearer prysm_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "workspace_id": "ws-myrepo",
    "project_name": "MyApp",
    "stack": ["python", "fastapi"],
    "protected_paths": ["backend/eval/", ".env"],
    "require_handoffs": true,
    "require_risk_gate": true
  }'

import httpx

client = httpx.Client(headers={"Authorization": "Bearer prysm_sk_..."})
resp = client.post("https://api.prysm1.com/v1/workspace/readiness", json={
    "workspace_id": "ws-myrepo",
    "project_name": "MyApp",
    "stack": ["python", "fastapi"],
    "protected_paths": ["backend/eval/", ".env"],
    "require_handoffs": True,
    "require_risk_gate": True,
})
print(resp.json()["score"], resp.json()["rating"])

{
  "object": "repo.readiness",
  "version": "repo-readiness-v0.1",
  "score": 75,
  "rating": "good",
  "earned_weight": 75,
  "total_weight": 100,
  "checks": [
    {"id": "has_project_name", "label": "Project name declared", "weight": 10, "passed": true},
    {"id": "has_protected_paths", "label": "Protected paths declared", "weight": 15, "passed": true}
  ],
  "recommendations": [
    {"id": "has_tests", "label": "Test suite declared", "weight": 10, "rec": "Add test_runner to manifest."}
  ]
}

POST /v1/workspace/generate

Generate AGENTS.md, CLAUDE.md, and .cursor/rules/*.mdc from a canonical workspace manifest. Same manifest as /readiness — score first, then generate. Output is deterministic (same manifest yields byte-identical artifacts).

POST https://api.prysm1.com/v1/workspace/generate · Auth required · Internal-only until the Patent §18.1–18.2 continuation is filed.

Request Body

Same fields as /v1/workspace/readiness.

Response

string

Generator version.

string

Echoed from the request.

object[]

Array of {path, content} objects. Paths: AGENTS.md, CLAUDE.md, .cursor/rules/prysm-security.mdc, .cursor/rules/prysm-docs.mdc.

curl -X POST https://api.prysm1.com/v1/workspace/generate \
  -H "Authorization: Bearer prysm_sk_..." \
  -H "Content-Type: application/json" \
  -d '{"workspace_id": "ws-myrepo", "project_name": "MyApp", "stack": ["typescript"]}'

{
  "version": "agents-md-v0.1",
  "workspace_id": "ws-myrepo",
  "artifacts": [
    {"path": "AGENTS.md", "content": "# AGENTS.md\n\n..."},
    {"path": "CLAUDE.md", "content": "# CLAUDE.md\n\n..."},
    {"path": ".cursor/rules/prysm-security.mdc", "content": "..."},
    {"path": ".cursor/rules/prysm-docs.mdc", "content": "..."}
  ]
}

GET /v1/workspace//snapshot

Audit-dashboard snapshot for a workspace: count, time range, risk-tier distribution, signed share, chain integrity verdict, and a tail of recent entries. Use this to render a workspace health view without re-implementing the chain verification math.

GET https://api.prysm1.com/v1/workspace/{workspace_id}/snapshot · Auth required

Path Parameters

string

required

The workspace to snapshot.

Query Parameters

integer

Cap the tail (1–200; default 50).

Response

string

Echoed workspace ID.

integer

Total handoffs in this workspace.

object

Counts per tier: auto, confirm, approve, block.

number | null

Mean risk score across all handoffs.

Fraction of handoffs that are Ed25519-signed (0–1).

object

Chain integrity verdict: ok, n, first_broken_index, reasons.

object[]

Last N handoffs summarized (id, objective, from_tool, to_tool, created_at, risk_tier, risk_score, signed).

curl "https://api.prysm1.com/v1/workspace/ws-myrepo/snapshot?limit=10" \
  -H "Authorization: Bearer prysm_sk_..."

{
  "object": "workspace.snapshot",
  "workspace_id": "ws-myrepo",
  "count": 12,
  "risk_distribution": {"auto": 10, "confirm": 1, "approve": 1, "block": 0, "unknown": 0},
  "avg_risk_score": 18,
  "signed_share": 1.0,
  "integrity": {"ok": true, "n": 12, "first_broken_index": null, "reasons": []},
  "tail": [
    {
      "id": "ho_abc123",
      "objective": "Refactor auth module",
      "from_tool": "cursor",
      "to_tool": "claude-code",
      "created_at": "2026-06-15T10:00:00+00:00",
      "risk_tier": "auto",
      "risk_score": 12,
      "signed": true
    }
  ]
}

MCP Manifest Handoff Ledger

Overview

Endpoints

Agentic Control Plane

Agentic Control Plane

Workspace Governance

POST /v1/workspace/readiness

Request Body

Response

POST /v1/workspace/generate

Request Body

Response

GET /v1/workspace//snapshot

Path Parameters

Query Parameters

Response

​POST /v1/workspace/readiness

​Request Body

​Response

​POST /v1/workspace/generate

​Request Body

​Response

​GET /v1/workspace//snapshot

​Path Parameters

​Query Parameters

​Response

POST /v1/workspace/readiness

Request Body

Response

POST /v1/workspace/generate

Request Body

Response

GET /v1/workspace//snapshot

Path Parameters

Query Parameters

Response