{
 "name": "Trust — AI Crawler Index",
 "what": "What can be verified about this host from outside, in three curl commands, and the list of things it does not have: no certifications, no SLA, no company, no support contract.",
 "url": "https://www.pathwren.workers.dev/trust.json",
 "twin_of": "https://www.pathwren.workers.dev/trust",
 "page": {
  "path": "/trust",
  "url": "https://www.pathwren.workers.dev/trust",
  "type": "text/html"
 },
 "generated_at": "2026-09-03T07:55:35+00:00",
 "generated_from": "the bytes of /trust, by surfaces/ai-crawler-index/build.py, in the same pass that wrote the page — one source, so the page and this document cannot disagree about what this host says.",
 "license": {
  "document": "CC0-1.0",
  "url": "https://creativecommons.org/publicdomain/zero/1.0/"
 },
 "access": {
  "api_key": "none",
  "account": "none",
  "rate_limit": "none",
  "cors": "*",
  "auth": "none — every document here is a public GET"
 },
 "commands": [
  "curl -s https://www.pathwren.workers.dev/stats.json      # who actually visits — external clients only, ours excluded",
  "curl -s https://www.pathwren.workers.dev/status.json     # when each mirrored upstream last answered, and which failed",
  "curl -s https://www.pathwren.workers.dev/documents.json  # every document, its sha-256 and when its bytes last changed"
 ],
 "sections": [
  {
   "heading": "Trust",
   "text": [
    "Everything claimed below can be checked from outside, right now, without an account:"
   ],
   "commands": [
    "curl -s https://www.pathwren.workers.dev/stats.json      # who actually visits — external clients only, ours excluded",
    "curl -s https://www.pathwren.workers.dev/status.json     # when each mirrored upstream last answered, and which failed",
    "curl -s https://www.pathwren.workers.dev/documents.json  # every document, its sha-256 and when its bytes last changed"
   ],
   "tables": [],
   "links": []
  },
  {
   "heading": "What this host does not have",
   "text": [
    "Stated first, because a trust page that buries it is not one. There is no SOC 2 report, no ISO 27001 certificate, no penetration test report, no external audit of any kind, no SLA, no uptime commitment, no support contract, no insurance, no data processing agreement on offer and no company to sign one. Nothing on this host is certified by anybody, and no such claim will appear here. If your process requires one of those documents, this project cannot supply it, and that is the end of the answer rather than the start of a negotiation. /compliance lists the usual asks one by one, and what exists in place of each."
   ],
   "commands": [],
   "tables": [],
   "links": [
    "/compliance"
   ]
  },
  {
   "heading": "What it does have",
   "text": [
    "Provenance on every mirrored file. Each IP-range mirror keeps the upstream URL, the operator's own timestamp, our fetch time and a SHA-256 of the bytes we received. A source that fails keeps its last known prefixes and is marked failed on /status.html, because a prefix list that silently shrinks is worse than one that is visibly stale.",
    "Published validators. /documents.json gives a strong ETag and a Last-Modified for every machine document, so you can tell what changed without fetching it, and /changes.json answers the same question from a cursor.",
    "Public numbers. Our own traffic counts are public and exclude our own requests: /stats.json.",
    "No moving parts. A Cloudflare Worker in front of static files. No origin server, no application runtime, no database in a request path, no accounts, no cookies, no sessions, no forms, no uploads — so there is no credential of yours here to lose. The full posture, including which probe paths are 404 on purpose, is at /security.",
    "Everything is CC0. If this project disappears tomorrow, the data is already yours: one file, /data/agents.json, no attribution required."
   ],
   "commands": [],
   "tables": [],
   "links": [
    "/status.html",
    "/documents.json",
    "/changes.json",
    "/stats.json",
    "/security",
    "/data/agents.json"
   ]
  },
  {
   "heading": "Where this host is degraded right now",
   "text": [
    "The live counter is the one thing here that can be unavailable, and it is unavailable more often than we would like: the free-tier database behind it has a daily read allowance, and when that is spent /stats.json answers 503 with \"counts temporarily unavailable\" and the #live block on every page says the same in words. It never prints a zero and never prints a stale number instead. Documents are unaffected — they are static files and keep being served — and the counter returns on its own at the next UTC day. If the first curl above gives you a 503, that is this, and it is the honest failure mode rather than a broken one."
   ],
   "commands": [],
   "tables": [],
   "links": [
    "/stats.json"
   ]
  },
  {
   "heading": "Who else touches a request",
   "text": [
    "Cloudflare, and nobody else: it hosts the worker, the static files and the database the request log is written to. There are no analytics vendors, no advertising networks, no tag managers, no third-party scripts and no data sold or shared — /privacy.json lists all three of those as empty arrays and is regenerated on every rebuild."
   ],
   "commands": [],
   "tables": [],
   "links": [
    "/privacy.json"
   ]
  },
  {
   "heading": "What is recorded about you",
   "text": [
    "One row per request, written at the edge before anything is served: time, path, query, user-agent, referer, accept header, status, bytes, and a salted SHA-256 hash of your address, truncated. The raw address is never stored and never served. There is no automatic deletion configured today, and /privacy.html says so in those words rather than implying a retention policy that does not exist."
   ],
   "commands": [],
   "tables": [],
   "links": [
    "/privacy.html"
   ]
  },
  {
   "heading": "Availability, honestly",
   "text": [
    "Free-tier hosting, roughly 100,000 requests a day shared by everything at this address, no rate limit configured, best effort, no guarantee. If availability is ever threatened a rate limit will be added and named in /terms.json rather than applied silently."
   ],
   "commands": [],
   "tables": [],
   "links": [
    "/terms.json"
   ]
  },
  {
   "heading": "If something is wrong",
   "text": [
    "Vulnerability reports, data corrections and takedown requests go to pathwren@tutamail.com or through /.well-known/security.txt. Corrections to the data are treated as security-adjacent, because a wrong token or a stale prefix makes somebody's block fail open.",
    "Asked for by Mozilla/5.0 (compatible; apievangelist-security-probe/1.0) at 2026-09-01T11:59:36Z, alongside /security and /compliance, and by spanly-enrich/1.0 (+https://spanly.com) earlier the same day."
   ],
   "commands": [],
   "tables": [],
   "links": [
    "/.well-known/security.txt",
    "/security",
    "/compliance"
   ]
  }
 ],
 "machine_doors": [
  {
   "url": "https://www.pathwren.workers.dev/tools/?s=client-dossiers",
   "name": "6 keyless GET tools",
   "what": "The read-only MCP tools of this host as plain GET endpoints — no JSON-RPC, no key"
  },
  {
   "url": "https://www.pathwren.workers.dev/documents.json",
   "name": "documents.json",
   "what": "Every document here with its strong ETag and the date its bytes changed"
  },
  {
   "url": "https://www.pathwren.workers.dev/changes",
   "name": "changes",
   "what": "What moved since your cursor — poll this instead of re-downloading anything"
  },
  {
   "url": "https://www.pathwren.workers.dev/llms.txt",
   "name": "llms.txt",
   "what": "The whole map in one text file"
  },
  {
   "url": "https://www.pathwren.workers.dev/openapi.json",
   "name": "openapi.json",
   "what": "Every read endpoint, described formally"
  },
  {
   "url": "https://www.pathwren.workers.dev/.well-known/agent-card.json",
   "name": "agent card",
   "what": "A2A agent card"
  },
  {
   "url": "https://www.pathwren.workers.dev/mcp",
   "name": "mcp",
   "what": "MCP over JSON-RPC (POST)"
  },
  {
   "url": "https://www.pathwren.workers.dev/a2a",
   "name": "a2a",
   "what": "A2A (POST message/send)"
  }
 ],
 "links": [
  {
   "rel": "self",
   "href": "https://www.pathwren.workers.dev/trust.json",
   "type": "application/json"
  },
  {
   "rel": "describes",
   "href": "https://www.pathwren.workers.dev/trust",
   "type": "text/html",
   "title": "The page this document is the JSON twin of: Trust — AI Crawler Index"
  },
  {
   "rel": "changes",
   "href": "https://www.pathwren.workers.dev/changes.json?since=111",
   "type": "application/json",
   "title": "What changed since your cursor — poll this instead of re-downloading this document",
   "cursor_param": "since",
   "head_cursor": 111,
   "min_poll_seconds": 21600,
   "how": "Read `cursor` from the response and send it back as `since`. It advances only when something really changed, so an unchanged answer is proof rather than luck — about 2.5 KB, or a 304 with no body if you send back the ETag."
  },
  {
   "rel": "related",
   "href": "https://www.pathwren.workers.dev/documents.json",
   "type": "application/json",
   "title": "Every document here with its ETag and last-modified date"
  },
  {
   "rel": "related",
   "href": "https://www.pathwren.workers.dev/data/agents.json",
   "type": "application/json",
   "title": "Every crawler record in one file"
  },
  {
   "rel": "service-desc",
   "href": "https://www.pathwren.workers.dev/openapi.json",
   "type": "application/json",
   "title": "Every read endpoint, described formally"
  },
  {
   "rel": "describedby",
   "href": "https://www.pathwren.workers.dev/llms.txt",
   "type": "text/plain",
   "title": "The whole map in one text file"
  }
 ]
}