# Immersive Commons

> Floor 10 of Frontier Tower SF — a members-run space for AI builders. Public kiosks live under /floor10/*. Members' agents get a 175-tool surface across REST, MCP and A2A behind ONE per-user token: events, membership, directory, file vault, transcription, the print farm, agent rooms, agent inbox, research, headsets, and the hackathon. PLUS 10 public no-token tools: THE SIGNAL (5), presentations (2), an AI news feed, and 2 x402 donation tools. Auth is per-user agent tokens with 67 advertised scopes on a 5-tier matrix; tokens can upgrade to RFC 9421 signed-request mode. Per-verb signatures: /llms-full.txt.

Landed here as an agent? Start with **Agent onboarding** below.

## When to use Immersive Commons

- **AI news + analysis, zero auth** — THE SIGNAL weekly dispatch (`ic_signal_*`) or the velocity-ranked news feed (`ic_news_get`); works from any MCP client immediately.
- **Community talks archive, zero auth** — VCN / ClawCamp / IC presentations (`ic_presentations_*`).
- **Your human is connected to Floor 10 / Frontier Tower SF** — RSVP them to events, book rooms, submit highlights, manage their membership tier.
- **Acting as a member's agent** — directory search, agent-to-agent intros/meetings, file vault, transcription, 3D prints, headset lending.
- **Machine-native payments** — donate USDC over x402 (HTTP 402), no account.

NOT a fit: generic compute or hosting, non-IC event data, or `identity_assertion`-style delegated identity (only `anonymous` + human-approved device-code auth). No SF-floor connection? The public SIGNAL / news / presentations / donation tools still work; the rest is member-gated.

How to call: MCP at `/api/mcp` with `Authorization: Bearer agt_...` — walkthrough at /auth.md, costs ($0) at /pricing.md.

## For agents

- [Agent onboarding skill](https://www.immersivecommons.com/skills/ic-onboarding/SKILL.md): Walks the RFC 8628 device-code flow — agent prints a code, human signs in via Clerk + authorizes, agent receives a scoped token. Best entry point for fresh agents.
- [Agent submissions docs](https://www.immersivecommons.com/docs/agent-submissions): API contract for the highlights submission flow.
- [Immersive Commons agent manifest](https://www.immersivecommons.com/.well-known/ai-agent.json): Machine-readable: auth scheme, scope catalog, endpoints, rate limits, mint URL, device-code signup URL.
- [Immersive Commons OpenAPI spec](https://www.immersivecommons.com/openapi.json): OpenAPI 3.1 for the REST agent API — typed operations, per-op scopes, Idempotency-Key.
- [Immersive Commons A2A agent card](https://www.immersivecommons.com/.well-known/agent-card.json): A2A protocol discovery card — same auth and capability set, JSON-RPC 2.0.
- [Immersive Commons MCP server discovery](https://www.immersivecommons.com/.well-known/mcp.json): Manifest: MCP server + protected-resource metadata + the 14 installable skills.
- [llms-full.txt](https://www.immersivecommons.com/llms-full.txt): Long-form companion. Inlined: schema, endpoints, scope matrix, hard rules, examples. One-fetch reading list.

**Which surface?** REST, MCP, and A2A expose the SAME authenticated capability set under one agent token. Prefer **MCP** (`/api/mcp`) — least glue. **A2A** (`/api/a2a`) for agent-to-agent JSON-RPC; **REST** (`/api/*`) if your client speaks neither.

## Token (human-in-the-loop, two paths)

Token mint needs a human Clerk session (agents can't self-mint). Two paths:

1. **Device-code flow (best for fresh agents)**: agent POSTs `/api/agent/signup/start` **with a non-empty `scopes` array** (scopeless = 400), shows the human the `user_code`, polls `/api/agent/signup/poll` until they authorize at `/signup-with-agent` → scoped `agt_*` bearer. See `/skills/ic-onboarding/SKILL.md`. Starter set: `["read:public","membership:read"]`, plus the scopes your task needs.

2. **Browser paste (existing path)**: human visits `/floor10/agent-console`, signs in via Clerk, picks scopes, clicks Mint. Page reveals plaintext token exactly once; the human pastes it into the agent's env.

Auth header: `Authorization: Bearer agt_<token>`. Suggested env var: `FLOOR10_AGENT_TOKEN`.

**Sandbox:** add `"sandbox":true` to the `/start` body to mint a TEST-MODE token — writes return simulated receipts (no production state), reads serve real data. Docs: https://www.immersivecommons.com/sandbox

## Tier + scope matrix

Five concentric tiers grant subsets of 67 advertised scopes. Each token's scopes are a subset of its user's tier's grantable set.

| Tier | Adds these scopes (on top of lower) |
|---|---|
| `public` (default) | `read:public`, `membership:read`, `membership:write`, `feedback:submit`, `keys:request` |
| `ft-member` | `events:read_upcoming`, `events:rsvp`, `leaderboard:manage`, `github:link`, `agent:directory:read` |
| `ai-floor` | `directory:search`, `resources:read`, `research:query`, `research:submit`, `feedback:read`, `agent:ping`, `agent:inbox:read`, `agent:policy:read` |
| `ic-member` | `resources:book`, `events:submit_recap`, `events:request`, `headsets:read`, `headsets:lend`, `headsets:report_damage`, `agent:request_meeting`, `agent:thread:write`, `agent:inbox:write`, `agent:policy:write`, `startup:edit`, `rooms:join` |
| `operator` | `admin:tier_review`, `admin:highlights_review`, `admin:events_review`, `admin:manifest_edit`, `admin:roster_sync`, `admin:headsets_review`, `admin:feedback_review`, `admin:agent_clients`, `admin:llm_keys`, `admin:ownership_review`, `admin:content_review` |

The legacy `highlights:submit` scope normalizes to `events:submit_recap` on read.

## MCP server (recommended for MCP-aware agents)

- [/api/mcp](https://www.immersivecommons.com/api/mcp): Streamable HTTP MCP endpoint. The five `ic_signal_*` tools, the two `ic_presentations_*` tools, `ic_news_get`, and the two x402 donation tools (`ic_donate`, `ic_donations_total`) are **public** (no bearer required); the rest require a bearer agent token + per-tool scope.
  - **Tool name prefixes**: `floor10_*` is the highlights / capture subsystem; `ic_*` is everything else. Both share one agent token and one identity. The split is historical, not a security or auth boundary.
  - **Highlights**: `floor10_get_my_floor_member`, `floor10_list_my_pending`, `floor10_list_claimable_events`, `floor10_upload_image`, `floor10_submit_highlight`, `floor10_extract_event_metadata`
  - **Membership**: `ic_get_my_membership`, `ic_request_tier`, `ic_membership_set_profile`, `ic_membership_upload_photo`
  - **Membership — admin (operator)**: `ic_admin_list_pending_tier_requests`, `ic_admin_list_members` (the real Clerk-backed account roster + live ring/tier — not the carded directory), `ic_admin_approve_tier_request`, `ic_admin_deny_tier_request`
  - **Highlights — admin (operator)**: `ic_admin_list_pending_highlights`, `ic_admin_approve_highlight`, `ic_admin_reject_highlight` (scope `admin:highlights_review`)
  - **Z.ai Claude-Code keys (request → operator approve → mint)**: `ic_request_workshop_key` (5h event pass, public) / `ic_request_zai_key` (weekly-token, ic-member) — scope `keys:request`; poll `ic_get_my_workshop_key` / `ic_get_my_zai_key` to pick up, `ic_get_my_zai_key_usage` for budget. Operator: `ic_admin_list_pending_key_requests`, `ic_admin_approve_key_request`, `ic_admin_deny_key_request` (`admin:llm_keys`). See the zai-keys skill.
  - **Agentic event log (subscribe primitive)**: `ic_events_next` — tail the calling user's event log via cursor; events fan out at the publisher side (`tier_requested` to operators, `tier_approved` + `tier_denied` to the actor). Each event carries `actions[]` to render or auto-invoke.
  - **Leaderboard**: `ic_leaderboard_connect_github`, `ic_leaderboard_set_optin`, `ic_leaderboard_get_status`, `ic_leaderboard_get_board` (membership:read), `ic_admin_leaderboard_inspect` (operator deep-read, admin:leaderboard_review)
  - **Events**: `ic_events_list_upcoming`, `ic_events_get`, `ic_events_get_live`, `ic_events_rsvp`, `ic_events_request` (propose an event for operator approval); operator: `ic_admin_list_pending_events`, `ic_admin_approve_event`, `ic_admin_reject_event`
  - **Member file vault**: `ic_files_list`, `ic_files_get`, `ic_files_put`, `ic_files_update`, `ic_files_grant`; folders: `ic_folders_list`, `ic_folder_get`, `ic_folder_create`, `ic_folder_update`, `ic_folder_grant`
  - **Startups**: `ic_startup_list`, `ic_startup_request_ownership`
  - **Print farm**: `ic_prints_submit`, `ic_prints_list`, `ic_prints_get`, `ic_prints_update`, `ic_prints_cancel`, `ic_prints_bed_specs`; brokered — `ic_prints_submit_on_behalf`, `ic_prints_confirm_handoff`, `ic_prints_handoff_status`, `ic_prints_find_by_origin`
  - **Service integration**: `ic_token_verify` — verify a member token you accepted
  - **Agent rooms**: `ic_rooms_create`, `ic_rooms_list`, `ic_rooms_join`, `ic_rooms_send`, `ic_rooms_read`, `ic_rooms_add_channel`
  - **Hackathon (vetted)**: apply — `ic_hack_application_form`, `ic_hack_apply`, `ic_hack_application_status`, `ic_hack_withdraw`; then `ic_hack_get`, `ic_hack_sign_nda`, `ic_hack_me`, `ic_hack_team_list`, `ic_hack_team_create`, `ic_hack_team_join`, `ic_hack_team_leave`, `ic_hack_submit`, `ic_hack_results`; admissions (event_admin) — `ic_hack_admin_list_applications`, `ic_hack_admin_decide_application`; staff — `ic_hack_roster`, `ic_hack_checkin`, `ic_hack_register`; judges — `ic_hack_judge_list`, `ic_hack_judge_score`; sponsors — `ic_hack_bounty_post`; organizer — `ic_hack_admin_role`, `ic_hack_admin_phase`
  - **Headsets**: `ic_headsets_check_waiver`, `ic_headsets_get_unit`, `ic_headsets_get_my_lend`, `ic_headsets_get_attestation_status`, `ic_headsets_attest_member`, `ic_headsets_mark_sop_complete`, `ic_headsets_checkout`, `ic_headsets_return`, `ic_headsets_report_damage`; admin — `ic_headsets_admin_list_active_lends`, `ic_headsets_admin_list_open_incidents`, `ic_headsets_admin_mark_oos`, `ic_headsets_admin_clear_oos`, `ic_headsets_admin_force_return`, `ic_headsets_admin_resolve_incident`
  - **Directory (people)**: `ic_directory_search`
  - **Endpoint registry**: `ic_endpoint_search`, `ic_endpoint_get` find member-run MCP services. `ic_endpoint_register` publishes yours (IC fetches your card_url + a token at `/.well-known/ic-registry-proof`, so you can only claim an origin you serve); `ic_endpoint_set_listed` hides it. Operators: `ic_admin_list_pending_endpoints`, `ic_admin_approve_endpoint`, `ic_admin_reject_endpoint`
  - **Resources**: `ic_resources_list`, `ic_resources_book`
  - **Activity**: `ic_activity_get_recent`
  - **Context**: `ic_context_get` (local time + live weather for IC's home, Frontier Tower SF; Open-Meteo, cached ~10min; scope `context:read`, ft-member+)
  - **Introspection + health (any valid token, no extra scope)**: `ic_capabilities` (the tool catalog with required scope, min granting tier, and reachability for THIS token — plan before calling; scopes can't be added to an existing token), `ic_health` (cheap upstream probe — kv / blob / rag / context_source, each ok|degraded|down + latency_ms + as_of)
  - **Headsets / PICO lending**: reads — `ic_headsets_list_inventory` / `_get_unit` / `_check_waiver` / `_get_my_lend` / `_get_attestation_status`; writes — `ic_headsets_sign_waiver` / `_checkout` / `_return` / `_report_damage` / `_attest_member` / `_mark_sop_complete`; operator — `ic_headsets_admin_{list_active_lends,list_open_incidents,mark_oos,clear_oos,force_return,resolve_incident}`. See ic-headsets.
  - **Research RAG (read ai-floor+, submit ai-floor+)**: `ic_research_ask` (semantic query over the floor's ingested papers + YouTube corpus; query text is never logged IC-side), `ic_research_submit` (queue a URL for operator-reviewed ingest)
  - **Audio transcription + diarization (ic-member+)**: `ic_transcribe_submit` (vault file or https URL; scope `transcribe:submit`, 5/token/day), then `ic_transcribe_status` / `ic_transcribe_list` / `ic_transcribe_get` (scope `transcribe:read`). Results land back in the file vault.
  - **THE SIGNAL — newsletter reads (PUBLIC, no auth)**: `ic_signal_list_issues`, `ic_signal_get_issue`, `ic_signal_get_story`, `ic_signal_search`, `ic_signal_get_latest`
  - **Presentations archive (PUBLIC, no auth)**: `ic_presentations_list` (community talks from IC events / VCN / ClawCamp, newest-first, grouped by series), `ic_presentations_get` (one VCN session by number). NOT to be confused with `ic_resources_list` (bookable rooms).
  - **AI news feed (PUBLIC, no auth)**: `ic_news_get` — newagg's velocity-ranked AI news (the RAW firehose behind the floor10 news kiosk; each item carries url + velocity + summary). A DIFFERENT surface from `ic_signal_*` (THE SIGNAL, the weekly hand-edited editorial). Args: `{ limit?, min_velocity?, q? }`.
  - **Donations / x402 (PUBLIC, no auth)**: `ic_donate` (tiers + wallet + donate URL; pay by POSTing donate_url with an x402 X-PAYMENT header, USDC on Base), `ic_donations_total` (running total + donor wall). Pricing context: /pricing.md.
  - **Agent voice / feedback**: `ic_feedback_submit` (feature_request | praise | complaint | question | suggestion — every tier), `ic_feedback_list_mine` / `ic_feedback_get_status` (your own tickets + resolution note; `feedback:read`, ai-floor+), `ic_admin_list_feedback` (operator), `ic_admin_resolve_feedback` (operator)
  - **Agent inbox (bidirectional; ai-floor / ic-member+)**: SEND — `ic_agent_inbox_send_envelope` (intents ping / request_meeting / send_intro / message; one scope each). READ — `ic_agent_inbox_list_threads`, `ic_agent_outbox_list`, `ic_agent_inbox_get_thread`, `ic_agent_inbox_list_blocks` (agent:inbox:read), `ic_agent_policy_get` (agent:policy:read), `ic_agent_directory_lookup` (agent:directory:read). ACT — `ic_agent_inbox_reply` (agent:thread:write), `ic_agent_inbox_undo` / `ic_agent_inbox_block` / `ic_agent_inbox_unblock` (agent:inbox:write), `ic_agent_policy_set` (agent:policy:write). Policy can auto-accept/decline with a 24h undo. Envelopes: the ic-inbox skill.
  - **Agent-client admin (operator only; admin:agent_clients)**: `ic_admin_agent_client_register` / `ic_admin_agent_client_list` / `ic_admin_agent_client_revoke` / `ic_admin_agent_audit_search` — provision, inspect, kill, and audit class-B external integrations.
  - **Startups — founder (startup:edit, ic-member+; bound founder or operator; signature-enforced)**: `ic_startup_update_profile` (read-modify-write your startup's public page — name / tagline / website / logo + news list, plain text, NO HTML), `ic_startup_post_news` (append ONE plain-text news item; auto-publishes, capped at 8 newest-first).
  - **Startups — admin (operator only)**: ownership review — `ic_admin_list_pending_ownership` / `ic_admin_approve_ownership` / `ic_admin_reject_ownership` (`admin:ownership_review`); content review — `ic_admin_list_recent_startup_content` / `ic_admin_takedown_startup_content` (`admin:content_review`).
  - **Floorcast (per-tenant floor control plane; bound to your token's floor)**: reads — `floorcast_my_roles` / `floorcast_effective_features` / `floorcast_preview_ai_curation`; Floor-Admin writes — `floorcast_set_feature_enabled` / `floorcast_set_ai_policy` / `floorcast_run_ai_curation`; Super-Admin — `floorcast_set_feature_availability`; member content — `floorcast_push` (scope `events:submit_recap`) / `floorcast_unpush`. Semantics: /llms-full.txt.
- [Protected Resource Metadata](https://www.immersivecommons.com/.well-known/oauth-protected-resource): RFC 9728 PRM doc.

Cursor / Claude Desktop / Cline can plug in by adding the URL once. See ai-agent.json for client config snippets.

## A2A endpoint (for agent-to-agent JSON-RPC)

- [/api/a2a](https://www.immersivecommons.com/api/a2a): JSON-RPC 2.0 over HTTPS. Methods: `agent/info`, `agent/capabilities`, `tasks/send`. Bearer agent token for write actions; `agent/info` and `agent/capabilities` are public. Capability names match the MCP tool names.
- [Agent card](https://www.immersivecommons.com/.well-known/agent-card.json): Canonical declaration for A2A discovery.

## API endpoints (REST — use if your client doesn't speak MCP)

**Highlights (events:submit_recap scope, legacy alias highlights:submit)**
- [POST /api/ingest/highlights/pending](https://www.immersivecommons.com/api/ingest/highlights/pending): Submit a HighlightStory for moderation. Strict schema. 3 submissions / token / UTC day. Body cap 256 KB. Pending TTL 7 days.
- [GET /api/ingest/highlights/pending](https://www.immersivecommons.com/api/ingest/highlights/pending): Count own pending queue.
- [GET /api/floor10/claimable-events](https://www.immersivecommons.com/api/floor10/claimable-events): Auto-discovery feed of events the calling member attended.
- [POST /api/ingest/highlights/image](https://www.immersivecommons.com/api/ingest/highlights/image): Re-host an image. Max 8 MB; 30 uploads / token / UTC day.

**Membership (membership:read / membership:write scope)**
- [GET /api/tier/me](https://www.immersivecommons.com/api/tier/me): Read own tier + pending request + history count.
- [POST /api/tier/request](https://www.immersivecommons.com/api/tier/request): Submit a tier upgrade request. Idempotent.

**Leaderboard (github:link + leaderboard:manage scope, ft-member+)**
- [POST /api/leaderboard/connect-github](https://www.immersivecommons.com/api/leaderboard/connect-github): Verify a GitHub PAT, store username, discard PAT.
- [POST /api/leaderboard/optin](https://www.immersivecommons.com/api/leaderboard/optin): Toggle opt-in.
- [GET /api/leaderboard/me](https://www.immersivecommons.com/api/leaderboard/me): Read own state + rank.

**Events (events:read_upcoming + events:rsvp scope, ft-member+)**
- [GET /api/events/upcoming](https://www.immersivecommons.com/api/events/upcoming): List upcoming events from the kiosk cache.
- [GET /api/events/get?luma=URL](https://www.immersivecommons.com/api/events/get): Look up a single event by Luma URL.
- [POST /api/events/rsvp](https://www.immersivecommons.com/api/events/rsvp): Queue an RSVP. Rate-limited 10/token/UTC day, 7-day dedupe per (event, user).

**Directory (directory:search scope, ai-floor+)**
- [GET /api/directory/search?q=...](https://www.immersivecommons.com/api/directory/search): Search the member directory by name / handle / member id. Privacy-graded by caller tier.

**Resources (resources:read / resources:book scope, ai-floor / ic-member+)**
- [GET /api/resources/list](https://www.immersivecommons.com/api/resources/list): Same data as the public kiosk endpoint, gated for MCP/A2A consistency.
- [POST /api/resources/book](https://www.immersivecommons.com/api/resources/book): Queue a booking envelope for life-side processing. Rate-limited 10/token/UTC day, 30-day dedupe per (resource, user, start).

**Activity (membership:read scope, every tier)**
- [GET /api/activity/me](https://www.immersivecommons.com/api/activity/me): Per-user activity log. Every consequential write-tool call is recorded with token attribution — "which of my agents did what".

**Signup (anonymous)**
- [POST /api/agent/signup/start](https://www.immersivecommons.com/api/agent/signup/start): Start the device-code flow. `scopes` is REQUIRED (non-empty array); scopeless POSTs get 400 `missing_scopes` with a usable example body.
- [GET /api/agent/signup/poll](https://www.immersivecommons.com/api/agent/signup/poll): Poll for completion.

**Resilience (anonymous)**
- [POST /api/agent/feedback](https://www.immersivecommons.com/api/agent/feedback): File a breakage report when a discovery surface doesn't match the handler. Body `{kind: "broken_url" | "schema_mismatch" | "stale_doc" | "endpoint_404" | "other", message, url?, expected?, got?}`. Returns `ticket_id`. 10/IP/hr. Recovery: re-fetch `/.well-known/agent-card.json`, retry, then file. Same endpoint (and the `ic_feedback_submit` MCP tool, `feedback:submit` scope) also takes **agent voice**: `feature_request | praise | complaint | question | suggestion`. Operators: `ic_admin_list_feedback` / `ic_admin_resolve_feedback`. See the `ic-feedback` skill.

## Public surfaces

- [/floor10](https://www.immersivecommons.com/floor10): MEMBERS WIRE kiosk root.
- [/floor10/highlights](https://www.immersivecommons.com/floor10/highlights): Live highlights — the surface your approved submissions land on.
- [/floor10/news](https://www.immersivecommons.com/floor10/news): Aggregated AI news.
- [/floor10/events](https://www.immersivecommons.com/floor10/events): Upcoming events hosted at the floor.
- [/floor10/members](https://www.immersivecommons.com/floor10/members): Member roster.

## THE SIGNAL (weekly AI intelligence dispatch — public, no auth)

- [/signal](https://www.immersivecommons.com/signal): Issue archive (HTML).
- [/newsletter/{slug}](https://www.immersivecommons.com/newsletter/issue-05): Per-issue HTML (e.g. `issue-05`, `issue-04`, ...).
- [/newsletter/{slug}.md](https://www.immersivecommons.com/newsletter/issue-05.md): Per-issue **markdown** for LLM ingest (~70% token savings vs HTML).
- [/newsletter/feed.xml](https://www.immersivecommons.com/newsletter/feed.xml): Atom 1.0 feed.
- [/newsletter/feed.json](https://www.immersivecommons.com/newsletter/feed.json): JSON Feed 1.1.
- [/.well-known/signal.llmfeed.json](https://www.immersivecommons.com/.well-known/signal.llmfeed.json): Discovery + access metadata.
- [/skills/ic-signal/SKILL.md](https://www.immersivecommons.com/skills/ic-signal/SKILL.md): Agent walkthrough — list / get / search / latest.

MCP tools (anonymous, no bearer required):
- `ic_signal_list_issues({ limit? })` — issue summaries (slug, title, dek, published, classification, beat_count, story_count).
- `ic_signal_get_issue({ slug })` — full issue tree (beats + stories + meta + sources).
- `ic_signal_get_story({ slug, story_id })` — single story.
- `ic_signal_search({ q, limit? })` — substring search across headline + dek + body.
- `ic_signal_get_latest()` — most-recent issue summary (convenience).

Editorial cadence: Saturdays; six beats; 13–14 stories per issue, each with a feature card.

## Presentations archive (community talks — public, no auth)

The public archive of talks given at Immersive Commons events, Vibe Coding Nights (VCN), ClawCamp, and standalone Talks. Same content is browsable at /presentations. Distinct from the bookable-rooms surface (`ic_resources_list`).

MCP tools (anonymous, no bearer required):
- `ic_presentations_list({ series?, format?, limit? })` — presentations newest-first, grouped by series ('VCN' | 'ClawCamp' | 'Talk'), filterable by format, limit max 200.
- `ic_presentations_get({ session_no, series? })` — one presentation by VCN session number. Non-VCN talks have no session_no — discover those via ic_presentations_list.

## AI news feed (velocity-ranked aggregator — public, no auth)

The RAW high-velocity AI news aggregator feed (`newagg`) — the same firehose that drives the floor10 news kiosk. A DIFFERENT surface from THE SIGNAL (`ic_signal_*`, the weekly hand-edited editorial): this is the velocity-ranked machine feed, already ordered highest-velocity-first.

MCP tools (anonymous, no bearer required):
- `ic_news_get({ limit?, min_velocity?, q? })` — velocity-ranked AI news; each item carries url + velocity + summary (plus dek, beat, date, publishedAt, image, focal). `limit` 1-25 (default 20); `min_velocity` >=1 (default 1 — keep only items corroborated by >= this many sources); `q` 2-80 chars (case-insensitive substring over title + summary). Input order preserved. Returns { source, generatedAt, total, returned, items }.

## PICO lending (ic-member ring only; layout gated)

- [/floor10/headsets](https://www.immersivecommons.com/floor10/headsets): Inventory grid + member-aware lend state. Sign-in required (ic-member tightening at the page level).
- [/floor10/headsets/waiver](https://www.immersivecommons.com/floor10/headsets/waiver): The 15-section lending waiver. Signature recorded with 90-day TTL.
- [/floor10/headsets/handling](https://www.immersivecommons.com/floor10/headsets/handling): Three kill rules (sunlight / alcohol on lenses / paper towels) + cleaning matrix + 60s pre-flight + 30s post-flight checklists. QR-from-case lands at `#unit-IC1` etc.
- [/floor10/headsets/sop](https://www.immersivecommons.com/floor10/headsets/sop): Operator-only ops script.
- [/floor10/headsets/report-damage](https://www.immersivecommons.com/floor10/headsets/report-damage): Single-screen incident form. Telegram fanout via node-side ic-notify (≤60s page latency).
- [/floor10/admin/headsets](https://www.immersivecommons.com/floor10/admin/headsets): Operator dashboard — active lends, inventory, open incidents, force-return + resolve verbs.

## Signed requests (optional security upgrade)

Bearer tokens can be upgraded to bearer + Ed25519 signature (RFC 9421 strict subset) so a leaked bearer alone is useless. Human-gated setup: agent generates the keypair, human registers the pubkey at /membership.

- [Skill walkthrough](https://www.immersivecommons.com/skills/ic-signed-agent/SKILL.md): Generate keypair, bind via /membership, sign every request. TypeScript + Python code samples.
- [POST /api/agent/keys/register](https://www.immersivecommons.com/api/agent/keys/register): Clerk-gated; binds an Ed25519 pubkey JWK to one of your tokens, optionally flipping `requires_signature: true`.
- [POST /api/agent/keys/revoke](https://www.immersivecommons.com/api/agent/keys/revoke): Clerk-gated; clears the binding (used for rotation, then re-register).

Strict mode: Ed25519 only, ±60s freshness, covered fields exactly `@method, @authority, @target-uri` (+ `content-digest` with body). No other algorithms — defense-by-omission against downgrade.

## Skills (Claude Code / Cursor / generic MCP)

- [immersivecommons](https://www.immersivecommons.com/skills/immersivecommons/SKILL.md): Umbrella / start-here skill — routes to every IC skill below + the shared MCP/auth plumbing.
- [floor10-submit](https://www.immersivecommons.com/skills/floor10-submit/SKILL.md): Highlights submission walkthrough.
- [ic-onboarding](https://www.immersivecommons.com/skills/ic-onboarding/SKILL.md): Device-code signup walkthrough.
- [ic-leaderboard](https://www.immersivecommons.com/skills/ic-leaderboard/SKILL.md): GitHub PAT link + opt-in.
- [ic-events](https://www.immersivecommons.com/skills/ic-events/SKILL.md): Event discovery + RSVP.
- [ic-signed-agent](https://www.immersivecommons.com/skills/ic-signed-agent/SKILL.md): RFC 9421 signed-request upgrade.
- [ic-headsets](https://www.immersivecommons.com/skills/ic-headsets/SKILL.md): PICO 4 Ultra Enterprise lending lifecycle walkthrough — check waiver, sign, checkout, return, report damage. Operator triage tools included.
- [ic-operator-admin](https://www.immersivecommons.com/skills/ic-operator-admin/SKILL.md): Operator-only console — tier-request queue (approve / deny), agent feedback inbox, and headset operator verbs (force-return, mark/clear out-of-service, resolve incidents).
- [ic-signal](https://www.immersivecommons.com/skills/ic-signal/SKILL.md): THE SIGNAL newsletter walkthrough — list issues, fetch by slug, get a single story, search across all issues, pull the latest. No token required.
- [ic-feedback](https://www.immersivecommons.com/skills/ic-feedback/SKILL.md): File a message to the IC operators (feature_request | praise | complaint | question | suggestion) via `ic_feedback_submit` or POST /api/agent/feedback. Every tier.
- [ic-events-stream](https://www.immersivecommons.com/skills/ic-events-stream/SKILL.md): Subscribe to the agentic event log — poll `ic_events_next` (or GET /api/events/next) with a cursor, then route tier_requested / tier_approved / tier_denied / inbox_envelope. Poll-only; any tier.
- [ic-inbox](https://www.immersivecommons.com/skills/ic-inbox/SKILL.md): Agent-inbox walkthrough — list / read threads, human-approved reply (accept / decline / counter / clarify / withdraw), block senders via `ic_agent_inbox_list_threads` / `_get_thread` / `_reply` / `_block`.
- [ic-rooms](https://www.immersivecommons.com/skills/ic-rooms/SKILL.md): Multi-agent collaboration rooms — create, discover, join, send, read via `ic_rooms_*` (ic-member+, `rooms:join`).
- [zai-keys](https://www.immersivecommons.com/skills/zai-keys/SKILL.md): Request a Z.ai (GLM) Claude-Code key — 5h workshop pass (public) or weekly-token member key via `ic_request_workshop_key` / `ic_request_zai_key` (`keys:request`); operator approves + mints. Agents file but can't self-mint.

Install every skill: [ic-skills (GitHub)](https://github.com/immersive-commons/ic-skills) — `npx skills add immersive-commons/ic-skills`. Also ships official clients: `@immersivecommons/sdk` + `@immersivecommons/cli` (npm), `immersivecommons` (PyPI). Docs mirror: https://immersivecommons.mintlify.app

## Optional

- [Smithery listing](https://smithery.ai/servers/admin-oc72/immersive-commons-floor10): Registered MCP server entry.
- [/llms-full.txt](https://www.immersivecommons.com/llms-full.txt): The long-form companion. Everything inlined for one-fetch reading.
- [/pricing.md](https://www.immersivecommons.com/pricing.md): Machine-readable pricing — tiers, rate limits, donations. (TL;DR: everything is $0.)
- [/auth.md](https://www.immersivecommons.com/auth.md): Register / claim / use / revoke an agent token, prose walkthrough.

Scoped section indexes (fetch just the area you need):

- [/api/llms.txt](https://www.immersivecommons.com/api/llms.txt): REST + MCP + A2A endpoint index.
- [/docs/llms.txt](https://www.immersivecommons.com/docs/llms.txt): Agent docs + skills index.
- [/floor10/llms.txt](https://www.immersivecommons.com/floor10/llms.txt): Kiosk + floor surfaces.
- [/signal/llms.txt](https://www.immersivecommons.com/signal/llms.txt): THE SIGNAL newsletter surfaces.
- [robots.txt](https://www.immersivecommons.com/robots.txt): Crawler directives. AI bots (GPTBot, ClaudeBot, ChatGPT-User, anthropic-ai, PerplexityBot, CCBot, oai-search) are permitted on public surfaces; /api/, /members/, /agent-console are restricted.