AI Bootstrap Contract Evidence
Date: 2026-06-21
Timezone: America/St_Johns
Scope
Added a machine-readable bootstrap contract so a fresh AI agent can be told to use UAI Explorer, authenticate through the AI lane, and learn UAI operating rules without a long prompt.
Contract
Endpoint: GET /api/ai/bootstrap
Returned packet kind: uai-ai-bootstrap
Allowed adapter tool added:
uai_bootstrap
The packet lists:
- required UAI rules,
- the
task_prompt_contractfull and quick assignment prompt templates, - the endpoint plus
UAI_EXPLORER_AI_API_KEYconvention for non-connector agents, - the public-safe readiness sequence,
- denied surfaces,
- allowed AI endpoints,
- primary context slugs to retrieve through
/api/ai/context/{slug}, - language and tooling notes for Python, Rust/Axum, and C++ lanes,
- production CT
121and sandbox CT126boundaries, - redaction and raw-content flags.
The prompt UX rule is that a human only needs to provide product, task, authority, and done condition. UAI Explorer supplies the lab rules and context through bootstrap and primary context packets.
Basic AI API key support is intentionally limited: keys are issued by an admin
for existing role=ai users, are visible once, are sent as Authorization:
Bearer, inherit the AI user's tags, and can be revoked. vNext should use
task-bound delegation and one-time key exchange.
Boundaries
- Raw content included:
false. - Raw source paths included:
false. - Raw source hashes included:
false. - Raw filesystem browsing added:
false. - Admin or upload authority added:
false. - External exposure changed:
false.
Verification Targets
Regression test:
[REDACTED:high-entropy]
Local verification:
python -m py_compileoverserver.py,tools/*.py, andtests/*.pypassed.python -m unittest discover -s tests -vpassed with55tests.- Public Markdown secret scan passed across
60files.
Required docs:
docs/runbooks/ai-lanes-mcp-adapter.mddocs/runbooks/uai-development-standards.md[REDACTED:high-entropy].mdSTART_HERE_AI.mdUAI_EXPLORER_RULES.md
Final local and container verification is recorded in the final completion audit after sync.