Conformance · flashyos/1 · three levels

The spec is free. The mark is not.

Anyone may build on the FlashyOS mesh, fork the spec, or ship a competing implementation — the handshake contract, the AAO format, the JSON Schema and the conformance suite itself are all Apache-2.0. A standard that needs our permission is not a standard. What is not free is the claim that a stranger verified your organization is accountable, because that claim is only worth anything if someone other than you made it.

npx @flashyos/conformance yourdomain.com

Three levels

A programme with one binary — conformant or not — gets adopted by nobody, because the first thing a stranger can prove about themselves is small and the last thing is expensive. The first two levels are yours to check offline and claim without asking. The third is the one we verify.

L1
Discoverable
Serves a valid flashyos/1 handshake at /.well-known/flashyos.json.
Publish one JSON file at a fixed path. No account, no relationship with us, nothing to sign.
self-claimed
L2
Chartered
Publishes an AAO charter that passes every static conformance question.
Publish an AAO charter and pass all five static questions — who your agents are, what they may do, which human is accountable, and what waits for approval.
self-claimed
L3
Accountable
The three runtime facts — authorized, revocable, auditable — are verified against the register.
Run agents on the mesh long enough to have a record: every live token names the human who minted it, authority is bounded, and there are decisions a human actually resolved.
carries the mark

The three questions a file cannot answer

An organization that certifies its own agents are revocable has said nothing. So the suite reads these three from the register — not from the site it is checking. That asymmetry is the only reason Level 3 is worth more than a self-declaration, and it is why the register has to be able to answer no.

Who authorized this agent?
Every live token names the human who minted it. Bootstrap and legacy tokens are not excused — neither lies, but neither answers the question.
authorization-recorded
Can I revoke it?
Authority ends by default, not only by intervention: every live token expires, or the org has demonstrably revoked one before.
revocable
What did it do?
Agent events for ordinary work and decision records for the consequential kind. An org that never routes a decision to a human is automated, not governed.
auditable

Only public orgs have a conformance record. A private org’s is indistinguishable from a missing one — same status, same message — because whether an organization exists is itself that organization’s data.

In your CI

Levels 1 and 2 need no account and make no call to us beyond fetching your own files. Run them on every commit.

.github/workflows/conformance.yml
name: FlashyOS conformance
on: [push, pull_request]
jobs:
  conform:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npx @flashyos/conformance ${{ vars.DOMAIN }} --level 2

Exit codes are three rather than two. A suite that exits green on “I could not tell” is how green ticks stop meaning anything, so an unreachable register defers rather than passes.

0the level you asked for is met
1a check at that level failed
2the run could not reach a verdict

Who may say what

Anyone, without asking
  • speaks flashyos/1
  • publishes an AAO charter
  • compatible with the FlashyOS mesh
  • built with @flashyos/agent
  • your L1 or L2 report, verbatim, including the level number
Level 3, and only while it holds
  • the ⚡ mark itself
  • the words “FlashyOS Conformant”
  • the word “Certified” alongside FlashyOS or AAO

The entitlement is continuous, not a certificate with a date on it. If the register stops verifying a fact, the entitlement stops with it. Full terms ship with the package as MARK.md, which is also candid about which half of the programme is built and which half still needs a filing.

Why not just close it

Because it does not work. A closed protocol has no second implementer, and a protocol with one implementer is a product. The alternative people reach for — a permissive licence and hope — does not work either: anyone can rebuild this functionality without depending on a single one of our packages, and they can.

What cannot be rebuilt is a register other people already trust. That is earned by publishing the criteria, running them the same way for everyone including ourselves, and being willing to fail. Today the suite reports flashyos.com at Level 1: we publish the format and do not yet wear the charter. Leaving that on the page is the point.

Start with the AAO spec, or read Governance for how declarations become enforced decisions once an org is live.