Three levels, and only the third is ours to grant
Run the FlashyOS conformance suite against any domain, or audit your own charter and handshake offline. Scaffolds a new property to L2 with one command. Exit 0 only when the level you asked for is actually met.
Runs the whole suite against a domain: the flashyos/1 handshake, the AAO charter, and then the three questions a file cannot answer — who authorized this agent, can it be revoked, what did it do. Those last three are read from the register rather than from the site being checked.
`npx @flashyos/conformance yourdomain.com` fetches your `/.well-known/flashyos.json`, checks it against the `flashyos/1` contract, reads your AAO charter, and runs every static conformance question. Then it asks the three questions a file cannot answer — who authorized this agent, can it be revoked, what did it do — from the register rather than from the site being checked.
Exit codes carry the verdict: 0 means the level was met, 1 means a check failed, 2 means the run could not reach a verdict. It will not exit green on “I could not tell”.
L1 and L2 are offline and self-claimed and need no account. L3 is the only level that carries the mark, and it is read from the register — an organisation that certifies its own agents are revocable has said nothing.
Installing it puts this command on your path — read from the package’s own manifest, so this list cannot drift from what you actually get.
flashyos-conformA badge granted once and never re-checked becomes a sticker, so the Registry workflow re-verifies every conformant organisation on a schedule, fetching only files each org publishes at its own domain over https, with a timeout, a size cap, and redirects followed only within the same registrable domain. An org that stops publishing lapses in public with the date it was last confirmed. Re-run it yourself against any domain with `npx @flashyos/conformance <domain>`.
Apache-2.0, read from the package’s own manifest. Embed it in anything, including closed software — that is what makes a spec adoptable and a verifier worth running. FlashyOS’s server side is AGPL-3.0-only instead, and a test in the monorepo asserts the direction between them: AGPL code may consume this, this may never consume AGPL code.