Canonical per-app agent descriptor (side-effect-free)

Side-effect-free sibling of the page gate: no auto-claim, no token mint, no cookie, no mutating telemetry. A public or remixable app returns the full descriptor to anyone, with operations[].input/output/examples gated on app:read (owner, accepted share grant, team membership, or a bearer token) — an anonymous caller sees discovery-level operation fields only. A private app returns the full descriptor only to a caller who already holds app:read; everyone else — including an unclaimed app’s claim-cookie holder, which grants app:run but never app:read — gets the minimal stub (AppDescriptorStub). Reachable via both the /app/{id} UUID form and the /{handle}/{app-name} friendly form (byte-identical id + canonical_url), and advertised from the served page’s <link rel="alternate" type="application/json"> and matching Link: HTTP header.

curl -X GET "https://charm.ing/app/string/agent.json" \
  -H "Authorization: Bearer YOUR_TOKEN"

const response = await fetch("https://charm.ing/app/string/agent.json", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});

import requests

response = requests.get(
    "https://charm.ing/app/string/agent.json",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)

{}

{
  "ok": false,
  "error": {
    "kind": "not_found",
    "message": "string",
    "reason": "token_malformed",
    "recovery": {
      "kind": "pair",
      "start": "<uri>",
      "verification_url": "<uri>",
      "instructions": "string"
    }
  }
}

{
  "ok": false,
  "error": {
    "kind": "not_found",
    "message": "string",
    "reason": "token_malformed",
    "recovery": {
      "kind": "pair",
      "start": "<uri>",
      "verification_url": "<uri>",
      "instructions": "string"
    }
  }
}