auth.md

auth.md

You are an agent. This site is a static, public, read-only deployment of the PRISM benchmark. Agentic registration is not supported. There is no user account, no API key, and no token to issue.

This file tells you what is available, what is not, and where to look next.

What this site is

PRISM (Peer Review Intelligence via Structured Multi-dimensional assessment) is a benchmark for evaluating LLM-generated and human peer reviews of machine learning papers. The site publishes:

• The paper (read-only HTML at /).
• An interactive demo explorer (read-only HTML at /demo) backed by static JSON fixtures under data_demo/.
• A machine-readable capability descriptor at /.well-known/agent-card.json.
• A resource catalog at /.well-known/api-catalog.
• A documentation-only DNS-AID zone file at /.well-known/dns-aid.zone.

Current state

This site does not support agentic registration. There is no /agent/identity endpoint, no token endpoint, no revocation endpoint, and no claim ceremony. Every URL on the site is publicly fetchable without credentials.

Do not attempt to register. Do not poll for a token. Do not expect a WWW-Authenticate: Bearer resource_metadata="..." header on a 401 — the site does not return 401, because there is nothing to gate.

What you can do

1. Read the capability descriptor. GET /.well-known/agent-card.json returns the full A2A agent-card with the four benchmark capabilities (constructiveness, flaws, depth, novelty), their inputs, metrics, and links to the demo. This is the authoritative description of what the site offers.
2. Browse the resource catalog. GET /.well-known/api-catalog returns a JSON-LD DataCatalog of the public resources.
3. Read the documentation-only DNS-AID zone file. GET /.well-known/dns-aid.zone returns the zone file the maintainers intend to publish at a custom domain once one is registered. It is not authoritative on the current prism-benchmark.github.io host because the project does not own the github.io zone — the in-file comment block explains the migration path.
4. Run the demo. GET /demo returns the interactive read-only demo page. The JSON fixtures it loads are public.
5. Cite the paper. The arXiv link is in the capability descriptor.

Discovery (for completeness)

The standard auth.md discovery documents are published but intentionally empty, so an agent deciding whether to register gets a clean negative answer:

• GET /.well-known/oauth-protected-resource — RFC 9728 Protected Resource Metadata with an empty authorization_servers array, signalling that none of the public resources require authorization.
• GET /.well-known/oauth-authorization-server — RFC 8414 Authorization Server Metadata with an agent_auth block whose identity_types_supported and credential_types_supported arrays are empty, signalling that no registration surface is offered. register_uri, claim_url, and the revocation_endpoint are explicitly null (not applicable).

Errors you may encounter

Status	Meaning	What to do
Any non-2xx on a public resource	The page or fixture is missing or has moved.	Re-read the capability descriptor; do not retry the same URL.
404 on /.well-known/oauth-authorization-server	The AS metadata is intentionally not published in some deployments (see above).	Treat the site as not offering agentic registration.