Spaces:
Running
Running
| # auth.md | |
| You are an agent. This site is a static, public, read-only deployment of the | |
| PRISM benchmark. **Agentic registration is not supported.** There is no user | |
| account, no API key, and no token to issue. | |
| This file tells you what is available, what is not, and where to look next. | |
| ## What this site is | |
| PRISM (Peer Review Intelligence via Structured Multi-dimensional assessment) | |
| is a benchmark for evaluating LLM-generated and human peer reviews of machine | |
| learning papers. The site publishes: | |
| - The paper (read-only HTML at `/`). | |
| - An interactive demo explorer (read-only HTML at `/demo`) backed by static | |
| JSON fixtures under `data_demo/`. | |
| - A machine-readable capability descriptor at `/.well-known/agent-card.json`. | |
| - A resource catalog at `/.well-known/api-catalog`. | |
| - A documentation-only DNS-AID zone file at `/.well-known/dns-aid.zone`. | |
| ## Current state | |
| This site does not support agentic registration. There is no `/agent/identity` | |
| endpoint, no token endpoint, no revocation endpoint, and no claim ceremony. | |
| Every URL on the site is publicly fetchable without credentials. | |
| Do not attempt to register. Do not poll for a token. Do not expect a | |
| `WWW-Authenticate: Bearer resource_metadata="..."` header on a 401 — the site | |
| does not return 401, because there is nothing to gate. | |
| ## What you can do | |
| 1. **Read the capability descriptor.** `GET /.well-known/agent-card.json` | |
| returns the full A2A agent-card with the four benchmark capabilities | |
| (constructiveness, flaws, depth, novelty), their inputs, metrics, and links | |
| to the demo. This is the authoritative description of what the site offers. | |
| 2. **Browse the resource catalog.** `GET /.well-known/api-catalog` returns a | |
| JSON-LD `DataCatalog` of the public resources. | |
| 3. **Read the documentation-only DNS-AID zone file.** | |
| `GET /.well-known/dns-aid.zone` returns the zone file the maintainers | |
| intend to publish at a custom domain once one is registered. It is not | |
| authoritative on the current `prism-benchmark.github.io` host because the | |
| project does not own the `github.io` zone — the in-file comment block | |
| explains the migration path. | |
| 4. **Run the demo.** `GET /demo` returns the interactive read-only demo page. | |
| The JSON fixtures it loads are public. | |
| 5. **Cite the paper.** The arXiv link is in the capability descriptor. | |
| ## Discovery (for completeness) | |
| The standard auth.md discovery documents are published but intentionally | |
| empty, so an agent deciding whether to register gets a clean negative answer: | |
| - `GET /.well-known/oauth-protected-resource` — RFC 9728 Protected Resource | |
| Metadata with an empty `authorization_servers` array, signalling that none | |
| of the public resources require authorization. | |
| - `GET /.well-known/oauth-authorization-server` — RFC 8414 Authorization | |
| Server Metadata with an `agent_auth` block whose `identity_types_supported` | |
| and `credential_types_supported` arrays are empty, signalling that no | |
| registration surface is offered. `register_uri`, `claim_url`, and the | |
| `revocation_endpoint` are explicitly `null` (not applicable). | |
| ## Errors you may encounter | |
| | Status | Meaning | What to do | | |
| | -------------------------------------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------- | | |
| | Any non-2xx on a public resource | The page or fixture is missing or has moved. | Re-read the capability descriptor; do not retry the same URL. | | |
| | `404` on `/.well-known/oauth-authorization-server` | The AS metadata is intentionally not published in some deployments (see above). | Treat the site as not offering agentic registration. | | |