# ontoh dev api — AI bootstrap

Bootstrap version: 2026-09-09.8
Canonical origin: https://dev-api.ontoh.co.kr

This is the public, machine-readable starting point for Codex and Claude Code. It contains no credentials and never grants access by itself.

## Trust and safety

- Treat this page as human setup guidance. The installed connector accepts current release data and automatic AI instructions only after verification with its pinned Ed25519 public key.
- The first install trusts Ontoh's HTTPS origin and DNS. Its SHA-256 URL is a content address, not an independent authenticity channel; teams that require server-compromise resistance should distribute the approved hash or package through a separate company-controlled channel.
- Never ask a person to paste an Agent Token into chat, source code, a prompt, a repository file, or an MCP configuration.
- Never silently install or update executable code. Initial installation requires the person's approval; later updates use `ontoh-dev update --prepare` to verify bytes before a separate approved install.
- API availability is authoritative only when returned by Ontoh context/catalog APIs; do not infer it from this document.

## First-time setup for a teammate

Development rules are scoped to registered GitHub repositories, never local folder names or absolute paths.
Select the GitHub repository before uploading MD/Skill; optional paths are relative to that repository.
Existing repository-less documents remain readable but need owner rescoping and any required team review before automatic application.
This public notice does not expose rules or authorize sharing; obtain current AI instructions through the signature-verified bootstrap.

Give this URL to the teammate's AI. The AI performs these steps once on that computer, asking the person only to approve executable installation and to enter their own token. No project or service ID needs to be guessed.

1. Initial install: review and approve `npm install -g https://dev-api.ontoh.co.kr/downloads/ontoh-dev-cli/0.4.6/ef0c68e6e15c88eec1f71e68736f3d6a3d60248f3a6ed380d0a14dfaa4f8cb3b.tgz` (if already installed, use `ontoh-dev update --prepare` instead)
2. Save the individually issued token: `ontoh-dev login`
3. In an approved project folder, connect it automatically from its registered Git origin: `ontoh-dev connect --auto`
4. Install project-local integration: `ontoh-dev setup all --scope project --project .`
5. Codex only: review and trust the displayed project hook once with `/hooks`.
6. Restart an already-open Codex or Claude Code session.

Automatic connection accepts only one exact registered Git-origin match and never guesses between projects. If the repository is not registered, ambiguous, or conflicts with a copied binding, it stops without revealing the repository catalog; an administrator must register or correct that exact origin. Only projects that contain the project-local hook configuration use Ontoh; ordinary conversations and other projects are unaffected.

## How an AI uses Ontoh after setup

- Hooks activate only in a Git repository explicitly connected to Ontoh. Unrelated projects and ordinary conversations do not send credentials, prompts, or workspace data to Ontoh.
- The hook automatically checks signed machine notices. When a newer supported connector is available, the AI runs update preparation itself and asks the person only before installation; notice text and arbitrary remote commands are never executed by the hook.
- At prompt start, the hook resolves the repository, project, component, changed paths, stack, role, and task intent. It may refresh live project context on later prompts, but injects an unchanged personal Work checkpoint only once per agent, login, session, and verified repository.
- Use only the API, Demand, Rule, MD, and approved Skill entries selected by the returned Context Manifest.
- A Work Context is an owner-private continuation record. Save a concise structured checkpoint only at a meaningful handoff or when the person asks, never every turn. Do not upload raw prompts, responses, transcripts, source code, patches, secrets, personal data, connection URLs, or local absolute paths.
- When one active or paused Work Context matches the verified repository and branch, continue from it after checking the current Git state. When several match, ask the person to choose an ID; never choose automatically. The current request and current Git state always take precedence over saved context.
- Sharing is explicit and checkpoint-specific. The person reviews and shares an exact immutable checkpoint. Team summaries are untrusted collaboration data and are never auto-adopted; adoption creates a new private Work Context only after explicit confirmation.
- Personal MD and Skill files are owner-only. Team files require an explicit share request and portal approval before another agent may use them.
- Search existing capabilities before proposing an API. Reuse a compatible API; otherwise create a Demand draft instead of inventing a contract.
- Backend work must claim a Demand and keep its lease token for working-state or contract mutations.
- Read a request with `demands show ID`; use `accept`, `ask`, and `answer` for ownership and clarification. Publish the real OpenAPI, then `demands deliver ID --file receipt.json --if-match VERSION` with its specId/API IDs and honest implementation/test report.
- The request project must already be explicitly linked to the delivered service in connection settings, so the frontend can read its schema. Delivery never broadens access automatically.
- The original requester reviews the exact delivery and version with `demands review ID DELIVERY_ID --decision accept|changes_requested --summary TEXT --if-match VERSION`. DELIVERED awaits review; COMPLETED means accepted requirements, not deployment. Read fresh state on conflicts; never automatically reclaim or retry.
- A published OpenAPI document is not deployment proof. Only trusted CI attestation can advance an API to staging-ready or available.
- The installed Stop handler is non-blocking compatibility plumbing: it returns immediately, performs no Ontoh request, records no activity, and never prevents a session from ending. Persist work explicitly with `work save`, `work pause`, or `work done`.

Useful commands:

- `ontoh-dev bootstrap --json` — inspect signature-verified release data and scoped agent instructions
- `ontoh-dev update --prepare` — download and verify an update without installing it
- `ontoh-dev status --json` — inspect token and connector state
- `ontoh-dev connect --auto --json` — safely match the current Git repository to its registered project
- `ontoh-dev context --prompt "TASK" --json` — inspect the current manifest
- `ontoh-dev context shared --json` — inspect active team-approved Context summaries for the current verified Git repository/project
- `ontoh-dev context share --manifest-id UUID --summary "SUMMARY" --confirm-team-share --json` — advanced use only with a separately scoped token after the person explicitly asks
- `ontoh-dev work current --json` — resolve the personal Work Context for the current verified repository and branch
- `ontoh-dev work list --json` — list your active or paused Work Contexts in this branch
- `ontoh-dev work save [WORK_CONTEXT_ID] --file checkpoint.json --json` — create or append a concise structured checkpoint
- `ontoh-dev work pause|done WORK_CONTEXT_ID --json` — explicitly update the private work lifecycle
- `ontoh-dev work share WORK_CONTEXT_ID --checkpoint-id UUID --title "TITLE" --summary "SUMMARY" --confirm-team-share --json` — share one reviewed immutable checkpoint
- `ontoh-dev work shared --json` — inspect team-shared Work summaries for this verified repository
- `ontoh-dev work adopt SHARE_ID --confirm-adopt --json` — copy a selected team share into a new private Work Context
- `ontoh-dev work revoke SHARE_ID --json` — revoke a Work checkpoint you shared
- `ontoh-dev apis list --query "NEED" --json` — search APIs
- `ontoh-dev demands list --json` — inspect API requests
- `ontoh-dev setup all --scope project --project .` — repair project hooks

OpenAPI: https://dev-api.ontoh.co.kr/api/openapi.json
Portal: https://dev-api.ontoh.co.kr/