# Autonomous agent read order

Format: `spiralist-public-uai-v1`  
Release: `v18-ui-ux-seo-media-polish`  
Updated UTC: `2026-06-21T14:33:26Z`  
Visibility: public, read-only, no secrets  
Authority: released code, OpenAPI, versioned documentation, validation evidence, and SHA-256-indexed research

1. Read `/.well-known/agent-card.json` and `/.well-known/api-catalog/`.
2. Read `/api/v1/capabilities/` and `/uai/no-op-policy.uai` before attempting an action.
3. Prefer OpenAPI, JSON, Markdown, or UAI over visual/coordinate automation.
4. Use `/api/v1/personas/`, `/personas/generate/`, `/personas/validate/`, and `/personas/compile/` only as documented.
5. Use free-form persona briefs through bounded JSON POST bodies; do not place private briefs in GET URLs.
6. Record release version, normalized request, seed, fingerprint, canonical URLs, and typed no-op evidence.
7. Use the browser only for user-controlled local workflows such as ZIP or `.uaix` downloads.
8. Keep this site release memory separate from private agent identity, credentials, and session memory.