# services.dev

> AI delivers every job, people or their agents pay when it's done, and a person is one optional line, wherever you want or need one.

Software sold tools and left buyers the work. Services-as-Software sells the finished job.

Use services.dev to sell a kind of work as a finished job: write one Service() and it serves a site, an API, an MCP server, a CLI, an SDK, docs, and an app for your buyers and you. Not for internal AI tools or chat assistants.

Writing a Service? Read "Write a Service". Buying from a brand built on services.dev? Read "Buy a job".

## Write a Service

1. `npx services.dev` writes `services/translation.ts`, its brief and AGENTS.md, and serves it on localhost with simulated AI and money. No account, key or card.
2. Edit the file. Leave out `human` and AI delivers every job alone.
3. Run `npx services.dev check --json`. Each failure carries `code`, `reason`, `next` and `doc_url`:

```json
{
  "code": "price_below_cost",
  "reason": "A delivered job could lose money: payout, nested Services and the AI cap add up to more than the price.",
  "next": "Raise price.usd, or lower payout.",
  "doc_url": "https://services.dev/docs/reference/check/price_below_cost"
}
```

Fix the first `next`, run it again, and stop when it exits 0 with `failures: []`.

### Every key of Service()

| Key | Written | Left out | Does |
|---|---|---|---|
| `name` | `string` | required | What buyers call the work: the Site's title and the tool description's first word. |
| `input` | `{ <field>: <type word> }` | required | What a buyer sends, field by field. |
| `output` | `{ <field>: <type word> }` | required | What the buyer gets back. |
| `deliver` | `Deliver` | `'ai'`, briefed by services/&lt;id>.md | Who does the work: `'ai'`, a person or a role word, a URL, your function, or named steps in order. |
| `human` | `Human` | none: AI delivers every job alone | Optional: `'risky'`, `'always'`, your rule, or a credential that signs. |
| `price` | `number \| PriceForm` | required | What a job costs: dollars, or `{ usd, payout, within, approved, share, of, release }`; with `every`, what each cycle of a subscription costs, and `includes` its allowances. |
| `outcome` | `Outcome` | none | What a share is paid on: the amount, who proves it, how a payment finds the job, and how long the money stays held. |
| `on` | `Triggers` | none | What starts jobs on a subscription: dates in `schedule`, events in `event`, each minting this Service or the one it names. Needs `price.every`. |
| `description` | `string` | written from name, input and output | One sentence for the Site's lede and the tool description. |
| `review` | `Review` | `'adversarial'` | How the AI checks every job before it ships: `'adversarial'`, or `'affirmative'` for creative work. |
| `policy` | `{ <name>: PolicyEntry }` | none | What an order may set, within your bounds: the buyer's mechanics, and the merits only the client sets. |
| `signals` | `{ <name>: Signal }` | none | Named facts that route the work: a predicate, `silent` for a span, or `inbound`; `goto` moves the job. |
| `ends` | `{ <end>: EndSpec }` | none | Ends beyond accepted, canceled, lapsed and declined, each with its charge, who may reach it, and what can follow. |
| `status` | `Status` | `'live'` | `'live'`, `'preview'` (test keys only) or `'roadmap'` (published, answering not_live). |
| `roles` | `{ [K in R]: Role }` | none: a role word is your staff | Who may do, sign or review a step: each role's Pool, credential, region, pay and separation. A step's role word names one. |
| `rules` | `Rules` | none: no act is reserved | The rules table, from rules.ts or a package you pin: which acts are reserved, open or refused. |
| `subject` | `SubjectSpec` | none | What outlives the job: a subject keyed by an input or a receipt, the member of record on it, its kept facts, its periods, and the Service that watches its clocks. |
| `clocks` | `{ <name>: Clock }` | none | Dates the world sets, by name: when each is due, who answers for it, the rungs that notice, escalate, ask for an acknowledgement and run a step, the steps that move it, and what the owner chooses at the end. The rungs, moves, `every` and `on` run, and the clock's own calls acknowledge, satisfy, choose and name its owner. |
| `talk` | `Talk \| false` | on, the AI answering the client | The job's thread: the AI answers the client in it, and holds an answer in an advice class the rules reserve until a member of `adopt` adopts it. `false` turns it off. |
| `calendar` | `Calendar` | the brand's | This Service's own calendar, in place of the brand's: its zone, closed days, closing minute and roll. |
| Key | Written | Left out | Does |
| `subject.kind` | `string` | required | What it is, in your words: 'patent family', 'trademark', 'company'. |
| `subject.key` | `(keyof I \| keyof O) & string` | required | The input, or the output a receipt fills, whose value names it: `application_number`, `ein`. |
| `subject.of_record` | `{ role: RoleWord; named_at: <step>; custodian?: (RoleWord \| 'brand')[] }` | none | The member of record: whoever attests at `named_at` stays of record on the subject across jobs. Withdrawal names a successor; a member whose credential or coverage lapses leaves it vacant, and `custodian` covers it, rung by rung, then the brand. |
| `subject.keeps` | `K` | none | Facts the subject keeps across jobs, each from the output that writes it: `{ carryforwards: 'carryforwards', tax: 'tax' }`, typed as that output is. Written only when a job ends accepted, never when it is canceled or lapses, and keyed by the period the job held. Insert-only: each value records `{ value, job, step, at, period }`, and nothing is overwritten. |
| `subject.period` | `(keyof I & string) \| ((job) => string)` | none | One live or ended job of this Service per subject per period: the input that names the period, or a function of the order. A second order for a period answers 409 `period_taken`, its next the follow-on the end offers, such as an amendment. A canceled job frees its period. |
| `subject.steward` | `AnyService` | none | The Service that keeps the subject's clocks once a job ends with one still running: ordered with the subject's key, it keeps the date in someone's hands. Until it is, the customer portal offers it beside an ask in which the client acknowledges they own the date, and nothing lapses into a gap between jobs. |
| Key | Written | Left out | Does |
| `price.every` | `Every` | none | A subscription: an order is a Subscription, `sbn_…`, charged `usd` at the start of each cycle, and `on` mints its jobs. |
| `price.includes` | `{ <name>: number }` | none | Allowances per cycle, by Service id: inside one a job is $0 and counted; past it, the order answers 402 OFFER at the job's price. Renewal resets them. |

### Step forms

Each step under `deliver` is one of these:

| Written | Does |
|---|---|
| `'ai'`, `'person'`, a role word, a URL, your function, another Service | `'ai'`, a person, a URL, your function, or another of your Services. A person is `'person'`, or a role word such as `'interpreter'`: the role names their app, `/interpreters`. Once you write `roles`, a role word is one of them. |
| `{ by, … }` | Work: AI, a person, your code, a URL or another Service proposes output. |
| `{ review, … }` | Review: a step that hardens the step before it (adversarial) or extends it, "yes, and" (affirmative). |
| `{ ask, to, … }` | Ask: a party acts, through a hosted single-use link or the customer portal, with no account. The job waits `on: 'party'`, and the step's `within` pauses. Every ask is an object, `ask_…`, with its own link. |
| `{ submit, to, receipt, … }` | Submit: send to a system you don't control, and keep its receipt. The send goes through the gate, so a guard can stop it, and the job waits `on: 'outside'` for the answer. A rejection is a transition: the job moves to the repair step `rejected` names, never an error answer. |

## Money

- `price` is required. Every price is per job, and a job keeps the price it was ordered at.
- you = charge − tax − processing − AI − pay − pass-through − coverage − placement − nested Services − services.dev's take. Pay is $0 when no person works on the job.
- The AI spends at most 20% of a job's price, so a job AI delivers alone leaves you at least 80%, before services.dev's take: a share of the value your brand adds on each released charge, smaller on higher [plans](https://services.dev/docs/money/plans.md).
- Every key runs on every plan in test; the plan decides which run on live jobs, and `check` names the one a file needs. The plans side by side: [pricing](https://services.dev/pricing.md).

## Buy a job

Every brand serves `/.well-known/agents.json`, `/llms.txt`, `/mcp`, `/openapi.json` and `/pricing`.

1. Ask the price: call `order_<service>`, or `POST /jobs` with `service`, without `max_usd`. The answer is an offer, HTTP 402, with `next`.
2. Order: send `next` as is. The answer is a job.
3. Wait: `get_job` with `wait: 50`, or `GET /jobs/<id>?wait=50`.
4. Accept: `accept_job`, or `send_back_job` with a note and the AI redoes it.

- A file is `{ url, name }`. `max_usd` is the most you pay in all, and the same `key` and input return the same job.
- A refusal carries `type`, `code`, `reason`, `next`, `doc_url` and `request_id`. `next` is `{ do, tool, arguments, http }`, safe to send as is; a wrong input's `next` names the fields to fill.
- Only a person approves, signs or raises a buyer key's budget.

## Docs

Every written page, tab by tab.

### Start

- [Your first paid job](https://services.dev/docs.md): One command writes a Service, serves it on every surface, and has an agent buy a job that AI delivers. No account, key or card.
- [The whole system](https://services.dev/docs/start/system.md): One Service({...}) becomes a whole business. The file, the objects it creates, the two rules that hold them together, and how the Service and services.dev earn.
- [Services as software](https://services.dev/docs/start/why.md): Most paid work is a known sequence of steps. A Service sells the finished job, delivered by AI, with people where you want or need them, and buyers and their agents pay when it's done.
- [How a job runs](https://services.dev/docs/start/how-it-runs.md): One order, carried from the first input to the last cent. Every Service runs the same six stops, whether AI does all of it or a credentialed person signs.
- [Everyone gets an app](https://services.dev/docs/start/participants.md): Who takes part in a job is worked out from your Service, never declared, and each of them gets the app and the calls their part needs.
- [Choose your shape](https://services.dev/docs/start/shapes.md): Find the reference Service that looks like your business, see what each of its jobs leaves you and the plan it runs live on, then build it file by file and take the first real job.
- [Your own Service](https://services.dev/docs/own.md): Add the work you sell to your brand, brief the AI that does it, check it until it's ready, and sell it on every surface.
- [Harden it](https://services.dev/docs/grow/review.md): Add a review step that attacks every translation before the buyer sees it, and watch the redo it sends back.
- [Ask the buyer](https://services.dev/docs/grow/ask.md): Add an ask step. The buyer answers one question through a link that needs no account, and the job's clock pauses until they do.
- [Add a signer](https://services.dev/docs/grow/role.md): A sworn translator from your Pool signs every job. A rules row reserves the act to their credential, and the signature is stamped into the file it binds.
- [File it somewhere](https://services.dev/docs/grow/submit.md): Send the signed translation to a registry, keep its receipt, route a coded rejection back to the signer, and charge on the receipt.
- [A date the world sets](https://services.dev/docs/grow/clock.md): Give the filing a date the registry sets and the buyer answers for. Three days out, a rung asks the registry for more time; at the date, unfiled, the buyer chooses what happens.
- [Paid on the close](https://services.dev/docs/grow/outcome.md): AI works a deal, and the buyer pays nothing until its own customer pays it. Two lines make a Service outcome-priced, the outcome with its proof and the share the price takes, and check prints what a win leaves you, what a loss costs and the win rate where they meet.
- [Every month](https://services.dev/docs/grow/subscription.md): Sell Translation by the month on the buyer's site. A schedule and an event order it, four a month are included, the fifth is offered at its price, and renewal resets the count.
- [All four, in one filing](https://services.dev/docs/grow/together.md): Grow 1 to 4 in one Service, and every branch it writes run once, each by the magic value that produces it.
- [Build with your coding agent](https://services.dev/docs/start/agents.md): The agent in your editor writes Services the way you would. AGENTS.md tells it the loop, check --json tells it what to fix, and every failure names the fix.
- [Take the first real job](https://services.dev/docs/start/live.md): Connect Stripe, deploy live on your builder.domains address, and take a paid order. What test kept, what live changes, and the first payout, yours and each member's.

### Service

- [Service()](https://services.dev/docs/service.md): Service({...}) is the only constructor. One file in services/ is one kind of work you sell and how it earns; its path is its address, and it runs nothing until it serves.
- [Fields and type words](https://services.dev/docs/service/fields.md): input and output name each field with one of eleven type words. Add ? for optional, [] for a list, and a note an agent can try.
- [deliver](https://services.dev/docs/service/deliver.md): Who does the work on each job. Leave it out and AI does it, in one step. Name steps and each can be AI, your code, a person, a party or an outside system.
- [The step graph](https://services.dev/docs/service/graph.md): Steps run in the order you write them. after, when and next add branches, loops, joins and parallel steps, and the step that last committed is the job's stage.
- [AI steps and briefs](https://services.dev/docs/service/ai.md): An AI step works from a brief you write in Markdown. Every call is recorded with its model, the hash of each input and the brief it read, so any job replays.
- [Review steps](https://services.dev/docs/service/review.md): A review step hardens the work before it, or extends it. Adversarial lenses attack it and flag it back; affirmative lenses propose additions and keep the ones that hold.
- [Asks: a ceremony without an account](https://services.dev/docs/service/ask.md): An ask step waits on a party to sign, consent, answer, upload, decide or direct, through a single-use link that needs no account. Only that party can complete it.
- [Grants and decisions](https://services.dev/docs/service/grants.md): A grant ask is a scoped, expiring permission the party gives through their own link. A step that needs it is refused needs_grant until it is live, and asked for again once it expires or the party revokes it. A decide ask is the client's choice among yours, and it is merits.
- [Intake and request lists](https://services.dev/docs/service/intake.md): Intake is steps at the top of the graph. Consent comes first, then the terms, then a request list your code derives from the job and its subject. Each item is answered, waived with a reason or substituted, and a step can start on one item while the rest are still open.
- [Sending to outside systems](https://services.dev/docs/service/submit.md): A submit step sends the work to a system you don't control, waits for its answer and keeps a typed receipt. Rejections route by code, a timely repair stays timely, and silence falls back.
- [One submission per element](https://services.dev/docs/service/each.md): each sends one submission per element of a list and keeps one receipt for each. The lead goes first, and the linked ones wait for its acceptance.
- [Your code as a step](https://services.dev/docs/service/code.md): A function can do the whole job or one step of it. It gets the input and the job, returns output, and can name the rule its calculation follows on the record.
- [Sourced output](https://services.dev/docs/service/sourced.md): cite 'source' makes every field a step outputs carry the file and page it came from, and the review fails a field that doesn't trace.
- [Another Service as a step](https://services.dev/docs/service/nested.md): Import one of your Services and make it a step. It is ordered the way an agent orders it, at its price, and keeps its own job and ledger.
- [Propose, then the gate commits](https://services.dev/docs/service/gate.md): AI, your code, a person and an outside system all propose. One gate runs seven checks in order and commits or refuses, the same way for everyone.
- [Guards](https://services.dev/docs/service/guards.md): A guard checks a step's output before it commits, such as a floor, a cap or a required field. The AI redoes a refused proposal, and a person's step stays theirs until it holds.
- [What the buyer sets, and what only the client sets](https://services.dev/docs/service/policy.md): policy declares what an order may set, each value with a default and bounds. Mechanics are the buyer's; merits are the client's alone; the rest is the house's.
- [Signals](https://services.dev/docs/service/signals.md): A signal is a named fact about the job. A predicate turns true, a silence runs its span, or your system says so; a signal can move the job, and never blocks it.
- [How a job ends](https://services.dev/docs/service/ends.md): Every job can be accepted, canceled, lapsed or declined, and a Service declares the rest. Each end says what it charges and who may reach it. An end is forever, and again starts a linked job.
- [The job lifecycle](https://services.dev/docs/service/lifecycle.md): Every status a job can be in, what it waits on, and every move between them the engine made in a captured run.
- [Keeping time](https://services.dev/docs/service/time.md): Every kind of time a Service keeps, indexed with its key, its place in the tick, its money and its page. Each compiles to one timer on the record, fired once on the brand's calendar in a fixed order.
- [Timers and replay](https://services.dev/docs/service/timers.md): Every kind of time compiles to one timer on the record, keyed so a replay arms it again and no move of a date rewrites it. It is armed, fired, superseded or held, re-armed only by a closed list of events, committed once however often it is woken, and pinned with the bundle it was armed under.
- [Deadlines](https://services.dev/docs/service/within.md): within is the job's deadline, 48 hours unless you set it, or a span before a date the world sets, stated in the price sentence. It counts only while the work is the brand's. At three quarters the job is at risk, at the end it is late, and price.late takes a share off the charge.
- [Clocks](https://services.dev/docs/service/clocks.md): A clock is a date the world sets, beside the job's own deadline. It names who answers for it, rings rungs that give notice, escalate, ask for an acknowledgement and run a step through the gate, moves when an extension commits or never moves at all, can be one date per item, prices a miss, and never lapses silently.
- [Subjects](https://services.dev/docs/service/subject.md): A subject is what outlives the job, keyed by an input or a receipt. It keeps typed facts across jobs, insert-only, tells every job that read a fact when an amendment restates it, holds one job of a Service per period, names who is of record, and keeps its open clocks in someone's hands between jobs and after a client leaves.
- [One job per period](https://services.dev/docs/service/periods.md): With subject.period, a subject holds one live or ended job of a Service per period. A second order for that period answers 409 period_taken, and its next is the follow-on the job's end offers, such as a revision.
- [Schedules and triggers](https://services.dev/docs/service/subscriptions.md): On a subscription, on.schedule mints jobs on dates and periods, derived from the minted Service's own clocks, and on.event mints one when an event arrives, each routed to the Service it names. A gap, a late start, a client who changes and a client who leaves each mint by a stated rule.
- [Talk](https://services.dev/docs/service/talk.md): Every job has one thread. The AI answers the client in it by default, advice your rules reserve goes out only under a member's name and credential, and a member reaches the client only through it.
- [The record](https://services.dev/docs/service/record.md): Every job has one append-only record. Its status, its stage, its money and its ledger are replayed from it, and nothing else, so the record is the job.
- [Evidence and replay](https://services.dev/docs/service/evidence.md): One call assembles a job's evidence bundle, its record, every file by hash and the state replayed from them, so an auditor or a dispute can check the job without trusting you.
- [Publish before it takes orders](https://services.dev/docs/service/status.md): status publishes a Service before it sells. A roadmap Service shows its types and price everywhere and answers not_live with a waitlist; a preview takes test keys only.
- [Brand()](https://services.dev/docs/service/brand.md): Brand({...}) is optional, in brand.ts beside services/. It sets the brand's domain, its own words, the credentials it holds, its family, tenants, practice workspaces, fee policy and payouts. Without it, the brand is package.json's name.
- [Your brand's words](https://services.dev/docs/service/brand-words.md): Brand.words renames the core's generic words on every surface your buyers, their agents and your members read. The core says job; your routes, events, commands, tools, SDK, Site, docs and apps say yours.
- [The manifest](https://services.dev/docs/service/manifest.md): The whole definition as JSON, every default written and money in cents. Every surface reads it, and nothing else.

### People

- [human: the line](https://services.dev/docs/people.md): Where a person comes in, if anywhere. Leave it out and AI delivers every job alone. Draw the line where you want a person, and where the work needs one, name the role and let the rules decide the act.
- [Rules: how a Service meets licensing by design](https://services.dev/docs/people/rules.md): One table your counsel writes, with a row per act. Each act is reserved to a credential, open to the brand, refused here, or the client's own decision, and the gate holds every job to the version it was ordered under.
- [Roles](https://services.dev/docs/people/roles.md): Who may do or sign a step, where, and apart from whom. A role names a credential expression, the region its act needs, what the act pays, and the members it must differ from.
- [Your own team](https://services.dev/docs/people/staff.md): A role with no Pool is your staff. They approve or send back at the line from the owner console, in their own session, and the fill ladder can hand them a Task no member claimed.
- [Where an act happens](https://services.dev/docs/people/where.md): The region a reserved act needs comes from its rules row and the job's facts. '*' takes any admission, regions says where a row is ratified, and flags mark jobs whose facts straddle two places.
- [Refusals and cures](https://services.dev/docs/people/refusals.md): When the rules say no, the answer names the act, the row it cites and the way to yes, and nothing is charged. The same refusal reaches a buyer, an agent and a person.
- [When the client does it themselves](https://services.dev/docs/people/self.md): A rules row can let the client perform a reserved act in their own name. The Service then sells two ways, with a professional and yourself, at two prices with two boundaries, and the order picks one.
- [Credentials the brand holds](https://services.dev/docs/people/brand-credentials.md): Some acts are performed under a credential the brand itself holds, such as an e-file number. Declare it in Brand(), name it in a rules row, and an act that needs it waits while it is unverified or stale.
- [What a person can do](https://services.dev/docs/people/acts.md): Every act a person takes on a Task, from the claim to the attestation, what it carries, whether it is paid, and what it does to the job. Each one is the person's own, in the delivery portal or the member CLI, and never an MCP tool or a key's.
- [Declines and direction](https://services.dev/docs/people/direction.md): A member may decline any Task, with a memo only the client reads. The decline is paid, never scored, and final until the client directs the job, to another member they name or to an end.
- [Two sovereigns](https://services.dev/docs/people/sovereignty.md): The member's no and the client's yes. A member's decline can't be overridden, and a client's decision on their own merits can't be undone. The gate holds both, against the brand, a reseller, the buyer and the AI.
- [Of record](https://services.dev/docs/people/of-record.md): A member who attests at a named step stays of record on the subject across jobs. They withdraw by naming a successor, and if their credential or coverage lapses, the custodian ladder covers the subject so nothing falls into a gap.
- [Buyer, client, party](https://services.dev/docs/people/parties.md): The buyer pays and holds the key. A party is a person the work is for or about, named in the input, who acts only through their own single-use link. The buyer can be the client, or order for one.
- [A sample that falls](https://services.dev/docs/people/sample.md): A person checks a share of delivered jobs, and the share falls toward a floor while send-backs stay rare. The owner console says when the line can come out.
- [Pool(): your marketplace](https://services.dev/docs/people/pool.md): One kind of people, verified once, offered only work they can do, paid for every act and never charged to work. A role names a Pool, and the Pool fills it.
- [Approval or completion: a Pool's register](https://services.dev/docs/people/pool/register.md): A Pool's register is what its members deliver. An expert register attests on a packet; a work register completes a Task at a site, in a window, with evidence. A missing or silent party never costs the member their fee.
- [Join: the application](https://services.dev/docs/people/pool/join.md): The application a Pool writes becomes its /join funnel, email first and resumable, ending on the member's payout account. What a member says is an application; only the verifier writes what is true.
- [The door: where members join and work](https://services.dev/docs/people/pool/door.md): A Pool's door is where its members find the work, join, read the terms and do their Tasks. It serves at /<pool> on your brand, on a domain you operate, or on an existing door, and every door keeps one member charter.
- [Verify a member](https://services.dev/docs/people/pool/verify.md): An application, whole, is sent to the Pool's verifier as member.applied. The verifier checks it against the source that issued the credential, and writes back only what it checked, on its own write path with its vt_ token. Each write replaces the last, and freshness runs from it.
- [Eligibility](https://services.dev/docs/people/pool/eligibility.md): Seven predicates, in order, decide whether a member may take a Task, and a work register adds two. The first one they fail is the answer, with its cure, and no tier overrides it.
- [Dispatch](https://services.dev/docs/people/pool/dispatch.md): Who sees a Task first. Every eligible member's feed, one member at a time in rank order, the owner's pick, or one named member, each with a default you can override.
- [Tasks: offered, never assigned](https://services.dev/docs/people/pool/tasks.md): A role step posts a Task at a fee fixed when it posts. Members claim it, it holds for one of them on a clock, and it counts as done only when the gate accepts their act.
- [Pay](https://services.dev/docs/people/pool/pay.md): A member's pay accrues when the gate accepts their act, becomes payable on its own clock, and is paid on the Pool's schedule to one payout account. Nothing claws it back except a contest ruling that records bad faith.
- [Conflicts without disclosure](https://services.dev/docs/people/pool/conflicts.md): Each member keeps a conflicts ledger of hashes only. A Task's parties are checked against it mechanically, and no one, the brand included, learns what matched.
- [What a member sees, and when](https://services.dev/docs/people/pool/disclosure.md): A teaser that never names a party, a sheet one member reads at a time with every view logged, and the packet once they've cleared it. A pass is free and never counted against them.
- [The packet](https://services.dev/docs/people/pool/packet.md): What a member works from once they've claimed and cleared a Task, and what they attest to. It opens to that member alone, and its hash is what their attestation binds.
- [When no one claims](https://services.dev/docs/people/pool/fill.md): A Task no one claims climbs a ladder, raising its fee and widening who may take it, and never past eligibility. Until someone claims it, the job waits on a claim, which is a state and not an error.
- [Track records](https://services.dev/docs/people/pool/track.md): A member's track record is built from outcomes only, it is the member's to carry, and a credentialed peer rules any contest of their work. A decline, a pass, a recusal, a hold given back or a window let close is never scored.
- [Integrity](https://services.dev/docs/people/pool/integrity.md): Throttles and breakers sit outside the track record. A Pool can cap claims a day and open holds, and pause offers to a member whose declines or late releases run past a share. A pause is never scored, and a refusal never is.
- [Coverage in force](https://services.dev/docs/people/pool/coverage.md): A Pool says how much insurance must be in force on each act, and who carries it, the member, the Pool, or either. It is checked at every claim, written only by the verifier, and the Pool's own costs the brand a line on every act it carries.
- [One Pool, several brands](https://services.dev/docs/people/pool/share.md): Share one Pool across your brands, import a Pool another operator runs at terms pinned to a version, or export yours so other brands draw on it and pay you placement.
- [A simulated market](https://services.dev/docs/people/pool/simulate.md): Seed simulated members in every Pool, set how hard work is to fill, and watch the market run through the real gate before anyone joins. Every act they take is labeled simulated.
- [Tenants](https://services.dev/docs/people/tenants.md): An integrator resells your Service as its own offer. It orders for its customer with a tenant key and On-Behalf-Of, sets its own price within your limits, and its markup is its own seller line on the receipt.
- [Practices](https://services.dev/docs/people/practices.md): A buyer that is itself a practice brings its own professionals into a scoped workspace. They do the steps your roles name, under your Rules, and the practice stays a buyer, never a supplier.

### Money

- [Money](https://services.dev/docs/money.md): How a Service earns and pays. One ledger the buyer, each member and you read, one carrier for every way money goes wrong, and the Stripe object behind every line.
- [Prices](https://services.dev/docs/money/prices.md): Every form a price takes, from $49 a job to nothing on effort and a share at won. Each is one key on Service(), answers an order with its price before anything is held, and writes one line on the ledger.
- [Subscriptions](https://services.dev/docs/money/subscriptions.md): price.every makes an order a subscription, sbn_, charged once per cycle, and price.includes says how many jobs of each Service the cycle covers. Past an allowance, the next job is offered at its own price. Renewal charges again and resets every allowance, an update takes effect at the next mint, and a cancel runs to the end of the cycle paid for.
- [Outcomes](https://services.dev/docs/money/outcomes.md): Pricing on results, as one operating contract. The win rate a price breaks even at, who funds the work before the end, the proof that confirms the amount, how the money is collected, the window that holds it, what reverses it, and the tail that keeps a lost deal watched.
- [Release](https://services.dev/docs/money/release.md): When a charge releases. The order holds the money by an authorization, a capture or a mandate, and collects it only when the fact the price names is on the record, from delivery to a verified outcome. A refusal never charges, a job that ends early charges only the paid acts already committed, and a declined charge retries before it is unpaid.
- [Lines and rails](https://services.dev/docs/money/lines-and-rails.md): The lines a charge carries beside the price, and who sells each one. Pass-through fees at cost, flat lines, referral shares and placement; then the three sellers a fee can have, the brand, the member at the same checkout, or an entity you own, which the rules decide.
- [Flow of funds](https://services.dev/docs/money/flow-of-funds.md): Every ledger line as Stripe holds it. One charge model, separate charges and transfers on behalf of each seller; the accounts and who controls them; the held money that waits under its job; money that moves outside a charge; the order money is drawn back in; the event map by how a charge is held; and the sandbox values that test each path.
- [Refunds and disputes](https://services.dev/docs/money/refunds-and-disputes.md): What happens to the money when a job is canceled, sent back, refunded or disputed. Each seller carries its own charge's losses, each line reverses on its own entry, accrued and held pay stand, and the record answers each dispute with the evidence its reason code asks for.
- [Pay](https://services.dev/docs/money/pay.md): What each person earns and how it enters the ledger. Flat pay on every outcome of an act, share pay at an outcome and held for its window, who funds each, the protection every member has, the one charge a member may ever see, and your brand's fee policy.
- [Payouts](https://services.dev/docs/money/payouts.md): How money reaches each account, on Stripe Connect. Your share of each charge transfers to your connected account and pays out to your bank; members' pay transfers on the Pool's schedule and each account pays out daily; every deposit reconciles back to its jobs, and an account that can't be paid keeps its pay.
- [Plans](https://services.dev/docs/money/plans.md): Which plan a Service needs, as check derives it from your files. What each plan adds, the limits, the floor no plan sells, the Live gate, and the take, which falls as the plan rises and sits only on the value your brand adds.

### Surfaces

- [Every surface, from one contract](https://services.dev/docs/surfaces.md): One Service() becomes an API, a CLI, an MCP server, an SDK, a Site, Docs and an App. Each one renders the same contract, so no surface can say something the others don't.
- [The contract](https://services.dev/docs/surfaces/contract.md): Five registries derived from your Services (operations, objects, credentials, events and errors) that every surface renders and none renames.
- [Your API](https://services.dev/docs/api.md): Every Service you write is an API on your own domain, generated from its file. The first call needs no key.
- [Answers: OK, EMPTY, OFFER, BLOCKED](https://services.dev/docs/api/answers.md): Every call on every surface answers in one of four envelopes, and every no has one shape. An agent branches on them, never on prose.
- [Conventions](https://services.dev/docs/api/conventions.md): The rules every call follows: money on the wire, idempotency, lists and the feed's cursor, versions, webhook signatures, request ids and casing.
- [Your events](https://services.dev/docs/api/events.md): Everything that happens to a job is an event in one numbered feed. A buyer key reads its own share of it, by list, stream or a signed watch; the owner reads everything, and the working never leaves the record.
- [Machine registers](https://services.dev/docs/api/machine.md): What an agent or a generator reads before its first call, with no key. Each register is a row of the operation registry, served by every brand. Every value below is lingua's.
- [Your conformance suite](https://services.dev/docs/api/verify.md): Every brand publishes its own conformance suite at /verify/suite.json, generated from its registries as operations × credentials × magic values. services.dev verify runs it over HTTP and MCP, and anyone can run it against your brand.
- [The CLIs](https://services.dev/docs/cli.md): Two command lines, rendered from one contract. services.dev is yours, to write, check, serve and test a brand. npx <brand> is your buyers', their agents' and your members'.
- [Install and log in](https://services.dev/docs/cli/install.md): Run services.dev with npx, or install it once on your PATH. On localhost there's nothing to log in to, because dev prints a test key and every call uses it.
- [In CI](https://services.dev/docs/cli/ci.md): Run check on every push. It exits 1 on any failure and names each fix, as text for you or JSON for a pipeline, and magic values and test clocks reach every branch without a person or a wait.
- [Listening locally](https://services.dev/docs/cli/listen.md): Watch your brand's events as they happen, forward them to your own endpoint signed the way your webhooks are, and fire any event yourself with trigger.
- [Your MCP server](https://services.dev/docs/mcp.md): Every brand serves an MCP server written from its operation rows. Its tools, hints, output schemas, prompts and instructions come from the same file as its API, so the two never disagree.
- [What an agent can never do](https://services.dev/docs/mcp/never.md): Signing, consenting, directing, deciding, granting, attesting and raising a cap belong to a person. No tool exists for them. An agent gets the link to hand on.
- [The SDKs](https://services.dev/docs/sdk.md): Two packages for two readers. You build with services.dev. Your buyers' developers get a typed client for your brand, generated from your Services.
- [Safe to depend on](https://services.dev/docs/sdk/types.md): Your brand's client types each Service's names as literal unions, returns an OFFER as a value, narrows every refusal to its operation's codes, and verifies webhooks into a typed event.
- [A buyer that is software](https://services.dev/docs/sdk/agent.md): services.dev/agent buys from any brand by its card. It asks the price, orders within a budget, waits through any person's line, and accepts.

### Apps

- [The customer portal](https://services.dev/docs/app/buyers.md): Every Service gets a portal for the people it works for, AI-only Services included. It is drawn from the operations a buyer, a client or a party calls, so every control on it is one of them. It opens on every date ahead, and shows each subject's periods, what it keeps on file and its clocks, the subscriptions and the allowances used.
- [The delivery portal](https://services.dev/docs/app/members.md): Every Pool gets a portal for its members, phone-first. It opens on the Pool's terms for them; Tasks are offered, never assigned; the packet shows the document they sign; and each act runs only in the member's own session, paid at the act whether they sign, send it back or decline. Their dates sit beside their Tasks, with the clocks they acknowledge.
- [The owner console](https://services.dev/docs/app/owner.md): Your view of the business, one route per job you do. What needs you, every job with its record and ledger, deploys, quality and the line, holds and incidents, the Pool, support, dates, limits, the audit log and your keys, each screen with the controls that answer it.

### Operate

- [Your business](https://services.dev/docs/business.md): Several Services under one name, with an app for everyone in a job and one sum of what they keep.
- [Run your Service](https://services.dev/docs/operate.md): Running a Service once it is live, from the owner's seat. Each alarm runs the response your files name, your coding agent acts within the ceilings you set, and the owner console lists only what is left, each item with its control. Every control is a CLI and API call, and every threshold is a key you deploy.
- [Deploy](https://services.dev/docs/operate/deploy.md): A deploy builds your folder into a version, checks it against live, serves it in test mode and runs your brand's own suite against it. deploy --live sends that exact version to buyers, all at once or in stages that compare it job for job against live and abort on their own, and every job already running keeps the version it started on.
- [Test and live](https://services.dev/docs/operate/testing.md): Every brand runs in two modes at one address, and the key picks the mode, with the same simulation on your machine before either. Test mode simulates AI, money, outside systems and members, takes magic values that pick each branch, and runs on test clocks, so a whole season runs before a buyer sees it. Every key runs in test on every plan.
- [Versions](https://services.dev/docs/operate/versions.md): Each deploy is a version, the whole bundle under one sha256. A job keeps the version it was ordered under until it ends, a key keeps the contract of its first call, and check --against live sorts every change into additive or breaking. You move jobs in flight to a new version with a dry run first, and a rollback changes only what new orders take.
- [Observe](https://services.dev/docs/operate/observe.md): Every job's trace, step by step, with who did it, how long it took, what it waited on, what AI cost and what the gate said. Then the job's ledger to the cent, and AI spend by Service, step and model, with an alarm when a step's cost jumps. Each view is read from the record, so nothing is sampled or estimated.
- [Quality](https://services.dev/docs/operate/quality.md): Each review lens keeps its own numbers on the record, and the outside world's later answers count what each lens missed. Evals score a change against held-out jobs whose real outcome is known, and deploy --live refuses a version on which any lens finds fewer grounds.
- [Move a step to AI](https://services.dev/docs/operate/line.md): A line answers one question, where a person still changes the work, and moves between its rungs on the record. A step moves down when the evidence clears a bar scaled to what a miss costs, slice by slice and tied to the model that earned it, and moves back up on its own. A reserved act never moves, and what it learns from still does.
- [Pool health](https://services.dev/docs/operate/pool-health.md): Whether your Pool fills, and whether it pays. Time to claim, who was eligible and when no one was, how much of the declared time is used, what members earn, how long pay takes to reach their bank, and who left, for each role and region, with an alarm and the control that answers each one.
- [Dates at risk](https://services.dev/docs/operate/dates.md): Every date that needs your hand, in one list on the owner console. A clock no one answers for, a seat of record left vacant, a rung held at the gate, a missed acknowledgement, a job at risk or late. Each one comes with why it is there and the control that settles it, and the next 30 days follow.
- [Incidents](https://services.dev/docs/operate/incidents.md): Four controls for when something breaks, run first by the response your files name. Hold one step, reroute it to people, drain a Service of new orders, or stop the whole brand. Then find every job the cause touched, redo it at no charge, lift without sending a job back to the cause, and close the incident on its record, cost included.
- [Support](https://services.dev/docs/operate/support.md): What a buyer asks for after an order, and how you answer it. The AI answers questions in the job's thread at once. A redo, a refund, a dispute or a contest lands in the console's support queue with its control, and each answer moves money the way the refund rules say, with members' earned pay untouched.
- [Limits](https://services.dev/docs/operate/limits.md): Every ceiling a live Service meets, where it is set and what happens at it. Requests per key, AI per job and per day, file sizes, the buyer's own bounds and your plan's limits. At every limit nothing already running stops, and each answer names its next move.

### Examples

- [Examples](https://services.dev/docs/examples.md): Whole brands built on services.dev, each proving one layer of the model, file by file.
- [lingua](https://services.dev/docs/examples/lingua.md): The example brand the docs run on: four translation Services, three of them delivered by AI alone, one signed by a sworn translator.
- [The legal example](https://services.dev/docs/examples/legal.md): A brand shaped like api.lawyer. Six Services a licensed practice sells, one Pool of attorneys and patent practitioners, one rules table, and api.lawyer's own suite passing against what they generate.
- [Build it](https://services.dev/docs/examples/legal/build.md): The legal brand's folder, one file at a time. Its words, its rules table and its Pool first, then six Services, with check after each one.
- [One job, every side](https://services.dev/docs/examples/legal/walk.md): One provisional patent matter, from one recording, as each participant sees it. The buyer orders, the applicant consents and answers through her own links, a practitioner signs in their own session, and the owner reads the record.
- [Every branch](https://services.dev/docs/examples/legal/branches.md): Each human and outside branch the legal brand's files can take, run in the sandbox with no person and no outside system, each picked by the magic value that produces it.
- [The customer portal](https://services.dev/docs/examples/legal/customer-portal.md): The legal brand's customer portal, screen by screen as the brand serves it for one provisional patent matter, and for one contract review whose advice an attorney adopts.
- [The delivery portal](https://services.dev/docs/examples/legal/delivery-portal.md): The attorneys' delivery portal, screen by screen as the brand serves it to one patent practitioner. The offer, the sheet, the claim, the packet, a refused signature, a question to the client, the attestation, the pay and the tier.
- [The owner console](https://services.dev/docs/examples/legal/console.md): The legal brand's console with three matters in it, a patent filed, a contract review holding advice for its attorney, and a demand letter its attorney declined, each with its record, its ledger and the rules version it pinned.
- [The money](https://services.dev/docs/examples/legal/money.md): Every legal matter's ledger, as check prints it before you sell and as the owner reads it after. The brand's rail and the attorney's, a raised fee, two prices, pay that accrues at the act, and what an early end costs.
- [What the brand gets](https://services.dev/docs/examples/legal/surfaces.md): The legal brand's API, CLI, MCP server, SDK, Site, Docs and App, each generated from its files, in its own words of matter, review and signer.
- [The rules table](https://services.dev/docs/examples/legal/rules.md): Who may perform each act in the legal brand's six Services, per Service, frozen under a version. Every row is illustrative and records its position; a brand's counsel writes its real table.
- [The attorneys' Pool](https://services.dev/docs/examples/legal/pool.md): One Pool for the legal brand's six Services. Attorneys and patent practitioners join, the verifier checks each credential, Tasks are offered one member at a time, conflicts stay private, and tiers come from outcomes.
- [Provisional patent application](https://services.dev/docs/examples/legal/provisional-patent.md): The legal brand's fullest Service. A stamped signature by a registered practitioner, a filing whose receipt releases the charge, a practitioner who stays of record, and a second price for applicants who sign and file themselves.
- [Contract review](https://services.dev/docs/examples/legal/contract-review.md): The client consents before any attorney reads a name, advice the AI drafts waits for the attorney to adopt it, the advice is ratified in three states, and the attorney's fee is the attorney's own, at the same checkout.
- [Demand letter](https://services.dev/docs/examples/legal/demand-letter.md): An attorney signs a demand letter, the brand sends it to the other side and waits for the delivery receipt, and the client alone decides whether to settle, against a floor only she sets.
- [Company formation](https://services.dev/docs/examples/legal/formation.md): The brand files the certificate itself, as an open act. An attorney admitted where the founders are advises on the entity and the 83(b) election, the state turns down a name and the founders rename it, and every founder signs.
- [Trademark response](https://services.dev/docs/examples/legal/trademark-response.md): An office action answered and filed. The client sends the specimen through her own link, an attorney signs the response, and the office's typed rejections route the matter back to the step that repairs it, the client's evidence or a fee. A client who stops can end it, owing only the acts done.
- [Docket watch](https://services.dev/docs/examples/legal/docket-watch.md): A subscription on a patent family, $12 a month. Every Monday the AI checks the docket, a watcher acknowledges a date in its last week, and an office action on the family routes to Trademark response at that Service's own price.
- [When the attorney declines](https://services.dev/docs/examples/legal/decline.md): An attorney declines a demand letter they claimed. The decline is paid, its memo is the client's alone, and the matter waits on the client's direction until she names a second attorney, who signs.
- [Porting api.lawyer](https://services.dev/docs/examples/legal/port.md): Every api.lawyer route, matched to the operation the generated legal brand serves it with, adapted to a new shape, or decided. Then api.lawyer's own suite, passing against the generated brand.
- [Take your first real matter](https://services.dev/docs/examples/legal/launch.md): Everything outside the legal folder a real matter depends on, the filing offices, the courier, the verifier, the referral route, the docketing system, coverage, live keys, payouts, clocks and firms, each with the contract a real one meets.
- [The tax example](https://services.dev/docs/examples/tax.md): A brand shaped like apis.tax. Ten Services a business-return practice sells, its own Pool of preparers, signers and representatives on gigs.tax, accountants from gigs.accountants, one rules table, a lender line on the same consent, and a client's years run on a test clock.
- [Build it](https://services.dev/docs/examples/tax/build.md): The tax brand's folder, one file at a time. Your code first, then its words, its rules table and its Pool, then ten Services, with check after each one and the plan each file needs.
- [One job, every side](https://services.dev/docs/examples/tax/walk.md): One annual return, from the year the Tax Plan ran, as each participant saw it. The plan orders it, the company's officer answers through her own links, an enrolled agent signs for the brand's firm in her own session, and the owner reads the record.
- [The agent's order](https://services.dev/docs/examples/tax/agent.md): A business's bookkeeping agent buys the Tax Plan, pays with a scoped token, answers the organizer items it holds with the business's delegated key, asks a question inside the allowance and waits through the year. The officer's consent, signature and decisions stay hers, and the agent hands her each link.
- [Every branch](https://services.dev/docs/examples/tax/branches.md): Each human and outside branch the tax brand's files can take, run in the sandbox with no person and no outside system, each picked by the magic value that produces it, and the test EINs your own code answers.
- [The customer portal](https://services.dev/docs/examples/tax/customer-portal.md): The tax brand's customer portal across one plan year, screen by screen as the brand serves it. The year ahead, an extension filed by a clock, the return with its record, and the taxpayer's kept facts and allowances.
- [The delivery portal](https://services.dev/docs/examples/tax/delivery-portal.md): One enrolled agent's season on gigs.tax, screen by screen. Katherine Johnson joins, reads an offer, opens a packet with last year's return beside it, signs one return and sends another back, is paid, is offered next year's return first, and leaves with a successor named.
- [The owner console](https://services.dev/docs/examples/tax/console.md): The tax brand's console after the plan's first year, with ten returns in it, each Service's charges and costs, the dates at risk and the dates ahead, and every return's record and ledger.
- [The money](https://services.dev/docs/examples/tax/money.md): Every way the tax brand earns, as check prints it before you sell and as the owner reads it after a year. The Tax Plan once a cycle, a notice answered with a professional or by the client, a fee on a penalty abated, an approval sold on top, a state's fee at cost, what each person is paid, and what a missed date gives back.
- [What the brand gets](https://services.dev/docs/examples/tax/surfaces.md): The tax brand's API, CLI, MCP server, SDK, Site, Docs and App, each generated from its files, in its own words of return, taxpayer, review and preparer.
- [The rules table](https://services.dev/docs/examples/tax/rules.md): Who may perform each act in the tax brand's Services, frozen under a version. Who prepares and signs, the EFIN a return goes under, where the §7216 consent lets return information go, who represents, which advice waits for a signer, and the fee no return may carry. Every row is illustrative and records its position.
- [The preparers' Pool](https://services.dev/docs/examples/tax/pool.md): The brand's own Pool on gigs.tax, and accountants imported from gigs.accountants. Preparers, signers and representatives join, the verifier writes what each holds, a signer signs as the paid preparer for the brand's firm, and every member knows what protects them, what they answer for and when it ends.
- [The season](https://services.dev/docs/examples/tax/season.md): How the preparers' Pool holds the filing season. Standby retainers in two windows, spring and October, the fill ladder under a tight market, the extension that spreads the spring crunch into the autumn, and Pool health on the owner console.
- [A year, and the next](https://services.dev/docs/examples/tax/years.md): The tax example's gate. A company's 2025 return, then a Tax Plan run for a year on a test clock with tick 1y. The plan mints each 1099 filing, return and estimate, a rung deposits the tax and files each state's extension by its own rule, a state is repaired in time, a CP161 is answered, and the plan renews into the next year.
- [Two clients, over the years](https://services.dev/docs/examples/tax/clients.md): What a subject holds after the first year. Acme's states each keep their own date, it registers in Texas, a restated figure mints an amendment, a refund date bars one, and it leaves with its dates handed back. A partnership's three partners each get a K-1, and Beta Labs joins mid-year on a June year end.
- [The dates to file and pay](https://services.dev/docs/examples/tax/deadline.md): The annual return's dates as clocks, each state on its own rule. The date to file belongs to the signer of record, and three days out its rung deposits the tentative tax and files each extension that state needs. The date to file moves as far as each rule says; the date to pay never does. Three more dates outlive the return on the taxpayer.
- [Tax Plan](https://services.dev/docs/examples/tax/tax-plan.md): One subscription a business buys once a year, routed to six Services, five inside allowances and the amendment at its own price. Schedules order the 1099s, the return and each quarter's estimate on dates the Services derive, and events order a question, a notice response or an amendment.
- [Annual return](https://services.dev/docs/examples/tax/annual-return.md): A company's return, from the §7216 consent to four accepted filings. A request list the officer answers item by item, a signer who reads last year's return beside this one and signs as the paid preparer for the brand's firm, the officer's Form 8879, and facts the taxpayer keeps for next year.
- [Federal first, then the states](https://services.dev/docs/examples/tax/efile.md): The annual return's file step. One filing per jurisdiction, the federal return leading and each state linked to it, a rejection routed by its code to the step that repairs it, and a repair inside the perfection window that keeps its first filing time.
- [Estimated payment](https://services.dev/docs/examples/tax/estimate.md): A quarter's estimated tax in each jurisdiction, figured, decided and paid. The prior-year safe harbor, cumulative by quarter so a quarter figured short catches up, California's 30, 40, 0 and 30, New York's first installment on its extension, and what an unpaid installment costs.
- [Tax question](https://services.dev/docs/examples/tax/question.md): A taxpayer's question, answered by AI in the job's thread with its sources. An answer that tells them what to do is advice the rules reserve, so a signer from the Pool adopts it as written, revises it, or refuses it, and it goes out in the signer's name.
- [Notice response](https://services.dev/docs/examples/tax/notice-response.md): A letter from the IRS, answered. The AI reads it, your code matches each payment against the periods the letter shows, and sorts it. A representative claims it, the officer grants a Form 2848 that names them by CAF number for this form and these periods, and the response goes out under it. Or, for $99, the officer answers it herself.
- [Amended return](https://services.dev/docs/examples/tax/amended-return.md): A second order for a tax year already filed answers period_taken, and its next is the amended return, ordered again from the accepted one. The amendment is its own return on the same taxpayer, prepared by one member and signed by another, and a partnership files an administrative adjustment request instead.
- [Carryforward watch](https://services.dev/docs/examples/tax/carryforward-watch.md): The steward a taxpayer keeps for the dates a return leaves on it. $9 a year, the brand answers for each carryforward's expiry, gives notice 180 days out, and sends a letter each year of what is still open.
- [Year-end close](https://services.dev/docs/examples/tax/year-end-close.md): The year's books, reconciled and closed before the return reads them. AI reconciles each account and proposes the entries, the officer decides which to post, and for $900 instead of $300 an accountant from gigs.accountants attests the close. The closed books are kept on the taxpayer for that year's return.
- [Information returns](https://services.dev/docs/examples/tax/information-returns.md): The calendar year's 1099s, filed by 31 January. AI reads the ledger for each vendor paid $600 or more, a W-9 is asked of each payee without one, every name and TIN is matched under the brand's own TIN matching, and the 1099-NECs are e-filed under its transmitter code, $15 a payee.
- [Tax transcript](https://services.dev/docs/examples/tax/transcript.md): Lender records, shaped like apis.tax's. A lender reads a return the brand filed, on the §7216 consent that names it, or orders a transcript on the taxpayer's Form 4506-C under the brand's own credential on a 120-day clock. Each field cites its form, year and line, and the acts that belong to people are refused.
- [When a date is missed](https://services.dev/docs/examples/tax/missed.md): A return filed late because the brand's own e-file number went stale. Whose date it was, the 20% off the charge, the penalty notice that orders its own response, the guarantee's payment of the penalty and its interest, up to $5,000, after the abatement request, and the cases where the date isn't the brand's.
- [Porting apis.tax](https://services.dev/docs/examples/tax/port.md): Every flow the live apis.tax door states, matched to the generated tax brand's behavior, adapted to a new shape, or decided. Then the tests behind them, and the brand's own suite, passing.
- [Take your first real return](https://services.dev/docs/examples/tax/launch.md): Everything outside the tax folder a real return depends on, from the e-file transmitter and the Treasury to the brand's credentials, the verifiers, the two doors and each client's ledger, each with the contract a real one meets.
- [The sales example](https://services.dev/docs/examples/sales.md): A brand shaped like api.forsale, from three files. One Service works a deal from first touch to the account's payment, one Pool of setters, closers and nurturers works on an existing door, and nothing is charged on effort. The seller pays 5% of the closed value at won, or 15% when a closer takes the deal, the closer's 10% passed through whole.
- [Build it](https://services.dev/docs/examples/sales/build.md): The sales brand's folder, one file at a time. Its words, then the closers' Pool on an existing door, then the Deal Service, with check after each one.
- [One deal, every side](https://services.dev/docs/examples/sales/walk.md): Northwind Freight's deal, from the order on 2 November to the closer's payout on 12 March, as the seller, the setter, the closer and the owner each read it. AI works it, two people step up at their roles, the gate refuses one close, and nothing is charged until Northwind pays the seller's own invoice.
- [The agent's order](https://services.dev/docs/examples/sales/agent.md): Harbor Labs' agent finds the brand's tools, reads the OFFER, orders with a scoped payment token, sends what it learns and waits through the people on the deal and the account's payment. It sets the mechanics it may, and hands the floor to the person who decides it.
- [Every branch](https://services.dev/docs/examples/sales/branches.md): Every way an api.forsale deal goes, run in the sandbox with no person and no Stripe. AI alone, a meeting nobody attended, lost, gone dark and revived, gone dark before the meeting, confirmed dead, no one claims, signed and never paid, and a lost deal started again, each picked by the value that produces it.
- [Every deal shape](https://services.dev/docs/examples/sales/shapes.md): Every deal api.forsale sells from one deal.ts, each run in the sandbox from the value that picks it, with the line that handles it and what you keep.
- [The customer portal](https://services.dev/docs/examples/sales/customer-portal.md): The sales brand's customer portal on Northwind Freight's deal, screen by screen as the brand serves it to the seller. The deal at the close, with the floor only the seller sets, then won and awaiting the account's payment, then paid, charged once and held to its window.
- [Closing on closers.deals](https://services.dev/docs/examples/sales/delivery-portal.md): The closer's path through the sales brand, in your own session on closers.deals. Join with your payout account, read the feed, claim a gig and its brief, work the account in the seller's name, take a refused close, follow your 10% from won to held to Friday's payout, and see what protects it. Your own agent can do all of it but the close.
- [The owner console](https://services.dev/docs/examples/sales/console.md): The sales brand's console on the last day of December. Twenty-four deals ended, four won and awaiting the account's payment with nothing charged, three paid and held, the month's cash, the closers' held pay, and each deal's state and what it left you.
- [The money](https://services.dev/docs/examples/sales/money.md): Northwind Freight's deal from its mandate to Friday's payout, each step's ledger line and the three apps' view of it, how the account's payment finds the deal, what the share is of, who funds the setter, the ways a won deal reverses, and every api.forsale deal on this site.
- [What the brand gets](https://services.dev/docs/examples/sales/surfaces.md): The sales brand's API, CLI, MCP server, SDK, Site, Docs and App, each generated from its three files, in its own words of deal, account, gig and closer.
- [The Deal Service](https://services.dev/docs/examples/sales/deal.md): services/deal.ts, step by step. AI sources, qualifies, books, meets and negotiates; a warm reply sends the booking to a setter; the deal's value, a buying committee or the seller's ask sends the meeting and everything after it to one closer. The gate holds the meeting to someone attending and the close to the seller's floor, and the closer works the account in the seller's name.
- [The closers' Pool](https://services.dev/docs/examples/sales/pool.md): One Pool for the three roles a deal escalates to. Setters, closers and nurturers join on an existing door, hold a claim while they work the account, climb tiers on their own track record, keep all of their pay, and may come in through a firm. A seller of a licensed offer adds one credential line.
- [Porting api.forsale](https://services.dev/docs/examples/sales/port.md): Every api.forsale route, matched to the operation the generated sales brand serves it with, adapted to a new shape, or decided, and each of the sales kernel's 76 behavior tests matched to the line that carries it. Then the kernel's money path and api.forsale's own probe suite, passing against the generated brand.
- [Take your first real deal](https://services.dev/docs/examples/sales/launch.md): Everything outside the sales folder a real deal depends on, the seller's Stripe account behind the proof and the pay link, the mandate, the sending mailbox, the calling number, the calendar, the contract, the door, live keys, payouts and firms, each with the contract a real one meets.

### Reference

- [Operations](https://services.dev/docs/reference/operations.md): Every call a brand serves, one row each: its HTTP route, CLI command, MCP tool and SDK method, who may make it, what it does, what it emits and every answer it can give.
- [Objects](https://services.dev/docs/reference/objects.md): Every prefixed id a brand hands out, what it names and the fields it carries, then each live object as a real run served it.
- [Every key](https://services.dev/docs/reference/keys.md): Every key you write on Service(), with its form, its default, the plan it runs live on and the page that explains it, then every key the registry tracks, Rules, Pool and Brand included.
- [Credentials](https://services.dev/docs/reference/credentials.md): Every credential that can call a brand: who holds it, its prefix, the surfaces it reaches and each operation it can call.
- [Events](https://services.dev/docs/reference/events.md): Every event in a brand’s feed, who may read it, what it says and the operations that emit it.
- [Errors](https://services.dev/docs/reference/errors.md): Every code a call or check can return, with its category, its HTTP status and the operations that return it. A buyer’s or member’s code renders on the brand’s own /docs/errors/<code>.
- [Definition errors](https://services.dev/docs/reference/definition-errors.md): What Rules(), Pool() and Brand() refuse as they are written, before anything loads: each code, the path in what you wrote, and the message that says the fix.
- [check’s gates](https://services.dev/docs/reference/check.md): Every gate npx services.dev check runs before you sell, the code its --json output prints, and what fixes it. A failing gate exits 1.
- [description_too_long](https://services.dev/docs/reference/check/description_too_long.md): The tool description is over 30 words, so agents skim past it.
- [price_unstated](https://services.dev/docs/reference/check/price_unstated.md): The tool description omits the price or when it's charged.
- [agent_cannot_buy](https://services.dev/docs/reference/check/agent_cannot_buy.md): An agent couldn't order, wait for and accept a job.
- [toolset_too_large](https://services.dev/docs/reference/check/toolset_too_large.md): The buyer's MCP toolset is over its token budget, so an agent's context fills with tools.
- [instructions_too_long](https://services.dev/docs/reference/check/instructions_too_long.md): The MCP server's instructions are over 120 words.
- [step_unreachable](https://services.dev/docs/reference/check/step_unreachable.md): A step no edge reaches never runs.
- [review_after_attest](https://services.dev/docs/reference/check/review_after_attest.md): A person attests work no review has passed: the review runs after the signature.
- [release_unproven](https://services.dev/docs/reference/check/release_unproven.md): price.release names no step that runs.
- [clock_unowned](https://services.dev/docs/reference/check/clock_unowned.md): A clock's owner can never resolve: a role the Service doesn't have, or of_record with no member of record on its subject. It would run vacant, with no one to answer for the date.
- [clock_due_unreadable](https://services.dev/docs/reference/check/clock_due_unreadable.md): A clock's due function can't give a date for the Service's own example order: it throws, or returns something that isn't a date. On a real order the clock would never open, and the owner console would alarm.
- [price_below_cost](https://services.dev/docs/reference/check/price_below_cost.md): A delivered job could lose money: payout, nested Services and the AI cap add up to more than the price.
- [upgrade_below_payout](https://services.dev/docs/reference/check/upgrade_below_payout.md): The approved price adds less than the person's payout.
- [rail_conflict](https://services.dev/docs/reference/check/rail_conflict.md): A role's pay.rail contradicts the rail of the row for its act.
- [rush_uncapped](https://services.dev/docs/reference/check/rush_uncapped.md): A role is paid from the buyer, its Pool's fill ladder raises the fee, and nothing caps what the buyer pays for it.
- [fill_underwater](https://services.dev/docs/reference/check/fill_underwater.md): The Pool's fill_cap lets the ladder raise a brand-funded fee past what the job leaves: a job filled at the cap loses money.
- [reserved_act_unstaffed](https://services.dev/docs/reference/check/reserved_act_unstaffed.md): A step performs a reserved act, and no role that does it holds the credential its row reserves it to.
- [act_unruled](https://services.dev/docs/reference/check/act_unruled.md): A step names an act the rules table has no row for, under its Service or shared. There is no fallback.
- [rule_unread](https://services.dev/docs/reference/check/rule_unread.md): The rules table binds a name nothing reads: a key that names no Service file, or a row no step performs that is neither an advice class nor refused.
- [where_unresolved](https://services.dev/docs/reference/check/where_unresolved.md): A reserved row reads where from a party's region, and the Service takes no input that names it, so an order could never say where the act happens.
- [region_unqualified](https://services.dev/docs/reference/check/region_unqualified.md): A rules row's regions entry isn't an ISO 3166 code: a bare state such as NY is no country, and CA is Canada.
- [self_unruled](https://services.dev/docs/reference/check/self_unruled.md): price.self prices the client performing reserved acts themselves, and no reserved row the Service performs allows self.
- [advice_without_adopt](https://services.dev/docs/reference/check/advice_without_adopt.md): The rules reserve an advice class for the Service, and its talk names no role from a Pool that holds the row's credential to adopt held answers.
- [client_decision_gated](https://services.dev/docs/reference/check/client_decision_gated.md): A rules row reserves a decision to the client, and the step isn't an ask to the client, or a guard ahead of it refuses what the client would decide.
- [sheet_without_consent](https://services.dev/docs/reference/check/sheet_without_consent.md): A Pool's sheet names the job's parties to the members who read it, and the client hasn't consented before the first Task posts.
- [custodian_unqualified](https://services.dev/docs/reference/check/custodian_unqualified.md): A subject's custodian ladder leaves the brand of record for a role whose credential the brand doesn't hold.
- [pool_role_unknown](https://services.dev/docs/reference/check/pool_role_unknown.md): A Service's role names a Pool that has no role by that name, so no member could ever be offered its Task.
- [fill_bypasses_reserved](https://services.dev/docs/reference/check/fill_bypasses_reserved.md): A fill rung could offer a reserved act to someone who doesn't hold its credential.
- [brand_credential_missing](https://services.dev/docs/reference/check/brand_credential_missing.md): A rules row names a credential the brand holds, and the Brand doesn't declare it.
- [surface_drift](https://services.dev/docs/reference/check/surface_drift.md): A surface serves a call with no row, or lacks a live row.
- [service_id_reserved](https://services.dev/docs/reference/check/service_id_reserved.md): A Service's file name, or a portal's, takes a word services.dev's own routes use.
- [word_collision](https://services.dev/docs/reference/check/word_collision.md): A Brand.words value takes a generic word, a word an operation's id is spelled with or a path services.dev already serves, or makes two rows render the same, so two things would read the same.
- [The services.dev CLI](https://services.dev/docs/reference/cli.md): Every npx services.dev command: what it does, who runs it, the operation it calls, and its status, with the exit codes an agent branches on.
- [Magic values](https://services.dev/docs/reference/magic-values.md): Every sandbox value, the branch it makes a job take, and the pages whose captured runs took it, so every person and outside branch runs without a person.
- [Task verbs](https://services.dev/docs/reference/task-verbs.md): Every act on a Task, the worklists.dev verb it maps to, who writes it, the operation and event, the status it folds to on both sides, and what it means for the member.

## Registries

The tables the reference pages render, as JSON, byte for byte what the package captured:

- [operations](https://services.dev/docs/reference/operations.json): every call a brand serves, one row each: its route, CLI command, MCP tool and SDK method
- [objects](https://services.dev/docs/reference/objects.json): every prefixed id and the object it names
- [credentials](https://services.dev/docs/reference/credentials.json): every credential that can call a brand
- [events](https://services.dev/docs/reference/events.json): the events catalog, with each event's audience
- [errors](https://services.dev/docs/reference/errors.json): every code a call can answer with: type, HTTP status, reason, fix
- [gates](https://services.dev/docs/reference/check.json): every gate check runs, its reason and its fix
- [magic-values](https://services.dev/docs/reference/magic-values.json): every sandbox value and the branch it makes a job take

## Bundles

Whole reading sets, one file each, in the nav's order:

- [write](https://services.dev/llms/write.txt): Write a Service: Start, the Service tab and the ledger; Grow, the time pages, the People tab and the rest of Money, the price forms included, are bundles of their own, and the generated pages and the Publishing group are left out, about 74,108 tokens
- [grow](https://services.dev/llms/grow.txt): Grow: from four lines to a regulated business, one key per tutorial, each ending on the surfaces it changed, about 27,196 tokens
- [time](https://services.dev/llms/time.txt): Time: clocks, the subject, periods and subscriptions, and what a subscription charges, on the tax example, about 38,067 tokens
- [buy](https://services.dev/llms/buy.txt): Buy from a brand: the four calls, the answers, the conventions, the MCP server, the agent client, and what an agent can't do, about 20,201 tokens
- [reference](https://services.dev/llms/reference.txt): Every registry as a table but the operations: keys, objects, credentials, events, errors, check's gates, the CLI and magic values, about 67,598 tokens
- [operations](https://services.dev/llms/operations.txt): The operation registry: every operation, with its row on every surface, about 30,499 tokens
- [gates](https://services.dev/llms/gates.txt): check's gates but rules and people, one page each: the failing file, the `--json` output and the fix, about 26,753 tokens
- [gates-people](https://services.dev/llms/gates-people.txt): check's gates for rules and people, one page each: the failing file, the `--json` output and the fix, about 23,195 tokens
- [start](https://services.dev/llms/start.txt): The Start tab, whole, its generated pages left out, about 45,267 tokens
- [service](https://services.dev/llms/service.txt): The Service tab but its gate, job, time and publishing groups: the work and its steps, about 33,930 tokens
- [people](https://services.dev/llms/people.txt): The People tab but the Pool: the rules, the roles and the person at the step, about 27,164 tokens
- [money](https://services.dev/llms/money.txt): The Money tab, whole, its generated pages left out, about 43,476 tokens
- [surfaces](https://services.dev/llms/surfaces.txt): The Surfaces tab, whole, its generated pages left out, about 48,412 tokens
- [apps](https://services.dev/llms/apps.txt): The Apps tab, whole, its generated pages left out, about 10,279 tokens
- [operate](https://services.dev/llms/operate.txt): The Operate tab, whole, its generated pages left out, about 23,137 tokens
- [examples](https://services.dev/llms/examples.txt): The Examples tab but the legal, tax and sales brands: the index and lingua, about 3,189 tokens
- [job](https://services.dev/llms/job.txt): The Service tab's gate, the job and publishing: guards, policy, signals, ends, talk, the record and status, about 24,935 tokens
- [pool](https://services.dev/llms/pool.txt): The Pool: joining, verifying, eligibility, Tasks, dispatch, the packet, fill, coverage and integrity, about 37,477 tokens
- [legal](https://services.dev/llms/legal.txt): The legal brand, the worked example a person is on the line of: its files, every side, its rules and Pool, six Services, the decline, the port and the launch, about 47,442 tokens
- [tax](https://services.dev/llms/tax.txt): The tax brand, the worked example that runs for years: its files, every side, the agent, its rules, its Pool and season, the port and the launch, about 47,131 tokens
- [tax-years](https://services.dev/llms/tax-years.txt): The tax brand across the years: the walk, two clients, each state's dates, the lender line and a missed date, about 15,811 tokens
- [tax-services](https://services.dev/llms/tax-services.txt): The tax brand's ten Services, one page each: the plan, the return and its e-file, estimates, questions, notices, amendments, the watch, the close and the 1099s, about 20,386 tokens
- [sales](https://services.dev/llms/sales.txt): The sales brand, the worked example paid on an outcome: its files, every side, its money, its deal and Pool, and the kernel it ports, about 34,614 tokens

## Brands

- [incorporations.legal](https://incorporations.legal): Legal · Company formation, filed
- [monthend.finance](https://monthend.finance): Accounting · The month-end close
- [closers.deals](https://closers.deals): Sales · Human closers on your deal
- [research.delivery](https://research.delivery): Research · Cited desk research
- [gigs.claims](https://gigs.claims): Insurance · Adjuster sign-off on claim files
- [api.cleaning](https://api.cleaning): Facilities · Commercial cleaning work orders
- [verifies.email](https://verifies.email): Marketing · Email list verification
- amended.tax: Tax · Amended returns, preparer signs
- denials.services: Healthcare admin · Claim-denial rework and appeal
- queues.support: Support · Support queues, worked by AI
- pentesters.work: IT and security · Pen tests, signed reports
- showings.properties: Real estate · Property showings, staffed
- interviewers.expert: Recruiting · Structured hiring interviews
- retouchers.pics: Design · Image finishing by retouchers
- parcelaudit.bid: Logistics · Parcel refund recovery

## Optional

- [Everything to write a Service and to buy from one, short, in one file](https://services.dev/llms-full.txt)