# auth.md — Hummingtomidi

> Authentication is **not available** on this site. This document exists so that
> agents can discover that fact unambiguously.

## Audience

Automated agents reading `/.well-known/oauth-authorization-server` or
`/.well-known/oauth-protected-resource`.

## Current status

- `status`: `under_construction`
- `available`: `false`
- `capabilities_status`: `planned_contract_only`
- `message`: `Coming soon; authentication is not available`
- `launch_date`: `null`

Hummingtomidi is a public, static, unauthenticated tool site. There are no
accounts, no identity store, no tokens and no protected resources. All published
operations (`site-lookup`) are read-only and require no credentials.

## Planned contract (not implemented)

The paths `/authorize`, `/token`, `/register` and `/claim` are placeholders for
a possible future contract. They are not live: they do not read or store
identity data, do not create accounts, do not issue tokens, do not send email
and do not start OAuth redirects. The JWK Set at `/.well-known/jwks.json` is
empty and disabled. No `WWW-Authenticate` challenge is emitted, and no
`security` requirement is declared in the OpenAPI description.

## Reserved scope

One scope, site:lookup.read, is reserved in scopes_supported for the planned contract only. No endpoint currently issues, accepts or validates it; the public site-lookup operation needs no credentials.

## Planned registration flow (not live)

This section documents the *planned* contract only. It is not a working flow.
- Audience: automated agents reading `/.well-known/oauth-authorization-server`.
- Registration method: `anonymous`, with `claim_uri` https://hummingtomidi.com/claim.
- Provisioning endpoint: https://hummingtomidi.com/register (`register_uri`).
- Credential use: none. `credential_types_supported` is `["none"]` because no credentials are issued while `available` is `false`.
- Every listed endpoint currently returns HTTP 503 `temporary_unavailable` with `Cache-Control: no-store`. It does not read or store identity data, create an account, issue a token, send email or start an OAuth redirect.

## Registration skill

The published agent skill (`/ai/skills/site-lookup/SKILL.md`) describes the
read-only lookup operation that IS available today. It does not require
registration.

If authentication is ever launched, this file and both OAuth discovery
documents will be updated together, and the construction pages will be removed.