JESS MOVEDevelopers
Build on it
Everything the platform promises is enforced at a layer a client cannot route around: the publishing gate in the service, the privacy floor in the query planner, and the invariants as constraints inside PostgreSQL.
The envelope
Base path /api. Every response carries the signature line — the full line in meta.poweredBy, and an ASCII-safe rendering in the x-powered-by-jessmove header, because HTTP header values must be latin1.
{
"data": {
"held": true,
"reason": "The user cannot move right now.",
"blocks": ["driving"],
"retryAfterSeconds": 900
},
"meta": { "poweredBy": "…" }
}
-- a hold is a 200, never an errorReference
| Method | Path | Purpose |
|---|---|---|
| GET | /health | Liveness plus AI-gateway status. |
| GET | /system | The operating system’s invariants, machine-readable. |
| GET | /ai/providers | Provider configuration. Staff session required. |
| POST | /ai/complete | Raw gateway completion. Staff session required, and metered. |
| GET | /movements | The published library. |
| GET | /movements/gate | The publishing contract, in full. |
| POST | /movements/:id/check | Dry-run the five-variant gate. |
| POST | /movements/:id/publish | Attempt publication. Fails closed. |
| POST | /prescriptions/next | The core call — the next best Snap, or an explicit hold. |
| POST | /body/assess | Pathway and safety assessment. Can only narrow. |
| POST | /body/plan | The daily plan for the assessed pathway. |
| GET | /body/pathways | The nine pathways and what each permits. |
| GET | /body/scorecard | The weighting behind the four readings. |
| GET | /body/agents | The nineteen BodyCommand agents and their supervisor. |
| GET | /acu/policy | ACU policy: what is metered, what never is, and how allowances work. |
| POST | /acu/quote | Price an action before running it. |
| POST | /acu/wallets/:id/spend | Cost Governor: bucket precedence, hard stop at zero. |
The AI gateway
Every model call in the platform goes through one gateway, which owns provider selection, the fallback chain, prompt redaction, the per-agent cost ceiling, the timeout and the decision log. A refusal on one provider walks to the next; when every provider fails, the caller falls back to the cached plan — a slow model must never produce a broken app.
Which models sit behind the gateway is deployment configuration, not part of this contract, and can change without any client noticing. Swapping or adding a provider means implementing ModelProvider and registering it — no other call site in the platform changes.
Enforcement
The schema is not a passive record. Each of these is a CHECK constraint with a test that attempts the violating write and asserts the rejection.
A Snap outside 90–300 seconds is rejected by the database.
A prescription without a context decision cannot be written.
A minor without a linked guardian cannot exist.
A minor placed in an adult mode cannot exist.
A movement published without review is rejected.
A cohort report below k = 8 is rejected.
An ACU debit priced below its own cost floor is rejected.
Grace tokens outside 0–2 are rejected.
A proxy action without a named acting person is rejected.
pnpm db:migrate && pnpm db:test — every rule proven to reject the write that violates itRules for clients
contextDecisionId that authorised it.The API and its refusals are documented and public. An ordinary account is the fastest way to see what it returns.
Free to create. 150 AI credits a month for 2 months, then AI features need a plan — everything that is not AI carries on either way. Premium is £5.99 a month and cancels in one click. Under 18 a guardian confirms before the account opens.