> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aethis.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployed contract status

> What api.aethis.ai serves today, and how to confirm which engine build answered you.

The documentation describes the current contract, and `api.aethis.ai` serves
engine **0.59.3** — the build that contract describes. Everything on these pages
is live; nothing on them is waiting on a deploy.

Every response carries `engine_version`. Check it to see which build served you:

```bash theme={null}
curl -sS -X POST https://api.aethis.ai/api/v1/public/decide \
  -H "Content-Type: application/json" \
  -d '{
    "ruleset_id": "aethis/uk-fsm/child-eligibility",
    "field_values": { "child.age": 10, "child.school_type": "state_funded" }
  }' | python3 -c 'import sys,json; print(json.load(sys.stdin)["engine_version"])'
```

```
aethis-core@0.59.3
```

## What changed at 0.49.1

Earlier revisions of this page listed contract rows that the deployed engine did
not yet serve. All of them now do. Each row below was re-verified against
`api.aethis.ai` on 2026-07-28:

| Behaviour | Status on `api.aethis.ai` (0.49.1) |
| - | - |
| Resolved identity: immutable `ruleset_id`, a real `ruleset_version`, `content_digest` | **Served.** `/decide` and `/explain` both return `ruleset_version` (e.g. `"v2"`) and `content_digest` |
| Blocking `field_errors` force `decision: "undetermined"` | **Served.** An unusable input returns `undetermined` with the offending field in `field_errors` and `missing_fields` |
| An undefined top-level request key returns `422 extra_forbidden` | **Served.** An unknown body key is rejected, not silently ignored |
| `X-Aethis-Records-Omitted` on catalogue reads | **Served.** `GET /rulesets` returns the header (`0` when nothing was omitted) |
| Publish-validated `source_references[]` on criteria | **Served.** `/explain` returns `source_refs` and `source_references` on every criterion. They are `null` on the first-party showcase rulesets, which do not yet declare citation keys — see [Provenance and citations](/authoring/provenance) |
| Anonymous cross-origin access scoped per route and method | **Served.** The open surface answers any origin with `GET, POST, OPTIONS` and no credentials; every other route reflects only first-party origins |

## What to guard for anyway

Nothing here is version-gated any more, but two habits stay worth keeping:

* **Check `field_errors` yourself** rather than relying on the engine to force
  `undetermined` for you — good practice regardless of which build answers.
* **Treat `source_references` as optional.** `null` and `[]` both mean "this
  criterion carries no verified reference", never "verification failed".

If a call ever returns an `engine_version` below `0.49.1`, you are talking to a
different deployment — check the host before debugging the contract.

## Coordinated release candidate: frozen rulebook members

Core candidate `e71e758` adds an additive `release` object for a composed
rulebook decision. It is **not a deployed capability claim**: do not send
`release_id` to `api.aethis.ai` or rely on this response shape until the
production OpenAPI and an observed production response confirm it.

When deployed, a caller will be able to pin a composed decision with
`release_id`. The response will retain the selected `release_id`, its existing
`content_identity`, and a `members` mapping. Each member records the resolved
section, ruleset identity, version identity and content digest used for that
release. This is stronger than retaining a composition hash or member IDs alone:
it makes a replay auditable against the exact member bytes.

```json theme={null}
{
  "release": {
    "release_id": "<immutable release id>",
    "content_identity": "<composition identity>",
    "members": {
      "<section_id>": {
        "ruleset_id": "<resolved ruleset id>",
        "version_id": "<immutable member version id>",
        "content_digest": "sha256:<member bytes>"
      }
    }
  }
}
```

Treat this as the coordinated OpenAPI candidate shape. The deployment gate is
the live OpenAPI plus a pinned decision/replay observation; a merged core pull
request alone is not evidence that public production serves it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.