Contract

The Product Contract is protobuf, not a second JSON SDK.

Semantic SSOT: proto/sylphx/data/v1/data.proto. Canonical public base: https://api.data.sylphx.com/v1. Residual dens data.api.sylphx.com is not dest. HTTP is a ProtoJSON projection of generated messages. A handwritten public request model is a defect.

Product
Sylphx Data · product id data · runtime sylphx-data
Peel
https://api.data.sylphx.com — Binding api_base. The product site is https://data.sylphx.com. Residual dens data.api.sylphx.com is not dest.
API base
https://api.data.sylphx.com/v1
Package
sylphx.data.v1
Digest
sha256:468bf2a330519af70877760f9e45255d8a1be7b4e884962fa82be4899065b1f4
Envelope
Binding + Delegation. A Data product key is not a second Binding.

Public resource families

Family	Kind	Selected operations	Invariant
Database	`database`	`PutResource` after signed Platform Operation	Ready only from `POST /v1/database-platform-operations` authorization `platform-signed-database-operation`
KV	`kv_namespace`	`PutValue`, `GetValue`	Put then get returns the same key, value, and version
Object	`bucket`	`PutObject`, `GetObject`, multipart, shares	Put then get returns the same bytes, size, and SHA-256
Search	`search_index`	`PutDocument`, `Search`	Lexical or cosine; Data does not invent embeddings

Customer authority headers

Authorization: Bearer <sylphx-delegation+jwt>
Sylphx-Project-Binding: <sylphx-project-binding+jwt>
Sylphx-Effect-Id: <closed-ascii-intent-id>

Audience is https://api.data.sylphx.com/v1. Closed EdDSA claims agree on product data, contract digest, project, binding, revision, and environment. Project comes only from those claims. Tenant headers and static secrets do not authorize a write.

Binding verifies on the Platform Binding Ed25519 JWKS pin https://api.sylphx.com/.well-known/project-binding-jwks.json (OKP/Ed25519/EdDSA/use=sig). Login https://api.sylphx.com/.well-known/jwks.json RSA is not dest Binding.

Not public customer routes

Platform-signed ingest is fabric-to-Data authority, not a customer hole and not dual-token:

POST /v1/project-binding-authority-events authorization platform-signed-authority-event
POST /v1/database-platform-operations authorization platform-signed-database-operation

Public unauthenticated routes are only GET /healthz, GET /readyz, and GET /v1/public/object-shares/{token}. Health 200 is not the Data contract.

Fail closed. A second public schema, Lattice JSON façade, Binding substituted by a Data product key, or parking this site on the peel is not this contract.