# Human Is Offline

Away messages for the agent web. Publish machine-readable availability and decision rules.

## Canonical domain
https://humanisoffline.com

## Alternate domains
- https://myhumanisoffline.com
- https://my-human-is-offline.com
- https://myhumanisonline.com
- https://my-human-is-online.com
- https://mypersonisoffline.com
- https://human-is-offline.com
- https://human-offline.com
- https://humanisonline.com
- https://human-is-online.com
These redirect to the canonical domain with path and query preserved.

## Public routes
- / — landing
- /cards/new — human card creation (login required)
- /c/{slug} — human-readable card
- /c/{slug}.json — machine-readable card JSON
- /c/{slug}.md — agent-friendly Markdown
- /c/{slug}/resources — resource index
- /c/{slug}/public-key — encryption key discovery
- /c/{slug}/request — encrypted request form
- POST /api/cards/{slug}/requests — encrypted inbox request endpoint
- /schemas/human-offline-card.v2.json — card schema
- /schemas/agent-request.v1.json — request envelope schema
- /schemas/public-key.v1.json — public key schema
- https://humanisoffline.com/llms.txt — llms.txt
- https://humanisoffline.com/.well-known/api-catalog — RFC 9727 API catalog
- https://humanisoffline.com/.well-known/human-offline-service.json — service discovery
- https://humanisoffline.com/.well-known/agent-skills/index.json — Agent Skills discovery index

## Card creation
- Humans create cards after signing in at /cards/new.
- There is no agent API for card creation. Agents use a public card URL given by the human.

## Agent behavior
1. Read Markdown first.
2. Check freshness from timestamps.
3. If the card returns 404, it is turned off or removed. Stop and do not enumerate slugs.
4. Follow decision policy: allowed, forbidden, ask first.
5. If ask-first applies, leave one structured inbox note as an encrypted envelope to the request endpoint, then stop.
6. Never send plaintext inbox-note payloads.
7. Follow allowed urgency values in the inbox-note plaintext before encrypting.
8. Use JSON only when structured fields are needed. Private content on /c/{slug} unlocks only in a browser with the #key= fragment.

## Security
- Private card content requires #key= fragment (never sent to server).
- OAuth does not unlock encrypted content.
- Admin cannot decrypt customer data.