# Public evidence tasks Discover this site's signed [A2A Agent Card](https://blackcatinformatics.ca/.well-known/agent-card.json) and [verification keys](https://blackcatinformatics.ca/.well-known/a2a-jwks.json). 1. POST an empty body to `https://blackcatinformatics.ca/a2a/token`. Keep the returned bearer token private. No account is required. Tokens expire after 30 days of inactivity. The token grants the `task-owner` role for its own tasks; this is an opaque bearer scheme, not an OAuth flow. 2. Send A2A 1.0 JSON-RPC requests to `https://blackcatinformatics.ca/a2a` with `Authorization: Bearer ` and `A2A-Version: 1.0`. 3. Use `SendMessage` or `SendStreamingMessage` with a unique message ID and one text part, or one data part containing `{ "topic": "RDF", "questions": ["Which published projects use RDF?"], "locale": "en" }`. 4. Use `GetTask`, `ListTasks`, `CancelTask`, or `SubscribeToTask` to follow the task. Repeating the same message ID and content returns the same task. A new request needs a new message ID. Streaming disconnection does not cancel work. The task produces JSON and Markdown dossiers plus a signed manifest. These contain exact public passages, versioned source URLs, SHA-256 byte identities, retrieval times, authored dates when available, structured public records, and the locale's RDF graph identity. They organize evidence for your assessment. They do not give a technical-fit verdict or generate new factual claims. ## Limits and retention Use at most eight questions, with up to five candidate documents per question and twenty distinct sources per dossier. Each source is limited to 8 MiB. Supported locales are `en`, `fr`, and `zh`. Tasks have a five-minute deadline. There are at most four active tasks and one hundred retained tasks per token. Requests are limited to 32 KiB. Token issuance is limited at the edge to ten requests per minute per site and client IP; a 429 response includes a retry interval. Task inputs, event history and dossier artifacts are private to the token that created them and are deleted seven days after task creation. Artifact downloads require that token. Original public source snapshots under `/evidence/sha256/` are immutable and retained indefinitely. Never put secrets in a research request. This service only retrieves registered public site resources; URLs supplied in a request are not fetched. ## Verification Verify the card with the A2A JWS/JCS procedure and this site's JWKS. The dossier manifest uses compact JWS with Ed25519 over its embedded JSON payload; verify it using the `kid` in the protected header and the same JWKS. Compare each artifact and source's raw-byte SHA-256 and size against the signed manifest. Old public verification keys remain published across rotation. RDF identities use the explicitly named PurRDF RDF 1.2 overlay profile in `/.well-known/rdf-canonicalization.json`. Canonical bytes are opaque bytes, and source datasets are retained for recomputation. The native profile is not an RDFC-1.0 or Data Integrity proof claim. Push notifications, authenticated extended cards, multi-turn task modification and arbitrary URL ingestion are not supported. Create a new task to ask a follow-up question. ## Inspect a dossier Open the [evidence browser](https://blackcatinformatics.ca/evidence.html), enter a topic and select a source language. The page obtains an owner token and follows the task to completion. Keep the token shown under “Resume a task” if you want to reopen the dossier; the page keeps it only in memory. Closing the page does not cancel the task. The viewer checks the signed manifest, both artifact hashes, archived publication proofs, every source snapshot and the exact passages. It compares source digests with the current signed publication. Integrity, freshness and claim support are separate judgments. The graph panel displays the publication-time native canonicalization receipt; the browser does not recompute RDF canonicalization. JSON, Markdown and signed-manifest downloads remain available. Compatible MCP Apps hosts can render the same viewer through `browse_evidence`. Without a task ID this tool returns the public browser link. With `task_id`, it retrieves only a task owned by the bearer token configured on the MCP connection. Tokens belong in the HTTP Authorization header, never in tool arguments or URLs. ## MCP Tasks The same jobs are available through the `io.modelcontextprotocol/tasks` extension on `https://blackcatinformatics.ca/mcp`, using protocol `2026-07-28`. Configure the owner token obtained from `/a2a/token` as `Authorization: Bearer ` on every request. Send the normal protocol envelope and headers, including `Mcp-Method` and, for tool calls, `Mcp-Name`. Declare `"extensions": { "io.modelcontextprotocol/tasks": {} }` inside `params._meta["io.modelcontextprotocol/clientCapabilities"]` on each task request. Call `create_evidence_dossier` with `topic`, optional `questions`, `locale`, and an optional stable `request_id` for deduplication. The response has `resultType: "task"`, `taskId`, status, lifetime and polling interval. It is durable before acknowledgment. Use `tasks/get` with `taskId` to retrieve progress and the final tool result, or `tasks/cancel` to request cancellation. The `tasks/get` response has `resultType: "complete"`; its `status` describes the job, and `result` contains the final tool result when completed. An evidence-capture failure is a completed tool execution with `isError: true`, preserving the MCP distinction between tool errors and protocol errors. `tasks/update` acknowledges unknown input responses; this workflow does not issue input requests. Task notifications are not advertised; use polling. Clients without the extension receive the standard missing-capability error and can use A2A or the browser instead. ## Follow publication changes The [LDES feed](https://blackcatinformatics.ca/changes) publishes immutable versions of public service, project, publication and CV records in all three languages. A publication member also links the signed source inventory, verification keys and graph identity receipt. It is captured after the corresponding index activates. Follow `tree:view`, then `tree:relation` links, and collect the IRIs in `tree:member`. Immutable pages link backward to earlier pages. Persist seen member IDs, revisit the root for new pages and deduplicate by member IRI. This is an unordered TREE traversal; order versions by `dcterms:created`. Use `dcterms:isVersionOf` for stable record identities and ActivityStreams Create, Update and Delete types for changes. Each active record version carries its complete payload as an RDF JSON literal and links its archived public record source. A deletion keeps earlier versions available. History starts at the first captured publication. It does not reconstruct earlier deployments. Public stream members and record snapshots have no expiry. Private task inputs and outputs never enter this feed. Source inventories identify changes across public files; complete snapshots of other cited files are retained when a dossier captures them. LDES 1.0 is a SEMIC technical specification; TREE is Community Group work. Neither is described here as a W3C Recommendation.