Is Canon available on this deployment?

The feature probe, and the supported way to detect Canon before calling any other /coord/v1 path. Unauthenticated — no credential required. 200 {"canon": true} enabled, 404 disabled.

First-party clients should read capabilities.canon from GET /v2/me instead: it is this probe, cached by the gateway.

Canon — the coordination layer. Where memory answers what do my agents know, Canon answers what do my agents agree is true: an append-only assertion store with enforced authority ordering (operator > observation > inference — authority outranks recency), bitemporal reads (valid time vs transaction time), explicit contested state, and advisory claims with fencing tokens.

Proxied verbatim to Kairos; the gateway authenticates and parses NOTHING here, so the Authorization header goes upstream untouched and Kairos is the sole authority — the same terms as /v1. Either il_* credential is accepted; a Supabase session JWT is not.

Canon is optional per deployment, and detectable. Where it is not enabled, EVERY /coord/v1 path answers 404 — including the four verbs below — and the gateway forwards that 404 unchanged rather than substituting an error of its own. The memory API is completely unaffected either way: enabling or disabling Canon changes nothing about /v1, /v2 or /mcp. Probe GET /coord/v1/healthz (or read capabilities.canon from GET /v2/me) before relying on Canon.