Clover REST API skill

Read SKILL.md, then inspect the operation in endpoint-contracts.json.

Default: review / READ-ONLY. Before credential access or dispatch, read execution authority [CL0124–CL0131]. Sandbox and production writes need explicit merchant/environment/operation-budget/recovery approval. Credential probes cannot disclose secrets; historical notes confer no approval. Project overlays are opt-in [CL0144].

This repository contains reviewed documentation excerpts, July 2026 production and sandbox observations, design inference and local safety policy. It does not claim every behavior was measured or that live provider/consumer integration is certified. The claim ledger records scope and missing evidence; raw July probe fixtures are absent.

Repository layout

File	Purpose
SKILL.md	Claim-ID entrypoint
references/claims.json	Atomic claim provenance and occurrence inventory
references/endpoint-contracts.json	Operation contracts, unresolved fields and release blockers
references/source-map.md	Portable discovery and evidence rules
references/clover-verified-behavior.md	Historical July record with current correction notices
references/authentication.md	Credential classes and incomplete wire-schema gates
references/webhooks.md	Static-secret intake, durable hints and unresolved canonical evidence
references/printing.md	Paid-order firing intent and uncertainty without automatic re-fire
references/execution-authority.md	Mandatory authority and data boundaries
scripts/test_safety_model.py	Socket-free adversarial policy checks, not agent-behavior certification
references/synchronization.md	Bounded projections and uncertain completeness
examples/go/clover/CONTRACTS.md	Canonical Go 1.27.0 module and collaborator boundaries
scripts/fetch-docs.py	Standard-library credential-free retriever
scripts/test_fetch_docs.py	Offline retrieval checks

Install and use

Canonical installed parent: using-clover-rest-api, matching the skill frontmatter. From the actual checkout root (whatever its path), run:

python3 scripts/install-skill.py --skills-dir "$HOME/.agents/skills"

Choose your agent's configured skill directory if different. The installer derives the source from its own checkout path, validates the name and all local links, and refuses any existing target, including dangling symlinks. It never replaces a file, directory or link. No author-specific cache or home-directory script is needed. Inspect first with --help.

For an old install name, keep that install as a backup, install the canonical name into a clean configured skills directory, switch the agent to that directory and reload/restart its skill session. Avoid loading both versions. Rollback may select a retained read-only version; keep writes disabled and never reactivate unsafe historical examples. Unrelated skills are untouched.

Skill version: 0.7.0-unreleased. Minimum Go: 1.27.0. Python tools: 3.12+, standard library only. Claim ledger: 2026-09-08.batch7, four classes; endpoint registry: 2026-09-08.batch3, 84 records, all release-blocked. MIT; Copyright (c) 2026 Mohamed Elkholy (LICENSE). Version changes do not clear provider gates.

Changelog · Release checklist · Evaluation protocol — NOT YET RUN.

1. Read SKILL.md and the relevant claim/operation records.
2. Discover pages through https://docs.clover.com/dev/llms.txt; append .md for Markdown or reference OpenAPI.
3. Retrieve with python3 scripts/fetch-docs.py --help; review the body before promoting any contract.

The retriever defaults to a repository-relative .cache/clover-docs directory. A title match confirms identity only. Missing/blocked contracts remain unresolved. Browser User-Agent needs are conditional: same-day network observations disagree.

Local verification and boundaries

cd examples/go/clover
go build ./...
go vet ./...
go test -count=1 ./...

Tests use synthetic credentials and no Clover sockets. Consumer deployment still requires principal/installation authorization, durable stores and one fleet dispatcher. Atomic DTOs and complete OAuth wire adapters are not advertised as shipped functionality.

examples/go-client-usage is a retired migration path; references/go-adapter.md contains generated canonical excerpts (CL0121). Atomic quantity/correlation defects are corrected in non-executable guidance; live financial adapters remain disabled (CL0122). OAuth code-exchange/recovery adapters remain disabled. The canonical module has 301 cases plus 3 CLI cases; local race checks passed in batch 6. Hosted stable-matrix evidence remains pending.

From the checkout or installed root, run python3 scripts/check-local-links.py for offline, case-sensitive local paths and fragments, and python3 scripts/check-links.py for citations.