Create a workspace: the container for the participants, tasks and audit log of one piece of collaborative work. Returns the workspace id, which every later call carries.

Report the current state of a workspace: its members, enabled profiles, audit length, and task and override counts.

Replace the set of profiles enabled on a workspace. Enabling audit-scitt/1.0 on a workspace that already has entries leaves those entries outside the hash chain.

Add a participant to a workspace. The type given, human, agent, service, group or workspace, decides whether they are eligible to review work that requires it.

Remove a participant from a workspace. Entries they have already written stay in the audit log.

Create a task: a unit of work assigned to one participant. Set review_required to make the task's completion depend on a reviewer decision rather than on the assignee.

Move a task to a new state. Only the transitions in the specification's lifecycle table are accepted, and a task that requires review cannot be completed here.

Submit a task's output. A task that requires review does not complete: the output is held as the artefact under review, the task moves to review_requested, and a reviewer decision completes it. Any other task completes immediately.

Read entries from a workspace's audit log, optionally within a sequence range and filtered by method, sender or task.

Open a review on a task and address it to one or more reviewers. They then call chap.decide.approve, chap.decide.reject, chap.decide.override or chap.abstain.declare. Repeating the request with the same artefact adds reviewers to the open review.

Approve the artefact under review. The task completes once the review's rule is satisfied.

Reject the artefact under review. The task is declined, or returns to in_progress if request_revision is set.

Correct the artefact under review with an RFC 6902 JSON Patch and accept the result. The patch, the rationale and any tags are recorded together, so the audit log holds what was changed and why, rather than only that the work was not accepted as written.

Stand aside from a review, giving a reason and a category. The task moves to abstained.

Hand a task upwards. The original moves to escalated and is linked to a new task opened for whoever takes it on. The successor starts with an empty input unless one is supplied.

Put one question to one or more participants, with a deadline and a default. If the deadline passes unanswered the default applies, so a task is never blocked waiting on a reply.

Answer an open whisper. Where the question carried options, the answer must name one of them.

Open a deliberation among several participants under a stated voting rule: any_one_approves, all_approve, quorum:N, weighted_vote:T or weighted_vote_with_veto:T.

Record a comment on an open deliberation, so the reasoning is on the audit log alongside the votes.

Cast a yea, nay or abstain in an open deliberation. Each participant votes once.

Close a deliberation and compute its outcome from the votes cast under its rule.

Propose handing one or more tasks to another participant or a group, with the context needed to pick them up. Every task must currently be assigned to the proposer.

Accept a proposed handoff. The accepted tasks are reassigned to the accepting participant.

Decline a proposed handoff, with a reason and optionally a suggestion of who should take it instead.

Pause work. Scoped to a task it moves that task to paused; to a participant it stops new tasks being assigned to them; to the workspace it refuses every method except describing, reading the audit log, joining, leaving and resuming.

Resume work paused at the same scope: a task returns to in_progress, a participant can be assigned tasks again, a workspace returns to active.

Cancel a task. Cancelled is terminal, and a task that has already settled cannot be cancelled.

Capture the workspace state as an artefact and return its id, which chap.control.rollback takes as its target.

Restore workspace state from a snapshot. The mode ceiling and member roles are restored; the rollback is appended to the audit log rather than rewriting it.

Replace a task with a successor in one call. The original moves to superseded and stays linked to its replacement.

Set the highest operating mode tasks in this workspace may request. A task above the ceiling is refused.

Choose an assignee for a task from a list of candidates and record a route_decision artefact naming the policy, the candidate chosen, and the alternatives it passed over.

Decide how much review a task warrants, skip, spot_check or full, from its routing hints. Records a route_decision artefact giving the rule that produced the answer.

Evaluate a task's routing hints against the escalation policy and report whether it should be escalated, and to whom. Records a route_decision artefact.

Retire a participant's signing key and register its replacement. The old key stays in the key history with a valid_until timestamp, so envelopes it signed still verify.

Revoke a signing key, for example after a device is lost. Signatures presented with it are refused from then on. Revoking another participant's key requires the admin role.

Build COSE_Sign1-shaped statements for a range of audit entries and submit them to the configured SCITT transparency service. Where none is configured the statements are returned for submission out of band.

Verify a SCITT receipt through the configured verifier. Verification fails closed where no verifier is configured.

Replay a workspace's prev-hash chain. Only status verified with ok true means the log was checked and is intact. Status not_evaluated with ok false means part of the log was never checked, so its integrity is unknown and must not be reported as verified; entries_unchecked says how much. An error means the chain is broken or absent.