Integrating Apps With NCP

Apps integrate with NCP by adding NerveEndings: small adapters that turn app events, metrics, logs, billing changes, and product signals into NCP triggers for a user's own NerveOS System.

Modern Connection Workflow

NCP-native apps should not ask users to paste generic passwords. They should create a scoped app connection that the user can understand and revoke.

1. User opens the app object that should emit signals.
   Example: SummitOS -> Rainier Expedition -> Enable NerveOS System.

2. App asks the user to connect a NerveOS System.
   The user creates or approves a scoped NCP connection token.

3. Token metadata should describe the connection:
   label: SummitOS Rainier Expedition
   sourceSystem: summitos.com
   audience: Rainier Expedition
   environment: live
   scopes: ncp:trigger:write
   allowedEventTypes:
     - expedition.weather_window
     - expedition.readiness_changed

4. App stores the endpoint and token securely.

5. App sends signed NCP triggers when selected events happen.

6. User can disconnect the app from NerveOS System at any time.

Authentication Headers

App monitoring agents should send bearer-authenticated, signed requests. Receivers use X-NCP-Event-Id to reject duplicate retries without creating duplicate nudges. For copy-paste implementation code, see NCP Auth for Agents.

POST https://{nervesynapse-endpoint}
Authorization: Bearer ncp_live_...
X-NCP-Timestamp: 2026-05-31T18:00:00Z
X-NCP-Signature: sha256=base64url(hmac_sha256(token, timestamp + "." + raw_body))
X-NCP-Event-Id: evt_summitos_rainier_window_001
Content-Type: application/json

{ ...valid NCP trigger JSON... }

Coding Agent Prompt

Add NCP signal emission to this app.

Start at the application layer. Create NCP signals for product events the app
itself understands, such as:
- user or customer milestones
- per-object opportunities
- deadlines, conflicts, or readiness windows
- important workflow status changes
- domain-specific events a generic platform cannot infer

NerveEndings are not only infrastructure monitors. Use the best source for the
signal:
- app code for domain events only the app knows
- Google Analytics for application behavior signals such as missing-song demand,
  visitor intent, content demand, conversions, traffic spikes, and referrals
- Firebase alerting or budget alerts for hosting, auth, and cost signals
- error tracking tools for unusual error rates
- lifestyle sources for passive OS signals such as calendar, health, location,
  weather, availability, and readiness

When a threshold is crossed, emit a valid NCP v0.1 trigger to my NerveOS System endpoint.

Use context_refs for dashboards, logs, billing records, and analytics details.
Do not copy raw customer data, secrets, payment details, or private logs into the trigger.

Use NCP Auth v0.1:
- Authorization: Bearer ncp_live_...
- X-NCP-Timestamp
- X-NCP-Signature over timestamp + "." + raw_body
- X-NCP-Event-Id for idempotency

Example: Traffic Spike

A project such as happybirthdaysong.com can use Google Analytics for app-domain behavior signals such as missing-song demand, visitor intent, content demand, and traffic spikes. It can use Firebase alerting for cost/auth/hosting and app code for product events only the app itself understands.

{
  "ncp_version": "0.1",
  "type": "trigger",
  "id": "trg_hbs_traffic_spike_2026_05_23",
  "source": {
    "system": "happybirthdaysong.com",
    "event_type": "web.traffic.spike",
    "url": "https://happybirthdaysong.com"
  },
  "timestamp": "2026-05-23T23:00:00Z",
  "domain": "growth.analytics",
  "subject": "Traffic spike on Happy Birthday Song",
  "summary": "Traffic is running above the normal baseline and may indicate a campaign, referral, bot spike, or viral page.",
  "severity": "opportunity",
  "confidence": 0.87,
  "sensitivity": "internal",
  "personal_relevance": 0.82,
  "evidence": [
    { "label": "visitors_24h", "value": 18420 },
    { "label": "baseline_24h", "value": 2900 },
    { "label": "increase", "value": 535, "unit": "percent" }
  ],
  "context_refs": [
    {
      "type": "url",
      "ref": "https://analytics.example/happybirthdaysong/traffic/2026-05-23",
      "description": "Analytics dashboard for the traffic spike",
      "sensitivity": "internal"
    }
  ],
  "recommended_route": {
    "agent": "growth_analytics_agent",
    "project": "happybirthdaysong.com",
    "domain": "growth"
  },
  "action_contract": {
    "allowed_without_approval": [
      "summarize_traffic_source",
      "identify_referrers",
      "draft_growth_brief"
    ],
    "requires_approval": [
      "change_ad_spend",
      "publish_public_update",
      "email_users"
    ],
    "forbidden": ["export_personal_data"]
  },
  "delivery_policy": {
    "urgency": "same_hour",
    "channels": ["app", "push"],
    "quiet_hours_respected": true
  },
  "tags": ["traffic", "growth", "analytics"]
}