@agenticprimitives/devkit 0.0.0-alpha.14 → 0.0.0-alpha.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/devkit",
-  "version": "0.0.0-alpha.14",
+  "version": "0.0.0-alpha.15",
   "description": "The Developer Kit core (spec 398 §10 / spec 399 §3): `ap doctor` runs the doctrine gates as data + pure rules over any tree, `ap doctor --rules` projects one pinned rules source into AGENTS.md / CLAUDE.md / .cursor/rules by digest, `ap upgrade` rewrites every @agenticprimitives/* pin to one coherent exact set, and `ap conform` / `ap test` dispatch to the packages that own conformance and live gates.",
   "homepage": "https://agenticprimitives.dev",
   "bugs": {
@@ -44,7 +44,7 @@
     "@agenticprimitives/mcp-protocol": "0.0.0-alpha.4"
   },
   "peerDependencies": {
-    "@agenticprimitives/a2a": "0.0.0-alpha.29",
+    "@agenticprimitives/a2a": "0.0.0-alpha.30",
     "@agenticprimitives/evaluation": "0.0.0-alpha.5",
     "@agenticprimitives/harness": "0.0.0-alpha.11",
     "@agenticprimitives/orchestration": "0.0.0-alpha.10",

package/rules/service-agent-birthrights.md

@@ -30,7 +30,7 @@ Every one of those is a working system honestly enforcing a birthright nobody ga
 | 1 | **Identity + standing** | the account deployed; its typed name bought or claimed; its public records written (`atl:agentType`, `a2aEndpoint`, `atl:cardUri`, `atl:mcpEndpoint` when it serves one, `siteUrl` when it has a site); the **stewardship link** from the service to its steward recorded in the steward's vault | nobody can reach it by name; its steward's Home does not list it; "only the agent's custodian…" |
 | 2 | **Storage** | the **vault key binding** (spec 278: provision + bind, signed by the custodian, ERC-1271 against the service's account) and the **standing interactions grant** to its own door (spec 322 plane B, the scope list the Home builds today) | `vault_key_unauthorized` on every read; `record_scope_denied` on every write; nothing it does can be recorded |
 | 3 | **Playbook** | the archetype assignment in its vault, by definition digest (spec 354 §4.3): the default for its kind, or the one its charter names (`content-catalog` for a catalog, `treasury-steward` for a treasury, the app's own for an app) | the bare harness — a service that moves value and tells nobody (spec 360's incident) |
-| 4 | **Harness** | the agent runs **the** harness, not a loop of its own: hosted by the runtime (records name its MCP; nothing to deploy) or self-hosted with the Service Host embedded (spec 433) — either way runs, receipts and `run.provenance:<runRef>` land in **its** DO and **its** vault | an endpoint that answers and an estate that never saw it |
+| 4 | **Harness** | the agent runs **the** harness, not a loop of its own: hosted by the runtime (records name its MCP; nothing to deploy) or self-hosted with the Service Host embedded (spec 433) — either way runs, receipts and `run.provenance:<runRef>` land in **its** DO and **its** vault. **A self-hosted agent also issues its READ WIRE to its steward's Home** (spec 433 W2): a delegation from the agent to the Home runtime's interactions-session key, pinned `harness.read` only, signed by the custodian the way its storage grant is (`issue-self-host-read-wire.mts`) — the Home cannot verify its own session at another host, so the steward's Activities page reads the agent's runs under the agent's own wire, or not at all | an endpoint that answers and an estate that never saw it; runs kept at a host the steward's Home is refused at ("this host admits no Home session") |
 
 A charter that cannot complete a birthright **says so and stops**, the way the Home's org-create says "storage
 not enabled — Enable (steward)". It does not deploy, name and walk away. A script that mints a key, deploys and
@@ -43,6 +43,7 @@ deploy → name + records → stewardship link
       → vault-key bind (278)  → interactions grant (322 §2 B, current scopes)
       → archetype assignment (354 §4.3, by digest)
       → the harness: records name the MCP (hosted) │ the app embeds the Service Host (433)
+                                                    │   + the read wire to the steward's Home (433 W2: issue-self-host-read-wire.mts)
       → verify: /harness/ask on the new agent answers; its steward's Home lists it with 0 runs, not "not enabled"
 ```