@awebai/oats 0.25.9 → 0.27.0

package/README.md

@@ -11,7 +11,9 @@ OATS—**Open Agent Team Specification**—is a framework for building, running
 
 **Capabilities are the building blocks of an OATS setup.** When you define an agent, you choose its capabilities. Each provides the know-how and tools for knowledge systems, messaging, task coordination or any other workflows, tools or ways of working. We provide defaults to get started, but you can adapt existing capabilities or create fully custom ones to shape how your agents work and which tools they use.
 
-The [official marketplace](docs/official-marketplace.md) is the reviewed list of official packages; listing is not executable approval.
+The [official catalog](docs/official-catalog.md) is the reviewed list of official packages; a workspace trusts a package by declaring it, and listing does not declare it for you.
+
+**oats.aweb 1.13.1** attaches resident session-grant homes to the resident custody service during minting, verifies the written `grant.yaml` custody locator, and fails closed if an installed `aw` cannot write or prove that attachment. If a grant-sent message ever arrives as unverified, report the missing custody attachment instead of retrying.
 
 For example, a kernel expert, a UX expert and a customer-support expert can share capabilities for learning and coordination, while each has specific capabilities for its own area of expertise.
 
@@ -82,9 +84,9 @@ Several developers may each work with an instance of the same kernel-expert soul
 
 They share a specialisation, but not an active mind. Each develops an understanding of its assignment and keeps track of its own unfinished work. Accepted findings can become useful to other instances without making their working contexts identical.
 
-## Fundamental capabilities—and any others you need
+## Core capabilities—and any others you need
 
-Three capability areas provide the foundation for working as a team:
+Three **core capabilities** provide the foundation for working as a team; a soul has at most one of each:
 
 | Capability | What it provides |
 |---|---|
@@ -94,13 +96,13 @@ Three capability areas provide the foundation for working as a team:
 
 These responsibilities are distinct. A conversation is not automatically a task record, and a task record is not automatically knowledge.
 
-They are **not the only capabilities you can define**. Additional capabilities can provide domain tools, specialised skills, research methods, review procedures or integrations with your systems.
+Core capabilities are **not the only capabilities you can define**. Other capabilities can provide domain tools, specialised skills, research methods, review procedures or integrations with your systems.
 
 A **skill** teaches a way of working. A capability can supply that skill together with instructions, tools and supporting automation. OATS composes the selected resources into an instance’s working environment when it is created.
 
 ### Common contracts, different implementations
 
-The kernel supplies soul and instance identity, configuration, lifecycle, resource composition and execution approval. Models and harnesses remain user-selected execution choices; capabilities may declare requirements that a chosen setup must satisfy.
+The kernel supplies soul and instance identity, configuration, lifecycle, resource composition and exact, integrity-checked package locking. Models and harnesses remain user-selected execution choices; capabilities may declare requirements that a chosen setup must satisfy.
 
 Capabilities supply the behaviour behind their contracts:
 
@@ -109,7 +111,7 @@ Capabilities supply the behaviour behind their contracts:
 - A task capability can connect agents to the tracker or coordination model you prefer.
 - Additional capabilities can extend a team without becoming mandatory parts of OATS.
 
-A **package** distributes capabilities and their resources. Acquiring one does not automatically activate it or approve executable code. Provider independence does not mean every combination is compatible; missing requirements must be reported, not silently discarded.
+A **package** distributes capabilities and their resources. Declaring one in a workspace is the decision to trust it; its capabilities reach a soul only when the soul or a workspace default selects them. Provider independence does not mean every combination is compatible; missing requirements must be reported, not silently discarded.
 
 ## Our approach to knowledge and learning