@kybernesis/create 0.3.0 → 0.3.2

package/dist/doctor.js

@@ -45,10 +45,13 @@ export async function doctor() {
     if (env.ARCANA_API_KEY && env.ARCANA_COMPANY_WORKSPACE)
         arcanaPairs.push({ key: env.ARCANA_API_KEY, ws: env.ARCANA_COMPANY_WORKSPACE, label: "company brain" });
     if (env.ARCANA_EVAL_API_KEY) {
-        const evalWs = /ARCANA_COMPANY_WORKSPACE=([a-z0-9-]+)-eval|([a-z0-9-]+)-eval/.exec(pkg.scripts?.eval ?? "");
-        const ws = evalWs?.[1] ? `${evalWs[1]}-eval` : evalWs?.[2] ? `${evalWs[2]}-eval` : null;
-        if (ws)
-            arcanaPairs.push({ key: env.ARCANA_EVAL_API_KEY, ws, label: "eval workspace" });
+        // Match both `WORKSPACE=name-eval` and the shell-default form
+        // `WORKSPACE=${ARCANA_EVAL_WORKSPACE:-name-eval}`.
+        const script = pkg.scripts?.eval ?? "";
+        const evalWs = /=\$\{[A-Z0-9_]+:-([a-z0-9][a-z0-9-]*-eval)\}/.exec(script) ??
+            /=([a-z0-9][a-z0-9-]*-eval)\b/.exec(script);
+        if (evalWs?.[1])
+            arcanaPairs.push({ key: env.ARCANA_EVAL_API_KEY, ws: evalWs[1], label: "eval workspace" });
     }
     for (const [k, v] of Object.entries(env)) {
         const m = /^ARCANA_([A-Z0-9_]+)_API_KEY$/.exec(k);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent — plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",

package/skills/certification/SKILL.md

@@ -33,7 +33,23 @@ model under test.
 - Stale sandbox state (migration errors, re-baking templates):
   `rm -rf .eve/sandbox-cache .eve/dev-runtime` and rerun.
 - Don't pipe the eval command through `tail` in scripts — it masks the exit
-  code.
+  code (and `| tail -N` on a backgrounded run destroys the per-eval detail —
+  `tee` to a file instead).
+- **Heavy-model suites: `maxConcurrency: 1` locally.** At 2, long opus turns
+  overload the local world-queue transport (`Queue delivery failed … fetch
+  failed`); crashed deliveries REPLAY subagent steps, surfacing as
+  `lost continuationToken` races and phantom failures that move between runs.
+  The deployed runtime uses real queue infra — this is a local-harness limit.
+- **AI Gateway budget is a silent eval killer**: Vercel applies a default
+  per-project budget (e.g. $10/daily); a suite of real opus turns can exhaust
+  it MID-RUN → `MODEL_CALL_FAILED` on whatever ran last. Check/raise:
+  `vercel ai-gateway budgets list` / `budgets set project <name> --limit 30
+  --refresh-period monthly`.
+- **"run parked on N unanswered input request(s)"** = the agent called a
+  human-in-the-loop tool (`approval: status=pending tool=ask_question` in the
+  turn log) — no one answers in an eval. Usually a behavior finding: the
+  fixture was self-contained and the agent asked instead of acting. Fix the
+  agent's bias-to-act instructions, not the fixture.
 
 ## eve version certification
 

package/skills/connect-agents/SKILL.md

@@ -18,7 +18,11 @@ able to *initiate*.
 2. **Vercel identities** of both projects: team slug + project name as shown in
    `npx vercel ls <project>` (slugs, not `team_…`/`prj_…` IDs).
 3. **Stable production URL** of the callee: `npx vercel inspect <latest-prod-url>`
-   → Aliases → prefer the `<project>-<team>.vercel.app` form (survives redeploys).
+   → Aliases — then **verify the alias is OPEN before wiring it**:
+   `curl -s -o /dev/null -w "%{http_code}" <url>/eve/v1/health` must return
+   **200**. The `<project>-<team>.vercel.app` aliases commonly sit behind
+   Vercel SSO deployment protection (302 → vercel.com/sso-api) and CANNOT
+   receive dispatches; the shorter production alias is usually the open one.
 4. Both repos need `@kybernesis/dispatch` installed (`npm i @kybernesis/dispatch`).
 
 ## Caller side — one file
@@ -86,3 +90,30 @@ the peer by hand to BOTH the `vercelOidc({ subjects })` list and the
 - **Works locally, 401 in production** → caller's OIDC not accepted: the
   receiver's `trustedPeers` names the wrong environment (default is
   production-only) or wrong project.
+
+## Governed mode (control-plane edges — preferred when the client runs the admin)
+
+Instead of hand-enumerated peers, edges are GRANTED in the Kybernesis control
+plane and enforced with 300s A2A tokens. Full lifecycle proven live 2026-08-07
+(grant → dispatch → revoke → refused ≤5 min → re-grant → restored, no deploys).
+
+Setup, per agent (admin UI /agents):
+1. Register both agents as eve deployments — URL must be the OPEN production
+   alias (health 200; forms sanitize pasted punctuation as of this writing).
+2. Grant the edge on the CALLEE's panel ("Agent-to-agent edges" → allow calls
+   from <caller> + purpose; expiry optional — self-destructing edge).
+3. Mint each agent's credential (shown ONCE) → set as Sensitive env
+   `KYBERNESIS_AGENT_CREDENTIAL` on that agent's Vercel project.
+
+Then in code (dispatch ≥0.2.1 + enterprise ≥0.2.0 both installed):
+- caller: `remotePeer({ callee: "<EXACT registered name>", governed: { issuer },
+  envVar, fallbackUrl, description })` — envVar/fallbackUrl kept as overrides;
+  registry supplies the URL when the credential is present.
+- receiver: `dispatchChannel({ governed: { issuer, agent: "<own name>" } })`.
+
+Gotchas: names are case-sensitive ("Kyber" ≠ "kyber" — copy from the admin);
+credentials are one JWS line ~3 segments, an ES256 signature is 86 base64url
+chars — a truncated paste fails verification silently, so length-check it;
+scheduled/cron turns still forward no human (service identity at the peer);
+the deployed agent's model spend shares the project's AI Gateway budget with
+local eval runs — size the budget for BOTH or production goes model-dead.

package/skills/kybernesis-packages/SKILL.md

@@ -49,6 +49,17 @@ then `eve add @kybernesis/<item>`). Each covers one axis:
   versions (old receivers silently drop forwarding → service identity).
   Composes with enterprise via `extraAuth: [kybernesisAuth(...)]`. See the
   `connect-agents` skill for the end-to-end wiring flow.
+  **GOVERNED mode (≥0.2.1, proven live 2026-08-07):** `remotePeer({ callee:
+  "<registered-name>", governed: { issuer } })` + `dispatchChannel({ governed:
+  { issuer, agent } })` — edges granted in the control plane, outbound auth =
+  a 300s A2A token minted from POST /api/agent/session with the deployment's
+  `KYBERNESIS_AGENT_CREDENTIAL`, callee URL from the registry (envVar
+  overrides). Revoke in the admin → refused within the token TTL, no
+  redeploy. Names match EXACTLY (case-sensitive: "Kyber" ≠ "kyber").
+  Requires @kybernesis/enterprise ≥0.2.0 installed (optional peer, lazy).
+  0.2.1 lesson: eve resolves remote URLs at BOOT — url() must degrade
+  (env → discovery-if-credentialed → fallbackUrl), never throw on a missing
+  credential, or the whole agent (and its evals) fails to boot.
 - **evals** — QA. `kybernesisBaseline({ agentDisplayName, routing,
   engineer? })` = smoke + 5 memory + routing per dept + optional vision-loop
   eval. Judge model ≠ model under test. Hermetic runs force all workspaces to