@kybernesis/create 0.3.1 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kybernesis/create",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "The Kybernesis agent scaffolder and FDE toolkit: one command to a governed, remembering, multiplayer, self-testing eve agent — plus doctor and upgrade.",
   "license": "Apache-2.0",
   "type": "module",

package/skills/connect-agents/SKILL.md

@@ -90,3 +90,30 @@ the peer by hand to BOTH the `vercelOidc({ subjects })` list and the
 - **Works locally, 401 in production** → caller's OIDC not accepted: the
   receiver's `trustedPeers` names the wrong environment (default is
   production-only) or wrong project.
+
+## Governed mode (control-plane edges — preferred when the client runs the admin)
+
+Instead of hand-enumerated peers, edges are GRANTED in the Kybernesis control
+plane and enforced with 300s A2A tokens. Full lifecycle proven live 2026-08-07
+(grant → dispatch → revoke → refused ≤5 min → re-grant → restored, no deploys).
+
+Setup, per agent (admin UI /agents):
+1. Register both agents as eve deployments — URL must be the OPEN production
+   alias (health 200; forms sanitize pasted punctuation as of this writing).
+2. Grant the edge on the CALLEE's panel ("Agent-to-agent edges" → allow calls
+   from <caller> + purpose; expiry optional — self-destructing edge).
+3. Mint each agent's credential (shown ONCE) → set as Sensitive env
+   `KYBERNESIS_AGENT_CREDENTIAL` on that agent's Vercel project.
+
+Then in code (dispatch ≥0.2.1 + enterprise ≥0.2.0 both installed):
+- caller: `remotePeer({ callee: "<EXACT registered name>", governed: { issuer },
+  envVar, fallbackUrl, description })` — envVar/fallbackUrl kept as overrides;
+  registry supplies the URL when the credential is present.
+- receiver: `dispatchChannel({ governed: { issuer, agent: "<own name>" } })`.
+
+Gotchas: names are case-sensitive ("Kyber" ≠ "kyber" — copy from the admin);
+credentials are one JWS line ~3 segments, an ES256 signature is 86 base64url
+chars — a truncated paste fails verification silently, so length-check it;
+scheduled/cron turns still forward no human (service identity at the peer);
+the deployed agent's model spend shares the project's AI Gateway budget with
+local eval runs — size the budget for BOTH or production goes model-dead.

package/skills/kybernesis-packages/SKILL.md

@@ -49,6 +49,17 @@ then `eve add @kybernesis/<item>`). Each covers one axis:
   versions (old receivers silently drop forwarding → service identity).
   Composes with enterprise via `extraAuth: [kybernesisAuth(...)]`. See the
   `connect-agents` skill for the end-to-end wiring flow.
+  **GOVERNED mode (≥0.2.1, proven live 2026-08-07):** `remotePeer({ callee:
+  "<registered-name>", governed: { issuer } })` + `dispatchChannel({ governed:
+  { issuer, agent } })` — edges granted in the control plane, outbound auth =
+  a 300s A2A token minted from POST /api/agent/session with the deployment's
+  `KYBERNESIS_AGENT_CREDENTIAL`, callee URL from the registry (envVar
+  overrides). Revoke in the admin → refused within the token TTL, no
+  redeploy. Names match EXACTLY (case-sensitive: "Kyber" ≠ "kyber").
+  Requires @kybernesis/enterprise ≥0.2.0 installed (optional peer, lazy).
+  0.2.1 lesson: eve resolves remote URLs at BOOT — url() must degrade
+  (env → discovery-if-credentialed → fallbackUrl), never throw on a missing
+  credential, or the whole agent (and its evals) fails to boot.
 - **evals** — QA. `kybernesisBaseline({ agentDisplayName, routing,
   engineer? })` = smoke + 5 memory + routing per dept + optional vision-loop
   eval. Judge model ≠ model under test. Hermetic runs force all workspaces to