@lapxo/head 0.1.3 → 0.1.4

package/TARGET.bound

@@ -1,45 +1,67 @@
+bound-lock/1 about="# Connect any API\n\nhead reads an API by the document its provider already publishes, at the address you give it. head names no provider and connects none of its own: what is connected is what you hand it. Here is one way for each level of access, with an API of each kind.\n\n### No access: a document that says nothing about it\n\nTake an API whose document lists its operations and states nothing about access. head does not guess what that means: it tries a read once with nothing attached, and keeps what it saw (`access/<source>/<operation>/observed anonymous`) as a receipt its own key signs. Nothing but a read is ever tried this way.\n\nConnect the document by its address, `https://<provider>/openapi.yaml`, by the site that publishes it, or by a folder holding it, as `forecast`, then read one of its operations. With no place yet, one yes founds your place in `~/place`, connects the document there and lets head read `forecast` for the next 90 days. A document that names several servers asks once which one. The answer comes back typed by what the document declares, one value a line, with a signed receipt of the read (abridged):\n\n```text\nanswer/<request>/current/temperature   number  …\nanswer/<request>/current_units/temperature   text    …\nread/forecast/<operation>/<request>    digest  sha256:… signed by head\n```\n\nAn overlay can still say what the provider says on its own site, so the place states it rather than observes it:\n\n```yaml\noverlay: 1.0.0\ninfo: { title: the forecast, read without a key, version: '1' }\nactions:\n  - target: \"$.paths['/forecast'].get\"\n    description: the provider says this read needs no key\n    update: { security: [] }\n```\n\nWhatever API you connect, its terms are the provider's: read them before you connect it, and say where an answer came from when they ask you to.\n\n### A declared flow: OAuth 2.0\n\nTake an API whose document declares OAuth 2.0 with an authorization code. head compiles it into the two steps it takes, the provider's page with PKCE and then the token exchange, and nobody writes a line of it. What it needs is yours: the client id of an app you registered with the provider, signed into the place as `keys/access/<source>/<flow> client <id>`. Until then head says so and calls nothing.\n\n### A secret entered by hand\n\nWhen a document declares a bearer token or an API key and no way to obtain one, the key is a secret input. head asks for it on its own one-time page, never through the model, and only when the place's root allows a secret with `access/secret-inputs`. It is kept in the keychain, never in a file.\n\n### When the document says too little\n\nA login of its own (an email, a one-time code, a choice of account) is written once as an `x-access` flow, an Arazzo profile in an overlay, and every API of the same issuer refers to it with one `$ref`. The profile and its vectors are on topos-openapi's own page, `docs/x-access.md` in `@lapxo/topos-openapi`. Every API connected this way is read the same way afterwards: one access per issuer, each answer typed and kept.\n" at=policy:head/connect/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/page/connect-any-api shape=docs/connect-any-api.md value=lock
+bound-lock/1 about="# head\n\nAn API already says what it offers, where it is reached and how access to it is proven. head reads that document once, compiles it into lines its place pins by digest, and from then on answers by those lines: which operation reads, what it asks, what it answered. It names no kind of source and no client: what it reads is said by the worlds it adopts, and what it asks through is what the client declares. [Connect any API](docs/connect-any-api.md) shows each level of access.\n\nA person does three things. **Found a place**: a folder whose lock is the place, its root key kept in the keychain; the first source connected with no place founds `~/place` on the same yes. **Connect a source**: hand head an API document, and an overlay beside it when it says too little; it is compiled once, pinned, and every offer is listed with its class. **Ask**: read an operation. head obtains access the first time, as the document declares it, calls only what reads, types the answer and lands a receipt.\n\nAccess comes at three levels, and the place says which. **None**: the document states that a read needs nothing, or says nothing about access at all; then head tries the read once with nothing attached, and keeps what it saw as a receipt. **A declared flow**: the document, or its overlay, declares how access is obtained, as an Arazzo profile: a form, a one-time code, a choice, a provider's page. head runs it once per issuer and keeps only the token, in the keychain. **A secret entered by hand**: a key or a password, only where the place's root allows it, entered on head's own one-time page and never through the model.\n\nWhat head never does. It never guesses how access is proven: when a document does not state it, only a read is tried, with nothing attached, and nothing else is called. It never calls an operation that is not a read without the person's yes, nor past what the place allows; a place that would stand on another's lock as its parent is refused by name, since composing two places' policies is bound's. It never lets a secret reach the model, a file, an answer or an argument. And it never raises a ceiling to make room: what outgrows one is split by responsibility.\n\n## Install\n\n- **As an extension:** download `head-<version>-<digest>.mcpb` from the [latest release](https://github.com/Lapxo/head/releases/latest) and open it. Its digest is in the release notes.\n- **By command:** `npx -y @lapxo/head@0.1.4`, for an assistant that starts its servers by command.\n\nhead runs on macOS for now. Its keys live in your keychain, never in a file.\n\n## The first minute\n\nhead connects nothing when it is installed, and names no provider: what it reads is the API you hand it.\n\n1. Ask your assistant something. With no place yet, head says so, and asks for the address of the document of an API that answers it.\n2. Give that address and say yes once. head founds your place in `~/place`, connects the API from its document, pinned by the digest of what it read, and lets head read it for the next 90 days.\n3. Your assistant asks again by itself, and the answer comes back typed, with the source it came from and a receipt signed by head's key.\n" at=policy:head/docs/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/readme shape=README.md value=lock
 bound-lock/1 about="A lot is drafted lines, one a line, each by=target and unsigned: nothing was asked." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/bad-lot value=lock
 bound-lock/1 about="A place is founded in an absolute folder: nothing was made." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/place-absolute value=lock
+bound-lock/1 about="A source the place compiles, by the name the place gives it: alone, its region, what it offers; with an operation, one read of it." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/source value=string
 bound-lock/1 about="A source the place compiles." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/access/source value=string
 bound-lock/1 about="A source the place compiles." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/act/source value=string
 bound-lock/1 about="A source the place compiles: an API it holds the document of, by the name the place gives it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/source value=string
 bound-lock/1 about="A source this place connected whose access reads the document, sent to that source-s own origin alone; optional." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/connect/via value=string
+bound-lock/1 about="Access to {source} ({flow}) was refused and is not proven since: {place} holds it open." at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-pending value=lock
 bound-lock/1 about="Access to {source} is kept in this keychain, its receipt landed without the secret: nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/access-kept value=lock
 bound-lock/1 about="Admit another device into a place, once whoever holds its root says yes: the key its own key tool handed, under a name, covering what is given — without it, what a member is: asking, keeping what it read, proving access. What it claims to cover is not read." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/admit value=place|key|name|coverage
 bound-lock/1 about="Allow one offer that is not of class read, up to a number of times." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/can value=source|operation|times
-bound-lock/1 about="An API already says what it offers, where it is reached and how access to it is proven. head reads that document once, compiles it into lines its place pins by digest, and from then on answers by those lines: which operation reads, what it asks, what it answered. It names no kind of source and no client: what it reads is said by the worlds it adopts, and what it asks through is what the client declares. [Connect any API](docs/connect-any-api.md) shows each level of access on a real public API.\n\nA person does three things. **Found a place**: a folder whose lock is the place, its root key kept in the keychain. **Connect a source**: hand head an API document, and an overlay beside it when it says too little; it is compiled once, pinned, and every offer is listed with its class. **Ask**: read an operation. head obtains access the first time, as the document declares it, calls only what reads, types the answer and lands a receipt.\n\nAccess comes at three levels, and the place says which. **None**: the document states a read needs nothing, and nothing is asked. **A declared flow**: the document, or its overlay, declares how access is obtained, as an Arazzo profile: a form, a one-time code, a choice, a provider's page. head runs it once per issuer and keeps only the token, in the keychain. **A secret entered by hand**: a key or a password, only where the place's root allows it, entered on head's own one-time page and never through the model.\n\nWhat head never does. It never guesses how access is proven: a document that does not state it is said so, and nothing is called. It never calls an operation that is not a read without the person's yes, nor past what the place allows; a place that would stand on another's lock as its parent is refused by name, since composing two places' policies is bound's. It never lets a secret reach the model, a file, an answer or an argument. And it never raises a ceiling to make room: what outgrows one is split by responsibility." at=policy:head/docs by=target form=alphabet measure=text role=writes scope=prose/en/idea value=lock
+bound-lock/1 about="An API already says what it offers, where it is reached and how access to it is proven. head reads that document once, compiles it into lines its place pins by digest, and from then on answers by those lines: which operation reads, what it asks, what it answered. It names no kind of source and no client: what it reads is said by the worlds it adopts, and what it asks through is what the client declares. [Connect any API](docs/connect-any-api.md) shows each level of access.\n\nA person does three things. **Found a place**: a folder whose lock is the place, its root key kept in the keychain; the first source connected with no place founds `~/place` on the same yes. **Connect a source**: hand head an API document, and an overlay beside it when it says too little; it is compiled once, pinned, and every offer is listed with its class. **Ask**: read an operation. head obtains access the first time, as the document declares it, calls only what reads, types the answer and lands a receipt.\n\nAccess comes at three levels, and the place says which. **None**: the document states that a read needs nothing, or says nothing about access at all; then head tries the read once with nothing attached, and keeps what it saw as a receipt. **A declared flow**: the document, or its overlay, declares how access is obtained, as an Arazzo profile: a form, a one-time code, a choice, a provider's page. head runs it once per issuer and keeps only the token, in the keychain. **A secret entered by hand**: a key or a password, only where the place's root allows it, entered on head's own one-time page and never through the model.\n\nWhat head never does. It never guesses how access is proven: when a document does not state it, only a read is tried, with nothing attached, and nothing else is called. It never calls an operation that is not a read without the person's yes, nor past what the place allows; a place that would stand on another's lock as its parent is refused by name, since composing two places' policies is bound's. It never lets a secret reach the model, a file, an answer or an argument. And it never raises a ceiling to make room: what outgrows one is split by responsibility." at=policy:head/docs/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/idea value=lock
 bound-lock/1 about="An MCP server that reads any API by its document: access asked once per issuer, every answer typed by the world that compiled it, every read kept with a signed receipt." at=policy:head/docs by=target form=alphabet measure=text role=writes scope=prose/en/what value=lock
 bound-lock/1 about="An earlier call of {operation} on {source} landed its intent {intent} and no receipt: look at what it would have changed with closes={intent}, then act again." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/open value=lock
 bound-lock/1 about="An intent an earlier act left open, by the scope it was named under: once this read lands, it closes that intent with the read-s digest. Look at what the act would have changed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/closes value=string
+bound-lock/1 about="An intent an earlier act left open, by the scope it was named under: once this read lands, it closes that intent with the read-s digest. Look at what the act would have changed." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/closes value=string
 bound-lock/1 about="An overlay for the document, the same way; optional." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/connect/overlay value=string
+bound-lock/1 about="Answer latency depends on reuse of valid readings and an in-process Bound host; the declared answer ceiling remains unchanged." at=policy:head/release-checks/0.1.4 by=target form=alphabet measure=id role=writes scope=answer/seconds/rests-on value=bound/read-reuse|bound/in-process-host
 bound-lock/1 about="Answered from the receipt {scope} ({digest}), as the source answered it at {at}, within the reuse the place allows: nothing was called; nothing typed was kept of it, so the fold typed it again." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/reread value=lock
 bound-lock/1 about="Answered from what was kept for {scope} ({digest}), as the source answered it at {at}, within the reuse the place allows: nothing was called and nothing folded." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/reused value=lock
 bound-lock/1 about="Any API, read by its document" at=policy:head/docs by=target form=alphabet measure=text role=writes scope=docs/tagline value=lock
+bound-lock/1 about="Ask head, and nothing changes but the receipts of what was read. With nothing: what this device has connected. A source: its region, what it offers; with an operation and its parameters, one read of an offer of class read, answered with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. A view: as bound folds it. card: what is open, and the card do needs. lines: a lot for the person to sign. Nothing that is not a read is ever called. An answer about one place ends with its card, valid from it." at=policy:head/card/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask value=place|source|operation|args|view|card|key|lines|why|history|closes
 bound-lock/1 about="Ask me before {operation} on {source} is called, every time. Plan this line for me to sign:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/ask/text value=lock
 bound-lock/1 about="Ask the person before an offer is called, every time." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/ask value=source|operation
 bound-lock/1 about="Call one offer that is not of class read, only as far as the person allowed it and after their yes when they asked to be asked. The intent lands before the call and the receipt after; a call that never answered stays open until a look closes it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/act value=place|source|operation|args
 bound-lock/1 about="Clone, `npm ci && npm test`. A vector that gives you a different answer is the contribution: send it with what it printed. Lines land through the fold, never by hand; when a page and the lock disagree, the lock is right." at=policy:head/docs by=target form=alphabet measure=text role=writes scope=prose/en/contributing value=lock
 bound-lock/1 about="Closed {intent} by this read ({digest}). It counts as done: act runs again only within what is still allowed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/closed value=lock
 bound-lock/1 about="Connect a source to a place from its document." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/connect value=place|source|document
-bound-lock/1 about="Connect a source to a place, once the person says yes: its document, and an overlay beside it, laid whatever its kind and compiled once by whichever world reads it — or open, with the line that pays it — into what the source offers and how access is proven, pinned by digest. Nothing is called. A document at an address may be read as a source the place connected, with the access it holds, and checked against its digest. A package another place shared is connected whole: its lock as the document, named by its digest. And an origin alone, with no source, is used on one yes: a read-only place of its own, its document found where the origin says, compiled, and reads granted." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/connect value=place|source|document|overlay|digest|via|accept
+bound-lock/1 about="Connect a source to a place, once the person says yes: its document, and an overlay beside it, laid whatever its kind and compiled once by whichever world reads it — or open, with the line that pays it — into what the source offers and how access is proven, pinned by digest. Nothing is called. A document at an address may be read as a source the place connected, with the access it holds, and checked against its digest. A package another place shared is connected whole: its lock as the document, named by its digest. A site alone or a folder is looked for its document first, before anything is founded. With no place yet, the first connect founds the person-s place on one yes that also lets head read the source." at=policy:head/connect/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/connect value=place|source|document|overlay|digest|via|accept|operation|args
 bound-lock/1 about="Connect any API" at=policy:head/docs by=target form=alphabet measure=text role=writes scope=prose/en/page/connect-any-api/heading value=lock
 bound-lock/1 about="Connect {source} to the place {place} from {document} with the connect tool, then show me what it offers." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/connect/text value=lock
 bound-lock/1 about="Connected to {place} from the package {package}: {sources} — every document and every pin as it names them. Nothing was granted with them: access is asked here, issuer by issuer." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/received value=lock
+bound-lock/1 about="Do one action in a place, on the card ask answered for it: found a place, admit a device, land a lot ask planned, share a place, make this device-s key, prove access to a source, or call an offer that is not a read. An action on a place that moved since its card was asked is refused, with nothing done; one the place does not allow is said not to be in the card. The answer ends with the card valid from this act." at=policy:head/card/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do value=action|card|place|dir|name|key|coverage|lot|to|urls|who|source|operation|args
+bound-lock/1 about="Drafted lines, one a line, each by=target and unsigned: shown to the person and, on their yes to exactly those, signed by their key and folded as if landed. Nothing lands; the answer names the lot do lands." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/lines value=string
 bound-lock/1 about="Earlier, {source} answered the same request at {at}, under receipt {digest}." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/history-earlier value=lock
+bound-lock/1 about="For access and act: a source the place compiles." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/source value=string
+bound-lock/1 about="For act, the operation, by the id the source offers it under; for access, the read whose access is proven, without one the first read the source offers." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/operation value=string
+bound-lock/1 about="For act: the parameters by name, and body for what the operation is sent." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/args value=object
+bound-lock/1 about="For admit: the lines the other device-s key action answered, or the line holding its public key." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/key value=string
+bound-lock/1 about="For admit: what it may sign there, as scopes joined by |; without it, what a member may." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/coverage value=string
+bound-lock/1 about="For key: head, for the key that signs what head read and did; person, for the key that signs what the person allows. Without one, head." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/who value=string
+bound-lock/1 about="For land: the lot ask answered for the drafted lines." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/lot value=string
+bound-lock/1 about="For place, the name it is known by, without one the folder-s; for admit, the name the place knows that device by." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/name value=string
+bound-lock/1 about="For place: the folder of the new place, absolute." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/dir value=string
+bound-lock/1 about="For share: The folder the package is written into, absolute, inside the place or a folder the client shares: never the place itself, its connected documents, a folder head or bound keeps, or a folder holding a lock that is no package." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/to value=string
+bound-lock/1 about="For share: Where the package-s bytes are also published, as a JSON object from each path the package names to an encrypted address, signed or expiring as it may be; optional. A receiver then connects the lock from its own address, by its digest." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/urls value=string
 bound-lock/1 about="Found a place for my sources in a folder." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/place value=dir|name
 bound-lock/1 about="Found a place in a folder, once the person says yes: its root key made in the keychain, the lines it is born with — reads bounded, read-only — and its name in head-s index of places." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/place value=dir|name
-bound-lock/1 about="Found the place {name} in {dir} with the place tool. Ask me before you do." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/place/text value=lock
+bound-lock/1 about="Found the place {name} in {dir} with the do tool, as its place action. Ask me before you do." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/place/text value=lock
+bound-lock/1 about="Help me start with head. Ask me what I want to know and the address of the document of an API that answers it; then connect that API and answer me." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/welcome/text value=lock
 bound-lock/1 about="History, not a current answer: what {source} answered to {operation} at {at}, under receipt {digest}. Nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/history value=lock
 bound-lock/1 about="How many times, at most." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/can/times value=string
 bound-lock/1 about="How {source} proves access, the most trusted first: {flows}. A flow that asks a secret runs only as far as this place allows: {allowed} on head-s page (access/secret-inputs)." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/trust value=lock
 bound-lock/1 about="I allow {operation} on {source} up to {times} times. Plan this line for me to sign:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/can/text value=lock
 bound-lock/1 about="Its document: an https address or a file." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/connect/document value=string
-bound-lock/1 about="Its document: an https address, read with nothing attached and, named by its digest, followed wherever it moves to the bytes that digest names; or an absolute file inside the place or a folder the client shares; or a package-s lock, from either, with its digest. An origin alone, such as api.example.com, with no source, is used: on one yes head founds a read-only place of its own for it, finds its document where the origin publishes its catalog or at the paths head-s lock names, compiles it, caps every call that is not a read at zero and grants reads for the period head-s lock names." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/connect/document value=string
+bound-lock/1 about="Its document: an https address, read with nothing attached and, named by its digest, followed wherever it moves to the bytes that digest names; or an absolute file inside the place or a folder the client shares; or a package-s lock, from either, with its digest. Or a site alone, such as api.example.com, its document found where the site publishes its catalog or at the paths head-s lock names; or a folder the client shares, its document found inside it at those names. A site or folder names the source when none is given." at=policy:head/connect/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/connect/document value=string
 bound-lock/1 about="Keep a source read-only: whatever it offers beyond reads is never called, whatever else is allowed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/readonly value=source
 bound-lock/1 about="Keep {source} read-only. Plan this line for me to sign:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/readonly/text value=lock
 bound-lock/1 about="Land a lot plan signed, by its digest, while the place still stands on the base it was planned against." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/land value=lot
 bound-lock/1 about="No answer of {operation} on {source} is held for this request: there is no line to say why. A read of it, at 8, lands the receipt that would." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/why-none value=lock
 bound-lock/1 about="No intent {intent} stands open for this source: nothing was closed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/nothing-open value=lock
+bound-lock/1 about="No place stands yet, and head connects no API of its own: connecting {source} by the address of its document founds your place at {dir}, on one yes, and {operation} is asked again with {args}." at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unborn value=lock
 bound-lock/1 about="No place was named and the client shares no root: name the folder of a place." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-place value=lock
 bound-lock/1 about="No place {place} is in head-s index on this device: a place is founded with the place tool, and then it is listed here." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/places-none value=lock
 bound-lock/1 about="No retained read of {operation} on {source} is held here for whom it would be read as. Nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/history-none value=lock
@@ -55,14 +77,17 @@ bound-lock/1 about="Pick the origin head reaches {source} at in this place, once
 bound-lock/1 about="Propose lines for the person to sign: they are shown to the person with the place and the base they are made against; on a yes to exactly those, the person-s key signs them and they are folded as if landed. Nothing lands; the lot is kept by its digest." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/plan value=place|lines
 bound-lock/1 about="Prove access to a source ahead of any call, the way its document declares: the person-s own page, or its provider with a client registered for the visit; the secret is kept in this keychain and a receipt lands without it. Nothing is called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/access value=place|source|operation
 bound-lock/1 about="Prove access to a source the way it declares, ahead of any call: entered on head-s page or at its provider, never here." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/access value=place|source
-bound-lock/1 about="Prove access to {source} in {place} with the access tool. I will enter what it asks on head-s own page or at its provider, never here." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/access/text value=lock
-bound-lock/1 about="Read one view of a place as bound folds it; or what a source offers, as typed lines: at 0 where it is reached and the class of each offer, at 1 (the default) their forms and how access is proven; or, at 8 with an operation of class read, that operation once: the response comes back with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. Nothing else is ever called." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/look value=place|view|at|source|operation|args|closes|history|why
+bound-lock/1 about="Prove access to {source} in {place} with the do tool, as its access action. I will enter what it asks on head-s own page or at its provider, never here." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/access/text value=lock
+bound-lock/1 about="Read one view of a place as bound folds it, at the resolution ask reads it at; or what a source offers, as typed lines: at 0 where it is reached and the class of each offer, past it their forms and how access is proven; or, with an operation of class read, that operation once: the response comes back with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. Nothing else is ever called." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/look value=place|view|source|operation|args|closes|history|why
 bound-lock/1 about="Receive a package another place shared: from a file or an address, by the digest its sender sent apart from it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/receive value=package|digest|place
 bound-lock/1 about="Receive the package {package} into the place {place} with the connect tool: its lock as the document, named by the digest {digest}. Ask me before you do, and tell me which sources it connected and that access is asked here again." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/receive/text value=lock
 bound-lock/1 about="Share a place with someone: its sources, as a package they connect by its digest." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/share value=place|who
-bound-lock/1 about="Share the place {place} with {who}: pack it with the share tool into a folder I share, show me the package-s digest, and tell me to send {who} the folder — or the addresses it is published at — and the digest apart from it, over a private channel." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/share/text value=lock
+bound-lock/1 about="Share the place {place} with {who}: pack it with the do tool, as its share action, into a folder I share, show me the package-s digest, and tell me to send {who} the folder — or the addresses it is published at — and the digest apart from it, over a private channel." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/share/text value=lock
 bound-lock/1 about="Sign exactly these lines" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/elicit/yes value=lock
 bound-lock/1 about="Signed by who configures the place — its root where this keychain holds it, else the person-s key; nothing landed. Lot {lot}, made against base {base}. What bound printed, folding it as if it landed:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/planned value=lock
+bound-lock/1 about="Start here: any API, by the address of its document." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/welcome value=
+bound-lock/1 about="The card of {place} is {card}, valid from this {from}: do acts there on it while nothing else lands." at=policy:head/card/0.1.4 by=target form=alphabet measure=id role=writes scope=said/card value=lock
+bound-lock/1 about="The card the last answer about the place ended with, or the one ask answers asked with card: an action on a place that moved since is refused, and nothing is done." at=policy:head/card/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/card value=string
 bound-lock/1 about="The digest its sender sent apart from it, sha256 and its hex." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/receive/digest value=string
 bound-lock/1 about="The digest plan answered for the lot." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/land/lot value=string
 bound-lock/1 about="The document-s digest, sha256 and its hex: a document that hashes otherwise is refused, and a document that moved to another address is followed only when named by it; a package is received only by the digest its sender sent apart from it. Optional otherwise." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/connect/digest value=string
@@ -79,6 +104,8 @@ bound-lock/1 about="The folder of the place, absolute; without one, the first ro
 bound-lock/1 about="The folder of the place, absolute; without one, the first root the client shares." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/place value=string
 bound-lock/1 about="The folder of the place, absolute; without one, the first root the client shares." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/plan/place value=string
 bound-lock/1 about="The folder of the place, absolute; without one, the first root the client shares." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/share/place value=string
+bound-lock/1 about="The folder of the place, absolute; without one, the first root the client shares." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/place value=string
+bound-lock/1 about="The folder of the place, absolute; without one, the first root the client shares." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/place value=string
 bound-lock/1 about="The folder of the place." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/access/place value=string
 bound-lock/1 about="The folder of the place." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/connect/place value=string
 bound-lock/1 about="The folder the package is written into, absolute, inside the place or a folder the client shares: never the place itself, its connected documents, a folder head or bound keeps, or a folder holding a lock that is no package." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/share/to value=string
@@ -90,28 +117,36 @@ bound-lock/1 about="The lines the other device-s key tool answered, or the line
 bound-lock/1 about="The media type to ask the document as, where its address answers several; optional." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/connect/accept value=string
 bound-lock/1 about="The name it is known by." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/place/name value=string
 bound-lock/1 about="The name it is known by; without one, the folder-s." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/place/name value=string
+bound-lock/1 about="The name of a view the place signs; lines, for the lines that stand." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/view value=string
 bound-lock/1 about="The name of a view the place signs; without one, the lines that stand." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/view value=string
 bound-lock/1 about="The name the place knows that device by." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/admit/name value=string
 bound-lock/1 about="The name the source is known by in the place; none for a package, whose lock names its sources." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/connect/source value=string
 bound-lock/1 about="The name the source is known by." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/connect/source value=string
+bound-lock/1 about="The operation asked before the source was connected, by the id the source offers it under: asked again once it is; optional." at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/connect/operation value=string
 bound-lock/1 about="The operation, by the id the source offers it under." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/ask/operation value=string
 bound-lock/1 about="The operation, by the id the source offers it under." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/can/operation value=string
 bound-lock/1 about="The operation, by the id the source offers it under." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/act/operation value=string
 bound-lock/1 about="The operation, by the id the source offers it under." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/operation value=string
+bound-lock/1 about="The operation, by the id the source offers it under." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/why/operation value=string
+bound-lock/1 about="The operation, by the id the source offers it under: read once, when it is of the class head reads." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/operation value=string
 bound-lock/1 about="The package-s lock: an absolute file, or an encrypted address." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/receive/package value=string
 bound-lock/1 about="The parameters by name, and body for what the operation is sent." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/act/args value=object
+bound-lock/1 about="The parameters of that operation, by name; optional." at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/connect/args value=object
 bound-lock/1 about="The parameters of the operation, by name." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/args value=object
+bound-lock/1 about="The parameters of the operation, by name." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/args value=object
 bound-lock/1 about="The person did not finish entering what {source} asks for, or no page could be offered: nothing was called. Asking again, with the person there, pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/entry-unfinished value=lock
 bound-lock/1 about="The person did not say yes: nothing was signed and nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-yes value=lock
 bound-lock/1 about="The place holds nothing read of {source}: no line says where it is or what it offers." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/unread value=lock
 bound-lock/1 about="The place moved since base {base}: nothing landed. Plan again." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/base-moved value=lock
 bound-lock/1 about="The read whose access is proven; without one, the first read the source offers." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/access/operation value=string
+bound-lock/1 about="The resolution that explains, in place of the one a person reads. With a source: its region with each offer-s forms and how access is proven. With an operation: its region the same way and, once it was read, why its newest answer stands, who said it and when, its receipt digest and the pins it rests on. With a view: the view as it explains itself. Nothing is called." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/why value=boolean
 bound-lock/1 about="The resolution: of a view, the one it is read at; of a source, 0, 1 or 8 to read one offer." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/at value=integer
 bound-lock/1 about="The response came back but its receipt did not land: {why}" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/not-landed value=lock
 bound-lock/1 about="The response from {source} ran past read/response-bytes: it was refused whole and nothing landed. A wider read/response-bytes the place-s root signs pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/too-large value=lock
 bound-lock/1 about="The source, as the place names it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/ask/source value=string
 bound-lock/1 about="The source, as the place names it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/can/source value=string
 bound-lock/1 about="The source, as the place names it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/readonly/source value=string
+bound-lock/1 about="The source, as the place names it." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/why/source value=string
 bound-lock/1 about="The source." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/access/source value=string
 bound-lock/1 about="The way {source} proves access asks its host for {input}, which head does not hand any flow: nothing was called. An overlay whose flow asks the person for it instead pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/host-input value=lock
 bound-lock/1 about="The world compiled nothing {source} offers: nothing was pinned. A document that offers at least one operation pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/nothing-offered value=lock
@@ -121,17 +156,29 @@ bound-lock/1 about="This device keeps no keychain head can reach: no key was mad
 bound-lock/1 about="This device-s person key already attests {scope} in {place}, or the place states it itself: a second line of it is read only through a fold of this key-s lines, which bound does not publish. Nothing was signed; the place-s root can sign it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/attested-again value=lock
 bound-lock/1 about="This keychain keeps no root of {place}: whoever holds it connects sources and admits devices there. Nothing was asked." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-root value=lock
 bound-lock/1 about="This place signs no view of cells: nothing is open to ask." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-cells value=lock
+bound-lock/1 about="What do I have in head? List my places and the sources each one holds." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-i-have/text value=lock
+bound-lock/1 about="What do I have: my places and the sources each one holds." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-i-have value=
+bound-lock/1 about="What happened: what head read and did in my place." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-happened value=
+bound-lock/1 about="What has head read and done in my place? List each read and each act, newest first, with when it happened." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-happened/text value=lock
+bound-lock/1 about="What is done: place founds one, admit lets another device in, land lands a lot ask planned, share packs a place, key makes this device-s key, access proves access to a source, act calls an offer that is not a read." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/action value=string
 bound-lock/1 about="What is open for a key: each cell no reading has answered, its ceiling, its origins and the states it may take, in the order bound ranks them." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/card value=place|key
+bound-lock/1 about="What is open in the place, and the card do needs to act there." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/card value=boolean
 bound-lock/1 about="What it may sign there, as scopes joined by |; without it, what a member may." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/admit/coverage value=string
+bound-lock/1 about="What next: the next step my place names." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-next value=
+bound-lock/1 about="What should I do next in head? Read my place and tell me the next step it names, and why." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-next/text value=lock
 bound-lock/1 about="What the fold typed of that answer is no longer held here; the receipt stands as evidence of the read." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/history-gone value=lock
 bound-lock/1 about="What this device has connected: every place head-s index names, the sources each pinned, the grants that stand today and the last read it kept a receipt of — read off each place-s lines as bound folds them. Nothing is asked, called or signed." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/places value=place
 bound-lock/1 about="What {source} carries for this offer is not one request: nothing was called. An overlay that makes it one pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/carry-unsettled value=lock
 bound-lock/1 about="What {source} would have the person enter would go to another origin than {source} itself: refused, nothing was sent and nothing was called. An overlay whose steps stay on {source}-s own origin pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/cross-origin value=lock
 bound-lock/1 about="Where the package-s bytes are also published, as a JSON object from each path the package names to an encrypted address, signed or expiring as it may be; optional. A receiver then connects the lock from its own address, by its digest." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/share/urls value=string
 bound-lock/1 about="Who receives it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=prompt/share/who value=string
+bound-lock/1 about="Why an answer stands: who said it, when, and what it rests on." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/why value=source|operation
+bound-lock/1 about="Why does the newest answer of {operation} from {source} stand? Tell me who said it, when, and what it rests on." at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/why/text value=lock
 bound-lock/1 about="Why head" at=policy:head/docs by=target form=alphabet measure=text role=writes scope=prose/en/idea/heading value=lock
 bound-lock/1 about="With an operation and its parameters: what was retained of that read, as of when it was made, instead of a current answer. Nothing is called; the place must allow it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/history value=boolean
+bound-lock/1 about="With an operation and its parameters: what was retained of that read, as of when it was made, instead of a current answer. Nothing is called; the place must allow it." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/history value=boolean
 bound-lock/1 about="With an operation and its parameters: why its newest answer stands — who said it and when, its receipt digest, and the pins it rests on, read off the place-s evidence and lines. Nothing is called." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/look/why value=boolean
+bound-lock/1 about="With card: the key whose cells are asked; without one, every open cell." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/key value=string
 bound-lock/1 about="a client that asks, or head-s page opened" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/cannot-ask/next value=none
 bound-lock/1 about="a device key attests; it never admits another key" at=policy:head/device by=target form=alphabet measure=id role=writes scope=device/head/class value=attest
 bound-lock/1 about="a device key attests; it never admits another key" at=policy:head/device by=target form=alphabet measure=id role=writes scope=device/person/class value=attest
@@ -171,6 +218,7 @@ bound-lock/1 about="a question the person answers" at=policy:head/shape/0.1.2 by
 bound-lock/1 about="a question the person answers" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/visit/next value=none
 bound-lock/1 about="a signer over an encrypted file, for hosts with no keychain: only where a place declares it and every line it signs is marked so; never a default" at=policy:head/platform by=target form=alphabet measure=id role=demands scope=signer/encrypted-file value=declared|marked
 bound-lock/1 about="a source reached at the document-s origin" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/fetch-cross-origin/next value=none
+bound-lock/1 about="a view explained: the lines it stands on with the readings of their ceilings; read for a person, a view is read with no resolution, at its own" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=resolution/view/why value=1
 bound-lock/1 about="a view is lines of text" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=resource/view/mime value=text/plain
 bound-lock/1 about="a view of cells the place signs" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-cells/next value=none
 bound-lock/1 about="a wider allowance the person signs" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/not-allowed/next value=none
@@ -197,6 +245,7 @@ bound-lock/1 about="an overlay whose flow goes on" at=policy:head/shape/0.1.2 by
 bound-lock/1 about="another name" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/place-taken/next value=none
 bound-lock/1 about="another name, or the old admission withdrawn" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/key-taken/next value=none
 bound-lock/1 about="answering a question takes at most this; slower reads red with its coordinate" at=policy:head/ceilings by=target form=interval measure=seconds role=reads scope=answer/seconds value=0..2
+bound-lock/1 about="ask reads and never writes but the receipts of what it read; asked twice it answers the same" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/ask/hints value=readOnly|idempotent
 bound-lock/1 about="asked again, key answers the same lines; the first ask makes the key" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/key/hints value=idempotent
 bound-lock/1 about="asked twice of the same place, share writes the same bytes" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/share/hints value=idempotent
 bound-lock/1 about="bound did not settle the place {source} compiles to: {why} Nothing was called. What bound names there pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/unsettled value=lock
@@ -206,9 +255,14 @@ bound-lock/1 about="bound refused to fold {place}: {why} Nothing was signed and
 bound-lock/1 about="bound-lock/1 at=policy:person/allows by=target form=interval measure=calls role=writes scope=allow/{source} value=0..0" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/readonly/line value=lock
 bound-lock/1 about="bound-lock/1 at=policy:person/allows by=target form=interval measure=calls role=writes scope=allow/{source}/{operation} value=0..{times}" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/can/line value=lock
 bound-lock/1 about="bound-lock/1 at=policy:person/asks by=target form=alphabet measure=status role=writes scope=ask/{source}/{operation} value=present" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=prompt/ask/line value=lock
+bound-lock/1 about="bound-s words a person sees in the first minute: no resolution number, no refusal of bound-s" at=policy:head/ceilings/0.1.4 by=target form=interval measure=count role=writes scope=person-words value=0..0
 bound-lock/1 about="card reads and never writes" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/card/hints value=readOnly|idempotent
 bound-lock/1 about="composing policies is bound-s" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/parent-lock/next value=none
+bound-lock/1 about="connecting a public API at each level of access, every example run against the real API" at=policy:head/docs/0.1.4 by=target form=alphabet measure=id needs=docs/connect-any-api.md role=demands scope=view/docs-connect-any-api shape=docs/connect-any-api.md value=text
+bound-lock/1 about="connecting a public API at each level of access, every example run against the real API" at=policy:head/docs/0.1.4 by=target form=alphabet measure=text role=writes scope=region/docs-connect-any-api value=lock
 bound-lock/1 about="connecting a source, from the ask to the pin, takes at most this; slower reads red with its coordinate" at=policy:head/ceilings by=target form=interval measure=seconds role=reads scope=connect/seconds value=0..10
+bound-lock/1 about="do changes the place, and with act the world outside it" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/hints value=destructive|openWorld
+bound-lock/1 about="do knows no action {action}: it does one of {actions}." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unknown-action value=lock
 bound-lock/1 about="every file between head and what it does not own — each adapter of access or transport, each port, the protocol binding — measured alone" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/ports value=src/ports/**|src/index.ts|src/signer.ts
 bound-lock/1 about="every lot landed in a place head founds is one act, and land prints its result: the records it admitted, in one process" at=policy:head/birth by=target form=alphabet measure=id role=writes scope=birth/wire/act-result value=local-act@1
 bound-lock/1 about="every place head founds can be walked by bound: compared with a peer-s authenticated inventory, the regions that differ exchanged, the history converged by union" at=policy:head/walk by=target form=alphabet measure=id role=writes scope=birth/wire/walk/contract value=whole-region@1
@@ -221,7 +275,7 @@ bound-lock/1 about="head asks to admit the device {name} into {place}, covering
 bound-lock/1 about="head asks to connect to {place} every source the package {package} names whose bytes arrived, in its order: {sources}. Each is compiled here and held to the package-s pin; nothing the sharing place was granted comes with it. Waiting for their bytes, connected when they arrive: {open}. Say yes only to this." at=policy:head/surface/0.1.2 by=target form=alphabet measure=id role=writes scope=said/elicit-receive value=lock
 bound-lock/1 about="head asks to connect {source} to {place} from {document} {overlay}: compiled once and pinned; nothing is called. Say yes only to this." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/elicit-connect value=lock
 bound-lock/1 about="head asks to found the place {name} in {dir}: a root key made in your keychain, reads bounded, nothing it may write. Say yes only to this." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/elicit-place value=lock
-bound-lock/1 about="head asks to found your place at {dir} — a root key made in your keychain, reads bounded, nothing it may write — and to connect {source} to it from {document}: compiled once and pinned; nothing is called. Say yes only to this; a place elsewhere, named as you like, is founded with the place tool." at=policy:head/surface/0.1.2 by=target form=alphabet measure=id role=writes scope=said/elicit-first-run value=lock
+bound-lock/1 about="head asks to found your place at {dir} — a root key made in your keychain, reads bounded, nothing it may write — to connect {source} to it from {document}, compiled once and pinned, to prove access to it where its document declares how, on head-s page or at its provider, and to let head read {source} until {until}: no read of it asks again before then, and anything that is not a read still does. Say yes only to all of it; a place elsewhere, named as you like, can be founded instead." at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/elicit-first-run value=lock
 bound-lock/1 about="head asks to use {origin}: a place of its own at {dir}, read-only — nothing that is not a read is ever called there — its document found where {origin} publishes it and compiled, and reads granted until {until}. Say yes only to this." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/elicit-use value=lock
 bound-lock/1 about="head asks you to sign {count} lines for {place}, made against base {base}:\n{lines}\nSay yes only to exactly these." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/elicit value=lock
 bound-lock/1 about="head carries no transport for {origin}: nothing was called. An origin reached the way head carries — encrypted, or on this device — pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/no-transport value=lock
@@ -231,11 +285,11 @@ bound-lock/1 about="head keeps no planned lot {lot}." at=policy:head/surface by=
 bound-lock/1 about="head may read {sources} in {place} until {until}: no read asks again before then, writes still do. Say yes only to exactly this." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/grant value=lock
 bound-lock/1 about="head names no client anywhere, adapters included: what it asks through is what the client declares, read by its capabilities" at=policy:head/ceilings by=target form=interval measure=count role=reads scope=surface/client-words value=0..0
 bound-lock/1 about="head names no kind of source outside its transport adapters: those words live in worlds" at=policy:head/ceilings by=target form=interval measure=count role=reads scope=surface/kind-words value=0..0
-bound-lock/1 about="head reads an API by the document its provider already publishes. Here is one way for each level of access: the first two run against a real public API and its real document, and the third as head does it for any document that declares a key.\n\n### No access: Open-Meteo\n\nOpen-Meteo's forecast needs no key, but its document ([forecast.yml](https://github.com/open-meteo/open-meteo/blob/main/openapi/forecast.yml)) does not say so, and head never guesses: an operation whose document says nothing about access is listed and never called. One overlay says what the provider says on its own site:\n\n```yaml\noverlay: 1.0.0\ninfo: { title: Open-Meteo forecast, read without a key, version: '1' }\nactions:\n  - target: \"$.paths['/v1/forecast'].get\"\n    description: the free forecast needs no key, as open-meteo.com says\n    update: { security: [] }\n```\n\nConnect `forecast.yml` as `weather` with that overlay beside it and read `get-v1-forecast` at a latitude and a longitude. The document names two servers, so the person picks one, once. The answer comes back typed by what the document declares, one value a line, with a signed receipt of the read (abridged):\n\n```text\nanswer/286b453612143d46/current/temperature_2m        number  11.9\nanswer/286b453612143d46/current_units/temperature_2m  text    °C\nanswer/286b453612143d46/current/wind_speed_10m        number  7.9\nread/weather/get-v1-forecast/286b453612143d46          digest  sha256:… signed by head\n```\n\n### A declared flow: Spotify\n\nSpotify's document ([the community OpenAPI description](https://github.com/sonallux/spotify-web-api)) declares OAuth 2.0 with an authorization code. head compiles it into the two steps it takes, the provider's page with PKCE and then the token exchange, and nobody writes a line of it. What it needs is yours: the client id of an app you registered with Spotify, signed into the place as `keys/access/music/oauth_2_0 client <id>`. Until then head says so and calls nothing.\n\n### A secret entered by hand\n\nWhen a document declares a bearer token or an API key and no way to obtain one, the key is a secret input. head asks for it on its own one-time page, never through the model, and only when the place's root allows a secret with `access/secret-inputs`. It is kept in the keychain, never in a file.\n\n### When the document says too little\n\nA login of its own (an email, a one-time code, a choice of account) is written once as an `x-access` flow, an Arazzo profile in an overlay, and every API of the same issuer refers to it with one `$ref`. The profile and its vectors are on topos-openapi's own page, `docs/x-access.md` in `@lapxo/topos-openapi`. Every API connected this way is read the same way afterwards: one access per issuer, each answer typed and kept." at=policy:head/docs by=target form=alphabet measure=text role=writes scope=prose/en/page/connect-any-api value=lock
 bound-lock/1 about="head runs on {supported}; this host is {platform}: nothing was done. Its secret store and browser opener are none head carries. A host head runs on pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/platform value=lock
 bound-lock/1 about="head, for the key that signs what head read and did; person, for the key that signs what the person allows. Without one, head." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/key/who value=string
 bound-lock/1 about="head-s own key: it attests what it read, what the fold typed of it and was kept, what it did and the access it obtained, and nothing else" at=policy:head/device by=target form=alphabet measure=id role=writes scope=device/head/account value=head
 bound-lock/1 about="head-s own place — the index of the places it founded — is this folder, or ~/<home/folder> without it" at=policy:head/home by=target form=alphabet measure=id role=writes scope=home/env value=HEAD_HOME
+bound-lock/1 about="head-s seconds to it, the person-s waits excluded — a new person and head 0.1.3 as published (the .mcpb of its release), Open-Meteo-s real document and API, on a client with forms and on one with none; harness baseline-013.mts" at=witness:baseline-013-open-meteo by=target form=interval measure=seconds role=writes scope=baseline/onboarding/seconds value=10..11
 bound-lock/1 about="history, not a current answer" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history/next value=none
 bound-lock/1 about="how a place is made walkable: the context a peer authenticates it by, folded and pinned" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/walk value=src/walk/**
 bound-lock/1 about="how a reader installs the package: this verb, then the name its manifest carries" at=policy:head/docs by=target form=alphabet measure=id role=writes scope=install value="npm install"
@@ -251,24 +305,34 @@ bound-lock/1 about="how to contribute, from this lock" at=policy:head/docs by=ta
 bound-lock/1 about="its encrypted address" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/insecure-origin/next value=none
 bound-lock/1 about="look reads and never writes; asked twice of the same place it answers the same" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/look/hints value=readOnly|idempotent
 bound-lock/1 about="name: release\non:\n  workflow_run:\n    workflows: [tag]\n    types: [completed]\n  workflow_dispatch:\nconcurrency: release-delivery\njobs:\n  approve:\n    if: github.event_name == 'workflow_dispatch' || (github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_branch == 'main')\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n    outputs:\n      tag: ${{ steps.judge.outputs.tag }}\n      digest: ${{ steps.judge.outputs.digest }}\n      archive: ${{ steps.judge.outputs.archive }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha || github.sha }}\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm install --prefix .instrument --no-save --ignore-scripts @lapxo/bound@0.2.1\n      - name: Prepare release\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          TAG=\"v$(node -p \"require('./package.json').version\")\"\n          printf 'TAG=%s\\n' \"$TAG\" >> \"$GITHUB_ENV\"\n          git fetch origin \"refs/tags/$TAG:refs/tags/$TAG\"\n          gh api --paginate \"repos/$GITHUB_REPOSITORY/releases\" --jq '.[].tag_name' > \"$RUNNER_TEMP/release-tags\"\n          if grep -Fxq \"$TAG\" \"$RUNNER_TEMP/release-tags\"; then\n            printf 'RELEASE %s · exists\\n' \"$TAG\"\n          else\n            gh release create \"$TAG\" --verify-tag --draft --title \"$TAG\" --generate-notes\n            printf 'RELEASE %s · draft created · awaiting signed assets\\n' \"$TAG\"\n          fi\n      - name: Read owner approval\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          mkdir .release\n          gh release download \"$TAG\" --pattern approval-signed --dir .release\n          node .instrument/node_modules/@lapxo/bound/dist/cli/verb.js fold --as release .release/approval-signed > .release/verdict\n          cat .release/verdict\n      - name: Judge the approved release archive\n        id: judge\n        env:\n          GH_TOKEN: ${{ github.token }}\n        run: |\n          set -euo pipefail\n          read -r status digest archive source extra < .release/verdict\n          test \"$status\" = READY\n          test -z \"$extra\"\n          gh release download \"$TAG\" --pattern \"$archive\" --dir .release\n          printf '%s  %s\\n' \"${digest#sha256:}\" \".release/$archive\" | sha256sum -c -\n          expected=\"$(node -p \"require('./package.json').name+'@'+require('./package.json').version\")\"\n          actual=\"$(tar -xOf \".release/$archive\" package/package.json | node -p \"const p=JSON.parse(require('fs').readFileSync(0,'utf8'));p.name+'@'+p.version\")\"\n          test \"$actual\" = \"$expected\"\n          printf 'SOURCE release/%s/%s · %s · declared %s\\n' \"$TAG\" \"$archive\" \"$digest\" \"$source\"\n          printf 'tag=%s\\ndigest=%s\\narchive=%s\\n' \"$TAG\" \"$digest\" \"$archive\" >> \"$GITHUB_OUTPUT\"\n  bundle:\n    needs: approve\n    runs-on: macos-latest\n    permissions:\n      contents: write\n    env:\n      GH_TOKEN: ${{ github.token }}\n      TAG: ${{ needs.approve.outputs.tag }}\n      DIGEST: ${{ needs.approve.outputs.digest }}\n      ARCHIVE: ${{ needs.approve.outputs.archive }}\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha || github.sha }}\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Make the Desktop Extension from the approved archive, twice, repacked with fixed times and order, and require one digest\n        run: |\n          set -euo pipefail\n          mkdir -p \"$RUNNER_TEMP/release\"\n          gh release download \"$TAG\" --pattern \"$ARCHIVE\" --dir \"$RUNNER_TEMP/release\"\n          printf '%s  %s\\n' \"${DIGEST#sha256:}\" \"$RUNNER_TEMP/release/$ARCHIVE\" | shasum -a 256 -c -\n          test \"v$(node -p \"require('./manifest.json').version\")\" = \"$TAG\"\n          export SOURCE_DATE_EPOCH=\"$(git log -1 --format=%ct)\"\n          for n in 1 2; do\n            stage=\"$RUNNER_TEMP/stage-$n\"\n            mkdir -p \"$stage\"\n            tar -xzf \"$RUNNER_TEMP/release/$ARCHIVE\" -C \"$stage\" --strip-components 1\n            cp package-lock.json manifest.json \"$stage/\"\n            (cd \"$stage\" && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --loglevel=error)\n            npx --no-install mcpb pack \"$stage\" \"$RUNNER_TEMP/packed-$n.mcpb\"\n            unpacked=\"$RUNNER_TEMP/unpacked-$n\"\n            mkdir -p \"$unpacked\"\n            unzip -q \"$RUNNER_TEMP/packed-$n.mcpb\" -d \"$unpacked\"\n            chmod -R u=rwX,go=rX \"$unpacked\"\n            TZ=UTC find \"$unpacked\" -exec touch -h -t 198001020000 {} +\n            (cd \"$unpacked\" && find . -type f | LC_ALL=C sort | TZ=UTC zip -X -9 -q -@ \"$RUNNER_TEMP/head-$n.mcpb\")\n          done\n          one=\"$(shasum -a 256 \"$RUNNER_TEMP/head-1.mcpb\" | cut -d' ' -f1)\"\n          two=\"$(shasum -a 256 \"$RUNNER_TEMP/head-2.mcpb\" | cut -d' ' -f1)\"\n          for n in 1 2; do printf 'CONTENT %s · %s\\n' \"$n\" \"$(cd \"$RUNNER_TEMP/unpacked-$n\" && find . -type f | LC_ALL=C sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)\"; done\n          test \"$one\" = \"$two\"\n          bundle=\"head-${TAG#v}-${one:0:16}.mcpb\"\n          cp \"$RUNNER_TEMP/head-1.mcpb\" \"$RUNNER_TEMP/$bundle\"\n          printf 'BUNDLE=%s\\nMADE=sha256:%s\\n' \"$bundle\" \"$one\" >> \"$GITHUB_ENV\"\n          printf 'BUNDLE %s · sha256:%s · made twice · from %s\\n' \"$bundle\" \"$one\" \"$DIGEST\"\n      - name: Run it as a host would, from the unpacked bundle in a fresh home\n        run: HEAD_BUNDLE=\"$RUNNER_TEMP/$BUNDLE\" node --test test/bundle.test.ts\n      - name: Attach it to the release, its digest in the notes\n        run: |\n          set -euo pipefail\n          gh release view \"$TAG\" --json body --jq .body > \"$RUNNER_TEMP/notes.md\"\n          if grep -q 'The Desktop Extension `head-' \"$RUNNER_TEMP/notes.md\"; then\n            grep -Fq \"$MADE\" \"$RUNNER_TEMP/notes.md\" || { printf 'REFUSE·bundle the release names another digest than %s\\n' \"$MADE\"; exit 1; }\n          else\n            printf '\\n\\nThe signature covers `%s` (`%s`). The Desktop Extension `%s` (`%s`) is made by this workflow from that archive, packed by mcpb and repacked with fixed times, modes and order; made again, it gives the same digest.\\n' \"$ARCHIVE\" \"$DIGEST\" \"$BUNDLE\" \"$MADE\" >> \"$RUNNER_TEMP/notes.md\"\n            gh release edit \"$TAG\" --notes-file \"$RUNNER_TEMP/notes.md\"\n          fi\n          gh release upload \"$TAG\" \"$RUNNER_TEMP/$BUNDLE\" --clobber\n          mkdir -p \"$RUNNER_TEMP/back\"\n          gh release download \"$TAG\" --pattern \"$BUNDLE\" --dir \"$RUNNER_TEMP/back\"\n          printf '%s  %s\\n' \"${MADE#sha256:}\" \"$RUNNER_TEMP/back/$BUNDLE\" | shasum -a 256 -c -\n  publish:\n    needs: [approve, bundle]\n    environment: release\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n      id-token: write\n    env:\n      GH_TOKEN: ${{ github.token }}\n      TAG: ${{ needs.approve.outputs.tag }}\n      DIGEST: ${{ needs.approve.outputs.digest }}\n      ARCHIVE: ${{ needs.approve.outputs.archive }}\n    steps:\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm install --global npm@'12.1.0' --ignore-scripts\n      - name: Stage the approved release archive\n        run: |\n          set -euo pipefail\n          mkdir .release\n          gh release download \"$TAG\" --repo \"$GITHUB_REPOSITORY\" --pattern \"$ARCHIVE\" --dir .release\n          printf '%s  %s\\n' \"${DIGEST#sha256:}\" \".release/$ARCHIVE\" | sha256sum -c -\n          gh release edit \"$TAG\" --repo \"$GITHUB_REPOSITORY\" --draft=false\n          printf 'RELEASE %s · published · %s\\n' \"$TAG\" \"$DIGEST\"\n          npm stage publish \".release/$ARCHIVE\" --access public --ignore-scripts\n          printf 'STAGED %s · %s · owner approval pending\\n' \"$ARCHIVE\" \"$DIGEST\"\n" at=policy:head/forge by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/release shape=.github/workflows/release.yml value=lock
+bound-lock/1 about="name: suite-map\non:\n  push:\n    branches: ['suite-map/**']\npermissions:\n  contents: read\njobs:\n  map:\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n          fetch-depth: 0\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Run each test file alone, three at a time, its processes measured, keeping only what of head they ran\n        run: |\n          set -uo pipefail\n          map=\"$RUNNER_TEMP/suite-map\"\n          mkdir -p \"$map\"\n          measure() {\n            out=\"$1/$(basename \"$2\")\"\n            mkdir -p \"$out\"\n            NODE_V8_COVERAGE=\"$out\" node --test \"$2\" > \"$out.log\" 2>&1 || echo \"FAILED $2\" >> \"$out.log\"\n            grep -L -F \"$GITHUB_WORKSPACE/src/\" \"$out\"/*.json 2>/dev/null | xargs rm -f\n          }\n          export -f measure\n          ls test/*.test.ts | xargs -P 3 -I{} bash -c 'measure \"$0\" \"$1\"' \"$map\" {}\n          git log --format='%H %s' origin/main..HEAD > \"$map/commits.txt\"\n          cat \"$map\"/*.log | grep -E '^(FAILED|ℹ (pass|fail))' || true\n      - uses: actions/upload-artifact@v4\n        if: always()\n        with:\n          name: suite-map\n          path: ${{ runner.temp }}/suite-map/\n          if-no-files-found: error\n" at=policy:head/forge/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/suite-map shape=.github/workflows/suite-map.yml value=lock
 bound-lock/1 about="name: tag\non:\n  workflow_run:\n    workflows: [test]\n    types: [completed]\njobs:\n  tag:\n    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push' && github.event.workflow_run.head_branch == 'main'\n    runs-on: ubuntu-latest\n    permissions:\n      contents: write\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          ref: ${{ github.event.workflow_run.head_sha }}\n          fetch-depth: 0\n      - run: |\n          version=\"v$(node -p \"require('./package.json').version\")\"\n          git tag --list \"$version\" | grep -q . && exit 0\n          git tag \"$version\" && git push origin \"$version\"\n" at=policy:head/forge by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/tag shape=.github/workflows/tag.yml value=lock
-bound-lock/1 about="name: test\non:\n  push:\n    branches: [main]\n  pull_request:\npermissions:\n  contents: read\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}\n  cancel-in-progress: true\njobs:\n  test:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n        shard: [1, 2, 3]\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - run: npm ci\n      - run: npm run build\n      - name: Run tests, shard ${{ matrix.shard }} of 3\n        run: |\n          set -euo pipefail\n          node --test --test-shard=${{ matrix.shard }}/3 test/*.test.ts 2>&1 | tee \"$RUNNER_TEMP/head-tests.log\"\n      - name: Preserve test logs\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: head-node-${{ matrix.node }}-shard-${{ matrix.shard }}\n          path: ${{ runner.temp }}/head-tests.log\n          if-no-files-found: ignore\n  time:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - run: npm ci\n      - run: npm run build\n      - name: Run the timed tests alone on this machine, one at a time\n        run: |\n          set -euo pipefail\n          node --test --test-concurrency=1 test/time/*.test.ts 2>&1 | tee \"$RUNNER_TEMP/head-time.log\"\n      - name: Check the committed receipts on a clean checkout\n        if: ${{ !cancelled() }}\n        run: npx --no-install bound fold --check\n      - name: Preserve the timed log\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: head-time-node-${{ matrix.node }}\n          path: ${{ runner.temp }}/head-time.log\n          if-no-files-found: ignore\n  bundle:\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Pack the archive npm would publish\n        run: mkdir -p \"$RUNNER_TEMP/release\" && npm pack --pack-destination \"$RUNNER_TEMP/release\"\n      - name: Make the Desktop Extension from that archive, twice, repacked with fixed times and order, and require one digest\n        run: |\n          set -euo pipefail\n          test \"$(node -p \"require('./manifest.json').version\")\" = \"$(node -p \"require('./package.json').version\")\"\n          archive=\"$(ls \"$RUNNER_TEMP\"/release/*.tgz)\"\n          export SOURCE_DATE_EPOCH=\"$(git log -1 --format=%ct)\"\n          for n in 1 2; do\n            stage=\"$RUNNER_TEMP/stage-$n\"\n            mkdir -p \"$stage\"\n            tar -xzf \"$archive\" -C \"$stage\" --strip-components 1\n            cp package-lock.json manifest.json \"$stage/\"\n            (cd \"$stage\" && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --loglevel=error)\n            npx --no-install mcpb pack \"$stage\" \"$RUNNER_TEMP/packed-$n.mcpb\"\n            unpacked=\"$RUNNER_TEMP/unpacked-$n\"\n            mkdir -p \"$unpacked\"\n            unzip -q \"$RUNNER_TEMP/packed-$n.mcpb\" -d \"$unpacked\"\n            chmod -R u=rwX,go=rX \"$unpacked\"\n            TZ=UTC find \"$unpacked\" -exec touch -h -t 198001020000 {} +\n            (cd \"$unpacked\" && find . -type f | LC_ALL=C sort | TZ=UTC zip -X -9 -q -@ \"$RUNNER_TEMP/head-$n.mcpb\")\n          done\n          one=\"$(shasum -a 256 \"$RUNNER_TEMP/head-1.mcpb\" | cut -d' ' -f1)\"\n          two=\"$(shasum -a 256 \"$RUNNER_TEMP/head-2.mcpb\" | cut -d' ' -f1)\"\n          for n in 1 2; do printf 'CONTENT %s · %s\\n' \"$n\" \"$(cd \"$RUNNER_TEMP/unpacked-$n\" && find . -type f | LC_ALL=C sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)\"; done\n          printf 'BUNDLE sha256:%s · made again sha256:%s · from %s\\n' \"$one\" \"$two\" \"$(shasum -a 256 \"$archive\" | cut -d' ' -f1)\"\n          test \"$one\" = \"$two\"\n      - name: Run it as a host would, from the unpacked bundle in a fresh home\n        run: HEAD_BUNDLE=\"$RUNNER_TEMP/head-1.mcpb\" node --test test/bundle.test.ts\n      - uses: actions/upload-artifact@v4\n        if: always()\n        with:\n          name: head-bundle\n          path: |\n            ${{ runner.temp }}/release/\n            ${{ runner.temp }}/head-1.mcpb\n          if-no-files-found: error\n" at=policy:head/forge by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/test shape=.github/workflows/test.yml value=lock
+bound-lock/1 about="name: test\non:\n  push:\n    branches: [main]\n  pull_request:\npermissions:\n  contents: read\nconcurrency:\n  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}\n  cancel-in-progress: true\njobs:\n  test:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n        shard: [1, 2, 3]\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - run: npm ci\n      - run: npm run build\n      - name: Run tests, shard ${{ matrix.shard }} of 3\n        run: |\n          set -euo pipefail\n          node --test --test-shard=${{ matrix.shard }}/3 test/*.test.ts 2>&1 | tee \"$RUNNER_TEMP/head-tests.log\"\n      - name: Preserve test logs\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: head-node-${{ matrix.node }}-shard-${{ matrix.shard }}\n          path: ${{ runner.temp }}/head-tests.log\n          if-no-files-found: ignore\n  time:\n    strategy:\n      fail-fast: false\n      matrix:\n        node: [22, 24]\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: ${{ matrix.node }}\n      - run: npm ci\n      - run: npm run build\n      - name: Run the timed tests alone on this machine, one at a time\n        run: |\n          set -euo pipefail\n          node --test --test-concurrency=1 test/time/*.test.ts 2>&1 | tee \"$RUNNER_TEMP/head-time.log\"\n      - name: Measure a new person's first minute against an API on this machine\n        run: |\n          set -euo pipefail\n          HEAD_ONBOARDING=1 node --test test/onboarding.test.ts 2>&1 | tee -a \"$RUNNER_TEMP/head-time.log\"\n      - name: Check the committed receipts on a clean checkout\n        if: ${{ !cancelled() }}\n        run: npx --no-install bound fold --check\n      - name: Preserve the timed log\n        if: always()\n        uses: actions/upload-artifact@v4\n        with:\n          name: head-time-node-${{ matrix.node }}\n          path: ${{ runner.temp }}/head-time.log\n          if-no-files-found: ignore\n  bundle:\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n        with:\n          persist-credentials: false\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 24\n      - run: npm ci\n      - name: Pack the archive npm would publish\n        run: mkdir -p \"$RUNNER_TEMP/release\" && npm pack --pack-destination \"$RUNNER_TEMP/release\"\n      - name: Make the Desktop Extension from that archive, twice, repacked with fixed times and order, and require one digest\n        run: |\n          set -euo pipefail\n          test \"$(node -p \"require('./manifest.json').version\")\" = \"$(node -p \"require('./package.json').version\")\"\n          archive=\"$(ls \"$RUNNER_TEMP\"/release/*.tgz)\"\n          export SOURCE_DATE_EPOCH=\"$(git log -1 --format=%ct)\"\n          for n in 1 2; do\n            stage=\"$RUNNER_TEMP/stage-$n\"\n            mkdir -p \"$stage\"\n            tar -xzf \"$archive\" -C \"$stage\" --strip-components 1\n            cp package-lock.json manifest.json \"$stage/\"\n            (cd \"$stage\" && npm ci --omit=dev --ignore-scripts --no-audit --no-fund --loglevel=error)\n            npx --no-install mcpb pack \"$stage\" \"$RUNNER_TEMP/packed-$n.mcpb\"\n            unpacked=\"$RUNNER_TEMP/unpacked-$n\"\n            mkdir -p \"$unpacked\"\n            unzip -q \"$RUNNER_TEMP/packed-$n.mcpb\" -d \"$unpacked\"\n            chmod -R u=rwX,go=rX \"$unpacked\"\n            TZ=UTC find \"$unpacked\" -exec touch -h -t 198001020000 {} +\n            (cd \"$unpacked\" && find . -type f | LC_ALL=C sort | TZ=UTC zip -X -9 -q -@ \"$RUNNER_TEMP/head-$n.mcpb\")\n          done\n          one=\"$(shasum -a 256 \"$RUNNER_TEMP/head-1.mcpb\" | cut -d' ' -f1)\"\n          two=\"$(shasum -a 256 \"$RUNNER_TEMP/head-2.mcpb\" | cut -d' ' -f1)\"\n          for n in 1 2; do printf 'CONTENT %s · %s\\n' \"$n\" \"$(cd \"$RUNNER_TEMP/unpacked-$n\" && find . -type f | LC_ALL=C sort | xargs shasum -a 256 | shasum -a 256 | cut -d' ' -f1)\"; done\n          printf 'BUNDLE sha256:%s · made again sha256:%s · from %s\\n' \"$one\" \"$two\" \"$(shasum -a 256 \"$archive\" | cut -d' ' -f1)\"\n          test \"$one\" = \"$two\"\n      - name: Run it as a host would, from the unpacked bundle in a fresh home\n        run: HEAD_BUNDLE=\"$RUNNER_TEMP/head-1.mcpb\" node --test test/bundle.test.ts\n      - uses: actions/upload-artifact@v4\n        if: always()\n        with:\n          name: head-bundle\n          path: |\n            ${{ runner.temp }}/release/\n            ${{ runner.temp }}/head-1.mcpb\n          if-no-files-found: error\n" at=policy:head/release-checks/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/pipeline/test shape=.github/workflows/test.yml value=lock
 bound-lock/1 about="no answer of head carries a secret: only public halves and lines leave" at=policy:head/ceilings by=target form=interval measure=count role=reads scope=surface/secrets-out value=0..0
 bound-lock/1 about="no world typed the answer" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/untyped/next value=none
+bound-lock/1 about="nothing more is declared to explain it" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/why-undeclared/next value=none
 bound-lock/1 about="nothing stands open" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/nothing-open/next value=none
 bound-lock/1 about="one document a source" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/document-collision/next value=none
+bound-lock/1 about="one of the actions do names" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unknown-action/next value=none
 bound-lock/1 about="open: no world reads {kind}. {document} was laid and taken back; nothing was connected. The line that pays it:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-world value=lock
 bound-lock/1 about="places reads and never writes; asked twice it answers the same" at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=tool/places/hints value=readOnly|idempotent
 bound-lock/1 about="places/<name> value=<folder>, signed by the index-s root: where each place head founded lives" at=policy:head/home by=target form=alphabet measure=id role=writes scope=home/family value=places
 bound-lock/1 about="plan again" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/base-moved/next value=none
+bound-lock/1 about="questions the person answers before it: the place, the origin, reads — a new person and head 0.1.3 as published (the .mcpb of its release), Open-Meteo-s real document and API, on a client with forms and on one with none; harness baseline-013.mts" at=witness:baseline-013-open-meteo by=target form=interval measure=count role=writes scope=baseline/onboarding/questions value=3..3
 bound-lock/1 about="read/rate is spent for {source} this hour: nothing was called. The next hour pays it, or a wider read/rate the place-s root signs." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/rate value=lock
 bound-lock/1 about="red: {coordinate} took {seconds} s, over {scope} {ceiling}." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/red value=lock
+bound-lock/1 about="steps to the first real answer: install, connect, ask — a new person and head 0.1.3 as published (the .mcpb of its release), Open-Meteo-s real document and API, on a client with forms and on one with none; harness baseline-013.mts" at=witness:baseline-013-open-meteo by=target form=interval measure=count role=writes scope=baseline/onboarding/steps value=3..3
+bound-lock/1 about="temporary: head-s own checks said as not in the card, until topos and bound publish the authority-card view that folds what a key may do (demand-authority-card.md)" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=do/not-in-card/head value=not-covered|not-allowed|secret-unallowed|access-unstated
+bound-lock/1 about="the APIs head-s own lock names for a person to connect: none; head connects only what a person hands it, by the address of its document" at=policy:head/ceilings/0.1.4 by=target form=interval measure=count role=writes scope=first-minute/connects value=0..0
 bound-lock/1 about="the SDK head reads lines through, as published" at=policy:head/pins/0.2.0 by=target form=alphabet measure=digest needs=node_modules/@lapxo/topos role=reads scope=dep/topos shape=package value=sha256:fd7fb3783cad1919a7b0236df096c6b4c0d71d5a2f81fb14532779e1e83da261
 bound-lock/1 about="the Secret Service of a Linux session, through libsecret-s secret-tool" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/linux/store value=secret-tool
 bound-lock/1 about="the Windows Credential Manager, through Windows PowerShell-s password vault" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/win32/store value=credential-manager
+bound-lock/1 about="the actions do carries out, each by the catalogue tool of its name" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=do/actions value=place|admit|land|share|key|access|act
 bound-lock/1 about="the authenticated histories a place received, each with its origin" at=policy:head/walk by=target form=alphabet measure=id role=demands scope=birth/view/evidence value=evidence
 bound-lock/1 about="the bytes it waits on, then the package connected again" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/received-open/next value=none
 bound-lock/1 about="the bytes the digest names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/document-digest/next value=none
+bound-lock/1 about="the calls a new person gives something to, to the first answer: install aside, a call made from a cell-s next alone is the model-s" at=policy:head/ceilings/0.1.4 by=target form=interval measure=count role=writes scope=onboarding/steps value=0..3
+bound-lock/1 about="the catalogue tools ask answers by: a view or a source by look, drafted lines by plan, the card by card, anything else by places" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=ask/questions value=look|places|card|plan
 bound-lock/1 about="the ceiling it ran past" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/red/next value=none
 bound-lock/1 about="the ceiling, in the place-s lock and signed by its root, of how many secrets a flow may ask the person on head-s page; without it, none" at=policy:head/access by=target form=alphabet measure=id role=writes scope=access/secrets value=access/secret-inputs
 bound-lock/1 about="the check on every push and every proposal: the suite in shards on each node the place names, the timed tests alone, and the Desktop Extension made twice from the archive npm would publish" at=policy:head/forge by=target form=alphabet measure=id needs=.github/workflows/test.yml role=demands scope=view/pipeline-test shape=.github/workflows/test.yml value=text
@@ -299,7 +363,8 @@ bound-lock/1 about="the fields a line of this place may carry (value read from L
 bound-lock/1 about="the fields a place-s native receipts project, as topos declares them, so bound renders its receipts with no other world" at=policy:head/birth/0.1.2 by=target form=alphabet measure=id role=writes scope=birth/audit/wire/receipt-fields value=scope|role|measure|form|value|at
 bound-lock/1 about="the fields a walked line may carry: a world-s blob is pinned with its shape, and a grant the person witnessed names its witness; a field the contract omits makes the place unwalkable" at=policy:head/walk/0.1.1 by=target form=alphabet measure=id role=writes scope=birth/wire/walk/fields value=scope|role|form|measure|value|by|at|epoch|condition|needs|shape|witness
 bound-lock/1 about="the fields this place-s native receipts project, as topos declares them, so bound renders receipts.bound with no other world (value read from Lapxo/topos)" at=policy:world/founding by=target form=alphabet measure=id role=reads scope=audit/wire/receipt-fields value=scope|role|measure|form|value|at
-bound-lock/1 about="the folder a person-s first place is founded in, under their own home, when they connect a source naming no place: named for what it holds, theirs to rename by founding another with the place tool" at=policy:head/onboard/0.1.2 by=target form=alphabet measure=id role=writes scope=first-run/folder value=place
+bound-lock/1 about="the first read-s own seconds, red against answer/seconds 0..2 — a new person and head 0.1.3 as published (the .mcpb of its release), Open-Meteo-s real document and API, on a client with forms and on one with none; harness baseline-013.mts" at=witness:baseline-013-open-meteo by=target form=interval measure=seconds role=writes scope=baseline/answer/seconds value=3..3
+bound-lock/1 about="the folder a person-s first place is founded in, under their own home, when they connect a source naming no place: named for what it holds, theirs to rename by founding another" at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=first-run/folder value=place
 bound-lock/1 about="the folder of a place a body is laid in while bound reads it, and taken from once it has" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=place/answers value=.answers
 bound-lock/1 about="the folder of a place everything connected is laid in, whatever its kind: the fold decides which world reads it" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=place/connected value=connected
 bound-lock/1 about="the forms its values are read through (value read from Lapxo/topos)" at=policy:world/founding by=target form=alphabet measure=id role=reads scope=audit/wire/forms value=interval|alphabet|ladder
@@ -323,6 +388,7 @@ bound-lock/1 about="the lines of the compile region, together" at=policy:head/ce
 bound-lock/1 about="the lines of the core region, together" at=policy:head/ceilings by=target form=interval measure=core-lines role=reads scope=core/lines value=0..800
 bound-lock/1 about="the lines of the places region, together: split from the places that also connected, never raised" at=policy:head/ceilings by=target form=interval measure=places-lines role=reads scope=places/lines value=0..90
 bound-lock/1 about="the lines of the sources region, together: split from the places that also founded, never raised" at=policy:head/ceilings by=target form=interval measure=sources-lines role=reads scope=sources/lines value=0..150
+bound-lock/1 about="the lines of the verbs region, together, read by head-s suite; a region ceiling landed after founding has no reading of bound-s, so bound holds it as data" at=policy:head/ceilings/0.1.4 by=target form=interval measure=verbs-lines role=writes scope=verbs/lines value=0..80
 bound-lock/1 about="the lines of the walk region, together" at=policy:head/ceilings by=target form=interval measure=walk-lines role=reads scope=walk/lines value=0..40
 bound-lock/1 about="the lines the other device-s key tool answered" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-key/next value=none
 bound-lock/1 about="the longest head waits on bound; a view that has not answered by then is no reading, and nothing is called" at=policy:head/bound by=target form=interval measure=milliseconds role=writes scope=bound/wait value=60000..60000
@@ -341,6 +407,8 @@ bound-lock/1 about="the one adapter access runs by, whatever the kind: the steps
 bound-lock/1 about="the one class of offer head reads; every other class is listed, never called" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=vocab/callable value=read
 bound-lock/1 about="the only files a kind of source, a scheme or a platform-s secret store is named in: one adapter each" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/adapters value=src/ports/adapters/**|src/ports/access/**|src/ports/stores/**|src/ports/keychain.ts
 bound-lock/1 about="the package digest, sent apart" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/shared/next value=none
+bound-lock/1 about="the page a repository and a registry show first, rendered from the lock and never written by hand" at=policy:head/docs/0.1.4 by=target form=alphabet measure=role role=reads scope=leaf-role/README.md value=derived
+bound-lock/1 about="the pages of head, rendered from the lock and never written by hand" at=policy:head/docs/0.1.4 by=target form=alphabet measure=role role=reads scope=leaf-role/docs value=derived
 bound-lock/1 about="the parameter it names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/missing-param/next value=none
 bound-lock/1 about="the paths an origin-s document is looked for at when its catalog names none, in this order: the first a world compiles is connected" at=policy:head/use/0.1.1g by=target form=alphabet measure=id role=writes scope=use/documents value=/openapi.json|/openapi.yaml|/.well-known/openapi.json|/.well-known/openapi.yaml|/swagger.json|/v3/api-docs
 bound-lock/1 about="the person picks one origin" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/pick-origin/next value=none
@@ -352,10 +420,11 @@ bound-lock/1 about="the profile of the record bound prints after the diagnostic
 bound-lock/1 about="the protocol handler Windows opens an address with, started directly, never through cmd" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/win32/browser value=rundll32|url.dll,FileProtocolHandler
 bound-lock/1 about="the protocol head answers through, imported by one file only" at=policy:head/pins by=target form=alphabet measure=digest needs=node_modules/@modelcontextprotocol/sdk role=reads scope=dep/sdk shape=package value=sha256:63a3962282ff29d2ce532945c2edefd9b7c7195b8ec20c027e120e4498b0cb19
 bound-lock/1 about="the protocol is spoken by one file; everything else answers in lines" at=policy:head/ceilings by=target form=interval measure=count role=reads scope=surface/sdk-importers value=0..1
-bound-lock/1 about="the readme of head, in the one shape every place follows, every word of it a line of this lock; open and check are left out while a place outside the tree renders it: open would read the instrument's own demands as head's, and check counts cases from receipts head's vectors do not land yet" at=policy:head/docs by=target form=alphabet measure=id role=demands scope=view/readme shape=README.md value=hero|media|door|idea|figure|claims|learn|refuses|install|reading|how-they-rest|rested-on-by|pointers
+bound-lock/1 about="the questions a new person answers to the first answer" at=policy:head/ceilings/0.1.4 by=target form=interval measure=count role=writes scope=onboarding/questions value=0..1
 bound-lock/1 about="the receipt stands as evidence" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-gone/next value=none
 bound-lock/1 about="the receipt stands as evidence" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-untyped/next value=none
 bound-lock/1 about="the receipts head-s repository carries: the observations at 8, the summary at 0, the region bytes at 1" at=policy:head/docs by=target form=alphabet measure=id role=demands scope=view/receipts shape=receipts.bound value=receipts@8|receipts@0|receipts@1
+bound-lock/1 about="the refusals of bound-s that say an action is not in the card: of authority, of a view the place does not declare, of a key that does not cover a line" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=do/not-in-card/bound value=authority|view|uncovered
 bound-lock/1 about="the region a walk context is folded under" at=policy:head/walk by=target form=alphabet measure=id role=writes scope=walk/context/region value=region/context
 bound-lock/1 about="the relation a catalog names a document by (RFC 8631)" at=policy:head/use/0.1.1g by=target form=alphabet measure=id role=writes scope=use/catalog-rel value=service-desc
 bound-lock/1 about="the release of that version: the archive the owner approved, judged by bound, the Desktop Extension made from it twice on macOS, then staged on npm by the trusted publisher" at=policy:head/forge by=target form=alphabet measure=id needs=.github/workflows/release.yml role=demands scope=view/pipeline-release shape=.github/workflows/release.yml value=text
@@ -376,6 +445,8 @@ bound-lock/1 about="the states a cell of head-s answers is in: done, refused, op
 bound-lock/1 about="the tag of the version the manifest names, made once, on the branch the check passed" at=policy:head/forge by=target form=alphabet measure=id needs=.github/workflows/tag.yml role=demands scope=view/pipeline-tag shape=.github/workflows/tag.yml value=text
 bound-lock/1 about="the tag of the version the manifest names, made once, on the branch the check passed" at=policy:head/forge by=target form=alphabet measure=text role=writes scope=region/pipeline-tag value=lock
 bound-lock/1 about="the text region a view of verbatim prose is rendered by, the capsule obligations pins" at=policy:head/forge by=target form=alphabet measure=digest needs=forge/prose-render.bound role=writes scope=uses/prose-render value=sha256:907115916d64425dd23305fc74d91ea937f933de4949fb0c4dc94fb1106bd33e
+bound-lock/1 about="the tools a client is offered: anything more to do is an action of do or a question of ask" at=policy:head/ceilings/0.1.4 by=target form=interval measure=count role=writes scope=tools/visible value=0..3
+bound-lock/1 about="the tools a client is offered; every other tool line is the catalogue ask and do carry out" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=surface/tools value=connect|ask|do
 bound-lock/1 about="the tools that configure a place — found it, connect a source, prove access to it, admit a device — each answered from the places or the sources region, and no other; the surface grows only by this line" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tools/config value=place|connect|access|admit
 bound-lock/1 about="the transport an origin is reached by, chosen by its scheme; head carries one adapter per line" at=policy:head/transport by=target form=alphabet measure=id role=writes scope=adapter/https value=request
 bound-lock/1 about="the values and transforms a flow may name: extended by this line, never by a flow" at=policy:head/access by=target form=alphabet measure=id role=reads scope=wire/access-values value=$inputs|$steps|$response|$callback|$state|$verifier|$client|$scopes|$host|s256|base64url|base64
@@ -383,6 +454,7 @@ bound-lock/1 about="the variable a host names its person-s home folder by" at=po
 bound-lock/1 about="the variable a host names its person-s home folder by" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/win32/home value=USERPROFILE
 bound-lock/1 about="the variable a host names its person-s home folder by, which head-s own folder sits under when no home is named for it" at=policy:head/platform by=target form=alphabet measure=id role=writes scope=platform/darwin/home value=HOME
 bound-lock/1 about="the variables node reads as it starts: a bound process started ahead is asked only under the same values of them, else one is started as it is asked" at=policy:head/warm by=target form=alphabet measure=id role=writes scope=bound/spare-env value=NODE_|UV_
+bound-lock/1 about="the verbs a client is offered: each question and action routed to the catalogue module that answers it, on the card it was asked on" at=policy:project/0.1.4 by=target form=alphabet measure=coordinates role=reads scope=region/verbs value=src/verbs/**
 bound-lock/1 about="the view a place names to have bound compile its sources into the place vocabulary" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=place/view value=place
 bound-lock/1 about="the view a place names to have bound type what a source answered; without it, head hands no answer at all" at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=place/answer value=answer
 bound-lock/1 about="the view bound renders a place-s receipts by, beside its lock, after each act its root lands" at=policy:head/birth/0.1.2 by=target form=alphabet measure=id role=writes scope=bound/receipts value=receipts
@@ -392,12 +464,15 @@ bound-lock/1 about="unencrypted transport, which the adapter sends only to this
 bound-lock/1 about="what a clone runs: it installs, and every vector of head runs against bound as published" at=policy:head/docs by=target form=alphabet measure=id role=writes scope=check value="npm ci && npm test"
 bound-lock/1 about="what a device a place admits covers unless whoever admits it says otherwise: it asks, keeps what it read and proves access; it widens nothing and calls nothing that changes the world" at=policy:head/places by=target form=alphabet measure=id role=writes scope=member/coverage value=read/**|kept/**|access/**
 bound-lock/1 about="what a place adopts: every world head carries; a lock as its parent is refused by name, its composition being bound-s; split from the compile region at its ceiling, never raised" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/adopt value=src/adopt/**
+bound-lock/1 about="what a place allows is its root-s to change" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/not-in-card/next value=none
 bound-lock/1 about="what a place allows of answering a present read from a retained one: allow/reuse/<source> in seconds, the longest a retained answer may stand in for the source; without it every read calls" at=policy:head/access by=target form=alphabet measure=id role=writes scope=reuse/family value=allow/reuse
 bound-lock/1 about="what a place allows of inspecting retained reads: allow/history/<source> present; history is evidence of the read it came from, never a current answer" at=policy:head/access by=target form=alphabet measure=id role=writes scope=history/family value=allow/history
 bound-lock/1 about="what a place offers a peer it walks with: its policy and what it pins, never an identity" at=policy:head/walk by=target form=alphabet measure=id needs=allow/**|uses/**|dep/**|access/** role=demands scope=birth/view/walk value=walk@*
 bound-lock/1 about="what a place reads: a source connected and compiled once, access to it obtained" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/sources value=src/sources/**
 bound-lock/1 about="what a place-s walk context holds: the keys a peer authenticates it by, its wire and its origin" at=policy:head/walk by=target form=alphabet measure=id role=writes scope=walk/context/reads value=keys/**|wire/**|walk/origin
 bound-lock/1 about="what a region of the place is measured by, as obligations reads it: its coordinates and the leaves it writes" at=policy:head/forge by=target form=alphabet measure=id role=reads scope=audit/wire/region-measures value=coordinates|leaves
+bound-lock/1 about="what a source offers, as a person reads it: where it is reached and the class of each offer" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=resolution/offers/person value=0
+bound-lock/1 about="what a source offers, explained: each offer-s forms and how access is proven, in the order of trust" at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=resolution/offers/why value=1
 bound-lock/1 about="what bound names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/not-landed/next value=none
 bound-lock/1 about="what bound names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/receipts-open/next value=none
 bound-lock/1 about="what bound names" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unfolded/next value=none
@@ -405,6 +480,10 @@ bound-lock/1 about="what bound names" at=policy:head/shape/0.1.2 by=target form=
 bound-lock/1 about="what bound prints before the result of an act it committed: then the records it admitted, then its receipt" at=policy:head/bound by=target form=alphabet measure=id role=writes scope=bound/act value="ACT "
 bound-lock/1 about="what connect needs: a document, or a package-s lock, which names its sources" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/connect/required value=document
 bound-lock/1 about="what head hands a flow that asks its host for the name it registers a client under ($host.client-name); a world never names its host, and a flow asking the host for anything else head does not declare is refused by name" at=policy:head/access by=target form=alphabet measure=id role=writes scope=host/client-name value=head
+bound-lock/1 about="what head is, how it is installed and the first minute with it" at=policy:head/docs/0.1.4 by=target form=alphabet measure=id needs=README.md role=demands scope=view/readme shape=README.md value=text
+bound-lock/1 about="what head is, how it is installed and the first minute with it" at=policy:head/docs/0.1.4 by=target form=alphabet measure=text role=writes scope=region/readme value=lock
+bound-lock/1 about="what of head each test file runs, measured once by node-s own coverage with each file alone: the map the lane crosses with each change, nothing run" at=policy:head/forge/0.1.4 by=target form=alphabet measure=id needs=.github/workflows/suite-map.yml role=demands scope=view/pipeline-suite-map shape=.github/workflows/suite-map.yml value=text
+bound-lock/1 about="what of head each test file runs, measured once by node-s own coverage with each file alone: the map the lane crosses with each change, nothing run" at=policy:head/forge/0.1.4 by=target form=alphabet measure=text role=writes scope=region/pipeline-suite-map value=lock
 bound-lock/1 about="what share needs: the folder it writes" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=tool/share/required value=to
 bound-lock/1 about="what the first resolution shows of a source: where it is reached and the class of each offer" at=policy:head/look by=target form=alphabet measure=id role=writes scope=look/first value=origins|origin|class|tags
 bound-lock/1 about="what the forge runs, rendered from the lock and never written by hand" at=policy:head/forge by=target form=alphabet measure=role role=reads scope=leaf-role/.github value=derived
@@ -422,11 +501,13 @@ bound-lock/1 about="where topos-mcp 0.1.0 publishes its standing: bound fetches
 bound-lock/1 about="where topos-openapi 0.1.0 publishes its standing: bound fetches it there for every place that pins it, and head reads its readers from it, both by its digest" at=policy:head/worlds/0.2.0 by=target form=alphabet measure=id role=writes scope=sources/topos-openapi value=https://github.com/Lapxo/topos-openapi/releases/download/v0.1.1/standing.bound
 bound-lock/1 about="who is in a place: founding it with its root, admitting another device" at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/places value=src/places/**
 bound-lock/1 about="whoever holds the place-s root" at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-root/next value=none
-bound-lock/1 about="{\n  \"manifest_version\": \"0.3\",\n  \"name\": \"head\",\n  \"display_name\": \"head\",\n  \"version\": \"0.1.3\",\n  \"description\": \"An MCP server that folds: it runs bound as a process, hands a model what bound printed, and lands what it read as receipts.\",\n  \"author\": {\n    \"name\": \"Lapxo\"\n  },\n  \"license\": \"MIT\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/Lapxo/head\"\n  },\n  \"homepage\": \"https://github.com/Lapxo/head\",\n  \"server\": {\n    \"type\": \"node\",\n    \"entry_point\": \"dist/src/index.js\",\n    \"mcp_config\": {\n      \"command\": \"node\",\n      \"args\": [\n        \"${__dirname}/dist/src/index.js\"\n      ],\n      \"env\": {}\n    }\n  },\n  \"tools\": [\n    {\n      \"name\": \"access\",\n      \"description\": \"Prove access to a source ahead of any call, the way its document declares: the person-s own page, or its provider with a client registered for the visit; the secret is kept in this keychain and a receipt lands without it. Nothing is called.\"\n    },\n    {\n      \"name\": \"act\",\n      \"description\": \"Call one offer that is not of class read, only as far as the person allowed it and after their yes when they asked to be asked. The intent lands before the call and the receipt after; a call that never answered stays open until a look closes it.\"\n    },\n    {\n      \"name\": \"admit\",\n      \"description\": \"Admit another device into a place, once whoever holds its root says yes: the key its own key tool handed, under a name, covering what is given — without it, what a member is: asking, keeping what it read, proving access. What it claims to cover is not read.\"\n    },\n    {\n      \"name\": \"card\",\n      \"description\": \"What is open for a key: each cell no reading has answered, its ceiling, its origins and the states it may take, in the order bound ranks them.\"\n    },\n    {\n      \"name\": \"connect\",\n      \"description\": \"Connect a source to a place, once the person says yes: its document, and an overlay beside it, laid whatever its kind and compiled once by whichever world reads it — or open, with the line that pays it — into what the source offers and how access is proven, pinned by digest. Nothing is called. A document at an address may be read as a source the place connected, with the access it holds, and checked against its digest. A package another place shared is connected whole: its lock as the document, named by its digest. And an origin alone, with no source, is used on one yes: a read-only place of its own, its document found where the origin says, compiled, and reads granted.\"\n    },\n    {\n      \"name\": \"key\",\n      \"description\": \"The lines that admit a key of this device in a place: its public key, its class, what it may sign and how deep. The key is made once in the keychain and never shown.\"\n    },\n    {\n      \"name\": \"land\",\n      \"description\": \"Land a lot plan signed, by its digest, while the place still stands on the base it was planned against.\"\n    },\n    {\n      \"name\": \"look\",\n      \"description\": \"Read one view of a place as bound folds it; or what a source offers, as typed lines: at 0 where it is reached and the class of each offer, at 1 (the default) their forms and how access is proven; or, at 8 with an operation of class read, that operation once: the response comes back with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. Nothing else is ever called.\"\n    },\n    {\n      \"name\": \"place\",\n      \"description\": \"Found a place in a folder, once the person says yes: its root key made in the keychain, the lines it is born with — reads bounded, read-only — and its name in head-s index of places.\"\n    },\n    {\n      \"name\": \"places\",\n      \"description\": \"What this device has connected: every place head-s index names, the sources each pinned, the grants that stand today and the last read it kept a receipt of — read off each place-s lines as bound folds them. Nothing is asked, called or signed.\"\n    },\n    {\n      \"name\": \"plan\",\n      \"description\": \"Propose lines for the person to sign: they are shown to the person with the place and the base they are made against; on a yes to exactly those, the person-s key signs them and they are folded as if landed. Nothing lands; the lot is kept by its digest.\"\n    },\n    {\n      \"name\": \"share\",\n      \"description\": \"Pack a place for another place to receive: a lock naming by digest each world its sources were compiled under and each source-s document, overlay and compiled pin, written with those bytes into a folder — and, beside each digest, the encrypted address its bytes are also published at, where the person names one. It carries no key, no grant and no answer; nothing is asked, signed or landed. The folder or the addresses travel as the person chooses, and the digest apart, over a private channel.\"\n    }\n  ],\n  \"tools_generated\": false,\n  \"keywords\": [\n    \"bound\",\n    \"openapi\",\n    \"mcp\"\n  ],\n  \"compatibility\": {\n    \"platforms\": [\n      \"darwin\",\n      \"win32\"\n    ],\n    \"runtimes\": {\n      \"node\": \">=22.18\"\n    }\n  }\n}\n" at=policy:head/forge by=target form=alphabet measure=text role=writes scope=prose/en/bundle/manifest shape=manifest.json value=lock
+bound-lock/1 about="{\n  \"manifest_version\": \"0.3\",\n  \"name\": \"head\",\n  \"display_name\": \"head\",\n  \"version\": \"0.1.4\",\n  \"description\": \"An MCP server that folds: it runs bound as a process, hands a model what bound printed, and lands what it read as receipts.\",\n  \"author\": {\n    \"name\": \"Lapxo\"\n  },\n  \"license\": \"MIT\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"https://github.com/Lapxo/head\"\n  },\n  \"homepage\": \"https://github.com/Lapxo/head\",\n  \"server\": {\n    \"type\": \"node\",\n    \"entry_point\": \"dist/src/index.js\",\n    \"mcp_config\": {\n      \"command\": \"node\",\n      \"args\": [\n        \"${__dirname}/dist/src/index.js\"\n      ],\n      \"env\": {}\n    }\n  },\n  \"tools\": [\n    {\n      \"name\": \"ask\",\n      \"description\": \"Ask head, and nothing changes but the receipts of what was read. With nothing: what this device has connected. A source: its region, what it offers; with an operation and its parameters, one read of an offer of class read, answered with the receipt the device key landed for it, or, while the place allows reuse, the answer kept for it and nothing called. A view: as bound folds it. card: what is open, and the card do needs. lines: a lot for the person to sign. Nothing that is not a read is ever called. An answer about one place ends with its card, valid from it.\"\n    },\n    {\n      \"name\": \"connect\",\n      \"description\": \"Connect a source to a place, once the person says yes: its document, and an overlay beside it, laid whatever its kind and compiled once by whichever world reads it — or open, with the line that pays it — into what the source offers and how access is proven, pinned by digest. Nothing is called. A document at an address may be read as a source the place connected, with the access it holds, and checked against its digest. A package another place shared is connected whole: its lock as the document, named by its digest. A site alone or a folder is looked for its document first, before anything is founded. With no place yet, the first connect founds the person-s place on one yes that also lets head read the source.\"\n    },\n    {\n      \"name\": \"do\",\n      \"description\": \"Do one action in a place, on the card ask answered for it: found a place, admit a device, land a lot ask planned, share a place, make this device-s key, prove access to a source, or call an offer that is not a read. An action on a place that moved since its card was asked is refused, with nothing done; one the place does not allow is said not to be in the card. The answer ends with the card valid from this act.\"\n    }\n  ],\n  \"tools_generated\": false,\n  \"keywords\": [\n    \"bound\",\n    \"openapi\",\n    \"mcp\"\n  ],\n  \"compatibility\": {\n    \"platforms\": [\n      \"darwin\"\n    ],\n    \"runtimes\": {\n      \"node\": \">=22.18\"\n    }\n  }\n}\n" at=policy:head/version/0.1.4 by=target form=alphabet measure=text role=writes scope=prose/en/bundle/manifest shape=manifest.json value=lock
+bound-lock/1 about="{action} is not in the card of {place}: {why}. Nothing was done." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/not-in-card value=lock
 bound-lock/1 about="{count} lines landed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/landed value=lock
 bound-lock/1 about="{dir} is a place already: nothing was made." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/place-exists value=lock
 bound-lock/1 about="{document} answered {status} to the access {via} holds. Nothing was connected. Access {via} holds that {document} accepts pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/fetch-status value=lock
 bound-lock/1 about="{document} carries {scope}, which a package does not: a package names by digest, each once, the worlds its sources were compiled under and each source-s document, overlay and pin, in an order its pins rest in, and grants nothing. Nothing was connected." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/package-line value=lock
+bound-lock/1 about="{document} has not arrived, so {source} is not connected yet: {place} owes it. Ask {operation} again, with {args}, once it can be read; nothing else is asked." at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/bytes-owed value=lock
 bound-lock/1 about="{document} hashes to {got}, not to the {digest} it was named by. Nothing was connected. The bytes that digest names pay it, or the digest these bytes hash to, from whoever sent them." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/document-digest value=lock
 bound-lock/1 about="{document} is not at the origin {via} is reached at, and {via}-s access goes to its own origin alone: nothing was fetched. A source reached at {document}-s own origin, connected first, pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/fetch-cross-origin value=lock
 bound-lock/1 about="{document} moved to another address, which head follows only without the access and for bytes named by their digest: name the document-s digest. Nothing was connected." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/fetch-redirect value=lock
@@ -435,6 +516,7 @@ bound-lock/1 about="{document} was not read: an https address, or a file inside
 bound-lock/1 about="{flow} asks a one-time code" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/trust-one-time value=lock
 bound-lock/1 about="{flow} asks a secret" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/trust-secret value=lock
 bound-lock/1 about="{flow} asks no secret" at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/trust-none value=lock
+bound-lock/1 about="{form} declares no resolution that explains it: this is what ask reads, and nothing more." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/why-undeclared value=lock
 bound-lock/1 about="{message}. The page comes back to this device once, and only the secret it yields is kept, in your keychain." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/visit value=lock
 bound-lock/1 about="{name} at {dir} — sources: {sources}. Grants standing today: {grants}. Last read: {last}." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/place-held value=lock
 bound-lock/1 about="{name} is admitted into {place}, covering {coverage}:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/admitted value=lock
@@ -453,6 +535,7 @@ bound-lock/1 about="{place} admits a key named {name} already, or this key under
 bound-lock/1 about="{place} covers {coverage} for the key that would sign; {scope} is not in it, so nothing was asked, called or signed. Whoever configures {place} can sign these lines:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/not-covered value=lock
 bound-lock/1 about="{place} does not allow retained reads of {source} to be inspected. Whoever configures it can sign this line:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/history-undeclared value=lock
 bound-lock/1 about="{place} has no source connected: there is nothing to pack. Nothing was written." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/share-none value=lock
+bound-lock/1 about="{place} moved since the card {card} was asked, or none was: nothing was done. Ask for its card again, and act on what it shows." at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/card-stale value=lock
 bound-lock/1 about="{place} was acted in, and its receipts did not close: {why}" at=policy:head/surface/0.1.2 by=target form=alphabet measure=id role=writes scope=said/receipts-open value=lock
 bound-lock/1 about="{place} was born before its wire named who witnesses a widening, so nothing its root signs as one lands there until it does. head proposes this lot — the wire it stands on withdrawn and said again with the witness, signed by the root alone: plan it, then land it; nothing is migrated:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/unwitnessed value=lock
 bound-lock/1 about="{place} would stand on {parent} as its parent lock. Composing a parent-s policy with a child-s is bound-s to do, and this head does not: nothing was adopted, called or signed. A package another place shared is connected by the digest its sender sent apart from it." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/parent-lock value=lock
@@ -464,9 +547,10 @@ bound-lock/1 about="{source} declares no origin: nothing was called. The person-
 bound-lock/1 about="{source} declares several origins ({origins}): the person picks one as region/{source} origin; none is a default, production least of all. Nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/pick-origin value=lock
 bound-lock/1 about="{source} did not answer: nothing landed." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/unreachable-source value=lock
 bound-lock/1 about="{source} did not grant access the way it declares: nothing was kept and nothing was called. Entering it again, as {source} accepts it, pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/login-refused value=lock
-bound-lock/1 about="{source} does not state how access to {operation} is proven, and only a read is ever tried with nothing attached: nothing was called. An overlay beside its document that states it pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/access-unstated value=lock
+bound-lock/1 about="{source} does not state how access to {operation} is proven, and only a read is ever tried with nothing attached: nothing was called. An overlay beside its document that states the access of {method} {path} pays it." at=policy:head/connect/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-unstated value=lock
 bound-lock/1 about="{source} is a document of a profile the world does not read: {why}. It was laid and taken back; nothing was connected. A document of a profile a world reads pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/document-unsupported value=lock
 bound-lock/1 about="{source} is a document the world could not parse: {why}. It was laid and taken back; nothing was connected. The document mended where {why} points pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/document-unparsed value=lock
+bound-lock/1 about="{source} is connected to {place}, and head may read it: ask {operation} again, with {args}." at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/ready value=lock
 bound-lock/1 about="{source} is connected to {place}: {offers} offers, {reads} of them read; every other is listed, never called. Pinned as {pin}. How access is proven, and where it is reached:" at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/connected value=lock
 bound-lock/1 about="{source} is reached through a provider that needs a client the person registered: sign keys/access/{source}/<scheme> client with it. head invents none. Nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/no-client value=lock
 bound-lock/1 about="{source} names two different documents ({why}), and a source is one: neither was read. It was laid and taken back; nothing was connected. One document for {source} pays it." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/document-collision value=lock
@@ -475,10 +559,12 @@ bound-lock/1 about="{source} proves access to {operation} by {kinds}, and none o
 bound-lock/1 about="{source} referred to {by} before it was here: compiled again, its pin now {pin}. Nothing was reconnected and nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/resolved value=lock
 bound-lock/1 about="{source} refers to {refs}, which no document of this place declares yet: a demand, paid when the document that declares it is connected — {source} is then compiled again, never reconnected." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/unresolved value=lock
 bound-lock/1 about="{source} refused the read without access and named who issues it: {issuer}. head observed how — its metadata, the steps, a client where the server registers one — and the next read signs in there, on head-s page, once; its token and refresh are kept in this keychain and renewed on use." at=policy:head/surface/0.1.1g by=target form=alphabet measure=id role=writes scope=said/authorizer-observed value=lock
+bound-lock/1 about="{source} refused {operation} with the access head held for it: that access is spent, kept nowhere but marked so, and {place} shows it open. Prove it again once." at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-refused value=lock
 bound-lock/1 about="{source} states its reads need no access: nothing was kept and nothing was called." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/access-anonymous value=lock
 bound-lock/1 about="{source} waits on bytes that did not arrive, or did not hash to the package, and were not used: {waits}. Bring them beside the package lock by any means and connect the package again; the place holds the demand until they arrive." at=policy:head/surface/0.1.2 by=target form=alphabet measure=id role=writes scope=said/received-open value=lock
 bound-lock/1 about="{source} would ask you for {input}, a secret, and this place-s root allows no more on head-s page: nothing was asked and nothing was called. Its root may sign access/secret-inputs to allow it." at=policy:head/surface by=target form=alphabet measure=id role=writes scope=said/secret-unallowed value=lock
 bound-lock/1 about="{to} is not a folder a package is written into: it must be absolute, inside {place} or a folder the client shares, apart from the place-s own folders, and hold no lock but a package. Nothing was written." at=policy:head/surface/0.1.1 by=target form=alphabet measure=id role=writes scope=said/share-to value=lock
+bound-lock/1 about=done at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/connected/next value=ask
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/access-anonymous/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/access-kept/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/admitted/next value=none
@@ -486,7 +572,6 @@ bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measu
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/authorizer-observed/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/born/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/closed/next value=none
-bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/connected/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-earlier/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/landed/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/place-held/next value=none
@@ -497,6 +582,12 @@ bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measu
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/reused/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/used/next value=none
 bound-lock/1 about=done at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/why/next value=none
+bound-lock/1 at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-pending/next value=do
+bound-lock/1 at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-pending/next/args value=action:access|source:$source|place:$place
+bound-lock/1 at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-pending/state value=open
+bound-lock/1 at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-refused/next value=do
+bound-lock/1 at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-refused/next/args value=action:access|source:$source|place:$place
+bound-lock/1 at=policy:head/access/0.1.4 by=target form=alphabet measure=id role=writes scope=said/access-refused/state value=refused
 bound-lock/1 at=policy:head/acts by=target form=alphabet measure=id role=writes scope=act/done value=done
 bound-lock/1 at=policy:head/authority by=owner epoch=1 form=alphabet measure=public-key role=writes scope=keys/owner sig="ed25519:era1:HIVD8P4NcWjPd0Fec8d1Ff52oPI+PMa6U+w8WHKAbj8sJtUWvG5Epmt/44DGRkGB455ByTtcMTK2jMGPN3EPBQ==" value="MCowBQYDK2VwAyEAIYI0be8OWhf3HcVceKpibjgZ+hbYJKYO5ayX8Kk16LE="
 bound-lock/1 at=policy:head/authority by=target form=alphabet measure=class role=writes scope=keys/owner value=authorize
@@ -532,6 +623,16 @@ bound-lock/1 at=policy:head/birth by=target form=alphabet measure=id role=writes
 bound-lock/1 at=policy:head/birth by=target form=interval measure=bytes role=writes scope=birth/reader/response-bytes value=0..16777216
 bound-lock/1 at=policy:head/birth by=target form=interval measure=bytes role=writes scope=birth/signer/response-bytes value=1048576..1048576
 bound-lock/1 at=policy:head/birth by=target form=interval measure=milliseconds role=writes scope=birth/signer/timeout value=30000..30000
+bound-lock/1 at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/bytes-owed/next value=ask
+bound-lock/1 at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/bytes-owed/next/args value=source:$source|place:$place|operation:$operation|args:$args
+bound-lock/1 at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/bytes-owed/state value=open
+bound-lock/1 at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/connected/next/args value=source:$source|place:$place
+bound-lock/1 at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/ready/next value=ask
+bound-lock/1 at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/ready/next/args value=source:$source|place:$place|operation:$operation|args:$args
+bound-lock/1 at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/ready/state value=done
+bound-lock/1 at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unborn/next value=connect
+bound-lock/1 at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unborn/next/args value=source:$source|document:|operation:$operation|args:$args
+bound-lock/1 at=policy:head/birth/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unborn/state value=open
 bound-lock/1 at=policy:head/bound by=target form=alphabet measure=id role=writes scope=bound/at value=@
 bound-lock/1 at=policy:head/bound by=target form=alphabet measure=id role=writes scope=bound/cells value=cells
 bound-lock/1 at=policy:head/bound by=target form=alphabet measure=id role=writes scope=bound/key value=--key
@@ -572,7 +673,6 @@ bound-lock/1 at=policy:head/release by=target form=alphabet measure=id role=writ
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/access-anonymous/state value=done
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/access-kept/state value=done
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/access-unstated/state value=refused
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/act-failed/next value=look
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/act-failed/next/args value=source:$source|operation:$operation|closes:$intent
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/act-failed/state value=open
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/admitted/state value=done
@@ -604,8 +704,6 @@ bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/elicit/state value=asked
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/elicit/yes/state value=asked
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/enter/state value=asked
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/entry-unfinished/next value=access
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/entry-unfinished/next/args value=source:$source
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/entry-unfinished/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/fetch-cross-origin/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/fetch-redirect/state value=refused
@@ -613,35 +711,24 @@ bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/grant/state value=asked
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-earlier/state value=done
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-gone/state value=done
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-none/next value=look
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-none/next/args value=source:$source|operation:$operation|at:8
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-none/state value=refused
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-undeclared/next value=plan
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-undeclared/next/args value=place:$place
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-undeclared/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history-untyped/state value=done
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/history/state value=done
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/host-input/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/insecure-origin/state value=refused
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/is-read/next value=look
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/is-read/next/args value=source:$source|operation:$operation|at:8
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/is-read/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/key-taken/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/landed/state value=done
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/login-refused/next value=access
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/login-refused/next/args value=source:$source
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/login-refused/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/missing-param/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-adapter/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-cells/state value=refused
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-client/next value=plan
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-client/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-key/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-keychain/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-lot/state value=refused
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-origin/next value=plan
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-origin/state value=refused
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-place/next value=places
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-place/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-role/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-root/state value=refused
@@ -649,16 +736,11 @@ bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-world/state value=open
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/no-yes/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/not-allowed/state value=refused
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/not-callable/next value=act
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/not-callable/next/args value=source:$source|operation:$operation
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/not-callable/state value=refused
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/not-covered/next value=plan
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/not-covered/next/args value=place:$place
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/not-covered/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/not-landed/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/nothing-offered/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/nothing-open/state value=refused
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/open/next value=look
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/open/next/args value=source:$source|operation:$operation|closes:$intent
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/open/state value=open
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/package-line/state value=refused
@@ -668,11 +750,9 @@ bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/pick-origin/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/pick/state value=asked
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/place-absolute/state value=refused
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/place-exists/next value=places
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/place-exists/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/place-held/state value=done
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/place-taken/state value=refused
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/places-none/next value=place
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/places-none/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/planned/state value=done
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/platform/state value=refused
@@ -684,7 +764,6 @@ bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/reread/state value=done
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/resolved/state value=done
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/reused/state value=done
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/secret-unallowed/next value=plan
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/secret-unallowed/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/share-none/next value=connect
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/share-none/next/args value=place:$place
@@ -700,8 +779,6 @@ bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/trust-secret/state value=asked
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/trust/state value=asked
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unfolded/state value=refused
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unknown-operation/next value=look
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unknown-operation/next/args value=source:$source|at:1
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unknown-operation/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unreachable-source/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unreachable/state value=refused
@@ -711,15 +788,11 @@ bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unresolved/state value=open
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unsettled/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/untyped/state value=done
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unwitnessed/next value=plan
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unwitnessed/next/args value=place:$place
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/unwitnessed/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/use-held/state value=done
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/use-none/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/used/state value=done
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/visit/state value=asked
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/why-none/next value=look
-bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/why-none/next/args value=source:$source|operation:$operation|at:8
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/why-none/state value=refused
 bound-lock/1 at=policy:head/shape/0.1.2 by=target form=alphabet measure=id role=writes scope=said/why/state value=done
 bound-lock/1 at=policy:head/signer by=target form=interval measure=bytes role=writes scope=signer/response-bytes value=1048576..1048576
@@ -737,8 +810,55 @@ bound-lock/1 at=policy:head/surface by=target form=alphabet measure=id role=writ
 bound-lock/1 at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/admit/required value=key|name
 bound-lock/1 at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/land/required value=lot
 bound-lock/1 at=policy:head/surface by=target form=alphabet measure=id role=writes scope=tool/place/required value=dir
+bound-lock/1 at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/welcome/required value=
+bound-lock/1 at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-happened/required value=
+bound-lock/1 at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-i-have/required value=
+bound-lock/1 at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/what-next/required value=
+bound-lock/1 at=policy:head/surface/0.1.4 by=target form=alphabet measure=id role=writes scope=prompt/why/required value=source|operation
 bound-lock/1 at=policy:head/transport by=target form=alphabet measure=id role=writes scope=adapter/request/content-type value=content-type
 bound-lock/1 at=policy:head/transport by=target form=alphabet measure=id role=writes scope=adapter/request/json value=application/json
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/act-failed/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/card-stale/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/card-stale/next/args value=card:true|place:$place
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/card-stale/state value=refused
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/card/next value=do
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/card/next/args value=card:$card|place:$place
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/card/state value=done
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/entry-unfinished/next value=do
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/entry-unfinished/next/args value=action:access|source:$source
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/history-none/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/history-none/next/args value=source:$source|operation:$operation
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/history-undeclared/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/history-undeclared/next/args value=place:$place|lines:
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/is-read/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/is-read/next/args value=source:$source|operation:$operation
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/login-refused/next value=do
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/login-refused/next/args value=action:access|source:$source
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/no-client/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/no-client/next/args value=lines:
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/no-origin/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/no-origin/next/args value=lines:
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/no-place/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/not-callable/next value=do
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/not-callable/next/args value=action:act|source:$source|operation:$operation
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/not-covered/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/not-covered/next/args value=place:$place|lines:
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/not-in-card/state value=refused
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/open/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/place-exists/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/places-none/next value=do
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/places-none/next/args value=action:place
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/secret-unallowed/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/secret-unallowed/next/args value=lines:
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unknown-action/state value=refused
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unknown-operation/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unknown-operation/next/args value=source:$source|why:true
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unwitnessed/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/unwitnessed/next/args value=place:$place|lines:
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/why-none/next value=ask
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/why-none/next/args value=source:$source|operation:$operation
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=said/why-undeclared/state value=done
+bound-lock/1 at=policy:head/verbs/0.1.4 by=target form=alphabet measure=id role=writes scope=tool/do/required value=action|card
 bound-lock/1 at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=vocab/access value=access
 bound-lock/1 at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=vocab/anonymous value=anonymous
 bound-lock/1 at=policy:head/vocabulary by=target form=alphabet measure=id role=writes scope=vocab/carry value=carry
@@ -783,4 +903,4 @@ bound-lock/1 at=policy:project by=target form=alphabet measure=coordinates role=
 bound-lock/1 at=policy:project by=target form=alphabet measure=coordinates role=reads scope=region/source value=src/**
 bound-lock/1 at=policy:project by=target form=alphabet measure=id role=writes scope=license value=MIT
 bound-lock/1 at=policy:project by=target form=alphabet measure=id role=writes scope=name value=@lapxo/head
-bound-lock/1 at=policy:project/0.1.3 by=target form=alphabet measure=id role=writes scope=version value=0.1.3
+bound-lock/1 at=policy:project/0.1.4 by=target form=alphabet measure=id role=writes scope=version value=0.1.4