@quo-systems/dock 0.2.0 → 0.2.1

package/beings/avatar.ts

@@ -51,8 +51,11 @@ export class Avatar extends Being {
     return this.join(inv as unknown as Invitation);
   }
 
-  // Knock with an invitation, hand the user being one back so she can push,
-  // and take her as `user`. The only moment a standing is born here.
+  // Knock with an invitation, hand the far being one back so she can push,
+  // and take her as `user`. The only moment a standing is born here. A being
+  // who answers the hello with an error object is a being who answered: she
+  // is taken all the same, and the way back she did not take is dropped, so
+  // any world's public being may admit a guest, hello or not.
   async join(invitation: Invitation): Promise<Blueprint | { error: string }> {
     if (this.standings[USER]) return this.tools();
     const mine = await this.invite(PUSHER);
@@ -62,6 +65,7 @@ export class Avatar extends Being {
       this.occupants.remove(PUSHER);
       return { error: isSilence(out) ? 'silence' : wordOf(out) };
     }
+    if (out !== null && typeof out === 'object' && !Array.isArray(out) && 'error' in out) this.occupants.remove(PUSHER);
     await this.take(USER, invitation);
     return this.tools();
   }

package/beings/carry.ts

@@ -0,0 +1,101 @@
+// SPDX-License-Identifier: Apache-2.0
+// A carrier: a being who shows the asks of the standings she holds as asks
+// of her own, and forwards. Whoever she carries for sees, in one describe,
+// what she can be asked and what every being she holds can be asked, each
+// under that standing's name; asking one is an ask on that standing, in her
+// name, so the far being sees her and never who is behind her. A user being
+// carries acme for the human's devices; a house being could carry its
+// rooms; nothing here knows what she is.
+//
+// A carried ask is `<id>-<name>`, and the mapping back is kept in her cells
+// and never parsed from the name, so an id with a dash in it is no trouble.
+// The notes say which asks are whose, `standings: { id: { asks, look? } }`,
+// so a screen draws one section per standing and a model side keeps the
+// flat list it needs. Her own asks come first and are never shadowed: a
+// carried name that collides with one of hers is dropped.
+//
+// She asks a standing's describe again when its digest moved, and its
+// `look` once per digest, and keeps both in her cells. So a describe of
+// hers may cost one ask per stale standing, which is the price of a page
+// that is never more than one ask behind.
+import { Being, isSilence, isWord, wordOf } from '@quo-systems/quo';
+import type { Asker, Blueprint, JsonObject, OccupantRecord, Reply } from '@quo-systems/quo';
+import { sanitise, type Look } from './look.ts';
+
+type Carried = Record<string, { id: string; ask: string }>;
+type Looks = Record<string, { digest: string | null; look: Look }>;
+
+export class Carrier extends Being {
+  // Who sees what she carries. Nobody, until a subclass says who.
+  static carries(_occupant: OccupantRecord | undefined, _asker: Asker): boolean {
+    return false;
+  }
+  // Standings she never carries: a way back to a device is one, by the
+  // dock's own convention, and a subclass may name more.
+  static hidden(id: string): boolean {
+    return id.startsWith('to:');
+  }
+
+  private get carried(): Carried {
+    return ((this.cells.carried as Carried | undefined) ??= {});
+  }
+  private get looks(): Looks {
+    return ((this.cells.looks as Looks | undefined) ??= {});
+  }
+
+  // Her describe with her standings carried into it, for an asker who may
+  // see them. Every other asker gets her describe alone.
+  async blueprint(asker: Asker): Promise<Blueprint> {
+    const C = this.constructor as typeof Carrier;
+    const bp = this.describe(asker);
+    if (!C.carries(this.occupant(asker), asker)) return bp;
+    const own = new Set(bp.asks.map((a) => a.name));
+    const carried: Carried = {};
+    const groups: Record<string, { asks: string[]; look?: Look }> = {};
+    for (const [id, rec] of Object.entries(this.cells.standings)) {
+      if (C.hidden(id)) continue;
+      const st = this.standings[id];
+      if (!st) continue;
+      if (!rec.blueprint || rec.seen !== rec.digest) await st.ask(); // her ward writes the record
+      if (!rec.blueprint) continue;
+      const names: string[] = [];
+      for (const a of rec.blueprint.asks) {
+        if (a.name === 'look') continue;
+        const name = `${id}-${a.name}`;
+        if (own.has(name)) continue;
+        carried[name] = { id, ask: a.name };
+        names.push(name);
+        bp.asks.push({ ...a, name });
+      }
+      const group: { asks: string[]; look?: Look } = { asks: names };
+      if (rec.blueprint.asks.some((a) => a.name === 'look')) {
+        const kept = this.looks[id];
+        if (!kept || kept.digest !== rec.digest) {
+          const l = await st.ask('look');
+          this.looks[id] = { digest: rec.digest, look: isSilence(l) || isWord(l) ? {} : sanitise(l) };
+        }
+        group.look = this.looks[id]!.look;
+      }
+      groups[id] = group;
+    }
+    for (const id of Object.keys(this.looks)) if (!(id in groups)) delete this.looks[id];
+    this.cells.carried = carried;
+    const notes = bp.notes !== null && typeof bp.notes === 'object' && !Array.isArray(bp.notes) ? bp.notes : {};
+    return { asks: bp.asks, notes: { ...notes, standings: groups as unknown as JsonObject } };
+  }
+
+  override async answer(asker: Asker, method?: string, args: JsonObject = {}): Promise<Reply> {
+    if (method === undefined) return this.blueprint(asker);
+    const C = this.constructor as typeof Carrier;
+    const to = Object.hasOwn(this.carried, method) ? this.carried[method] : undefined;
+    if (to && C.carries(this.occupant(asker), asker)) {
+      const st = this.standings[to.id];
+      if (!st) return { error: 'unknown ask' };
+      const out = await st.ask(to.ask, args);
+      if (isSilence(out)) return out;
+      if (isWord(out)) return { error: wordOf(out) };
+      return out;
+    }
+    return super.answer(asker, method, args);
+  }
+}

package/beings/desk.ts

@@ -12,7 +12,7 @@ import { Being, isSilence, isWord, wordOf } from '@quo-systems/quo';
 import type { Asker, Json, JsonObject } from '@quo-systems/quo';
 
 export type Proof = { kind: string; [more: string]: Json };
-export type Verified = { user: string; client: string; wake?: boolean };
+export type Verified = { user: string; client: string; wake?: boolean; reach?: boolean };
 export type Verifier = (proof: Proof) => Promise<Verified | null> | Verified | null;
 
 export class Desk extends Being {
@@ -38,7 +38,7 @@ export class Desk extends Being {
     if (!who) return { error: 'refused' };
     const user = this.standings[`user:${who.user}`];
     if (!user) return { error: 'no such user' };
-    const inv = await user.ask('device', who.wake === true ? { client: who.client, wake: true } : { client: who.client });
+    const inv = await user.ask('device', { client: who.client, ...(who.wake === true ? { wake: true } : {}), ...(who.reach === true ? { reach: true } : {}) });
     if (isSilence(inv)) return { error: 'silence' };
     if (isWord(inv)) return { error: wordOf(inv) };
     return inv;

package/beings/index.ts

@@ -3,3 +3,5 @@
 export { User, DESK } from './user.ts';
 export { Desk, type Proof, type Verified, type Verifier } from './desk.ts';
 export { Avatar, USER, PUSHER } from './avatar.ts';
+export { Carrier } from './carry.ts';
+export { sanitise, hint, hintFor, groups, type Look, type Hint } from './look.ts';

package/beings/link.ts

@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: Apache-2.0
+// A link: a world's page with an invitation in the fragment. The page is the
+// hint, where the world lives; the fragment is the invitation, which never
+// leaves the browser: a query string reaches the server, its logs and every
+// referer, and an invitation is a capability. One reserved key, `quo`, the
+// one word no page uses for anything else, and the value is the invitation
+// compact: `ward.heir.secret`, three hex strings, or `ward` alone for a
+// world's public being. The dock's human module reads it, strips it before
+// any page code runs, and joins.
+import type { Invitation } from '@quo-systems/quo';
+
+export const KEY = 'quo';
+const HEX = (n: number) => `[0-9a-f]{${n}}`;
+const FULL = new RegExp(`^(${HEX(128)})\\.(${HEX(64)})\\.(${HEX(64)})$`);
+const PUBLIC = new RegExp(`^${HEX(128)}$`);
+
+export function format(inv: Invitation): string {
+  return inv.heir && inv.secret ? `${inv.ward}.${inv.heir}.${inv.secret}` : inv.ward;
+}
+
+// The invitation in a fragment, or null. Anything else in the fragment is
+// the page's own and is left alone.
+export function parse(hash: string): Invitation | null {
+  const m = /(?:^#|&)quo=([^&]+)/.exec(hash.startsWith('#') ? hash : `#${hash}`);
+  if (!m) return null;
+  const v = decodeURIComponent(m[1]!);
+  const full = FULL.exec(v);
+  if (full) return { ward: full[1]!, heir: full[2]!, secret: full[3]! };
+  return PUBLIC.test(v) ? { ward: v } : null;
+}
+
+// The fragment without the invitation, so the page keeps whatever else it
+// put there and the capability is gone from the address bar.
+export function strip(hash: string): string {
+  const rest = (hash.startsWith('#') ? hash.slice(1) : hash)
+    .split('&')
+    .filter((p) => !p.startsWith(`${KEY}=`))
+    .join('&');
+  return rest ? `#${rest}` : '';
+}
+
+export function link(page: string, inv: Invitation): string {
+  return `${page}#${KEY}=${format(inv)}`;
+}
+
+// Whether an answer is an invitation: a ward pk, and a heir with its secret
+// or neither. What a guest's form answers with to be let in.
+export function isInvitation(v: unknown): v is Invitation {
+  if (v === null || typeof v !== 'object' || Array.isArray(v)) return false;
+  const o = v as Record<string, unknown>;
+  if (typeof o.ward !== 'string' || !PUBLIC.test(o.ward)) return false;
+  const heir = typeof o.heir === 'string', secret = typeof o.secret === 'string';
+  return (heir && secret) || (!heir && !secret && !('heir' in o) && !('secret' in o));
+}

package/beings/look.ts

@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: Apache-2.0
+// A look: what a being may say about how she is presented, as values and
+// no more. One optional ask, `look`, answers it, and every side reads the
+// part it understands: a screen reads the tokens and paints her section, a
+// model side reads the hints per ask and writes them as tool annotations.
+// Nothing here is capability, so nothing here is in a blueprint or a digest,
+// and Quo never sees it. The vocabulary is closed: a token that is not
+// listed does not exist, and one that fails its shape is dropped, not
+// fixed. A being cannot paint outside her section or reach a server
+// through a look, because no token can carry a URL, a stylesheet or code.
+import type { Blueprint, Json, JsonObject } from '@quo-systems/quo';
+
+// What a side may do with one ask. `title` is a human label instead of the
+// name; `readOnly` says the ask changes nothing, so a screen may run it on
+// its own and a model side marks it so; `destructive` asks for care;
+// `idempotent` says asking twice is asking once; `icon` is one short string
+// for a button. A being who marks an ask read-only and then writes has lied
+// to her own page, and nothing enforces it, the way nothing enforces that
+// her empty ask is safe to repeat.
+export type Hint = { title?: string; readOnly?: boolean; destructive?: boolean; idempotent?: boolean; icon?: string };
+export type Look = {
+  name?: string;
+  logo?: string; // an image as a data URI, never a URL
+  accent?: string; // hex colours
+  background?: string;
+  foreground?: string;
+  font?: string; // a font stack, plain characters
+  radius?: number; // 0 to 40, in px
+  order?: string[]; // her asks in the order she wants them shown
+  asks?: Record<string, Hint>;
+};
+
+const COLOUR = /^#[0-9a-fA-F]{3,8}$/;
+const FONT = /^[\w\s,'"-]{1,80}$/;
+const LOGO = /^data:image\/(svg\+xml|png|jpeg|webp);base64,[A-Za-z0-9+/=]{1,40000}$/;
+const NAME = /^[^<>&]{1,60}$/;
+const ICON = /^[^<>&"']{1,8}$/;
+
+const str = (v: Json | undefined, re: RegExp): string | undefined => (typeof v === 'string' && re.test(v) ? v : undefined);
+
+// The look as a side may use it: every token held to its shape, everything
+// else gone. A value that is not an object is no look at all.
+export function sanitise(v: Json | undefined): Look {
+  if (v === null || v === undefined || typeof v !== 'object' || Array.isArray(v)) return {};
+  const l: Look = {};
+  const name = str(v.name, NAME);
+  if (name !== undefined) l.name = name;
+  const logo = str(v.logo, LOGO);
+  if (logo !== undefined) l.logo = logo;
+  for (const k of ['accent', 'background', 'foreground'] as const) {
+    const c = str(v[k], COLOUR);
+    if (c !== undefined) l[k] = c;
+  }
+  const font = str(v.font, FONT);
+  if (font !== undefined) l.font = font;
+  if (typeof v.radius === 'number' && Number.isFinite(v.radius) && v.radius >= 0 && v.radius <= 40) l.radius = Math.round(v.radius);
+  if (Array.isArray(v.order)) l.order = v.order.filter((x): x is string => typeof x === 'string');
+  if (v.asks !== null && typeof v.asks === 'object' && !Array.isArray(v.asks)) {
+    const asks: Record<string, Hint> = {};
+    for (const [ask, h] of Object.entries(v.asks as JsonObject)) {
+      if (h === null || typeof h !== 'object' || Array.isArray(h)) continue;
+      const hint: Hint = {};
+      const title = str(h.title, NAME);
+      if (title !== undefined) hint.title = title;
+      const icon = str(h.icon, ICON);
+      if (icon !== undefined) hint.icon = icon;
+      for (const k of ['readOnly', 'destructive', 'idempotent'] as const) if (typeof h[k] === 'boolean') hint[k] = h[k];
+      if (Object.keys(hint).length) asks[ask] = hint;
+    }
+    if (Object.keys(asks).length) l.asks = asks;
+  }
+  return l;
+}
+
+// The one hint a side reads first: whether this ask is in the look at all.
+export const hint = (l: Look | undefined, name: string): Hint => l?.asks?.[name] ?? {};
+
+// A carrier's notes say which asks are a standing's, and how she looks:
+// `standings: { id: { asks: [name], look? } }`. Every side reads them here.
+export type Group = { asks?: string[]; look?: Json };
+export function groups(bp: Blueprint | null): Record<string, Group> {
+  const n = bp?.notes;
+  const g = n !== null && n !== undefined && typeof n === 'object' && !Array.isArray(n) ? n.standings : undefined;
+  return g !== null && g !== undefined && typeof g === 'object' && !Array.isArray(g) ? (g as Record<string, Group>) : {};
+}
+
+// The hint for one ask, hers or a standing's: a carried ask is looked up
+// under its bare name in that standing's look.
+export function hintFor(bp: Blueprint | null, mine: Look, name: string): Hint {
+  for (const [id, g] of Object.entries(groups(bp))) {
+    if (!g.asks?.includes(name)) continue;
+    const prefix = `${id}-`;
+    return hint(sanitise(g.look), name.startsWith(prefix) ? name.slice(prefix.length) : name);
+  }
+  return hint(mine, name);
+}

package/beings/quo-dock.md

@@ -102,7 +102,10 @@ that every arrival is named and judged.
 - **Front desk.** A being on the user's harbor that strangers and fresh
   clients meet first. It holds a standing to every user being and can ask
   one for a device invitation. It is the only being that is ever public, and
-  only for the first hello.
+  only for the first hello. Public is not a kind of being: she is an ordinary
+  being who chose to describe herself to strangers and answer them, and what
+  she keeps is hers like anyone's. This one keeps little because that is the
+  desk's job, not because Quo asks it of her.
 - **Envoy.** A being whose methods call a non-Quo thing and whose describe
   is that thing's surface. A SaaS, an MCP server someone else runs, an
   Arduino behind serial: each enters a world as a being like any other.
@@ -112,6 +115,12 @@ that every arrival is named and judged.
 - **Client identity.** What a credential exchange establishes: this human at
   this browser, this OAuth client for this human, this process on this
   machine. One client identity is one avatar, for life.
+- **Carrier.** A being who shows the asks of the standings she holds as asks
+  of her own and forwards. The user being is one: a device the human let
+  reach sees acme's asks on her, and acme sees her.
+- **Look.** What a being may say about how she is presented, as values: a
+  name, a logo, colours, a font, and a hint per ask. One optional ask,
+  `look`, answers it, and every side reads the part it understands.
 - **Route.** A hostname a reverse proxy sends to one process: `web.`, `quo.`,
   `mcp.`. Routes are deployment, never boundaries.
 
@@ -122,7 +131,7 @@ One droplet, one harbor, three routes. Every other placement is a subset.
 ```
 acme.com, or razvan.com: the dialable part of an estate
   reverse proxy
-    web.   serves the bundle, runs the credential exchange, ends with an invitation
+    web.   one page per world, /<ward>, the credential exchange, ends with an invitation
     quo.   the harbor's socket door: the rendezvous for every dialer
     mcp.   the model side over HTTP, a credential exchange in front
   quo serve: one process, one harbor, the ask pointer
@@ -211,6 +220,63 @@ UI and then a tool layer: they build asks, both fall out, and neither side
 can do a thing the other cannot, because the gate is one decision for
 describe and for dispatch.
 
+## Carrying
+
+A device sees one describe, its avatar's one standing, and the human's
+world is many standings: acme, the calendar, the house. The user being
+carries them. Her describe for a device the human allowed to reach shows,
+after her own asks, every ask of every standing she holds, each named
+`<id>-<name>`, and answering one is an ask on that standing in her name. Acme
+sees her id and never the device; the device sees acme without holding a
+key anywhere; the human removes acme once, at her, and every device loses
+it at once. Invariant 1 holds as written: the occupant still holds one
+standing.
+
+Carrying is a base, `beings/carry.ts`, and nothing in it knows what a user
+is: a house being could carry its rooms, a company its suppliers. A subclass
+says who may see what she carries, and the user being says a device with the
+`reach` note, written when the human ticked the box at the exchange. The
+notes of a carrier's describe say which asks are whose,
+`standings: { id: { asks, look? } }`, so a screen draws one section per
+standing and a model side keeps the flat list it needs; the mapping back
+from a carried name to the standing is in her cells and never parsed from
+the name. Her own asks come first and are never shadowed. She asks a
+standing's describe again when its digest moved and its `look` once per
+digest, so a describe of hers may cost one ask per stale standing, the price
+of a page that is never more than one ask behind.
+
+## The look
+
+Three sides, one describe, and nothing hard-wired for any of them. A being
+who wants to say how she is presented answers one more ask, `look`, with
+values and no more, and every side reads the part it understands. The
+vocabulary is closed, in `beings/look.ts`, and a token that fails its shape
+is dropped, not fixed:
+
+| token                  | shape                                 | a screen                          | a model side               |
+| ---------------------- | ------------------------------------- | --------------------------------- | -------------------------- |
+| name                   | text, no tags                         | her heading                       | nothing                    |
+| logo                   | an image as a data URI, never a URL   | beside the heading                | nothing                    |
+| accent, background, fg | hex colours                           | CSS variables on her section only | nothing                    |
+| font                   | a font stack, plain characters        | her section                       | nothing                    |
+| radius                 | 0 to 40                               | her corners                       | nothing                    |
+| order                  | her ask names                         | which come first                  | tool order                 |
+| asks.NAME.title        | text                                  | the button                        | the tool's title           |
+| asks.NAME.icon         | one short string                      | on the button                     | nothing                    |
+| asks.NAME.readOnly     | boolean                               | run on open, nothing to type      | `readOnlyHint`             |
+| asks.NAME.destructive  | boolean                               | ask once more                     | `destructiveHint`          |
+| asks.NAME.idempotent   | boolean                               | offer a retry after silence       | `idempotentHint`           |
+
+A look is not capability: it is never in a blueprint or a digest, Quo never
+sees it, and a being without one renders and lists exactly as before. The
+`look` ask itself is presentation and is neither a form nor a tool. A
+carrier keeps each standing's look beside her asks in the notes, so acme's
+section on the human's page is painted as acme asked, inside that section
+and nowhere else. No token can carry a URL, a stylesheet or code, so a far
+being cannot paint over the page or reach a server through it. A being who
+marks an ask read-only and then writes has lied to her own page, and nothing
+enforces it, the way nothing enforces that her empty ask is safe to repeat.
+
 ## Asks only
 
 There is no listening in Quo, and none under `packages/dock/`. A being who wants
@@ -219,8 +285,8 @@ whenever something happens. An event is an ask in the other direction, and
 it is the same act next door and across planets; only latency and
 reachability change. It follows that two beings never share memory, not
 even in one ward: a callback, a stream or a bus between them is a link that
-breaks the day one of them moves, and Quo exists so that nothing breaks
-when a being moves.
+breaks the day one of them is somewhere else, and Quo exists so that nothing
+breaks when she is. Only a ward moves; a being is placed once, at boot.
 
 Two consequences every side obeys:
 
@@ -258,20 +324,26 @@ thin as one call. Every route ends the same way:
 1. The route authenticates by its own means. Password, passkey, OAuth, a
    bearer token from a client, a nonce from a local process.
 2. The route asks the front desk `device({ proof })` and receives an
-   invitation.
+   invitation. Which desk is which world: a harbor holds many wards, and
+   the human chooses the world at the allow page when there is more than
+   one; the grant remembers it.
 3. The route hands the invitation to the avatar it is about to boot, or to
    the one already booted for this client identity if it is a reconnect, in
    which case nothing is handed and the existing standing is used.
 4. The avatar knocks. The heir dies. From here there is no token anywhere.
 
-The human decides one more thing at step 1, on the same page that names
-the identity: whether this device may **wake** the human's other devices.
-The word travels with the proof, the user being writes it as a note on the
-occupant she mints, and her gate reads the note: `push` is shown to the
-desk and to a device with that note, and to nobody else. A device that may
-wake can hand an agent an event through the user being, and she sees who
-did. The note is written when the occupant is minted; to change it, remove
-the occupant and allow again, because reconnect mints nothing.
+The human decides two more things at step 1, on the same page that names
+the identity: whether this device may **wake** the human's other devices,
+and whether it may **reach** what she holds. Each word travels with the
+proof, the user being writes it as a note on the occupant she mints, and her
+gate reads the note: `push` is shown to the desk and to a device with the
+`wake` note, and her standings are carried for a device with the `reach`
+note, and for nobody else. A device that may wake can hand an agent an event
+through the user being, and she sees who did; a device that may reach sees
+acme on her, and a model sees acme only because the human said it may. A tab
+opened with the owner password reaches, since the owner opened it. The notes
+are written when the occupant is minted; to change one, remove the occupant
+and allow again, because reconnect mints nothing.
 
 Tokens, cookies and grants exist for the length of step 1 and are never
 stored on a Quo side. Revocation is `occupants.remove(id)` on the user being:
@@ -292,7 +364,7 @@ quo pilot [--dir D] [--via S] the owner pilot over stdio: the ward's describe as
 quo side [--dir D] --as NAME  an avatar over stdio for a local client; NAME is the client identity
 quo run [--dir D] --as NAME --url URL --model NAME  a human at a terminal talking to a model through an avatar; a line in, the final text out
 quo census [--dir D]      print the census once and exit
-quo boot|public|invite|knock|remove  the five owner asks from a shell, for scripts and for agents under cron; --via S sends them to another ward
+quo boot|public|invite|knock|remove|unboot  the six owner asks from a shell, for scripts and for agents under cron; --via S sends them to another ward
 quo reach <pk> <url>      a hint for the harbor's directory: that world's ward lives at that quo. route
 quo estate <dir> --domain D  an estate folder of the shape every estate has: a droplet's quo directory, its unit and Caddyfile, a package on this dock
 ```
@@ -405,6 +477,8 @@ class bodies and placement, and reaches every piece through the dock.
 | side         | an avatar speaking to someone outside      | screen, MCP server, runner, agent                |
 | proof        | turning a credential into an invitation    | one verifier, a daemon nonce, three kinds        |
 | envoy        | a non-Quo surface as a being               | none built: a name until its first user          |
+| carrier      | a being showing her standings as her own   | the user being; any estate being that extends it |
+| look         | how a being is presented, as values        | read by the screen and the model side            |
 
 Two rules keep them general:
 
@@ -474,12 +548,20 @@ above or sending us back to fix it:
    becomes an invitation the user being minted, the avatar knocks and takes
    her, and her tool list equals the user being's describe for her;
    reconnect mints nothing; two clients see two tool lists; a push is a
-   reverse ask that reaches the side; remove is revocation. The ids that
+   reverse ask that reaches the side; revocation is her sixth ask,
+   `forget({ client })`, the desk's alone. The ids that
    carry the conventions: the desk is the occupant the root named `desk`
    at the user being; the desk holds each user being as `user:<name>`; the
    user being holds each device's way back as `to:<client>`; the avatar
    holds the user being as `user` and is pushed to as `user:push`, two ids
    because standings and occupants share one namespace.
+   A device is two relations, because a relation in Quo is one direction:
+   its way in, the occupant, and her way back, `to:<client>`. Neither
+   implies the other, and the door will never join them. She joins them
+   herself, as her own rule and not Quo's: she does not push to a device
+   she no longer admits, and `forget` drops both in one act, so no side
+   has to remember there were two. Before this a revoked device kept
+   receiving every push.
 3. Done. The side in `packages/dock/beings/side.ts`: a function of the avatar
    that runs until closed, and `word`, which tells the three words and the
    object apart before any side renders them. The MCP server in
@@ -642,8 +724,7 @@ above or sending us back to fix it:
     a terminal, the same pipe as `quo side` with a model named in the
     hello, the daemon running the runner beside the avatar, a line in a
     turn and the final text a line out, proven with a scripted endpoint
-    as a child process in `packages/dock/test/cli.test.ts`. The gate profile per
-    client identity the road lists is defined nowhere and was not built.
+    as a child process in `packages/dock/test/cli.test.ts`.
 18. The edge terrain: Done. `packages/dock/harbor/edge/`, the core over a Durable
     Object: its storage the store with the seed sealed under a platform
     secret, the deployed worker the code, the object the lease; reached by
@@ -708,13 +789,41 @@ above or sending us back to fix it:
     overwrite a package or take a name that is no domain, and its droplet
     boots, `quo init` into it and a daemon answering the census.
 
+23. The human side proper, in flight. What the twelfth sitting decided, in
+    the order it lands: **carrying**, `beings/carry.ts`, the user being on
+    it, a device seeing acme's asks on her under the `reach` note from the
+    exchange, proven in `test/human.test.ts` and `test/mcp.test.ts` on the
+    memory harbor with a shop that has a look; **the look**, `beings/look.ts`,
+    one closed vocabulary read by the screen as a section per standing under
+    its tokens and by the model side as titles and annotations, the `look`
+    ask neither a form nor a tool. Then **worlds**: a world is a ward with a
+    public being, its guest page is that being's describe rendered by the
+    screen, whatever class she is, `human/guest.ts`, and a form whose answer
+    is an invitation is the way in; worlds have addresses, `web./<ward>`,
+    `web./` the list, a hostname per world the proxy's line; a link is the
+    page plus the invitation in the fragment under the reserved key `quo`,
+    never in a query string, `beings/link.ts`; the tab is a browser of worlds,
+    one ward per joined world, a switcher over them, and a content security
+    policy on its shell; the avatar joins a being with no `hello` all the
+    same. Proven on the memory harbor with a door that is not a desk and in
+    Chromium against the desk. Then **the routes read again against the
+    same pieces**: a grant names the world the human allowed the client
+    into, the allow page offers the harbor's worlds when it has more than
+    one, a session is an identity's in a world, and revocation is per world;
+    the MCP endpoint stays one per harbor, `/mcp`, since the grant says
+    which world. Done. What the lab taught before any of it was
+    written: a standing's blueprint is empty after take until the empty ask
+    fills it, so a carrier refreshes on describe; and a dotted name is
+    refused by the model side, so a carried name takes a dash.
+
 Steps 1 to 22 are in the tree and on the machines, and MCP is complete;
-the documents and the folders agree up to step 22. There is no gap named
-today. `next.md` is where the next sitting starts.
+the documents and the folders agree up to step 22, and step 23 is in flight
+as its line says. `next.md` is where the next sitting starts.
 
 ## Glossary
 
 - **avatar**: a being that is someone's voice from outside Quo.
+- **carrier**: a being who shows her standings' asks as her own and forwards.
 - **client identity**: what a credential exchange establishes; one avatar.
 - **envoy**: a being whose methods call a non-Quo thing.
 - **dock**: what every estate needs and nobody writes twice, `packages/dock/`,
@@ -725,6 +834,7 @@ today. `next.md` is where the next sitting starts.
 - **front desk**: the being every fresh client meets; hands out invitations
   minted by user beings.
 - **gate**: `for(occupant, asker)`; the whole permission model.
+- **look**: how a being is presented, as values; one optional ask.
 - **owner pilot**: `quo pilot`, the model side over a ward's owner asks, reaching
   the daemon's socket; with `--via`, a ward elsewhere through a standing.
 - **daemon**: `quo serve`, the one process on a device that holds a harbor.

package/beings/side.ts

@@ -6,13 +6,22 @@
 // a screen, an MCP server, a runner, an event-driven agent. None knows
 // another exists, and none of this file names a platform.
 import { isSilence, isUnreached, isWord, wordOf } from '@quo-systems/quo';
-import type { Answer, Json, JsonObject, WordName } from '@quo-systems/quo';
+import type { Answer, Blueprint, Json, JsonObject, Wanted, WordName } from '@quo-systems/quo';
 import type { Avatar } from './avatar.ts';
 
 // A side, running: it holds the avatar until closed.
 export type Serving = { close(): Promise<void> };
 export type Side = (avatar: Avatar) => Promise<Serving>;
 
+// What a side speaks for: the empty ask and a named one, and the ears a
+// push reaches. An avatar on her one standing is one; the owner's asks on a
+// ward are another; a guest at a world's public being is a third.
+export type Subject = {
+  tools(): Promise<Blueprint | { error: string }>;
+  call(name: string, args?: JsonObject, wanted?: Wanted): Promise<Answer>;
+  ears: Set<(object: JsonObject) => void>;
+};
+
 // The three words for "no object", and the object itself, as every side must
 // tell them apart before rendering. An error object is an ordinary answer
 // that the side may mark; silence and unreached are not objects at all.