@quo-systems/dock 0.2.0 → 0.2.2

package/beings/quo-dock.md

@@ -102,7 +102,10 @@ that every arrival is named and judged.
 - **Front desk.** A being on the user's harbor that strangers and fresh
   clients meet first. It holds a standing to every user being and can ask
   one for a device invitation. It is the only being that is ever public, and
-  only for the first hello.
+  only for the first hello. Public is not a kind of being: she is an ordinary
+  being who chose to describe herself to strangers and answer them, and what
+  she keeps is hers like anyone's. This one keeps little because that is the
+  desk's job, not because Quo asks it of her.
 - **Envoy.** A being whose methods call a non-Quo thing and whose describe
   is that thing's surface. A SaaS, an MCP server someone else runs, an
   Arduino behind serial: each enters a world as a being like any other.
@@ -112,9 +115,40 @@ that every arrival is named and judged.
 - **Client identity.** What a credential exchange establishes: this human at
   this browser, this OAuth client for this human, this process on this
   machine. One client identity is one avatar, for life.
+- **Carrier.** A being who shows the asks of the standings she holds as asks
+  of her own and forwards. The user being is one: a device the human let
+  reach sees acme's asks on her, and acme sees her.
+- **Look.** What a being may say about how she is presented, as values: a
+  name, a logo, colours, a font, and a hint per ask. One optional ask,
+  `look`, answers it, and every side reads the part it understands.
 - **Route.** A hostname a reverse proxy sends to one process: `web.`, `quo.`,
   `mcp.`. Routes are deployment, never boundaries.
 
+## The ids
+
+Every relation here is named by an id one being minted, and the dock's own
+are these. They are conventions of this package and nothing of Quo's; a
+different estate could choose others and change no word of the spec.
+
+| id                  | who holds it   | what it names                            |
+| ------------------- | -------------- | ---------------------------------------- |
+| `desk`              | the user being | the front desk, her privileged occupant  |
+| `user:<name>`       | the front desk | its standing to that human's user being  |
+| `<client>`          | the user being | one device, by its client identity       |
+| `to:<client>`       | the user being | her way back to that device              |
+| `user`              | an avatar      | her one standing, at the user being      |
+| `user:push`         | an avatar      | the user being as her occupant, to push  |
+| `avatar:<identity>` | the ward       | the being key one client identity boots  |
+
+A device is two relations, because a relation in Quo is one direction: its
+way in, the occupant, and her way back, `to:<client>`. Neither implies the
+other and the door never joins them. The user being joins them herself, as
+her own rule: she does not push to a device she no longer admits, and
+`forget` drops both in one act. Her way back is handed over at hello and
+taken when it can be: a knock back that is unreached, a tab whose pk the
+far harbor has not bound yet or a phone in a tunnel, spends nothing, so she
+keeps the invitation and takes it at the next push. A refusal is final.
+
 ## Architecture
 
 One droplet, one harbor, three routes. Every other placement is a subset.
@@ -122,7 +156,7 @@ One droplet, one harbor, three routes. Every other placement is a subset.
 ```
 acme.com, or razvan.com: the dialable part of an estate
   reverse proxy
-    web.   serves the bundle, runs the credential exchange, ends with an invitation
+    web.   one page per world, /<ward>, the credential exchange, ends with an invitation
     quo.   the harbor's socket door: the rendezvous for every dialer
     mcp.   the model side over HTTP, a credential exchange in front
   quo serve: one process, one harbor, the ask pointer
@@ -164,6 +198,15 @@ standing to the user being is minted once and persists in the partition; a
 side opening and closing is a reconnect, and the keys carry on. Reconnect
 never re-invites.
 
+An avatar is one standing, and a harbor holds as many avatars as it holds
+relations; a ward only groups them. The droplet groups by client identity
+per world, in the avatars ward. A tab groups by world, one local ward per
+far world and one avatar per relation in it, so a fresh invitation is
+always a fresh avatar and never a join on one that already holds hers: two
+invitations into one world are two avatars, and two humans on one family
+tablet are two relations. Which avatar a side speaks through is a switch
+and nothing more.
+
 One class for every side. It has:
 
 - `answer`: the user being asks her only to push, and she forwards the push
@@ -202,8 +245,8 @@ last word. A push is the trigger of a turn, never a line smuggled into one:
 a push that arrives while a turn is running waits in her cells and starts
 the next turn when this one ends. Nothing is dropped and nothing is held;
 the ask that carried the push was answered the moment it landed. Between
-turns, the world reaches a model the way step 11 says, an ask that starts a
-run and a callback when it ends.
+turns, the world reaches a model as `packages/dock/mcp/quo-mcp.md` says: an
+ask that starts a run, and a callback when it ends.
 
 One describe, many renderings. A screen is the user being's describe spoken
 as forms; a tool list is the same describe spoken as tools. Nobody builds a
@@ -211,6 +254,63 @@ UI and then a tool layer: they build asks, both fall out, and neither side
 can do a thing the other cannot, because the gate is one decision for
 describe and for dispatch.
 
+## Carrying
+
+A device sees one describe, its avatar's one standing, and the human's
+world is many standings: acme, the calendar, the house. The user being
+carries them. Her describe for a device the human allowed to reach shows,
+after her own asks, every ask of every standing she holds, each named
+`<id>-<name>`, and answering one is an ask on that standing in her name. Acme
+sees her id and never the device; the device sees acme without holding a
+key anywhere; the human removes acme once, at her, and every device loses
+it at once. Invariant 1 holds as written: the occupant still holds one
+standing.
+
+Carrying is a base, `beings/carry.ts`, and nothing in it knows what a user
+is: a house being could carry its rooms, a company its suppliers. A subclass
+says who may see what she carries, and the user being says a device with the
+`reach` note, written when the human ticked the box at the exchange. The
+notes of a carrier's describe say which asks are whose,
+`standings: { id: { asks, look? } }`, so a screen draws one section per
+standing and a model side keeps the flat list it needs; the mapping back
+from a carried name to the standing is in her cells and never parsed from
+the name. Her own asks come first and are never shadowed. She asks a
+standing's describe again when its digest moved and its `look` once per
+digest, so a describe of hers may cost one ask per stale standing, the price
+of a page that is never more than one ask behind.
+
+## The look
+
+Three sides, one describe, and nothing hard-wired for any of them. A being
+who wants to say how she is presented answers one more ask, `look`, with
+values and no more, and every side reads the part it understands. The
+vocabulary is closed, in `beings/look.ts`, and a token that fails its shape
+is dropped, not fixed:
+
+| token                  | shape                                 | a screen                          | a model side               |
+| ---------------------- | ------------------------------------- | --------------------------------- | -------------------------- |
+| name                   | text, no tags                         | her heading                       | nothing                    |
+| logo                   | an image as a data URI, never a URL   | beside the heading                | nothing                    |
+| accent, background, fg | hex colours                           | CSS variables on her section only | nothing                    |
+| font                   | a font stack, plain characters        | her section                       | nothing                    |
+| radius                 | 0 to 40                               | her corners                       | nothing                    |
+| order                  | her ask names                         | which come first                  | tool order                 |
+| asks.NAME.title        | text                                  | the button                        | the tool's title           |
+| asks.NAME.icon         | one short string                      | on the button                     | nothing                    |
+| asks.NAME.readOnly     | boolean                               | run on open, nothing to type      | `readOnlyHint`             |
+| asks.NAME.destructive  | boolean                               | ask once more                     | `destructiveHint`          |
+| asks.NAME.idempotent   | boolean                               | offer a retry after silence       | `idempotentHint`           |
+
+A look is not capability: it is never in a blueprint or a digest, Quo never
+sees it, and a being without one renders and lists exactly as before. The
+`look` ask itself is presentation and is neither a form nor a tool. A
+carrier keeps each standing's look beside her asks in the notes, so acme's
+section on the human's page is painted as acme asked, inside that section
+and nowhere else. No token can carry a URL, a stylesheet or code, so a far
+being cannot paint over the page or reach a server through it. A being who
+marks an ask read-only and then writes has lied to her own page, and nothing
+enforces it, the way nothing enforces that her empty ask is safe to repeat.
+
 ## Asks only
 
 There is no listening in Quo, and none under `packages/dock/`. A being who wants
@@ -219,8 +319,8 @@ whenever something happens. An event is an ask in the other direction, and
 it is the same act next door and across planets; only latency and
 reachability change. It follows that two beings never share memory, not
 even in one ward: a callback, a stream or a bus between them is a link that
-breaks the day one of them moves, and Quo exists so that nothing breaks
-when a being moves.
+breaks the day one of them is somewhere else, and Quo exists so that nothing
+breaks when she is. Only a ward moves; a being is placed once, at boot.
 
 Two consequences every side obeys:
 
@@ -258,22 +358,48 @@ thin as one call. Every route ends the same way:
 1. The route authenticates by its own means. Password, passkey, OAuth, a
    bearer token from a client, a nonce from a local process.
 2. The route asks the front desk `device({ proof })` and receives an
-   invitation.
+   invitation. Which desk is which world: a harbor holds many wards, and
+   the human chooses the world at the allow page when there is more than
+   one; the grant remembers it.
 3. The route hands the invitation to the avatar it is about to boot, or to
    the one already booted for this client identity if it is a reconnect, in
    which case nothing is handed and the existing standing is used.
 4. The avatar knocks. The heir dies. From here there is no token anywhere.
 
-The human decides one more thing at step 1, on the same page that names
-the identity: whether this device may **wake** the human's other devices.
-The word travels with the proof, the user being writes it as a note on the
-occupant she mints, and her gate reads the note: `push` is shown to the
-desk and to a device with that note, and to nobody else. A device that may
-wake can hand an agent an event through the user being, and she sees who
-did. The note is written when the occupant is minted; to change it, remove
-the occupant and allow again, because reconnect mints nothing.
-
-Tokens, cookies and grants exist for the length of step 1 and are never
+The human decides two more things at step 1, on the same page that names
+the identity: whether this device may **wake** the human's other devices,
+and whether it may **reach** what she holds. Each word travels with the
+proof, the user being writes it as a note on the occupant she mints, and her
+gate reads the note: `push` is shown to the desk and to a device with the
+`wake` note, and her standings are carried for a device with the `reach`
+note, and for nobody else. A device that may wake can hand an agent an event
+through the user being, and she sees who did; a device that may reach sees
+acme on her, and a model sees acme only because the human said it may. The
+notes are written when the occupant is minted; to change one, remove the
+occupant and allow again, because reconnect mints nothing. A device the
+root mints on her directly, with `quo invite`, carries no note: the id the
+root chose is its client identity, and it reaches and may wake, since the
+root owns everything she holds and chose to mint it.
+
+Two proof kinds exist, and each arrives only the one way it is made:
+`local`, a side that reached the daemon's side socket; `web`, a human who
+passed the exchange pages. Each is a nonce the daemon minted for one kind
+and honours once, under that kind alone, so a proof of any other provenance
+names no nonce and is refused. A human at a screen passes no exchange: a
+tab enters by a link, an invitation a user being minted, and nothing is
+ever typed to get in. The root's first device is no exception; the root
+mints its invitation with `quo invite` on the box and opens the link.
+
+The route's own lifetimes, where it speaks OAuth: a pending request and a
+code live ten minutes, an access token one hour, a refresh token thirty
+days. A registered client lives ten minutes, and as long as its refresh
+token once the human allowed it, since the register door is open to anyone
+and what nobody allowed must not stay on disk. A code is spent the first
+time it is offered, right or wrong. The client identity is chosen by the
+human at the allow page and never taken from the client's registration: a
+client may register afresh on every connect, and the avatar outlives that.
+
+Tokens, cookies and grants exist for the length of step 1 above and are never
 stored on a Quo side. Revocation is `occupants.remove(id)` on the user being:
 the client's next ask, under the key the door bound for its avatar, hears
 `removed`, and the side speaks that in its own vocabulary: the MCP route
@@ -283,7 +409,11 @@ answers 401 at the next session and forgets the grant.
 
 One command, `quo`, under `packages/dock/cli/`. It imports the four library exports
 and nothing else, holds no class body, and never speaks to a ward except
-through the ask pointer or an avatar, the two doors everyone has.
+through the ask pointer or an avatar, the two doors everyone has. The
+daemon's folder holds the process and its doors, the two sockets and the
+HTTP listener; each route on that listener lives in the folder whose truth
+it is, `human/web.ts`, `mcp/route.ts`, `harbor/quo.ts`, and the daemon only
+mounts them.
 
 ```
 quo init [--dir D]        mint a seed, boot a harbor and one ward over a disk store, write both
@@ -292,7 +422,7 @@ quo pilot [--dir D] [--via S] the owner pilot over stdio: the ward's describe as
 quo side [--dir D] --as NAME  an avatar over stdio for a local client; NAME is the client identity
 quo run [--dir D] --as NAME --url URL --model NAME  a human at a terminal talking to a model through an avatar; a line in, the final text out
 quo census [--dir D]      print the census once and exit
-quo boot|public|invite|knock|remove  the five owner asks from a shell, for scripts and for agents under cron; --via S sends them to another ward
+quo boot|public|invite|knock|remove|unboot  the six owner asks from a shell, for scripts and for agents under cron; --via S sends them to another ward
 quo reach <pk> <url>      a hint for the harbor's directory: that world's ward lives at that quo. route
 quo estate <dir> --domain D  an estate folder of the shape every estate has: a droplet's quo directory, its unit and Caddyfile, a package on this dock
 ```
@@ -393,8 +523,8 @@ to be decided.
 
 ## Generality
 
-Six general pieces exist under `packages/dock/`, and everything concrete is an
-implementation of one of them. An estate implements none of them: it holds
+Eight general pieces exist under `packages/dock/`, and everything concrete is
+an implementation of one of them. An estate implements none of them: it holds
 class bodies and placement, and reaches every piece through the dock.
 
 | piece        | one interface for                          | implementations                                  |
@@ -405,6 +535,8 @@ class bodies and placement, and reaches every piece through the dock.
 | side         | an avatar speaking to someone outside      | screen, MCP server, runner, agent                |
 | proof        | turning a credential into an invitation    | one verifier, a daemon nonce, three kinds        |
 | envoy        | a non-Quo surface as a being               | none built: a name until its first user          |
+| carrier      | a being showing her standings as her own   | the user being; any estate being that extends it |
+| look         | how a being is presented, as values        | read by the screen and the model side            |
 
 Two rules keep them general:
 
@@ -415,8 +547,8 @@ Two rules keep them general:
 
 Harbor core, reach and store held across three terrains and moved into
 `packages/quo/src` with `packages/quo/SPEC.md` in the same commit on 2026-09-04;
-what stays here of them is each terrain's store, loader, lease and listener. The
-other three are dock conventions and stay here.
+what stays here of them is each terrain's store, loader, lease and listener.
+The other five are dock conventions and stay here.
 
 ## Invariants
 
@@ -444,8 +576,11 @@ other three are dock conventions and stay here.
 
 ## Where the dock stands
 
-The one place under `packages/dock/` where a gap between these documents and the
-folders is named. Each line is a debt to close, not a note to keep.
+The one place under `packages/dock/` where a gap between these documents and
+the folders is named. Each line is a debt to close, not a note to keep.
+
+No gap today. Everything these documents describe is in the folders and on
+the machines, and MCP is complete.
 
 Two rules hold:
 
@@ -459,262 +594,12 @@ Two rules hold:
   keep in step with every change, and the vectors under `packages/quo/vectors/`
   are the hand that will be extended when the time comes.
 
-The order of work, each step usable on its own and each proving a sentence
-above or sending us back to fix it:
-
-1. Done. `packages/dock/` scaffold: its own package linking the library, the
-   four exports only, `check:dock` in the root gate, the terrain test pointed at
-   `packages/dock/beings`. The disk harbor in `packages/dock/harbor/disk.ts`:
-   one folder per ward holding seed, partition and the class source, a ward
-   record, the lease, and a save after every call. The `quo` CLI: init, serve,
-   census, boot, invite, knock, over the daemon's unix socket. Pilot and side
-   landed at steps 4 and 5.
-2. Done. The beings in `packages/dock/beings/`: `User`, `Desk`, `Avatar`, proven
-   on the memory harbor in `packages/dock/test/beings.test.ts`. A fake proof
-   becomes an invitation the user being minted, the avatar knocks and takes
-   her, and her tool list equals the user being's describe for her;
-   reconnect mints nothing; two clients see two tool lists; a push is a
-   reverse ask that reaches the side; remove is revocation. The ids that
-   carry the conventions: the desk is the occupant the root named `desk`
-   at the user being; the desk holds each user being as `user:<name>`; the
-   user being holds each device's way back as `to:<client>`; the avatar
-   holds the user being as `user` and is pushed to as `user:push`, two ids
-   because standings and occupants share one namespace.
-3. Done. The side in `packages/dock/beings/side.ts`: a function of the avatar
-   that runs until closed, and `word`, which tells the three words and the
-   object apart before any side renders them. The MCP server in
-   `packages/dock/mcp/server.ts`, proven over the SDK's in-memory transport in
-   `packages/dock/test/mcp.test.ts`: tools/list is her describe spoken as tools,
-   tools/call is a named ask, an object is a result, an error object and
-   the two words are error results with the text the trunk gives them, a
-   push is a logging notification, and a session closing and opening
-   reuses the standing. The SDK is the dock's first dependency, under
-   `packages/dock/` alone.
-4. Done. `quo side --as NAME` over stdio, proven in
-   `packages/dock/test/cli.test.ts` with the SDK's stdio client as a child
-   process: the daemon finds or boots
-   `avatar:NAME`, enters her with a nonce the desk honours once, and runs
-   the model side beside her; the tool list is the user being's describe
-   for that client; a second start is a reconnect and mints nothing; a
-   `local` proof from anywhere else is refused. `quo init` now does the
-   root's setup, the desk public and one user being named by `--user`, so
-   a fresh folder is a world. Claude Code and Claude Desktop on the Mac
-   need only `quo serve` running and `quo side --as claude` as the server
-   command: no droplet, no OAuth.
-5. Done. `quo pilot` in `packages/dock/mcp/pilot.ts`, proven in
-   `packages/dock/test/cli.test.ts` with the SDK's stdio client as a child
-   process: the model side of step 3 over the ward's owner asks, the
-   ward's describe as tools and no list of its own, each call an owner ask
-   on the daemon's root socket, and nothing logged. It is the root and not
-   an avatar: nothing is booted for it and no occupant is minted for it.
-   With no daemon it says so and exits. Claude Code as the owner is
-   `claude mcp add` with `quo pilot` as the command.
-6. Done. `quo serve --http PORT`: the HTTP door on loopback, `/health`
-   naming the wards, routes mounting by path so a hostname on the proxy is
-   a path on the daemon; proven in `packages/dock/test/cli.test.ts`. The systemd
-   unit and the Caddyfile are in `estates/lab/droplet/`. Disk store, the
-   lease and reboot from disk with relations intact were steps 1 and 4.
-7. Done. OAuth on the `mcp.` route in `packages/dock/mcp/oauth.ts`, mounted by
-   the daemon when `<dir>/routes.json` names the two public origins, and
-   proven over real HTTP in `packages/dock/test/oauth.test.ts`: metadata,
-   protected-resource metadata, dynamic registration, PKCE with S256, the
-   code grant, refresh with rotation, opaque tokens mapping a bearer to a
-   client identity, revoke by identity, and expiry. The conventions pinned
-   here: a pending request and a code live ten minutes, an access token
-   one hour, a refresh token thirty days; a registered client lives ten
-   minutes, and as long as its refresh token once the human allowed it,
-   since the register door is open to anyone and what nobody allowed must
-   not stay on disk; a code is spent the first time
-   it is offered, right or wrong; the client identity is chosen at the
-   allow page, not taken from the client's registration, because a client
-   like claude.ai registers a fresh client id on every connect and the
-   avatar must outlive that. The store is `<dir>/oauth.json`, the route's
-   own, mode 0600, and holds no secret of Quo's.
-8. Done. The exchange pages in `packages/dock/mcp/web/exchange.ts`, mounted on
-   the web route, proven over real HTTP in `packages/dock/test/web.test.ts`.
-   Login checks `QUO_OWNER_PASSWORD` in constant time and sets a signed
-   session cookie that lives ten minutes, the life of a request; with no
-   password set the exchange is closed. Allow names the client, where it
-   returns to, and the identity it will be, suggested from the client's
-   name and editable, one word and not the user or the desk. Allow admits
-   her through the one path every side uses: find or boot the avatar,
-   enter with a nonce the desk honours once under the `web` proof kind,
-   then complete the OAuth request with that identity. Deny sends the
-   client `access_denied`. Two pages, hand-written, rendering no blueprint.
-9. Done. The MCP endpoint in `packages/dock/mcp/http.ts` at `/mcp` on the mcp
-   route: streamable HTTP, a bearer names the identity, the identity names
-   her avatar through the same admit path, the side from step 3 runs
-   beside her, one session per connection, a session belonging to the
-   identity that opened it. Proven in `packages/dock/test/http.test.ts` with the
-   SDK's streamable HTTP client over the whole exchange. MCP is complete:
-   every human-assisted case on every device, with nothing of Quo's
-   crossing a machine.
-10. Done. The runner in `packages/dock/mcp/runner.ts`: the second side, an MCP
-    client written inline for a model that speaks function calling. Her
-    describe is a tools array, a tool call is a named ask, the three words
-    are tool messages, a line from the human or a push from the user being
-    starts a turn, and turns never overlap. Proven in
-    `packages/dock/test/runner.test.ts` over a scripted endpoint on loopback, and
-    live against Qwen3 Coder 30B in LM Studio on the Mac, which read her
-    describe, called `whoami` through the gate and answered with the id she
-    minted. What it taught: LM Studio refuses a parameters schema with no
-    `properties`, so the runner is where a describe is narrowed for an
-    endpoint, and nowhere else.
-11. Done. The agent side in `packages/dock/mcp/agent.ts`: the world is the loop.
-    A push from the user being is acknowledged at once by her `notify`,
-    lands in her inbox, which is the queue in her cells, and the side runs
-    it, one event at a time in order, then asks the user being back with
-    `report({ event, result })`, the ask this step added to her, gated to
-    devices. A run is a function of the event or a process in the agent's
-    folder with the event as its last argument, which is what `claude -p`
-    is. Proven in `packages/dock/test/agent.test.ts` with a fake run and a fake
-    process: the ask is answered before the run ends, a throw reports an
-    error object, and events that came while no side was up run when one
-    comes up. What it decided: the queue lives in the partition and not in
-    the side, so a restart loses nothing but the one run in flight. On a
-    device, `<dir>/agents.json` names each agent's identity, command and
-    folder, and the daemon admits her on the local proof and runs her side
-    beside her avatar; proven in the same suite over a disk harbor.
-12. The `quo.` route: Done. The reach interface with request and socket, since
-    the library move `packages/quo/src/harbor/reach.ts`, the disk harbor holds
-    the directory, and the daemon mounts `/quo` and dials with `--dial`. The
-    library's conformance suite passed untouched over two disk harbors on
-    loopback under both reaches, and the rendezvous carried a knock from a third
-    harbor to a dialer through its listener; `packages/dock/test/wire.test.ts`.
-    Live: a Mac daemon dialed `quo.lab.quo.systems`, an avatar there knocked at
-    the lab's user being across the internet, the lab knocked back over the held
-    socket and took `to:mac`, and a push from the lab landed in her inbox on the
-    Mac. What it taught: the proxy rewrites the route root with a trailing
-    slash, and a ward pk is 64 bytes on the wire;
-    `packages/dock/harbor/quo-harbor.md` has both.
-13. The browser harbor: Done. Harbor core carved out of the disk harbor
-    into a core of its own, since the library move `packages/quo/src/harbor/core.ts`,
-    the store a piece with files and IndexedDB under it, the dialer its
-    own terrain-free piece, the socket reach on the standard surface.
-    `packages/dock/harbor/browser.ts` is the core in a tab: IndexedDB, a web lock
-    for the lease, one socket per world.
-    The library's conformance suite passed untouched inside a real
-    Chromium against two browser harbors in one tab through a daemon on
-    loopback, migration between two databases included;
-    `packages/dock/test/terrain/browser.test.ts`, behind `check:terrain`. And the
-    first screen, `packages/dock/human/tab.ts`, rudimentary on purpose: a page on
-    the web route that boots a harbor in the tab, takes the owner password
-    once under the `tab` proof kind, and renders her describe as buttons,
-    with pushes landing on the page; a reload asks nothing. What it taught:
-    a tab's store keeps values through JSON because the cells guard refuses
-    structured clone; a side in a tab saves after the exchange and after
-    every call, as the daemon does; and a dialed socket is the fallback
-    from the moment it is dialed, because a ward asks the instant it boots.
-14. Owners at the door in the CLI: Done. The root socket takes `via`, a
-    standing the user being holds at another ward, and the daemon asks on
-    it in-process and saves; `quo pilot` and the bare owner asks take
-    `--via S`. Scene 8 on two daemons over a dialed socket in
-    `packages/dock/test/cli.test.ts`: the far root invites on its ward's pk, the
-    user being here knocks and takes `lab`, census and boot land there,
-    invite on the far pk is refused at the door, the standing survives a
-    restart, and the owner removed meets silence. What it taught: the
-    library had no owner ask that removes an owner, and the test reached
-    into the ward's cells; the word is `remove` now, decided in `packages/quo/SPEC.md`
-    at step 16.
-15. The human side, minimal: Done. Three pieces under `packages/dock/human/`:
-    `html.ts`, pure, a schema as a form, a form back as typed arguments,
-    an answer as a view, the three words with faces; `screen.ts`, the side
-    over a surface that can only show a page and hand back a form,
-    re-asking her describe after every call so the page follows the
-    digest; `dom.ts`, the surface on an element. The tab keeps its harbor
-    and exchange and hands the avatar to the side. Proven on the memory
-    harbor with a fake surface in `packages/dock/test/human.test.ts`, and in
-    Chromium behind `check:terrain`. Minimal on purpose: design, a
-    switcher, the guest's page and the native app are left to the human
-    document's own sitting, and none of them blocks a world from having
-    a screen.
-16. Removing: Done. `packages/quo/SPEC.md` gave the owner its fourth ask, `remove`,
-    the mirror of knock: a relation out of a being by id, occupant or
-    standing, and on the ward's own pk an owner, by the root alone. In
-    `packages/quo/src/ward/owner.ts` with its test; the pilot's fourth tool; `quo
-    remove` from the shell, the same word; the step 14 test asks it
-    instead of reaching into the cells. The lab's leftovers went with it,
-    recorded in `estates/lab/lab.md`.
-17. What the lab wants: Done. A launchd agent beside the systemd unit in
-    `estates/lab/droplet/`, the daemon as the user forever with
-    `~/.quo/dial.json` naming the routes it holds a socket to, installed
-    on the operator's Mac against the lab. And `quo run`: the runner from
-    a terminal, the same pipe as `quo side` with a model named in the
-    hello, the daemon running the runner beside the avatar, a line in a
-    turn and the final text a line out, proven with a scripted endpoint
-    as a child process in `packages/dock/test/cli.test.ts`. The gate profile per
-    client identity the road lists is defined nowhere and was not built.
-18. The edge terrain: Done. `packages/dock/harbor/edge/`, the core over a Durable
-    Object: its storage the store with the seed sealed under a platform
-    secret, the deployed worker the code, the object the lease; reached by
-    request, holding dialers' sockets, the root a route under a platform
-    secret. The conformance suite passed untouched inside the platform's
-    runtime, behind `check:terrain`; deployed to the lab's account and
-    piloted from the Mac over a standing, `--via edge`. The third terrain
-    the library move waited for; the `ws` question answered in the harbor
-    document. `estates/lab/lab.md` keeps the record, one slip included.
-
-19. The split: Done. The estate folder became the dock, the lab's own
-    things moved to `estates/lab/`, and the dock's package took its name.
-    Then the repository took the shape that says what ships by where it
-    lives: `packages/quo/` and `packages/dock/` are the two published
-    packages, `estates/` is private, and the root is nobody's package, the
-    workspaces and the gate. The lab is an estate folder of the shape this
-    document names, one folder per harbor, and `estates/lab/test/boot.test.ts`
-    is invariant 12 proven: a copy of the folder, the two packages installed
-    into it and nothing else, and the droplet boots. The lab redeployed
-    from it: the droplet from a clean export of HEAD with its unit copied
-    from the estate's folder, the edge from the estate's own config
-    resolving the dock's worker by name, the Mac's agent on the new path.
-    What it taught: a nested npm under `npm run` inherits the outer run's
-    local prefix by environment and installs into the repository instead
-    of the empty folder, so the stranger tests keep nothing of it; and
-    `npx` in a workspace runs at the package root, so an estate names its
-    edge config from its own folder.
-20. The dock published: Done. `@quo-systems/dock` 0.1.0, the same shape
-    the library took, an emitted `dist/` with the `quo` command pointing
-    into it, the source and the four documents beside it, and
-    `packages/dock/test/package.test.ts` as the one suite that meets it as
-    an adopter: the library's tarball and this one installed into an empty
-    folder with nothing but Node, then `quo init`, a daemon, and
-    `quo census` answering with the desk and the user being. The library
-    went to 0.2.0 first, since the door's words moved the wire. What it
-    decided: the daemon bundles the tab from beside itself, emitted or
-    source, whichever is there, the one place the dock reads a file by
-    path at run time.
-
-21. A second estate: Done, and live. `estates/gherghina/`,
-    staging like the lab and nothing more, one harbor on the shared droplet
-    `nervur-staging-0`, routes under `gherghina.quo.systems`, no agents and
-    no classes of its own yet, the same unit and Caddyfile shape as the
-    lab's. It is the first proof that the dock has two users: its folder
-    depends on the dock alone, and `estates/gherghina/test/boot.test.ts`
-    runs the one proof every estate here runs, `estates/proof.ts`, shared
-    between them and shipped nowhere. The three staging droplets are shared
-    by every estate in this repository, and none of them is production or
-    holds real data. Its droplet stood up the same day, its document says
-    how; what it taught went into both estates' units: the agent's folders
-    are optional to the daemon, since a harbor may have no agent.
-
-22. The scaffold: Done. `quo estate <dir> --domain D` writes an estate
-    folder of the shape the two estates here agreed on: a package file
-    depending on this dock and nothing else, one document to fill in, and
-    `droplet/` as the first harbor, its routes under the domain, no
-    agents, no classes of its own, and that device's unit and Caddyfile
-    from templates the dock ships beside its command. The unit it writes
-    runs the installed dock from the estate's folder on the box, since an
-    adopter has no tree there; the two estates here run the tree. Proven
-    in `packages/dock/test/cli.test.ts`: the folder is written, refuses to
-    overwrite a package or take a name that is no domain, and its droplet
-    boots, `quo init` into it and a daemon answering the census.
-
-Steps 1 to 22 are in the tree and on the machines, and MCP is complete;
-the documents and the folders agree up to step 22. There is no gap named
-today. `next.md` is where the next sitting starts.
+`next.md` is where the next sitting starts.
 
 ## Glossary
 
 - **avatar**: a being that is someone's voice from outside Quo.
+- **carrier**: a being who shows her standings' asks as her own and forwards.
 - **client identity**: what a credential exchange establishes; one avatar.
 - **envoy**: a being whose methods call a non-Quo thing.
 - **dock**: what every estate needs and nobody writes twice, `packages/dock/`,
@@ -725,6 +610,7 @@ today. `next.md` is where the next sitting starts.
 - **front desk**: the being every fresh client meets; hands out invitations
   minted by user beings.
 - **gate**: `for(occupant, asker)`; the whole permission model.
+- **look**: how a being is presented, as values; one optional ask.
 - **owner pilot**: `quo pilot`, the model side over a ward's owner asks, reaching
   the daemon's socket; with `--via`, a ward elsewhere through a standing.
 - **daemon**: `quo serve`, the one process on a device that holds a harbor.

package/beings/side.ts

@@ -6,13 +6,22 @@
 // a screen, an MCP server, a runner, an event-driven agent. None knows
 // another exists, and none of this file names a platform.
 import { isSilence, isUnreached, isWord, wordOf } from '@quo-systems/quo';
-import type { Answer, Json, JsonObject, WordName } from '@quo-systems/quo';
+import type { Answer, Blueprint, Json, JsonObject, Wanted, WordName } from '@quo-systems/quo';
 import type { Avatar } from './avatar.ts';
 
 // A side, running: it holds the avatar until closed.
 export type Serving = { close(): Promise<void> };
 export type Side = (avatar: Avatar) => Promise<Serving>;
 
+// What a side speaks for: the empty ask and a named one, and the ears a
+// push reaches. An avatar on her one standing is one; the owner's asks on a
+// ward are another; a guest at a world's public being is a third.
+export type Subject = {
+  tools(): Promise<Blueprint | { error: string }>;
+  call(name: string, args?: JsonObject, wanted?: Wanted): Promise<Answer>;
+  ears: Set<(object: JsonObject) => void>;
+};
+
 // The three words for "no object", and the object itself, as every side must
 // tell them apart before rendering. An error object is an ordinary answer
 // that the side may mark; silence and unreached are not objects at all.