@receiz/ai-skills 124.0.0 → 124.0.2

package/receiz-portable-continuity/manifest.json

@@ -1,7 +1,7 @@
 {
   "schema": "receiz.ai-skill-contract.v124",
   "name": "receiz-portable-continuity",
-  "version": "124.0.0",
+  "version": "124.0.2",
   "requires": {
     "sdk": ">=124.0.0 <125.0.0",
     "mcp": ">=124.0.0 <125.0.0",
@@ -1238,5 +1238,217 @@
     "receiz_v123_auth_granted_scopes"
   ],
   "releaseTheme": "Reality Becomes Infrastructure",
-  "releaseFrame": "The Production Runtime for Verified Civilization"
+  "releaseFrame": "The Production Runtime for Verified Civilization",
+  "currentMcpV124Tools": [
+    "receiz_v124_kai_now",
+    "receiz_v124_proof_authority_challenge_create",
+    "receiz_v124_execution_plan_atomic_operation",
+    "receiz_v124_execution_stage",
+    "receiz_v124_execution_stage_prepared",
+    "receiz_v124_execution_execute",
+    "receiz_v124_execution_resolve",
+    "receiz_v124_execution_resolve_by_idempotency",
+    "receiz_v124_execution_cancel",
+    "receiz_v124_runtime_authority_session_open",
+    "receiz_v124_runtime_authority_session_refresh",
+    "receiz_v124_runtime_authority_session_close",
+    "receiz_v124_runtime_qualify",
+    "receiz_v124_domain_verified_additions",
+    "receiz_v124_domain_verified_replay",
+    "receiz_v124_domain_verified_checkpoint",
+    "receiz_v124_domain_verified_private_additions",
+    "receiz_v124_domain_replay_proof_object_export",
+    "receiz_v124_domain_replay_proof_object_restore",
+    "receiz_v124_subject_namespaces_resolve",
+    "receiz_v124_identity_public_recipient_resolve",
+    "receiz_v124_source_publish_sealed"
+  ],
+  "currentMcpTools": [
+    "receiz_artifact_verify",
+    "receiz_artifact_admit",
+    "receiz_artifact_append_plan",
+    "receiz_artifact_transition_seal_and_stage",
+    "receiz_artifact_transition_commit",
+    "receiz_artifact_global_resolve",
+    "receiz_artifact_reconcile_plan",
+    "receiz_artifact_reconcile_stage",
+    "receiz_artifact_reconcile_commit",
+    "receiz_subject_resolve",
+    "receiz_subject_state",
+    "receiz_subject_history",
+    "receiz_subject_memory_query",
+    "receiz_subject_relationships",
+    "receiz_subject_inventory",
+    "receiz_subject_twin_profile",
+    "receiz_subject_twin_message",
+    "receiz_subject_twin_mind_export",
+    "receiz_subject_twin_mind_import_plan",
+    "receiz_subject_mandate_get",
+    "receiz_subject_mandate_plan",
+    "receiz_subject_mandate_activate",
+    "receiz_subject_mandate_pause",
+    "receiz_subject_mandate_revoke",
+    "receiz_world_additions",
+    "receiz_world_command_plan",
+    "receiz_world_command_validate",
+    "receiz_world_command_execute",
+    "receiz_world_transaction_plan",
+    "receiz_world_transaction_execute",
+    "receiz_world_receipt",
+    "receiz_world_replay",
+    "receiz_subject_runtime_enqueue",
+    "receiz_subject_runtime_status",
+    "receiz_subject_runtime_cancel",
+    "receiz_living_subject_conformance",
+    "receiz_subject_brain_head",
+    "receiz_subject_brain_search",
+    "receiz_subject_brain_resolve",
+    "receiz_subject_brain_stream",
+    "receiz_bearer_transfer_preview",
+    "receiz_bearer_instrument_issue",
+    "receiz_bearer_instrument_inspect",
+    "receiz_bearer_instrument_claim",
+    "receiz_bearer_transfer_cancel",
+    "receiz_bearer_transfer_status",
+    "receiz_v122_subject_admit",
+    "receiz_v122_subject_state",
+    "receiz_v122_subject_export_edge_bundle",
+    "receiz_v122_subject_import_edge_bundle",
+    "receiz_v122_subject_access_binding",
+    "receiz_v122_subject_access_key_publish",
+    "receiz_v122_world_plan_private",
+    "receiz_v122_world_validate_transaction",
+    "receiz_v122_world_execute_transaction",
+    "receiz_v122_world_execution",
+    "receiz_v122_world_execution_by_idempotency",
+    "receiz_v122_world_additions",
+    "receiz_v122_mandate_issue",
+    "receiz_v122_mandate_state",
+    "receiz_v122_mandate_revoke",
+    "receiz_v122_multi_world_plan",
+    "receiz_v122_multi_world_execute",
+    "receiz_v122_value_plan_settlement",
+    "receiz_v122_value_plan_reserve",
+    "receiz_v123_world_plan_command_v122",
+    "receiz_v123_world_plan_transaction_v122",
+    "receiz_v123_value_execute_settlement",
+    "receiz_v123_value_execute_reserve",
+    "receiz_v123_value_execution_by_idempotency",
+    "receiz_v123_subject_resolve_namespaces",
+    "receiz_v123_identity_exchange_proof_authority",
+    "receiz_v123_auth_granted_scopes",
+    "receiz_v124_kai_now",
+    "receiz_v124_proof_authority_challenge_create",
+    "receiz_v124_execution_plan_atomic_operation",
+    "receiz_v124_execution_stage",
+    "receiz_v124_execution_stage_prepared",
+    "receiz_v124_execution_execute",
+    "receiz_v124_execution_resolve",
+    "receiz_v124_execution_resolve_by_idempotency",
+    "receiz_v124_execution_cancel",
+    "receiz_v124_runtime_authority_session_open",
+    "receiz_v124_runtime_authority_session_refresh",
+    "receiz_v124_runtime_authority_session_close",
+    "receiz_v124_runtime_qualify",
+    "receiz_v124_domain_verified_additions",
+    "receiz_v124_domain_verified_replay",
+    "receiz_v124_domain_verified_checkpoint",
+    "receiz_v124_domain_verified_private_additions",
+    "receiz_v124_domain_replay_proof_object_export",
+    "receiz_v124_domain_replay_proof_object_restore",
+    "receiz_v124_subject_namespaces_resolve",
+    "receiz_v124_identity_public_recipient_resolve",
+    "receiz_v124_source_publish_sealed",
+    "receiz_doctor",
+    "receiz_capabilities",
+    "receiz_required_scopes",
+    "receiz_authorize_url",
+    "receiz_mcp_login",
+    "receiz_ensure_tenant_session",
+    "receiz_app_state_publish",
+    "receiz_app_state_resolve",
+    "receiz_app_state_by_url",
+    "receiz_app_state_by_creator",
+    "receiz_app_state_by_namespace",
+    "receiz_app_state_by_id",
+    "receiz_public_store_publish",
+    "receiz_public_store_resolve",
+    "receiz_inspect_offline_file",
+    "receiz_asset_by_url",
+    "receiz_material_url_open",
+    "receiz_sealed_kai_moment",
+    "receiz_asset_by_id",
+    "receiz_pitch_proof_by_witness_id",
+    "receiz_card_history",
+    "receiz_transfer_preview",
+    "receiz_transfer_requires_confirmation",
+    "receiz_pack_open_preview",
+    "receiz_marketplace_template_generate",
+    "receiz_webhook_events_catalog",
+    "receiz_webhook_register_endpoint",
+    "receiz_webhook_rotate_secret",
+    "receiz_webhook_send_test_event",
+    "receiz_webhook_receiver_scaffold",
+    "receiz_webhook_verify_payload",
+    "receiz_inspect_proof_object",
+    "receiz_wallet_public_ledger",
+    "receiz_action_ledger",
+    "receiz_sports_conformance",
+    "receiz_world_public_snapshot",
+    "receiz_proof_query",
+    "receiz_sandbox_seed_store",
+    "receiz_sandbox_checkout",
+    "receiz_runtime_blueprint",
+    "receiz_project_inspect",
+    "receiz_app_contract_create",
+    "receiz_app_plan",
+    "receiz_app_apply",
+    "receiz_app_check",
+    "receiz_app_upgrade",
+    "receiz_app_explain",
+    "receiz_app_repair",
+    "receiz_proof_trace",
+    "receiz_webhook_replay",
+    "receiz_scope_explain",
+    "receiz_release_qualify",
+    "receiz_architecture_inspect",
+    "receiz_domain_scaffold",
+    "receiz_command_scaffold",
+    "receiz_law_define",
+    "receiz_law_explain",
+    "receiz_law_coverage",
+    "receiz_authority_inspect",
+    "receiz_command_simulate",
+    "receiz_receipt_replay",
+    "receiz_history_trace",
+    "receiz_merge_simulate",
+    "receiz_bypass_scan",
+    "receiz_conformance_run",
+    "receiz_release_verify",
+    "receiz_mcp_execute_command",
+    "receiz_mcp_append_event",
+    "receiz_mcp_verify_receipt",
+    "receiz_mcp_commit_atomic_projection"
+  ],
+  "currentMcpV122Tools": [
+    "receiz_v122_subject_admit",
+    "receiz_v122_subject_state",
+    "receiz_v122_subject_export_edge_bundle",
+    "receiz_v122_subject_import_edge_bundle",
+    "receiz_v122_subject_access_binding",
+    "receiz_v122_subject_access_key_publish",
+    "receiz_v122_world_plan_private",
+    "receiz_v122_world_validate_transaction",
+    "receiz_v122_world_execute_transaction",
+    "receiz_v122_world_execution",
+    "receiz_v122_world_execution_by_idempotency",
+    "receiz_v122_world_additions",
+    "receiz_v122_mandate_issue",
+    "receiz_v122_mandate_state",
+    "receiz_v122_mandate_revoke",
+    "receiz_v122_multi_world_plan",
+    "receiz_v122_multi_world_execute",
+    "receiz_v122_value_plan_settlement",
+    "receiz_v122_value_plan_reserve"
+  ]
 }

package/receiz-proof-authority/SKILL.md

@@ -16,7 +16,7 @@ The object is authority. An application may exchange explicit consent bound to a
 5. Keep the returned bearer capability short-lived, non-refreshable, secret, and confined to the application and granted scopes.
 6. Use granted-scope introspection before planning or executing a protected operation.
 
-Read the [SDK map](references/sdk-map.md) for exact method boundaries.
+Read the [SDK map](references/sdk-map.md) and [MCP map](references/mcp-map.md) for exact method, scope, and custody boundaries.
 
 ## Machine contract
 
@@ -25,6 +25,9 @@ The edge performs independent verification and remains usable with its proof obj
 ## Quick reference
 
 - Exchange: `client.identity.exchangeProofAuthority(...)`
+- Live Kai: `receizKaiNow()`
+- Canonical challenge: `createReceizProofAuthorityChallenge(...)`
+- Session: `client.runtime.openAuthoritySessionV124(...)`, `refreshAuthoritySessionV124(...)`, `closeAuthoritySessionV124(...)`
 - Rail scopes: `client.auth.scopesForRails(...)`
 - Granted scopes: `client.auth.grantedScopes(...)`
 - Redirect requirement: none; the consent ceremony remains inside the developer's application.
@@ -35,6 +38,7 @@ The edge performs independent verification and remains usable with its proof obj
 - Requesting broad scopes rather than minimum scopes.
 - Moving proof verification entirely to the server.
 - Persisting a bearer capability as durable identity or attempting to refresh it.
+- Reconstructing an authority session from MCP JSON rather than resolving a local or trusted-host-persisted reference through the canonical SDK/server verification path.
 
 ## Completion refusal
 

package/receiz-proof-authority/manifest.json

@@ -1,7 +1,7 @@
 {
   "schema": "receiz.ai-skill-contract.v124",
   "name": "receiz-proof-authority",
-  "version": "124.0.0",
+  "version": "124.0.2",
   "requires": {
     "sdk": ">=124.0.0 <125.0.0",
     "mcp": ">=124.0.0 <125.0.0",
@@ -12,16 +12,32 @@
   "laws": [
     "receiz.identity.object-authority.v123",
     "receiz.identity.explicit-consent.v123",
-    "receiz.identity.minimum-scope.v123"
+    "receiz.identity.minimum-scope.v123",
+    "receiz.runtime.proof-object-storage-authority.v124",
+    "receiz.time.live-kai-genesis-phi-bridge.v124",
+    "receiz.runtime.authenticated-request-bound-response.v124",
+    "receiz.runtime.operational-capability-evidence.v124"
   ],
   "sdkOperations": [
+    "receizKaiNow",
+    "createReceizProofAuthorityChallenge",
     "identity.exchangeProofAuthority",
+    "runtime.openAuthoritySessionV124",
+    "runtime.refreshAuthoritySessionV124",
+    "runtime.closeAuthoritySessionV124",
+    "runtime.qualifyV124",
     "auth.scopesForRails",
     "auth.missingScopesForRails",
     "auth.canUseRails",
     "auth.grantedScopes"
   ],
   "allowedTools": [
+    "receiz_v124_kai_now",
+    "receiz_v124_proof_authority_challenge_create",
+    "receiz_v124_runtime_authority_session_open",
+    "receiz_v124_runtime_authority_session_refresh",
+    "receiz_v124_runtime_authority_session_close",
+    "receiz_v124_runtime_qualify",
     "receiz_v123_identity_exchange_proof_authority",
     "receiz_v123_auth_granted_scopes"
   ],
@@ -51,7 +67,11 @@
     "verified-exact-artifact-bytes",
     "signed-application-bound-challenge",
     "explicit-consent",
-    "registered-scope-containment"
+    "registered-scope-containment",
+    "live-kai-genesis-derived",
+    "exact-authority-session-scope-containment",
+    "same-runtime-session-custody",
+    "persisted-session-authenticated-recovery"
   ],
   "artifactLawVersion": "124.0.0",
   "artifactLaws": [
@@ -1173,5 +1193,217 @@
     "receiz_artifact_transition_commit"
   ],
   "releaseTheme": "Reality Becomes Infrastructure",
-  "releaseFrame": "The Production Runtime for Verified Civilization"
+  "releaseFrame": "The Production Runtime for Verified Civilization",
+  "currentMcpV124Tools": [
+    "receiz_v124_kai_now",
+    "receiz_v124_proof_authority_challenge_create",
+    "receiz_v124_execution_plan_atomic_operation",
+    "receiz_v124_execution_stage",
+    "receiz_v124_execution_stage_prepared",
+    "receiz_v124_execution_execute",
+    "receiz_v124_execution_resolve",
+    "receiz_v124_execution_resolve_by_idempotency",
+    "receiz_v124_execution_cancel",
+    "receiz_v124_runtime_authority_session_open",
+    "receiz_v124_runtime_authority_session_refresh",
+    "receiz_v124_runtime_authority_session_close",
+    "receiz_v124_runtime_qualify",
+    "receiz_v124_domain_verified_additions",
+    "receiz_v124_domain_verified_replay",
+    "receiz_v124_domain_verified_checkpoint",
+    "receiz_v124_domain_verified_private_additions",
+    "receiz_v124_domain_replay_proof_object_export",
+    "receiz_v124_domain_replay_proof_object_restore",
+    "receiz_v124_subject_namespaces_resolve",
+    "receiz_v124_identity_public_recipient_resolve",
+    "receiz_v124_source_publish_sealed"
+  ],
+  "currentMcpTools": [
+    "receiz_artifact_verify",
+    "receiz_artifact_admit",
+    "receiz_artifact_append_plan",
+    "receiz_artifact_transition_seal_and_stage",
+    "receiz_artifact_transition_commit",
+    "receiz_artifact_global_resolve",
+    "receiz_artifact_reconcile_plan",
+    "receiz_artifact_reconcile_stage",
+    "receiz_artifact_reconcile_commit",
+    "receiz_subject_resolve",
+    "receiz_subject_state",
+    "receiz_subject_history",
+    "receiz_subject_memory_query",
+    "receiz_subject_relationships",
+    "receiz_subject_inventory",
+    "receiz_subject_twin_profile",
+    "receiz_subject_twin_message",
+    "receiz_subject_twin_mind_export",
+    "receiz_subject_twin_mind_import_plan",
+    "receiz_subject_mandate_get",
+    "receiz_subject_mandate_plan",
+    "receiz_subject_mandate_activate",
+    "receiz_subject_mandate_pause",
+    "receiz_subject_mandate_revoke",
+    "receiz_world_additions",
+    "receiz_world_command_plan",
+    "receiz_world_command_validate",
+    "receiz_world_command_execute",
+    "receiz_world_transaction_plan",
+    "receiz_world_transaction_execute",
+    "receiz_world_receipt",
+    "receiz_world_replay",
+    "receiz_subject_runtime_enqueue",
+    "receiz_subject_runtime_status",
+    "receiz_subject_runtime_cancel",
+    "receiz_living_subject_conformance",
+    "receiz_subject_brain_head",
+    "receiz_subject_brain_search",
+    "receiz_subject_brain_resolve",
+    "receiz_subject_brain_stream",
+    "receiz_bearer_transfer_preview",
+    "receiz_bearer_instrument_issue",
+    "receiz_bearer_instrument_inspect",
+    "receiz_bearer_instrument_claim",
+    "receiz_bearer_transfer_cancel",
+    "receiz_bearer_transfer_status",
+    "receiz_v122_subject_admit",
+    "receiz_v122_subject_state",
+    "receiz_v122_subject_export_edge_bundle",
+    "receiz_v122_subject_import_edge_bundle",
+    "receiz_v122_subject_access_binding",
+    "receiz_v122_subject_access_key_publish",
+    "receiz_v122_world_plan_private",
+    "receiz_v122_world_validate_transaction",
+    "receiz_v122_world_execute_transaction",
+    "receiz_v122_world_execution",
+    "receiz_v122_world_execution_by_idempotency",
+    "receiz_v122_world_additions",
+    "receiz_v122_mandate_issue",
+    "receiz_v122_mandate_state",
+    "receiz_v122_mandate_revoke",
+    "receiz_v122_multi_world_plan",
+    "receiz_v122_multi_world_execute",
+    "receiz_v122_value_plan_settlement",
+    "receiz_v122_value_plan_reserve",
+    "receiz_v123_world_plan_command_v122",
+    "receiz_v123_world_plan_transaction_v122",
+    "receiz_v123_value_execute_settlement",
+    "receiz_v123_value_execute_reserve",
+    "receiz_v123_value_execution_by_idempotency",
+    "receiz_v123_subject_resolve_namespaces",
+    "receiz_v123_identity_exchange_proof_authority",
+    "receiz_v123_auth_granted_scopes",
+    "receiz_v124_kai_now",
+    "receiz_v124_proof_authority_challenge_create",
+    "receiz_v124_execution_plan_atomic_operation",
+    "receiz_v124_execution_stage",
+    "receiz_v124_execution_stage_prepared",
+    "receiz_v124_execution_execute",
+    "receiz_v124_execution_resolve",
+    "receiz_v124_execution_resolve_by_idempotency",
+    "receiz_v124_execution_cancel",
+    "receiz_v124_runtime_authority_session_open",
+    "receiz_v124_runtime_authority_session_refresh",
+    "receiz_v124_runtime_authority_session_close",
+    "receiz_v124_runtime_qualify",
+    "receiz_v124_domain_verified_additions",
+    "receiz_v124_domain_verified_replay",
+    "receiz_v124_domain_verified_checkpoint",
+    "receiz_v124_domain_verified_private_additions",
+    "receiz_v124_domain_replay_proof_object_export",
+    "receiz_v124_domain_replay_proof_object_restore",
+    "receiz_v124_subject_namespaces_resolve",
+    "receiz_v124_identity_public_recipient_resolve",
+    "receiz_v124_source_publish_sealed",
+    "receiz_doctor",
+    "receiz_capabilities",
+    "receiz_required_scopes",
+    "receiz_authorize_url",
+    "receiz_mcp_login",
+    "receiz_ensure_tenant_session",
+    "receiz_app_state_publish",
+    "receiz_app_state_resolve",
+    "receiz_app_state_by_url",
+    "receiz_app_state_by_creator",
+    "receiz_app_state_by_namespace",
+    "receiz_app_state_by_id",
+    "receiz_public_store_publish",
+    "receiz_public_store_resolve",
+    "receiz_inspect_offline_file",
+    "receiz_asset_by_url",
+    "receiz_material_url_open",
+    "receiz_sealed_kai_moment",
+    "receiz_asset_by_id",
+    "receiz_pitch_proof_by_witness_id",
+    "receiz_card_history",
+    "receiz_transfer_preview",
+    "receiz_transfer_requires_confirmation",
+    "receiz_pack_open_preview",
+    "receiz_marketplace_template_generate",
+    "receiz_webhook_events_catalog",
+    "receiz_webhook_register_endpoint",
+    "receiz_webhook_rotate_secret",
+    "receiz_webhook_send_test_event",
+    "receiz_webhook_receiver_scaffold",
+    "receiz_webhook_verify_payload",
+    "receiz_inspect_proof_object",
+    "receiz_wallet_public_ledger",
+    "receiz_action_ledger",
+    "receiz_sports_conformance",
+    "receiz_world_public_snapshot",
+    "receiz_proof_query",
+    "receiz_sandbox_seed_store",
+    "receiz_sandbox_checkout",
+    "receiz_runtime_blueprint",
+    "receiz_project_inspect",
+    "receiz_app_contract_create",
+    "receiz_app_plan",
+    "receiz_app_apply",
+    "receiz_app_check",
+    "receiz_app_upgrade",
+    "receiz_app_explain",
+    "receiz_app_repair",
+    "receiz_proof_trace",
+    "receiz_webhook_replay",
+    "receiz_scope_explain",
+    "receiz_release_qualify",
+    "receiz_architecture_inspect",
+    "receiz_domain_scaffold",
+    "receiz_command_scaffold",
+    "receiz_law_define",
+    "receiz_law_explain",
+    "receiz_law_coverage",
+    "receiz_authority_inspect",
+    "receiz_command_simulate",
+    "receiz_receipt_replay",
+    "receiz_history_trace",
+    "receiz_merge_simulate",
+    "receiz_bypass_scan",
+    "receiz_conformance_run",
+    "receiz_release_verify",
+    "receiz_mcp_execute_command",
+    "receiz_mcp_append_event",
+    "receiz_mcp_verify_receipt",
+    "receiz_mcp_commit_atomic_projection"
+  ],
+  "currentMcpV122Tools": [
+    "receiz_v122_subject_admit",
+    "receiz_v122_subject_state",
+    "receiz_v122_subject_export_edge_bundle",
+    "receiz_v122_subject_import_edge_bundle",
+    "receiz_v122_subject_access_binding",
+    "receiz_v122_subject_access_key_publish",
+    "receiz_v122_world_plan_private",
+    "receiz_v122_world_validate_transaction",
+    "receiz_v122_world_execute_transaction",
+    "receiz_v122_world_execution",
+    "receiz_v122_world_execution_by_idempotency",
+    "receiz_v122_world_additions",
+    "receiz_v122_mandate_issue",
+    "receiz_v122_mandate_state",
+    "receiz_v122_mandate_revoke",
+    "receiz_v122_multi_world_plan",
+    "receiz_v122_multi_world_execute",
+    "receiz_v122_value_plan_settlement",
+    "receiz_v122_value_plan_reserve"
+  ]
 }

package/receiz-proof-authority/references/mcp-map.md

@@ -0,0 +1,16 @@
+# V124 proof-authority MCP map
+
+The universal adapters for this skill are:
+
+| Tool | SDK method | Scope contract | Custody boundary |
+|---|---|---|---|
+| `receiz_v124_kai_now` | `receizKaiNow` | no bearer scope | Read-only genesis-derived Kai coordinate; UTC is elapsed-duration input, not authority. |
+| `receiz_v124_proof_authority_challenge_create` | `createReceizProofAuthorityChallenge` | exact requested scopes must remain within the registered application grant | The signable challenge is not identity authority. |
+| `receiz_v124_runtime_authority_session_open` | `client.runtime.openAuthoritySessionV124` | exact signed-challenge scopes plus `receiz:<requested-rail>.write` | Uses `identityArtifactRef`, `subjectSourceArtifactRef`, and `signedChallengeRef`; returns local `sessionRef` and optional trusted-host `persistedSessionRef`. |
+| `receiz_v124_runtime_authority_session_refresh` | `client.runtime.refreshAuthoritySessionV124` | exact signed-challenge and stored-session scopes plus `receiz:<requested-rail>.write` | Uses `sessionRef`, `identityArtifactRef`, and `signedChallengeRef`; canonical SDK/server verification precedes rotation. |
+| `receiz_v124_runtime_authority_session_close` | `client.runtime.closeAuthoritySessionV124` | exact stored session scopes | Close re-verifies and consumes the local or trusted-host-persisted session reference. |
+| `receiz_v124_runtime_qualify` | `client.runtime.qualifyV124` | application-bound bearer | Operational capability evidence is a deployment descriptor, never proof or identity authority. |
+
+The complete 22-tool surface is the [universal V124 runtime tool map](../../receiz-mcp-agent-skill/resources/v124-runtime-tool-map.md).
+
+The sealed proof object and Receiz identity artifact remain authority. A grant, bearer, session, MCP reference, server response, or database row never becomes identity authority. `applicationId` and `audience` are runtime-pinned, never model inputs. Canonically persisted sessions cross client recreation only through SDK/server authentication; MCP does not re-admit serialized session objects.

package/receiz-proof-authority/references/sdk-map.md

@@ -1,6 +1,12 @@
 # SDK map
 
+- `receizKaiNow()` returns the canonical live `{ pulse, uPulse }` coordinate derived from the Receiz genesis and the phi-exact ties-to-even bridge. UTC supplies elapsed duration only; it is not authority.
+- `createReceizProofAuthorityChallenge({ applicationId, artifactDigest, scopes, consentStatementDigest, ttlPulses, nonce })` builds the canonical whole-pulse signable challenge. The existing whole-pulse issue fields are never reinterpreted as micro-pulses.
 - `client.identity.exchangeProofAuthority({ artifact, challenge, applicationId, scopes })` binds explicit in-application consent to the exact verified artifact and issues a short-lived, non-refreshable authority.
+- `client.runtime.openAuthoritySessionV124(input)` verifies the signed challenge, sealed subject source, bearer, grant, scopes, and exact heads before issuing an authenticated short-lived session.
+- `client.runtime.refreshAuthoritySessionV124(input)` rotates a held or canonically persisted authenticated session without making the session identity authority.
+- `client.runtime.closeAuthoritySessionV124(input)` binds closure to the issuing authority and consumes the active session.
+- `client.runtime.qualifyV124(input)` reports whether every required production dependency is operational; method presence alone is insufficient.
 - `client.auth.scopesForRails(rails)` returns the authoritative OAuth/OIDC scopes required by Settlement and Reserve.
 - `client.auth.missingScopesForRails(grantedScopes, rails)` identifies exact missing permissions.
 - `client.auth.canUseRails(grantedScopes, rails)` answers whether every required rail scope was granted.

package/receiz-proof-media/SKILL.md

@@ -47,6 +47,12 @@ Use `assets.createProofObject` to run native Record -> Seal and `artifacts.downl
 
 Store and render the known verified artifact immediately when available. Do not claim a new Record -> Seal or profile projection succeeded while offline. Later sync may append a verified public projection without replacing the artifact.
 
+Content-bearing Receiz proof URLs carry exact sealed material either fully inline as `#material=rma2:...` or through a compact `#material=rmc1:...` proof-object append-segmentation head. Open both forms with `openVerifiedReceizMaterialUrl(url)`. Inline capsules open fully offline. Composite heads are hard-bounded to 4,096 URL characters and resolve and verify their ordered append segments, reconstruct the exact original capsule locally, then verify the enclosing sealed proof object with the pinned canonical verifier before exposing native payload bytes. The 4,096-character boundary applies only to the public head: it never truncates the artifact or its append segments and is never a truth-size limit. Render the returned `payloadBytes` according to `playableKind` and `payloadMimeType`; `createReceizPlayableMaterialObjectUrl(verified)` creates a browser-local image, audio, video, PDF, text, or download URL. Append transport never outranks the sealed proof object.
+
+Developers may carry the same `#material` coordinate on their own domain and render it there. The external route is a presentation wrapper only: reconstruct the inline capsule or committed proof-object append sequence, verify the enclosing artifact locally, render the returned exact payload, and expose `canonicalReceizUrl` as the direct link back to the Receiz public proof surface. Do not let an upload, database row, media CDN, SDK, or server response become proof authority.
+
+For identity artwork and sigil projection, use `receizKaiMomentFromSealedPulse(accountCreationPulse)`. The sealed account-creation pulse is creation authority. Device clock, browser clock, process uptime, SDK state, session state, device-enrollment time, and PBI evidence cannot replace or reinterpret it. `receizKaiNow()` is only the live freshness coordinate for short-lived challenges and must never be used to reconstruct an existing identity glyph.
+
 ## Conflict behavior
 
 If Record, Seal, or enclosing verification fails, return no new media artifact. If the profile projection fails, preserve the already sealed media proof object and leave the prior profile projection unchanged.
@@ -61,7 +67,7 @@ Show the source media, artifact filename, proof-object type, public URL if one i
 
 ## MCP parity
 
-Use the SDK artifact-custody workflow for media Record -> Seal; the active default MCP surface does not introduce a parallel media authority. To project an already verified media URL, call `receiz_identity_profile_update_plan` with `{ profile }`, require exact confirmation, then call `receiz_identity_profile_update_execute` with `{ planDigest, confirmation }`.
+Use `receiz_material_url_open` to verify and reconstruct a content-bearing proof URL locally. Set `includePayloadBytes: true` only when the agent host needs exact base64url payload bytes for rendering or playback. `rma2` needs no transport lookup. `rmc1` resolves only committed proof-object append segments, reconstructs exact capsule bytes locally, and rejects substitutions before canonical proof verification. Use `receiz_sealed_kai_moment` with the verified account-creation pulse when rendering identity artwork; never use the live-clock tool for an existing proof object. Neither media form may use device time to re-project an existing proof object. Use the SDK artifact-custody workflow for media Record -> Seal; MCP does not introduce a parallel media authority or a direct profile-mutation adapter. Project an already verified media URL through the canonical SDK `receiz.profile.update(profile)` operation and require the same-UID result. Never substitute an unrelated MCP tool or a model-carried projection for the sealed media proof object.
 
 ## Emulator fixture