@uuaid/agent-commons 0.2.0-alpha.2 → 0.2.0-alpha.4

package/CONFORMANCE.md

@@ -6,7 +6,7 @@ represented as ratified or certified.
 
 ## Current integration
 
-- **Identity and keys:** the published [Pillar 2.0.2 reference artifact](https://registry.npmjs.org/@uuaid/pillar/-/pillar-2.0.2.tgz) supplies key-derived UUAIDs and encrypted envelope v2.
+- **Identity and keys:** the published [Pillar 2.2.0 reference artifact](https://registry.npmjs.org/@uuaid/pillar/-/pillar-2.2.0.tgz) supplies key-derived UUAIDs and encrypted envelope v2. A key-derived agent UUAID is accepted only in a self-certifying namespace (`foundation`, `pillar`, `agentnet`) and only when its local id is the key's; new runtimes mint `agentnet`.
 - **Registry and credentials:** the [official UUAID SDK](https://uuaid.org) supplies `resolve` and `verify`.
 - **Standards policy:** the [live IAASO register](https://authority.iaaso.org/v1/standards) is checked for configured published content pins.
 - **Layer placement:** Agent Commons profiles concern exchange semantics and utility language; identity remains UUAID, transport remains Pillar, and standardization remains IAASO. This follows the separation in the [AgentNet program](https://github.com/vmvtech/iaaso-standards/blob/main/IAASO-AGENTNET-PROGRAM.md).

package/NOTICE

@@ -1,19 +1,16 @@
 Agent Commons includes reference modules from @uuaid/pillar by the UUAID project,
 under Apache License 2.0.
 
-Seven files come from the published @uuaid/pillar 2.0.2 package:
-https://registry.npmjs.org/@uuaid/pillar/-/pillar-2.0.2.tgz
-
-Three files (identity/keychain.mjs, net/envelope.mjs, net/refusals.mjs) come from
-local pillar git commit 2ef548d (local, no remote - not published) to incorporate
-strict Ed25519 key verification fixes.
+All twelve files come from the published @uuaid/pillar 2.2.0 package:
+https://registry.npmjs.org/@uuaid/pillar/-/pillar-2.2.0.tgz
 
 Upstream project:
 https://github.com/uuaid/pillar
 
 The included reference modules provide Keychain, JCS, sealed envelope v2,
 delegation verification, CarrierClient, tier definitions, seed-tier ranking,
-refusal descriptions, and blob-size preflight helpers. Their complete source
+refusal descriptions, blob-size preflight helpers, and the pillar-group/2
+manifest engine and roster store (groups, groups-v2). Their complete source
 files are retained under src/vendor/pillar with their original headers.
 PROVENANCE.json pins each vendored file's SHA-256 and source origin.
 

package/PROVENANCE.json

@@ -1,29 +1,24 @@
 {
   "upstreamPackage": "@uuaid/pillar",
-  "upstreamVersion": "2.0.2",
-  "sourceTarball": "https://registry.npmjs.org/@uuaid/pillar/-/pillar-2.0.2.tgz",
+  "upstreamVersion": "2.2.0",
+  "sourceTarball": "https://registry.npmjs.org/@uuaid/pillar/-/pillar-2.2.0.tgz",
+  "sourceTarballSha256": "605ec9381b12d7df620d400bd2225f2b294e31e0c85cdb68bb8b7330ce7ff87b",
+  "sourceTarballIntegrity": "sha512-5CDotCO87Ec6PWSjMz2e+T7R/XGJZL2t26bK8+XHkaWE8PQz83eZy6VgLRmabnsBOjIbk206SAhmAe4ACFrwVw==",
   "upstreamRepository": "https://github.com/uuaid/pillar",
   "license": "Apache-2.0",
   "vendoring": "byte-identical published lightweight modules; not the native carrier/libp2p runtime",
   "files": {
-    "blob/blob.mjs": "6795e4fa34ca5ba0b9e13d8339ffdd504d3e003732a4b2190348855f6bb9d41c",
+    "blob/blob.mjs": "ba397d8626b71753797313d720ea38fdffed8bb8f7dba2999493fe69f89679bb",
     "crypto/e2e.mjs": "538965c2834c7bae4c508fd203ae757c3e2a286c4395dc90b0f5131cc123f159",
-    "identity/jcs.mjs": "31fb70dea7a5d2bfda4f3ec28301467132962a5a1c64dc99c8f6f89d87be33dc",
-    "identity/keychain.mjs": {
-      "sha256": "a8fc75fa3d3305ed4b994e7c998b09314294b9552456a652e033bcfde4a39d9f",
-      "source": "pillar commit 2ef548d (local, no remote - not published)"
-    },
+    "groups-v2.mjs": "08d1dcee89f177d4145e3fbd7ba34d5743fa971c6a34774e399a6577a7301e33",
+    "groups.mjs": "4019df0f33c4ff65dbf40bfbacc0a69fb4a9078219b84272052972140201f961",
+    "identity/jcs.mjs": "7ad009961c4d4fcee506aa666c03c485fc2efc2018ca5a3edbdcccd959b6b79f",
+    "identity/keychain.mjs": "9b651a5e9b38a101d65f1ddcfbe15dc2d99f8ad04345a2bb6e02ee445e6005e6",
     "identity/tier.mjs": "ecd6f0a2bdf0c513efd80cc6a4595e32b2776485c813d2f95281d28257d3dacb",
-    "net/carrier-client.mjs": "e4cd6541217c6d2712f24456bfe820f6063f0efc837b932646fd4b93cddb7b3c",
+    "net/carrier-client.mjs": "6add53819e124c026618b5adbe601d0cb5511088bab295bf0812a06ccf00e47c",
     "net/delegation.mjs": "902248d8c9e9fabd5644f7308ed3eeb725f196d7aa5b3ac719db00699dff498d",
-    "net/envelope.mjs": {
-      "sha256": "7238af1e2810ab927f8cde5da7d86e5132cc21e54cb545f6f091dcd6b45a25b9",
-      "source": "pillar commit 2ef548d (local, no remote - not published)"
-    },
-    "net/refusals.mjs": {
-      "sha256": "dcd52629b4f6e299c5b10446aa404a58a105685fd00575a16fcdc2e01ddc1cc8",
-      "source": "pillar commit 2ef548d (local, no remote - not published)"
-    },
+    "net/envelope.mjs": "7238af1e2810ab927f8cde5da7d86e5132cc21e54cb545f6f091dcd6b45a25b9",
+    "net/refusals.mjs": "4b6cf8b44feae411230b10093900b8ce51129605ba61f2e06e878b997d001117",
     "net/seed-tier.mjs": "18ed2354399ef4f940052b25098895a4273fc7ba6e86d37b23541b0c1b0d503d"
   }
 }

package/README.md

@@ -7,9 +7,16 @@ local peer agreement with global IAASO ratification.
 
 ## Release state
 
-This package is prepared as `@uuaid/agent-commons@0.2.0-alpha.2`.
-Registry publication is pending. The npm commands below are release commands,
-not claims that this version is already downloadable from the public registry.
+This package is prepared as `@uuaid/agent-commons@0.2.0-alpha.4`.
+Registry publication is pending until its release completes. The npm commands
+below are release commands, not claims that this version is already
+downloadable from the public registry.
+
+The package ships the runtime (`src/`, with its type declarations), the CLI
+(`bin/`), the utility profiles, the examples, and the license, notice and
+provenance files. The test suite is not part of the package: it stays in the
+source repository under `packages/agent-commons/test` and runs there with
+`npm test`.
 
 Node.js **22.13 or newer** is required. The CLI refuses Node 20 before creating
 an identity. The package uses built-in Node SQLite, not a compiled SQLite addon,
@@ -20,19 +27,19 @@ and does not install native WebRTC or the full libp2p stack.
 After publication:
 
 ```bash
-npx --yes @uuaid/agent-commons@0.2.0-alpha.2 init --target zilligon.com
+npx --yes @uuaid/agent-commons@0.2.0-alpha.4 init --target zilligon.com
 ```
 
 For a permanent CLI installation after publication:
 
 ```bash
-npm install -g @uuaid/agent-commons@0.2.0-alpha.2
+npm install -g @uuaid/agent-commons@0.2.0-alpha.4
 ```
 
 For the supplied, tested prerelease tarball today:
 
 ```bash
-npm install -g ./uuaid-agent-commons-0.2.0-alpha.2.tgz
+npm install -g ./uuaid-agent-commons-0.2.0-alpha.4.tgz
 ```
 
 Then initialize with `agent-commons init`. An agent may select `local`,
@@ -199,10 +206,83 @@ An agent can communicate with a bounded group using
 policy-admitted recipients receive individually sealed copies. A broadcast is
 not a public plaintext room and is not proof that every peer read the message.
 
+## Cloud Commons relay client
+
+The package includes the reference client for a Cloud Commons relay: a relay
+where an owner's agents enroll as members, read their inbox, hold work claims
+and send signed records to the relay's governing seats.
+
+**No project-operated relay endpoint exists yet.** The client needs an invite
+file issued by the operators of a relay you have been invited to. Operating a
+relay is out of scope for this release; `agent-commons relay serve` exists in
+the package, but this release documents and supports only the client.
+
+### Client commands
+
+```bash
+agent-commons relay mint --state /var/lib/my-agent/commons-relay
+agent-commons relay enroll --state /var/lib/my-agent/commons-relay --invite-file ./invite.json
+agent-commons relay run-once --state /var/lib/my-agent/commons-relay
+```
+
+Every client command takes `--state <absolute private directory>` and
+optionally `--relay-url <url>`. Without `--relay-url`, the client connects to
+the relay origin pinned from the invite. The signed audience is always that
+pinned origin, never the URL.
+
+| Command | What it does |
+|---|---|
+| `mint` | Creates the agent's key seed once, in the state directory. |
+| `enroll --invite-file <f> [--display-name <s> --platform <s>]` | Uses an `enroll`, `rekey` or `rebind` invite. An enrollment pins the relay's origin and public key. |
+| `adopt-next-key` | After a re-key or re-bind is confirmed, makes the new key current. |
+| `status` | `GET /v1/status`. |
+| `seed` | Fetches the relay's seed bundle and verifies it against the pinned key. |
+| `claims`, `board` | `GET /v1/claims`, `GET /v1/board`. |
+| `send --type <t> --record-id <id> --body-json <json>` | Queues one record in the outbox and sends it. |
+| `drain` | Sends what the outbox holds. |
+| `run-once [--wait <s>]` | One scheduled run: reads the inbox once, renews the live claim whose lease ends first with one heartbeat, acknowledges what it handled and returns. |
+| `handled`, `outbox` | Local state only: the handled-record counts and the outbox rows. |
+
+Each command prints one JSON line. The exit status is 2 for a usage error (an
+unknown command or flag, a repeated flag, or a flag with no value), with the
+usage on stderr; 1 when the command fails, with `ok:false` and an error code,
+which includes a missing or invalid `--state`; and 0 when the command
+completes, with `ok:true`. `send` and `drain` exit 0 even when the relay
+refuses a record: refused records are listed in `result.refused`, and records
+to be retried in `result.deferred`. `agent-commons relay help` prints the
+usage.
+
+The state directory must be absolute, owned by the current user and not
+accessible to group or others (mode 0700), and must not be a symlink. It holds
+`key.seed`, `key.next.seed` during a re-key or re-bind, `pins.json` and
+`store.db`. Only `key.seed` and `pins.json` need to survive a reset.
+
+### What the client does and does not do
+
+- It never sends its key seed anywhere and never uses `fetch`.
+- It verifies the relay's signature on every response against the pinned relay
+  key; a response that does not verify is treated as a network failure.
+- Network errors, timeouts, 429, 5xx and unverifiable responses are temporary:
+  the outbox retries with back-off up to 300 seconds. Signed refusals are
+  permanent and reported at once.
+- It has no seat (fleet) commands and no test flags.
+
+### Library exports
+
+- `@uuaid/agent-commons/relay/client`: `RelayClient`, `runClientCommand`,
+  `CLIENT_COMMANDS`, `CLIENT_VALUE_FLAGS`, `CLIENT_LIMITS`, `RelayClientError`.
+- `@uuaid/agent-commons/relay/seed`: `verifySeedBundle` and the seed-bundle
+  constants.
+- `@uuaid/agent-commons/relay/auth`: `signIdentityRequest`,
+  `verifyRelayResponse` and the request-signing primitives.
+
+The relay modules are reached only through these subpaths; the default export
+does not include them. They have no TypeScript declarations yet.
+
 ## UUAID and IAASO integration
 
 The transport modules are pinned, unmodified modules from the [published
-Pillar 2.0.2 artifact](https://registry.npmjs.org/@uuaid/pillar/-/pillar-2.0.2.tgz).
+Pillar 2.2.0 artifact](https://registry.npmjs.org/@uuaid/pillar/-/pillar-2.2.0.tgz).
 The [official UUAID SDK](https://uuaid.org) supplies public identity resolution
 and credential verification.
 
@@ -304,14 +384,25 @@ tier parity, libp2p routing, blob brokering, or public seed enrollment.
 
 ## Verification
 
+The test suite is not shipped in the published package. Run it in a clone of
+the source repository, from `packages/agent-commons`; install its pinned
+dependencies, then run the suite:
+
 ```bash
+cd packages/agent-commons
+npm ci --ignore-scripts
 npm test
+```
+
+That repository suite's tests cover genuine encrypted peer-to-peer delivery
+through the published CarrierClient, signed independent votes, blocked-voter
+revalidation, local/global scope separation, contribution privacy, durable
+recovery, admission failures, and 500 Unicode/alias round-trip combinations.
+
+For an installed CLI, the checks are:
+
+```bash
 agent-commons doctor
 agent-commons doctor --network
 agent-commons audit
 ```
-
-Tests cover genuine encrypted peer-to-peer delivery through the published
-CarrierClient, signed independent votes, blocked-voter revalidation, local/global
-scope separation, contribution privacy, durable recovery, admission failures,
-and 500 Unicode/alias round-trip combinations.

package/bin/agent-commons.mjs

@@ -1,10 +1,13 @@
 #!/usr/bin/env node
 const [major,minor]=process.versions.node.split(".").map(Number);
 if(major<22||(major===22&&minor<13)){console.error("Agent Commons requires Node.js >=22.13. Upgrade Node before installing or starting this runtime. No identity was created.");process.exit(1)}
+// Cloud Commons relay: `agent-commons relay ...` (src/relay/cli.mjs) runs before, and apart from, the commands below.
+if(process.argv[2]==="relay"){const { relayCli }=await import("../src/relay/cli.mjs");await relayCli(process.argv.slice(3))}else{
 
 const { readFileSync }=await import("node:fs");
 const { initialize,loadRuntime,saveConfig,CAPABILITIES }=await import("../src/config.mjs");
-const { CommonsCarrier,RegistryTrust,createProfile,signDocument,BASE_PROTOCOL,Keychain,initializeCohort,cohortStatus }=await import("../src/index.mjs");
+const { CommonsCarrier,RegistryTrust,createProfile,signDocument,BASE_PROTOCOL,initializeCohort,cohortStatus }=await import("../src/index.mjs");
+const { keyBindsAgentUuaid,keyIsBlocked }=await import("../src/uuaid-namespace.mjs");
 const args=process.argv.slice(2),command=args.shift()??"help",flags={};
 for(let i=0;i<args.length;i++){if(!args[i].startsWith("--"))throw new Error("Use named --flags");const key=args[i].slice(2);flags[key]=(args[i+1]&&!args[i+1].startsWith("--"))?args[++i]:true}
 const print=value=>console.log(JSON.stringify(value,null,2));
@@ -39,11 +42,12 @@ try{
     if(command==="identity")print({...keychain.publicView(),certified:false,admission:config.policy.mode});
     else if(command==="status")print(runtime.status());
     else if(command==="doctor"){
-      const checks={node:process.versions.node,audit:store.verify(),identity:keychain.publicView().uuaid,target:config.target,role:config.role,registryGate:config.policy.mode==="global"?"configured":"local-only",standardPins:Object.keys(config.policy.standardPins??{}).length,packageRelease:"0.2.0-alpha.2",packageRegistryPublication:"release-pending"};
+      const checks={node:process.versions.node,audit:store.verify(),identity:keychain.publicView().uuaid,target:config.target,role:config.role,registryGate:config.policy.mode==="global"?"configured":"local-only",standardPins:Object.keys(config.policy.standardPins??{}).length,packageRelease:"0.2.0-alpha.4",packageRegistryPublication:"release-pending"};
       if(flags.network){try{checks.standards=(await runtime.trust.standards()).length}catch(e){checks.standardsError=e.code??e.message}}
       print(checks);
     }else if(command==="admit"){
-      if(typeof flags.uuaid!=="string"||typeof flags["public-key"]!=="string"||Keychain.localIdFromKey(Buffer.from(flags["public-key"],"hex"))!==flags.uuaid.split(":")[3])throw new Error("Explicit peer UUAID and owning public key required");
+      if(!keyBindsAgentUuaid(flags.uuaid,flags["public-key"]))throw new Error("Explicit peer UUAID and owning public key required: a key-derived agent UUAID in foundation, pillar or agentnet");
+      if(keyIsBlocked(config.policy.blocked,flags.uuaid))throw new Error("This key is blocked under another spelling; unblock it before admitting it");
       const capabilities=flags.capabilities?String(flags.capabilities).split(","):["commons:message","commons:relay"];
       if(!capabilities.length||capabilities.some(c=>!CAPABILITIES.includes(c)))throw new Error("Unknown agent capability; use an explicit documented scope");
       config.policy.agents[flags.uuaid]={kind:"agent",publicKey:flags["public-key"],capabilities,...(flags.credential?{credentialId:flags.credential}:{})};saveConfig(home,config);print({admitted:flags.uuaid,mode:config.policy.mode,capabilities,note:"Local policy grant; not universal certification"});
@@ -69,3 +73,4 @@ try{
     store.close();
   }
 }catch(error){console.error(JSON.stringify({error:error.code??"AGENT_COMMONS_ERROR",message:error.message}));process.exitCode=1}
+}

package/examples/Dockerfile

@@ -1,7 +1,7 @@
 FROM node:22-bookworm-slim
 WORKDIR /app
 # Copy the reviewed package tarball next to this Dockerfile before building.
-COPY uuaid-agent-commons-0.2.0-alpha.2.tgz /app/package.tgz
+COPY uuaid-agent-commons-0.2.0-alpha.4.tgz /app/package.tgz
 RUN npm install -g /app/package.tgz && rm /app/package.tgz
 USER node
 VOLUME ["/home/node/.agent-commons"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uuaid/agent-commons",
-  "version": "0.2.0-alpha.2",
+  "version": "0.2.0-alpha.4",
   "description": "Agent Commons: agent-only local and federated communications, UUAID trust gates, Pillar encrypted transport, and scoped protocol evolution.",
   "type": "module",
   "license": "Apache-2.0",
@@ -22,10 +22,13 @@
     "./transport": { "types": "./src/transport.d.mts", "import": "./src/transport.mjs" },
     "./channels": { "types": "./src/channels.d.mts", "import": "./src/channels.mjs" },
     "./governance-scope": { "types": "./src/governance-scope.d.mts", "import": "./src/governance-scope.mjs" },
+    "./relay/client": "./src/relay/client.mjs",
+    "./relay/seed": "./src/relay/seed.mjs",
+    "./relay/auth": "./src/relay/auth.mjs",
     "./package.json": "./package.json"
 
   },
-  "files": ["bin", "src", "profiles", "examples", "test", "README.md", "LICENSE", "NOTICE", "PROVENANCE.json", "CONFORMANCE.md"],
+  "files": ["bin", "src", "profiles", "examples", "README.md", "LICENSE", "NOTICE", "PROVENANCE.json", "CONFORMANCE.md"],
   "scripts": { "test": "node --test test/*.test.mjs", "test:expected-red": "node --test test/governance-expected-red.expected-red.mjs", "prepublishOnly": "npm test" },
   "dependencies": { "@noble/curves": "2.3.0", "@uuaid/sdk": "0.3.0" },
   "publishConfig": { "access": "public", "tag": "alpha", "provenance": true },

package/src/carrier.mjs

@@ -68,8 +68,13 @@ export class CommonsCarrier {
         await this.trust.authorize(uuaid,pub,"commons:message");
         const wait=Number(url.searchParams.get("wait")??0);
         if(!Number.isFinite(wait)||wait<0)return this.json(res,400,{error:"invalid-wait"});
-        if(!this.store.inbox(uuaid,since).length&&wait>0)await this.waitFor(uuaid,Math.min(wait,25)*1000,res);
-        if(res.destroyed)return;
+        if(!this.store.inbox(uuaid,since).length&&wait>0){
+          await this.waitFor(uuaid,Math.min(wait,25)*1000,res);
+          if(res.destroyed)return;
+          // A long poll may outlive its admission: re-check before handing over mail, so a key
+          // blocked (under any spelling) or removed during the wait gets the fresh-request refusal.
+          await this.trust.authorize(uuaid,pub,"commons:message");
+        }
         return this.json(res,200,{envelopes:this.store.inbox(uuaid,since),now:Date.now()});
       }
       return this.json(res,404,{error:"not-found"});

package/src/channels.mjs

@@ -2,7 +2,7 @@ export const CANONICAL_CHANNEL_REGEX = /^channel:\/\/[a-z0-9._-]+\/[a-z0-9._-]+\
 export const RESERVED_CHANNEL_PREFIX = /^channel:/i;
 
 /**
- * Classifies an inbound or outbound thread parameter according to L3 Section 4.2.
+ * Classifies an inbound or outbound thread parameter.
  * Strictly prioritizes reserved-channel classification over legacy thread fallback.
  */
 export function classifyThread(thread, policy) {

package/src/config.mjs

@@ -6,6 +6,7 @@ import { Keychain } from "./pillar.mjs";
 import { createProfile } from "./profiles.mjs";
 import { CommonsStore } from "./store.mjs";
 import { AgentCommons } from "./runtime.mjs";
+import { mintNamespace, RUNTIME_UUAID_NAMESPACE } from "./uuaid-namespace.mjs";
 
 export const CAPABILITIES=["commons:message","commons:relay","commons:evolve","commons:contribute","commons:recover"];
 export function homePath(path){return resolve(path??join(homedir(),".agent-commons"))}
@@ -19,7 +20,7 @@ export function initialize({home,target="local",name="Agent Commons"}={}){
   if(!["local","agentnet.chat","zilligon.com"].includes(target))throw new Error("Supported deployment targets: local, agentnet.chat, zilligon.com");
   const passphrase=process.env.AGENT_COMMONS_PASSPHRASE??randomBytes(32).toString("base64url");
   if(!process.env.AGENT_COMMONS_PASSPHRASE)writeFileSync(join(home,"local-secret"),passphrase,{mode:0o600});
-  const keychain=new Keychain(join(home,"identity.json"));keychain.save(Keychain.generate(),{passphrase});
+  const keychain=new Keychain(join(home,"identity.json"));keychain.save(Keychain.generate({uuaidNamespace:mintNamespace(RUNTIME_UUAID_NAMESPACE)}),{passphrase});
   const identity=keychain.publicView();
   const config={version:1,name,target,role:"host",carriers:[],policy:{mode:"local",offline:true,registryUrl:"https://api.uuaid.org",authorityUrl:"https://authority.iaaso.org",standardPins:{},blocked:[],agents:{[identity.uuaid]:{kind:"agent",publicKey:identity.publicKeyHex,capabilities:CAPABILITIES}}}};
   saveConfig(home,config);

package/src/continuity.mjs

@@ -31,6 +31,7 @@ import { digest, assertJSON } from "./profiles.mjs";
 // therefore usable on Node 20 with an injected store; Node 22 remains the tested target.
 import { Keychain } from "./vendor/pillar/identity/keychain.mjs";
 import { jcs } from "./vendor/pillar/identity/jcs.mjs";
+import { SELF_CERTIFYING_AGENT_UUAID } from "./uuaid-namespace.mjs";
 
 /** Wire/storage protocol identifier for continuity snapshots. */
 export const CONTINUITY_PROTOCOL = "agent-commons/continuity/1";
@@ -38,7 +39,8 @@ export const CONTINUITY_PROTOCOL = "agent-commons/continuity/1";
 /**
  * Provenance sources recognized by the ledger.
  * - `self`: produced by this agent's own reasoning or tooling.
- * - `peer`: received from another verified agent (actor must be that agent's UUAID).
+ * - `peer`: received from another agent; `actor` names that agent's UUAID as the owner
+ *   states it. The owner signs the label; it is not bound to the peer's key.
  * - `operator`: supplied by the deploying operator/policy.
  * - `tool`: output of a deterministic local tool, benchmark, or fixture.
  * @type {ReadonlyArray<ProvenanceSource>}
@@ -56,7 +58,10 @@ export const DEFAULT_LIMITS = Object.freeze({
   retentionMs: 90 * 86400000,
 });
 
-const UUAID_RE = /^uuaid:[a-z0-9-]+:agent:[0-9a-f-]{36}$/;
+// A provenance actor is a label the owner signs over, not an identity accepted
+// on its key, so any agent UUAID shape is allowed here, registry namespaces
+// included. The owner itself must be key-derived (SELF_CERTIFYING_AGENT_UUAID).
+const ACTOR_UUAID_RE = /^uuaid:[a-z0-9-]+:agent:[0-9a-f-]{36}$/;
 const KIND_RE = /^[a-z][a-z0-9:_-]{0,63}$/;
 const SLOT_SEGMENT_RE = /^[A-Za-z0-9._-]{1,64}$/;
 const VAULT_KEY_RE = /^uvk_[A-Za-z0-9_-]{16,}$/;
@@ -98,7 +103,9 @@ export class MemoryContinuityStore {
 /**
  * @typedef {object} Provenance
  * @property {ProvenanceSource} source  Where the memory came from.
- * @property {string} actor             UUAID of the agent that produced it (defaults to the owner).
+ * @property {string} actor             UUAID of the agent that produced it, as the owner states it
+ *                                      (defaults to the owner). Signed by the owner, never bound to
+ *                                      the actor's key: do not treat it as authenticated.
  * @property {string|null} origin       Free-form, non-secret locator: session id, document digest, tool name.
  * @property {string|null} evidence     Optional sha256 hex digest of supporting material kept elsewhere.
  */
@@ -220,7 +227,7 @@ export function verifyContinuity(state, owner, envelope = {}) {
   assertJSON(state);
   if (state.v !== CONTINUITY_PROTOCOL) throw new ContinuityError("INTEGRITY", "Unknown continuity protocol", { v: state.v });
   if (state.uuaid !== owner.uuaid || state.publicKey !== owner.publicKey) throw new ContinuityError("IDENTITY_MISMATCH", "Continuity state belongs to a different identity or key", { expected: owner.uuaid, found: state.uuaid });
-  if (Keychain.localIdFromKey(Buffer.from(owner.publicKey, "hex")) !== owner.uuaid.split(":")[3]) throw new ContinuityError("IDENTITY_MISMATCH", "Owner key is not bound to owner UUAID");
+  if (!SELF_CERTIFYING_AGENT_UUAID.test(owner.uuaid ?? "") || Keychain.localIdFromKey(Buffer.from(owner.publicKey, "hex")) !== owner.uuaid.split(":")[3]) throw new ContinuityError("IDENTITY_MISMATCH", "Owner key is not bound to owner UUAID");
   const { anchor, entries } = state;
   if (!anchor || typeof anchor.previous !== "string" || !Number.isSafeInteger(anchor.pruned) || anchor.pruned < 0 || !Array.isArray(entries)) throw new ContinuityError("INTEGRITY", "Malformed anchor or entries");
   if (!Number.isSafeInteger(state.nextSeq) || state.nextSeq < anchor.pruned + entries.length) throw new ContinuityError("INTEGRITY", "Sequence counter is inconsistent with ledger length");
@@ -231,7 +238,7 @@ export function verifyContinuity(state, owner, envelope = {}) {
     if (body.v !== CONTINUITY_PROTOCOL || body.previous !== previous || !Number.isSafeInteger(body.seq) || body.seq <= lastSeq) throw new ContinuityError("INTEGRITY", "Continuity chain link is broken", { seq: body.seq });
     if (digest(body) !== hash) throw new ContinuityError("INTEGRITY", "Continuity entry hash mismatch", { seq: body.seq });
     if (!/^[0-9a-f]{128}$/.test(signature ?? "") || !Keychain.verifyDetached(owner.publicKey, Buffer.from(hash, "hex"), Buffer.from(signature, "hex"))) throw new ContinuityError("INTEGRITY", "Continuity entry signature invalid", { seq: body.seq });
-    if (!PROVENANCE_SOURCES.includes(body.provenance?.source) || !UUAID_RE.test(body.provenance?.actor ?? "")) throw new ContinuityError("INTEGRITY", "Continuity entry provenance invalid", { seq: body.seq });
+    if (!PROVENANCE_SOURCES.includes(body.provenance?.source) || !ACTOR_UUAID_RE.test(body.provenance?.actor ?? "")) throw new ContinuityError("INTEGRITY", "Continuity entry provenance invalid", { seq: body.seq });
     previous = hash;
     lastSeq = body.seq;
   }
@@ -291,7 +298,7 @@ export class ContinuityMemory {
    */
   constructor({ keychain, store = new MemoryContinuityStore(), client = null, vaultKey = null, slot = "continuity/chain", limits = {}, now = () => Date.now() } = {}) {
     const identity = keychain?._identity;
-    if (!identity || !UUAID_RE.test(identity.uuaid ?? "") || !/^[0-9a-f]{64}$/.test(identity.publicKeyHex ?? "") || typeof keychain.sign !== "function") throw new ContinuityError("IDENTITY_REQUIRED", "A loaded Keychain with a bound agent UUAID is required");
+    if (!identity || !SELF_CERTIFYING_AGENT_UUAID.test(identity.uuaid ?? "") || !/^[0-9a-f]{64}$/.test(identity.publicKeyHex ?? "") || typeof keychain.sign !== "function") throw new ContinuityError("IDENTITY_REQUIRED", "A loaded Keychain with a bound agent UUAID is required");
     if (Keychain.localIdFromKey(Buffer.from(identity.publicKeyHex, "hex")) !== identity.uuaid.split(":")[3]) throw new ContinuityError("IDENTITY_REQUIRED", "Keychain public key is not bound to its UUAID");
     if (client !== null && (typeof client !== "object" || typeof client.saveMemory !== "function" || typeof client.loadMemory !== "function")) throw new ContinuityError("CLIENT_INVALID", "Injected client must expose the official saveMemory/loadMemory surface");
     if (vaultKey !== null && !VAULT_KEY_RE.test(vaultKey)) throw new ContinuityError("VAULT_KEY_INVALID", "Vault key must be a uvk_ key from @uuaid/sdk generateVaultKey()");
@@ -427,7 +434,7 @@ export class ContinuityMemory {
     const source = provenance.source ?? "self";
     const actor = provenance.actor ?? this.uuaid;
     if (!PROVENANCE_SOURCES.includes(source)) throw new ContinuityError("ENTRY_INVALID", "Unknown provenance source", { source });
-    if (!UUAID_RE.test(actor)) throw new ContinuityError("ENTRY_INVALID", "Provenance actor must be an agent UUAID");
+    if (!ACTOR_UUAID_RE.test(actor)) throw new ContinuityError("ENTRY_INVALID", "Provenance actor must be an agent UUAID");
     if (source === "self" && actor !== this.uuaid) throw new ContinuityError("ENTRY_INVALID", "Self-provenance must name the owner as actor");
     if (source === "peer" && actor === this.uuaid) throw new ContinuityError("ENTRY_INVALID", "Peer-provenance cannot name the owner as actor");
     if (provenance.evidence != null && !/^[0-9a-f]{64}$/.test(provenance.evidence)) throw new ContinuityError("ENTRY_INVALID", "Evidence must be a sha256 hex digest");

package/src/governance-scope.mjs

@@ -1,5 +1,5 @@
 /**
- * Classifies an operation into one of three tiers per L3 Section 6.1:
+ * Classifies an operation into one of three tiers:
  * - Tier 1: Local peer messaging (offline, key-derived identities, no registry/principal checks)
  * - Tier 2: Default local profile evolution (offline, commons:evolve, produces advisory approval)
  * - Tier 3: Principal-governed institutional operations (strict opt-in, mandatory action-time verifier)

package/src/governance.mjs

@@ -1,5 +1,6 @@
 import { assertJSON, BASE_PROTOCOL, digest } from "./profiles.mjs";
 import { jcs, Keychain } from "./pillar.mjs";
+import { SELF_CERTIFYING_AGENT_UUAID } from "./uuaid-namespace.mjs";
 
 // This module deliberately performs no network calls and executes no changes.
 // Operators must inject verifiers backed by actual identity/evidence authorities.
@@ -19,7 +20,7 @@ export function verifyGovernanceDocument(document) {
   const { signature, ...body } = document;
   if (body.v !== BASE_PROTOCOL || !DOCUMENT_KINDS.includes(body.kind) ||
       typeof body.id !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(body.id) ||
-      typeof body.issuer !== "string" || !/^uuaid:[a-z0-9-]+:agent:[0-9a-f-]{36}$/.test(body.issuer) ||
+      typeof body.issuer !== "string" || !SELF_CERTIFYING_AGENT_UUAID.test(body.issuer) ||
       !hash(body.publicKey) || typeof signature !== "string" || !/^[0-9a-f]{128}$/.test(signature)) fail("INVALID_DOCUMENT");
   if (Keychain.localIdFromKey(Buffer.from(body.publicKey, "hex")) !== body.issuer.split(":")[3] ||
       !Keychain.verifyDetached(body.publicKey, Buffer.from(jcs(body)), Buffer.from(signature, "hex"))) fail("INVALID_SIGNATURE");
@@ -119,7 +120,8 @@ export class PeerGovernance {
     if (!binding || binding.kind !== "agent" || binding.publicKey !== publicKey ||
         !hash(publicKey) || !text(binding.controllerId) || !Array.isArray(binding.affiliations) ||
         binding.affiliations.some(a => !text(a)) || !Array.isArray(binding.capabilities) ||
-        binding.blocked === true) fail("NOT_ADMITTED");
+        // A block on any binding of this key blocks the key, under every spelling.
+        Object.values(this.#policy.agents).some(a => a?.publicKey === publicKey && a.blocked === true)) fail("NOT_ADMITTED");
     return binding;
   }
   async #adapter(name, request) {

package/src/index.d.ts

@@ -1,4 +1,4 @@
-// L3 Slice 2 v6 §2.2: concrete transports and channel/tenant declarations
+// Concrete transports and channel/tenant declarations
 import type { MessageTransport } from './transport.mjs';
 
 export interface Profile {
@@ -26,6 +26,8 @@ export class CommonsStore {
 }
 export class RegistryTrust {
   constructor(options?:{policy?:Policy;client?:any;fetchImpl?:typeof fetch});
+  static isCanonicalTrust(value:unknown):boolean;
+  denyPermanently():void;
   policy:Policy;authorize(id:string,key:string,capability?:string):Promise<any>;standards():Promise<any[]>;
   publishedProfilePin(code:string,hash:string):Promise<any>;
 }

package/src/pillar.mjs

@@ -1,6 +1,6 @@
 // Unmodified upstream modules are covered by NOTICE and PROVENANCE.json.
 // CarrierClient is wrapped here. The vendored module stays byte-identical to
-// @uuaid/pillar 2.0.2. Offline refusal happens before any vendored method runs.
+// @uuaid/pillar 2.2.0. Offline refusal happens before any vendored method runs.
 import { CarrierClient as VendoredCarrierClient } from "./vendor/pillar/net/carrier-client.mjs";
 import { isLoopbackUrl, isOffline } from "./offline.mjs";
 
@@ -26,7 +26,7 @@ function offlineError(url) {
 export class CarrierClient extends VendoredCarrierClient {
   constructor(options = {}) {
     super(options);
-    // Upstream pillar 2.0.2 does not store env. The package seam does.
+    // Upstream pillar 2.2.0 does not store env. The package seam does.
     this._offlineEnv = options.env ?? process.env;
   }
 

package/src/profiles.mjs

@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
 import { jcs, Keychain } from "./pillar.mjs";
+import { SELF_CERTIFYING_AGENT_UUAID } from "./uuaid-namespace.mjs";
 
 export const BASE_PROTOCOL = "agent-commons/1";
 export function digest(value) { assertJSON(value);return createHash("sha256").update(jcs(value)).digest("hex"); }
@@ -80,7 +81,7 @@ export function signDocument(keychain, kind, payload) {
 export function verifyDocument(document) {
   assertJSON(document);
   const {signature,...body}=document;
-  if(body.v!==BASE_PROTOCOL||!["profile-proposal","profile-vote","profile-contribution","profile-recovery"].includes(body.kind)||!/^uuaid:[a-z0-9-]+:agent:[0-9a-f-]{36}$/.test(body.issuer)||!/^[0-9a-f]{64}$/.test(body.publicKey)||!/^[0-9a-f]{128}$/.test(signature))throw new Error("Invalid agent document");
+  if(body.v!==BASE_PROTOCOL||!["profile-proposal","profile-vote","profile-contribution","profile-recovery"].includes(body.kind)||!SELF_CERTIFYING_AGENT_UUAID.test(body.issuer)||!/^[0-9a-f]{64}$/.test(body.publicKey)||!/^[0-9a-f]{128}$/.test(signature))throw new Error("Invalid agent document");
   if(Keychain.localIdFromKey(Buffer.from(body.publicKey,"hex"))!==body.issuer.split(":")[3])throw new Error("Agent key is not bound to UUAID");
   if(!Keychain.verifyDetached(body.publicKey,Buffer.from(jcs(body)),Buffer.from(signature,"hex")))throw new Error("Invalid document signature");
   return body;