agent-yes 1.276.0 → 1.277.1

package/lab/ui/lab/posts/2026-07-22-ay-callback.html

@@ -3,22 +3,23 @@ title: ay callback — let readers message your agent from any web page
 tag: Feature
 summary: A signed, send-only, single-agent capability plus a one-script embed widget: report pages that can talk back, with a required expiry and a revoke kill-switch — never your serve token.
 ---
+
 <p class="lede">
-        Your agent just published a report. The person reading it has a question. Until now the
-        answer was "find the console, find the right terminal, type there." Now the report page
-        itself can carry a tiny widget that delivers the reader's message straight into that agent's
-        terminal — through a signed, send-only, single-agent capability that expires on a date you
-        chose, and never through your master token.
-      </p>
+  Your agent just published a report. The person reading it has a question. Until now the answer was
+  "find the console, find the right terminal, type there." Now the report page itself can carry a
+  tiny widget that delivers the reader's message straight into that agent's terminal — through a
+  signed, send-only, single-agent capability that expires on a date you chose, and never through
+  your master token.
+</p>
 
-      <h2 id="what">What it does <a class="anchor" href="#what">#</a></h2>
-      <p>
-        <code>ay callback</code> mints a capability for <strong>one agent</strong> and prints a
-        self-contained HTML snippet — one inline <code>&lt;script&gt;</code>, zero external
-        requests. Paste it into any page your agent publishes (a status dashboard, a nightly report,
-        a postmortem) and readers get a floating button:
-      </p>
-      <pre><code>$ ay callback --expires 7d
+<h2 id="what">What it does <a class="anchor" href="#what">#</a></h2>
+<p>
+  <code>ay callback</code> mints a capability for <strong>one agent</strong> and prints a
+  self-contained HTML snippet — one inline <code>&lt;script&gt;</code>, zero external requests.
+  Paste it into any page your agent publishes (a status dashboard, a nightly report, a postmortem)
+  and readers get a floating button:
+</p>
+<pre><code>$ ay callback --expires 7d
 callback 3b6f23e7 → claude #46555 @ ~/ws/reports
 expires:  2026-07-29T10:57:01.398Z  (7d)
 endpoint: https://x1a2b3c.agent-yes.com/cb/cb1.eyJpZCI6…
@@ -26,175 +27,221 @@ revoke:   ay callback revoke 3b6f23e7
 
 ── embed snippet ──────────────────────────────
 &lt;script&gt; … &lt;/script&gt;</code></pre>
-      <p>Here is what the widget feels like (demo only — this one talks to nobody):</p>
-      <div class="demo" id="cb-demo">
-        Imagine this box is your agent's published report page…
-        <button class="fab" id="cb-demo-fab">💬 Message the agent</button>
-        <div class="modal" id="cb-demo-modal">
-          <strong>Message the agent</strong>
-          <textarea id="cb-demo-ta" placeholder="Your message to the agent…"></textarea>
-          <button id="cb-demo-send">Send</button>
-          <div class="status" id="cb-demo-status"></div>
-        </div>
-      </div>
-      <p>
-        When a reader hits <em>Send</em>, the message lands in the agent's terminal wrapped in an
-        explicit "untrusted visitor" frame, and in its inbox. One way, by design — the visitor never
-        sees the terminal.
-      </p>
+<p>Here is what the widget feels like (demo only — this one talks to nobody):</p>
+<div class="demo" id="cb-demo">
+  Imagine this box is your agent's published report page…
+  <button class="fab" id="cb-demo-fab">💬 Message the agent</button>
+  <div class="modal" id="cb-demo-modal">
+    <strong>Message the agent</strong>
+    <textarea id="cb-demo-ta" placeholder="Your message to the agent…"></textarea>
+    <button id="cb-demo-send">Send</button>
+    <div class="status" id="cb-demo-status"></div>
+  </div>
+</div>
+<p>
+  When a reader hits <em>Send</em>, the message lands in the agent's terminal wrapped in an explicit
+  "untrusted visitor" frame, and in its inbox. One way, by design — the visitor never sees the
+  terminal.
+</p>
 
-      <h2 id="capability">
-        The capability is a hash, not a key <a class="anchor" href="#capability">#</a>
-      </h2>
-      <p>
-        The obvious-but-wrong implementation is to put your daemon's serve token in the snippet.
-        That token is a master key: whoever holds it can read every terminal, send to every agent,
-        spawn and kill. Pasting it into a public page is game over.
-      </p>
-      <p>
-        So the snippet carries a <strong>capability token</strong> instead — three dot-separated
-        parts, the last one an HMAC-SHA256 over the rest:
-      </p>
-      <pre><code>cb1 . base64url({ "id": "3b6f23e7",
+<h2 id="capability">
+  The capability is a hash, not a key <a class="anchor" href="#capability">#</a>
+</h2>
+<p>
+  The obvious-but-wrong implementation is to put your daemon's serve token in the snippet. That
+  token is a master key: whoever holds it can read every terminal, send to every agent, spawn and
+  kill. Pasting it into a public page is game over.
+</p>
+<p>
+  So the snippet carries a <strong>capability token</strong> instead — three dot-separated parts,
+  the last one an HMAC-SHA256 over the rest:
+</p>
+<pre><code>cb1 . base64url({ "id": "3b6f23e7",
                   "agent": "4d65a096e983",   // exactly one agent_id
                   "exp": 1785322621398 })    // hard expiry, unix ms
     . base64url(HMAC-SHA256(secret, "cb1." + payload))</code></pre>
-      <p>
-        The scope lives <em>inside the signed payload</em>. That has three consequences worth
-        spelling out:
-      </p>
-      <table>
-        <tr>
-          <th>Attack</th>
-          <th>Result</th>
-        </tr>
-        <tr>
-          <td>Edit the payload to point at another agent, or push the expiry out</td>
-          <td><span class="no">✗</span> signature no longer verifies — the daemon answers 404</td>
-        </tr>
-        <tr>
-          <td>Delete the daemon's bookkeeping to "resurrect" an expired token</td>
-          <td>
-            <span class="no">✗</span> expiry is in the token itself, not in local state — still 410
-          </td>
-        </tr>
-        <tr>
-          <td>Steal the token from the page source</td>
-          <td>
-            <span class="ok">✓</span> you can do exactly what the page could already do: send
-            rate-limited text to one agent, until the expiry the owner chose
-          </td>
-        </tr>
-      </table>
-      <p>
-        The HMAC secret is minted on first use into <code>~/.agent-yes/.callback-secret</code>
-        (0600), deliberately separate from the serve token — rotating one never invalidates the
-        other.
-      </p>
+<p>
+  The scope lives <em>inside the signed payload</em>. That has three consequences worth spelling
+  out:
+</p>
+<table>
+  <tr>
+    <th>Attack</th>
+    <th>Result</th>
+  </tr>
+  <tr>
+    <td>Edit the payload to point at another agent, or push the expiry out</td>
+    <td><span class="no">✗</span> signature no longer verifies — the daemon answers 404</td>
+  </tr>
+  <tr>
+    <td>Delete the daemon's bookkeeping to "resurrect" an expired token</td>
+    <td><span class="no">✗</span> expiry is in the token itself, not in local state — still 410</td>
+  </tr>
+  <tr>
+    <td>Steal the token from the page source</td>
+    <td>
+      <span class="ok">✓</span> you can do exactly what the page could already do: send rate-limited
+      text to one agent, until the expiry the owner chose
+    </td>
+  </tr>
+</table>
+<p>
+  The HMAC secret is minted on first use into <code>~/.agent-yes/.callback-secret</code>
+  (0600), deliberately separate from the serve token — rotating one never invalidates the other.
+</p>
 
-      <h2 id="expiry">
-        --expires is required. There is no "never" <a class="anchor" href="#expiry">#</a>
-      </h2>
-      <p>
-        Every capability API eventually grows a default lifetime, and every default lifetime
-        eventually becomes "forever, because nobody thinks about it." We refuse the default:
-      </p>
-      <pre><code>$ ay callback
+<h2 id="expiry">
+  --expires is required. There is no "never" <a class="anchor" href="#expiry">#</a>
+</h2>
+<p>
+  Every capability API eventually grows a default lifetime, and every default lifetime eventually
+  becomes "forever, because nobody thinks about it." We refuse the default:
+</p>
+<pre><code>$ ay callback
 ay callback: --expires is required (e.g. --expires 7d) —
 an embed capability must carry an explicit lifetime</code></pre>
-      <p>
-        <code>--expires</code> takes <code>30m</code>, <code>12h</code>, <code>7d</code>,
-        <code>2w</code> — and caps at 365 days. There is no <code>--expires never</code> and there
-        never will be. The point is a moment of deliberate friction: whoever pastes a capability
-        into a public page must answer "how long should this live?" while they still remember the
-        page exists. When it lapses, the widget doesn't fail silently — it tells the reader the link
-        expired and to ask the owner for a fresh one.
-      </p>
-      <p>For everything before the deadline, there's the kill switch:</p>
-      <pre><code>$ ay callback ls
+<p>
+  <code>--expires</code> takes <code>30m</code>, <code>12h</code>, <code>7d</code>,
+  <code>2w</code> — and caps at 365 days. There is no <code>--expires never</code> and there never
+  will be. The point is a moment of deliberate friction: whoever pastes a capability into a public
+  page must answer "how long should this live?" while they still remember the page exists. When it
+  lapses, the widget doesn't fail silently — it tells the reader the link expired and to ask the
+  owner for a fresh one.
+</p>
+<p>For everything before the deadline, there's the kill switch:</p>
+<pre><code>$ ay callback ls
 3b6f23e7  6d left     → claude #46555 @ ~/ws/reports
 $ ay callback revoke 3b6f23e7
 revoked 3b6f23e7</code></pre>
 
-      <h2 id="hardening">
-        A public route that leaks nothing <a class="anchor" href="#hardening">#</a>
-      </h2>
-      <p>
-        <code>POST /cb/&lt;cap&gt;</code> is the daemon's only unauthenticated write route, so it is
-        deliberately paranoid:
-      </p>
-      <ul>
-        <li>
-          <strong>Info-tight responses.</strong> The page learns <code>ok</code>,
-          <code>expired</code>, or a generic failure — never a pid, a cwd, a hostname, or whether a
-          given agent exists. Malformed and forged tokens are indistinguishable 404s.
-        </li>
-        <li>
-          <strong>Untrusted framing.</strong> Visitor text is stripped of control characters (no
-          smuggled escape sequences, no fake Enter) and wrapped in an
-          <code>&lt;ay-callback&gt;</code> block that names it an untrusted visitor message — the
-          agent is told to treat it as data, not instructions.
-        </li>
-        <li>
-          <strong>Flood control.</strong> Per-capability sliding-window rate limit and a 4&nbsp;KB
-          body cap. A public page can nudge your agent; it cannot bury it.
-        </li>
-        <li>
-          <strong>One-way.</strong> The route writes to the agent's stdin and records the inbox
-          entry. It never reads the terminal back — a public embed must not become a viewport into
-          your machine.
-        </li>
-      </ul>
-      <div class="note">
-        Two-way chat — the widget showing the agent's reply — is the obvious next step, and the
-        design line is already drawn: the page will only ever see replies the agent
-        <em>explicitly</em> addresses to that callback, never the raw terminal.
-      </div>
+<h2 id="hardening">A public route that leaks nothing <a class="anchor" href="#hardening">#</a></h2>
+<p>
+  <code>POST /cb/&lt;cap&gt;</code> is the daemon's only unauthenticated write route, so it is
+  deliberately paranoid:
+</p>
+<ul>
+  <li>
+    <strong>Info-tight responses.</strong> The page learns <code>ok</code>, <code>expired</code>, or
+    a generic failure — never a pid, a cwd, a hostname, or whether a given agent exists. Malformed
+    and forged tokens are indistinguishable 404s.
+  </li>
+  <li>
+    <strong>Untrusted framing.</strong> Visitor text is stripped of control characters (no smuggled
+    escape sequences, no fake Enter) and wrapped in an <code>&lt;ay-callback&gt;</code> block that
+    names it an untrusted visitor message — the agent is told to treat it as data, not instructions.
+  </li>
+  <li>
+    <strong>Flood control.</strong> Per-capability sliding-window rate limit and a 4&nbsp;KB body
+    cap. A public page can nudge your agent; it cannot bury it.
+  </li>
+  <li>
+    <strong>One-way.</strong> The route writes to the agent's stdin and records the inbox entry. It
+    never reads the terminal back — a public embed must not become a viewport into your machine.
+  </li>
+</ul>
+<div class="note">
+  Two-way chat — the widget showing the agent's reply — is the obvious next step, and the design
+  line is already drawn: the page will only ever see replies the agent
+  <em>explicitly</em> addresses to that callback, never the raw terminal.
+</div>
 
-      <h2 id="try">Try it <a class="anchor" href="#try">#</a></h2>
-      <pre><code>$ npm i -g agent-yes
+<h2 id="try">Try it <a class="anchor" href="#try">#</a></h2>
+<pre><code>$ npm i -g agent-yes
 $ ay serve            # local daemon
 $ ay expose …         # or put the daemon on a public URL first
 $ ay callback --expires 7d --title "Ask the report bot"</code></pre>
-      <p>
-        Paste the printed snippet at the end of anything your agent publishes. Ship the report; keep
-        the conversation.
-      </p>
+<p>
+  Paste the printed snippet at the end of anything your agent publishes. Ship the report; keep the
+  conversation.
+</p>
 <style>
   /* Inert demo replica of the widget the snippet renders. */
-  .demo{position:relative;background:var(--card);border:1px dashed var(--border);
-    border-radius:12px;min-height:180px;margin:18px 0;padding:12px 16px;color:var(--muted);font-size:.9em}
-  .demo .fab{position:absolute;right:16px;bottom:16px;padding:10px 14px;border-radius:20px;
-    border:none;background:#1a7f37;color:#fff;font:13px system-ui;cursor:pointer;
-    box-shadow:0 2px 8px rgba(0,0,0,.3)}
-  .demo .modal{position:absolute;right:16px;bottom:64px;width:min(300px,80%);background:var(--bg);
-    color:var(--fg);border:1px solid var(--border);border-radius:8px;padding:12px;font:13px system-ui;
-    box-shadow:0 4px 16px rgba(0,0,0,.25);display:none;text-align:left}
-  .demo .modal textarea{width:100%;height:64px;box-sizing:border-box;font:inherit;margin:8px 0;
-    resize:vertical;background:var(--card);color:var(--fg);border:1px solid var(--border);
-    border-radius:6px;padding:6px}
-  .demo .modal button{padding:6px 12px;border:none;border-radius:6px;background:#1a7f37;color:#fff;
-    cursor:pointer;font:inherit}
-  .demo .status{min-height:16px;font-size:12px;color:var(--muted);margin-top:6px}
+  .demo {
+    position: relative;
+    background: var(--card);
+    border: 1px dashed var(--border);
+    border-radius: 12px;
+    min-height: 180px;
+    margin: 18px 0;
+    padding: 12px 16px;
+    color: var(--muted);
+    font-size: 0.9em;
+  }
+  .demo .fab {
+    position: absolute;
+    right: 16px;
+    bottom: 16px;
+    padding: 10px 14px;
+    border-radius: 20px;
+    border: none;
+    background: #1a7f37;
+    color: #fff;
+    font: 13px system-ui;
+    cursor: pointer;
+    box-shadow: 0 2px 8px rgba(0, 0, 0, 0.3);
+  }
+  .demo .modal {
+    position: absolute;
+    right: 16px;
+    bottom: 64px;
+    width: min(300px, 80%);
+    background: var(--bg);
+    color: var(--fg);
+    border: 1px solid var(--border);
+    border-radius: 8px;
+    padding: 12px;
+    font: 13px system-ui;
+    box-shadow: 0 4px 16px rgba(0, 0, 0, 0.25);
+    display: none;
+    text-align: left;
+  }
+  .demo .modal textarea {
+    width: 100%;
+    height: 64px;
+    box-sizing: border-box;
+    font: inherit;
+    margin: 8px 0;
+    resize: vertical;
+    background: var(--card);
+    color: var(--fg);
+    border: 1px solid var(--border);
+    border-radius: 6px;
+    padding: 6px;
+  }
+  .demo .modal button {
+    padding: 6px 12px;
+    border: none;
+    border-radius: 6px;
+    background: #1a7f37;
+    color: #fff;
+    cursor: pointer;
+    font: inherit;
+  }
+  .demo .status {
+    min-height: 16px;
+    font-size: 12px;
+    color: var(--muted);
+    margin-top: 6px;
+  }
 </style>
 <script>
-      // Inert demo widget — mirrors the real snippet's UX, delivers nowhere.
-      (function () {
-        var fab = document.getElementById("cb-demo-fab");
-        var modal = document.getElementById("cb-demo-modal");
-        var ta = document.getElementById("cb-demo-ta");
-        var send = document.getElementById("cb-demo-send");
-        var status = document.getElementById("cb-demo-status");
-        fab.onclick = function () {
-          modal.style.display = modal.style.display === "block" ? "none" : "block";
-        };
-        send.onclick = function () {
-          if (!ta.value.trim()) return;
-          status.textContent = "sending…";
-          setTimeout(function () {
-            status.textContent = "Delivered. (demo — no agent was harmed)";
-            ta.value = "";
-          }, 450);
-        };
-      })();
-    </script>
+  // Inert demo widget — mirrors the real snippet's UX, delivers nowhere.
+  (function () {
+    var fab = document.getElementById("cb-demo-fab");
+    var modal = document.getElementById("cb-demo-modal");
+    var ta = document.getElementById("cb-demo-ta");
+    var send = document.getElementById("cb-demo-send");
+    var status = document.getElementById("cb-demo-status");
+    fab.onclick = function () {
+      modal.style.display = modal.style.display === "block" ? "none" : "block";
+    };
+    send.onclick = function () {
+      if (!ta.value.trim()) return;
+      status.textContent = "sending…";
+      setTimeout(function () {
+        status.textContent = "Delivered. (demo — no agent was harmed)";
+        ta.value = "";
+      }, 450);
+    };
+  })();
+</script>

package/lab/ui/lab/posts/2026-08-11-an-address-space-for-agents.md

@@ -14,13 +14,13 @@ with the parts that are still missing marked as missing.</p>
 
 Today an agent already has an identity: a stable string of the form
 `user@host:path:branch#pid`, stamped into every message it sends. That is the seed of an address
-space, and the endgame is the sentence written on the architecture map: *anyone can expose their
-own AI agent to the network with a single link, self-contained and end-to-end encrypted.*
+space, and the endgame is the sentence written on the architecture map: _anyone can expose their
+own AI agent to the network with a single link, self-contained and end-to-end encrypted._
 
 Two pieces of that exist. Links work, and they are properly end-to-end encrypted: the secret rides
 the URL fragment, the relay only ever holds a value derived through HKDF, and frames are sealed
 with keys the server has never seen. Scoped tokens work too — `ay callback` mints a capability for
-exactly one agent, send-only, with a hard expiry carried *inside* the signed payload, so revocation
+exactly one agent, send-only, with a hard expiry carried _inside_ the signed payload, so revocation
 does not depend on server-side bookkeeping surviving.
 
 The piece that does not exist yet is the general case. There is still a master token: one value
@@ -30,14 +30,14 @@ is a special case built beside it rather than a slice out of it. The work is to
 happens to include everything**, with view / steer / admin as separable grants and identity bound
 to something a person actually has (an OAuth account) rather than to possession of a string.
 
-The test for whether this is done is unglamorous and concrete: *can I hand a colleague a link that
-lets them watch one agent, in one repo, for two hours, and nothing else?* Right now the honest
+The test for whether this is done is unglamorous and concrete: _can I hand a colleague a link that
+lets them watch one agent, in one repo, for two hours, and nothing else?_ Right now the honest
 answer is "almost."
 
 ## Horizon 2 — a bus that humans are on
 
 The failure mode of agent tooling is that agents get a rich channel to each other and humans get a
-scrollback buffer. agent-yes is trying to avoid that by making the *page* the meeting point rather
+scrollback buffer. agent-yes is trying to avoid that by making the _page_ the meeting point rather
 than the terminal.
 
 Three primitives are already built and they point the same way. `ay callback` puts a message box on
@@ -76,7 +76,7 @@ reconstruct is an agent you can only use for work you were willing to lose.
 
 Three things are cluttered, and shipping features on top of clutter has a compounding cost:
 
-- **Three networking stacks that do not share a model** — HTTP, WebRTC + signaling, and a libp2p swarm. The fix is already named: make the swarm *a transport into `apiFetch`* rather than a parallel universe with its own idea of what an agent is. Then peers become just another reach surface.
+- **Three networking stacks that do not share a model** — HTTP, WebRTC + signaling, and a libp2p swarm. The fix is already named: make the swarm _a transport into `apiFetch`_ rather than a parallel universe with its own idea of what an agent is. Then peers become just another reach surface.
 - **Two runtimes that drift.** Rust is primary, TypeScript is the reference, and parity is currently defended by a hand-maintained table plus a few tests that parse both sources. That does not scale with surface area.
 - **Scattered state and several independent watchdogs.** One state directory and one liveness story, instead of a per-stack defence for each way a native dependency can freeze.
 
@@ -94,7 +94,7 @@ at a process whose entire job is to say yes. Prompt injection is not a hypotheti
 central threat model, and no amount of transport encryption touches it.
 
 The mitigations that exist are structural rather than clever: capabilities are send-only and
-single-agent where possible; visitor messages arrive wrapped in an explicit *untrusted* frame so
+single-agent where possible; visitor messages arrive wrapped in an explicit _untrusted_ frame so
 provenance is visible in the transcript rather than inferred; inter-agent messages carry attributed
 envelopes; injected text is deliberately kept inert against the wrapper's own pattern set, so a
 message can never trigger the automation that delivered it. The direction is more of that — **make
@@ -113,7 +113,7 @@ Not a bigger console. The measure is whether these become boring:
 
 The last one already holds — it is what the [local fabric](./2026-08-11-no-daemon-owns-your-agents)
 buys. The other four are the project, and so is the one not on the list: the fabric is per-machine
-files, so losing a *machine* still loses its agents, its logs and its task store.
+files, so losing a _machine_ still loses its agents, its logs and its task store.
 
 <p class="note">Start at the beginning: <a href="./2026-08-11-the-terminal-is-the-api">the terminal
 is the API</a> — why one small edit forced all of this.</p>

package/lab/ui/lab/posts/2026-08-11-no-daemon-owns-your-agents.md

@@ -49,7 +49,7 @@ has no connection to, and how liveness is classified without polling the process
 There is a fourth, smaller file that matters more than its size suggests: **`~/.agent-yes/reaper.jsonl`.**
 Each wrapper records `(wrapper_pid, agent_pgid)` before it runs, and sweeps the registry on every
 startup. If a wrapper died in a way that gave it no chance to clean up — `SIGKILL`, OOM, a power
-cut — the *next* agent to start kills its orphaned process group. Recovery does not depend on the
+cut — the _next_ agent to start kills its orphaned process group. Recovery does not depend on the
 thing that crashed being alive to notice.
 
 ## What you can do with it
@@ -57,15 +57,15 @@ thing that crashed being alive to notice.
 The fabric is not an implementation detail; it is the reason the command surface is as wide as it
 is. Everything below is live today, from any terminal, against agents started by anyone:
 
-| | |
-| --- | --- |
-| **Inspect** | `ay ls` (fleet, with the parent/child forest), `ay ps` (CPU + RSS rolled up over each agent's whole process tree), `ay status`, `ay whoami` |
-| **Read** | `ay tail -f`, `ay read` (paginated), `ay cat`, `ay head`, `ay hist` (past conversations, including exited sessions) |
-| **Steer** | `ay send`, `ay key` (raw keystrokes — drives menus), `ay select` (pick option N of a blocked menu), `ay attach`, `ay restart`, `ay stop`, `ay exit` |
-| **Coordinate** | `ay todo` (a task store shared across agents), `ay ask` / `ay answer` (a question becomes a task, with the asker and answerer both recorded), `ay msgs`, `ay result` |
-| **Reach** | `ay serve` (HTTP + browser console), `ay serve --share` (E2E-encrypted WebRTC), `ay expose <port>` (a private URL onto a local port), `ay remote`, `ay schedule` |
-| **Embed** | `ay callback` (readers message one agent), `ay term embed` (a live read-only terminal in any page), `ay widget` (an agent reads the page a human is looking at), `ay mint` (scoped, short-TTL capability tokens) |
-| **Provision** | `ay ws` (clone or refresh `<owner>/<repo>/tree/<branch>` workspaces), `ay setup`, `ay reap` |
+|                |                                                                                                                                                                                                                  |
+| -------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Inspect**    | `ay ls` (fleet, with the parent/child forest), `ay ps` (CPU + RSS rolled up over each agent's whole process tree), `ay status`, `ay whoami`                                                                      |
+| **Read**       | `ay tail -f`, `ay read` (paginated), `ay cat`, `ay head`, `ay hist` (past conversations, including exited sessions)                                                                                              |
+| **Steer**      | `ay send`, `ay key` (raw keystrokes — drives menus), `ay select` (pick option N of a blocked menu), `ay attach`, `ay restart`, `ay stop`, `ay exit`                                                              |
+| **Coordinate** | `ay todo` (a task store shared across agents), `ay ask` / `ay answer` (a question becomes a task, with the asker and answerer both recorded), `ay msgs`, `ay result`                                             |
+| **Reach**      | `ay serve` (HTTP + browser console), `ay serve --share` (E2E-encrypted WebRTC), `ay expose <port>` (a private URL onto a local port), `ay remote`, `ay schedule`                                                 |
+| **Embed**      | `ay callback` (readers message one agent), `ay term embed` (a live read-only terminal in any page), `ay widget` (an agent reads the page a human is looking at), `ay mint` (scoped, short-TTL capability tokens) |
+| **Provision**  | `ay ws` (clone or refresh `<owner>/<repo>/tree/<branch>` workspaces), `ay setup`, `ay reap`                                                                                                                      |
 
 The pattern repeats: each of those is a small program over the same three files, which is why they
 compose. Looping the pids from `ay ls --json` into a per-pid `ay tail` is a fleet dashboard.
@@ -99,7 +99,7 @@ apiFetch(req: Request) → Response
 
 `ay serve`'s HTTP listener calls it. The WebRTC bridge calls it in-process. Neither is a control
 plane; they are pipes into the same function. (The port-exposure tunnel sits on the other side of
-that line — it is *started* through the handler, by `POST /api/expose`, and then proxies raw bytes
+that line — it is _started_ through the handler, by `POST /api/expose`, and then proxies raw bytes
 to a local port. A consumer, not a caller.) Adding a
 transport — a relay, a peer mesh, something not invented yet — means writing a caller, not a second
 system with its own notion of what an agent is.
@@ -113,7 +113,7 @@ Honesty is the point of a lab, so: file-based coordination has real edges, and m
 ones have already drawn blood.
 
 **Concurrent appends interleave.** A pipe only guarantees atomicity below `PIPE_BUF`. Two agents
-writing a large message to the same FIFO at the same moment produced *byte-level* interleaving —
+writing a large message to the same FIFO at the same moment produced _byte-level_ interleaving —
 one logical message arriving in dozens of fragments, mixed with another's. The fix is an advisory
 lock around IPC writes, and the guarantee it provides is worth stating precisely: **messages do not
 interleave; they are not ordered.** Anything that needs ordering has to say so itself.
@@ -132,7 +132,7 @@ liveness is currently defended by several independent watchdogs instead of one s
 those is on the list, not done.
 
 None of these argue for a supervisor. They argue that "no central owner" moves the difficulty from
-*availability* to *concurrency* — and concurrency bugs, unlike outages, can be fixed once and stay
+_availability_ to _concurrency_ — and concurrency bugs, unlike outages, can be fixed once and stay
 fixed.
 
 <p class="note">Next: <a href="./2026-08-11-an-address-space-for-agents">an address space for