agents-city 0.3.0 → 0.5.1

package/bin/serve.py

@@ -23,11 +23,12 @@ import re
 import secrets
 import shutil
 import signal
+import sqlite3
 import socketserver
+import stat
 import subprocess
 import sys
 import threading
-import time
 import urllib.parse
 import webbrowser
 
@@ -36,14 +37,16 @@ sys.path.insert(0, AQUI)
 import setup as W  # noqa: E402  legacy template catalogue used by the Hall
 
 sys.path.insert(0, os.path.join(os.path.dirname(AQUI), "plugin", "scripts"))
-import busca  # noqa: E402  the one disk scanner: repos, worktrees, documents
 import card  # noqa: E402
 import domains  # noqa: E402
 import gh  # noqa: E402
 import parcels  # noqa: E402
 import units  # noqa: E402
+import busca  # noqa: E402  the disk scanner, and the one list of where work lives
 import cities  # noqa: E402
+import demos  # noqa: E402  the recorded demos the Hall plays back
 import roads  # noqa: E402
+import reception  # noqa: E402
 import capabilities  # noqa: E402
 import deliberations  # noqa: E402
 import avatar  # noqa: E402
@@ -129,7 +132,7 @@ def contador_git_local(a, datos):
     plain commits, activity the last thirty days. Without this, `_code`
     honestly answers zero and every code agent's sheet showed an empty house
     no matter how much it had built. The disk index a legacy agent needs is
-    memoised inside capabilities, so N agents cost one find-repos scan.
+    memoised inside capabilities, so N agents cost one disk scan.
     """
     import time
 
@@ -188,6 +191,22 @@ def estado_seguro_agentes(datos):
         return []
 
 
+def resumen_recepcion_segura():
+    """A damaged optional inbox must not make the whole local Hall disappear."""
+    try:
+        return reception.resumen()
+    except (OSError, sqlite3.Error, reception.ReceptionError) as e:
+        return {
+            "pending": 0,
+            "pendingBytes": 0,
+            "routingMode": "manual",
+            "reviewPolicy": "every_message",
+            "routerProfile": None,
+            "autoAvailable": False,
+            "error": str(e),
+        }
+
+
 def olvida_skills():
     """Forget the discovery memo: a skill was installed or removed, and that
     changes the answer without touching the card."""
@@ -402,24 +421,6 @@ def historia_del_demo(datos):
     historia = lee_clave(os.path.join(datos, "city.yml"), "domain")
     return historia if historia in DEMO_STORIES else "software"
 
-# Where people actually keep their code. The curses wizard offered `~/code` and
-# nothing else, which is wrong on most machines and silently scans a folder that
-# is not there. Offer the ones that exist, most-repos first, and let them type.
-CANDIDATAS = [
-    "code",
-    "codigo",
-    "src",
-    "dev",
-    "devel",
-    "projects",
-    "proyectos",
-    "work",
-    "trabajo",
-    "repos",
-    "git",
-    "Developer",
-    "Documents",
-]
 
 
 def glob_fichas(datos):
@@ -522,30 +523,19 @@ def actividad_viva(datos):
         return {"online": False, "url": "", "city": "", "started_at": ""}
 
 
-def _dia(cuando):
-    """A unix time as a plain date, or nothing. The picker shows when a place
-    was last touched, and an epoch integer is not something anybody reads."""
-    if not cuando:
+def _que_es_git(ruta):
+    """`repo`, `worktree`, or nothing. A label on a row, never a filter: the
+    picker shows every folder and lets the person decide which one matters."""
+    try:
+        # One stat, not an isdir followed by an isfile: a clone's `.git` is a
+        # directory and a linked worktree's is a file, and that is the whole
+        # question.
+        modo = os.stat(os.path.join(ruta, ".git")).st_mode
+    except OSError:
         return ""
-    return time.strftime("%Y-%m-%d", time.localtime(cuando))
+    return "repo" if stat.S_ISDIR(modo) else "worktree"
 
 
-def carpetas_probables():
-    """Existing folders under $HOME that look like where the work lives."""
-    casa = os.path.expanduser("~")
-    fuera = []
-    for n in CANDIDATAS:
-        ruta = os.path.join(casa, n)
-        if not os.path.isdir(ruta):
-            continue
-        try:
-            hijos = [x for x in os.listdir(ruta) if not x.startswith(".")]
-            gits = sum(1 for x in hijos if os.path.isdir(os.path.join(ruta, x, ".git")))
-        except OSError:
-            continue
-        fuera.append({"ruta": ruta, "nombre": n, "items": len(hijos), "gits": gits})
-    fuera.sort(key=lambda c: (-c["gits"], -c["items"]))
-    return fuera
 
 
 def catalogo_roles(dominio):
@@ -699,9 +689,11 @@ class Manejador(http.server.BaseHTTPRequestHandler):
         "/api/estado": "g_estado",
         "/api/instrucciones": "g_instrucciones",
         "/api/live": "g_live",
-        "/api/misrepos": "g_misrepos",
+        "/api/carpeta": "g_carpeta",
+        "/api/demos": "g_demos",
         "/api/domains": "g_domains",
         "/api/roles": "g_roles",
+        "/api/reception": "g_reception",
     }
     POSTS = {
         "/api/ficha": "p_ficha",
@@ -713,6 +705,7 @@ class Manejador(http.server.BaseHTTPRequestHandler):
         "/api/ciudad-archiva": "p_archiva_ciudad",
         "/api/ciudad-reinicia": "p_reinicia_ciudad",
         "/api/roads": "p_roads",
+        "/api/reception": "p_reception",
         "/api/agente": "p_agente",
         "/api/agentes": "p_agentes",
         "/api/montaje": "p_montaje",
@@ -834,6 +827,7 @@ class Manejador(http.server.BaseHTTPRequestHandler):
                 # Registration is earned by writing to one, never by looking.
                 "ciudades": lista_con(datos),
                 "roads": roads.lee(datos),
+                "reception": resumen_recepcion_segura(),
                 "invitation": roads.invitacion(datos, owner),
                 "skills": habilidades,
                 "deliberations": deliberations.lista(datos),
@@ -852,58 +846,98 @@ class Manejador(http.server.BaseHTTPRequestHandler):
     def g_live(self, q):
         return self.responde(actividad_viva(self.ciudad(q)))
 
-    def g_misrepos(self, q):
-        """Everything on this disk an agent could be given to work on.
+    def g_reception(self, q):
+        """Owner-level remote quarantine; it is deliberately not city-scoped."""
+        try:
+            return self.responde(reception.estado(seat.quien_soy(), actual=self.ciudad(q)))
+        except (OSError, sqlite3.Error, reception.ReceptionError) as e:
+            return self.responde({"error": str(e)}, codigo=503)
 
-        Repositories, linked worktrees and folders of documents, most recently
-        touched first — the same index the seat and the launcher read, so the
-        picker and the terminal can never disagree about what is out there.
+    def g_demos(self, q):
+        """The recorded demos, and one of them in full when asked by name.
 
-        The version before this one ran `git log` in every repository to mark
-        the ones you had committed to. On a machine with three hundred clones
-        that is three hundred processes while somebody watches a spinner, and
-        the answer it bought — "yours" — is one a single-user product can read
-        off the filesystem for free: what you touched this month is yours.
+        These are recordings, not simulations: `demo/graba.py` plays each story
+        over the real local bus and keeps the exact stream a spectator saw, so
+        the Hall can replay a committee without a provider account and without
+        the browser owning a second, drifting copy of the state machine.
         """
-        # ?refresh=1 rebuilds the index first. The cache lasts a day, and the
-        # repo somebody just cloned is exactly the one they came to tick.
+        cual = q.get("story", [""])[0]
+        if not cual:
+            return self.responde({"demos": demos.catalogo()})
+        # One read of one file: the card is derived from the very events being
+        # served, rather than building the whole shelf to look one row up.
+        eventos = demos.eventos(cual)
+        if not eventos:
+            return self.responde({"error": "no such demo"}, codigo=404)
+        return self.responde({**(demos.ficha(cual, eventos) or {}), "eventos": eventos})
+
+    def g_carpeta(self, q):
+        """One folder, listed: what is in it, and what each thing is.
+
+        This replaced a picker that scanned the whole disk and offered what it
+        thought you wanted. It was wrong to do that. A person choosing what an
+        agent works on knows where their work is, and being handed a guessed
+        list of two hundred repositories is not help — it is a second thing to
+        read before you can do the thing you came to do. So: a folder, its
+        contents, and you walk.
+
+        Read-only, and metadata only. It never opens a file. The Hall is already
+        bound to the loopback behind a per-run token, and mounting an arbitrary
+        path was always allowed from here; listing one is strictly less.
+        """
+        pedida = q.get("path", ["~"])[0] or "~"
+        ruta = os.path.realpath(os.path.expanduser(pedida))
+        if not os.path.isdir(ruta):
+            return self.responde({"error": f"there is no folder at {ruta}"}, codigo=404)
+        ocultos = bool(q.get("hidden", [""])[0])
+        entradas = []
         try:
-            sitios = busca.lugares(refrescar=bool(q.get("refresh", [""])[0]))
-        except OSError:
-            sitios = []
-        frontera = time.time() - 60 * 86400
+            with os.scandir(ruta) as it:
+                for e in it:
+                    if e.name.startswith(".") and not ocultos:
+                        continue
+                    try:
+                        es_dir = e.is_dir(follow_symlinks=True)
+                    except OSError:
+                        es_dir = False
+                    entradas.append(
+                        {
+                            "nombre": e.name,
+                            "ruta": os.path.join(ruta, e.name),
+                            "dir": es_dir,
+                            "enlace": e.is_symlink(),
+                        }
+                    )
+        except OSError as error:
+            return self.responde({"error": str(error)}, codigo=403)
+        # Folders first, then files, each alphabetical and case-insensitive —
+        # the order every file picker has used for forty years.
+        entradas.sort(key=lambda x: (not x["dir"], x["nombre"].lower()))
+        recortada = len(entradas) > 2000
+        entradas = entradas[:2000]
+        # Only now, and only for the rows that will be sent. Asking every entry
+        # in a twenty-thousand-item directory whether it holds a `.git` was
+        # eighteen thousand pairs of stat calls for rows nobody would see. What
+        # kind of place this is gets said plainly rather than used to filter
+        # anything out: a folder is yours to pick whether or not it holds one.
+        for e in entradas:
+            e["git"] = _que_es_git(e["ruta"]) if e["dir"] else ""
+        casa = os.path.expanduser("~")
+        arriba = os.path.dirname(ruta)
         return self.responde(
             {
-                "repos": [
-                    {
-                        "nombre": s["nombre"],
-                        "ruta": s["ruta"],
-                        "clase": s.get("clase", "repo"),
-                        "cuando": _dia(s.get("cuando", 0.0)),
-                        "mio": s.get("cuando", 0.0) >= frontera,
-                    }
-                    for s in sitios
-                ]
+                "ruta": ruta,
+                "arriba": arriba if arriba != ruta else "",
+                "atajos": [
+                    {"nombre": os.path.basename(c) or c, "ruta": c}
+                    for c in [casa] + [os.path.join(casa, n) for n in busca.CANDIDATAS]
+                    if os.path.isdir(c)
+                ],
+                "entradas": entradas,
+                "recortada": recortada,
             }
         )
 
-    def g_arranque(self, q):
-        plants = W.plantillas()
-        return self.responde(
-            {
-                "kinds": plants,
-                "destino": DESTINO,
-                "casa": os.path.expanduser("~"),
-                "carpetas": carpetas_probables(),
-                # Only whether the CLI is there. Whether it is logged in is the
-                # orgs endpoint's answer, and asking it here would make every
-                # page load wait on a network call.
-                "gh": bool(shutil.which("gh")),
-                "existe": os.path.isdir(DESTINO),
-                "paleta": [{"hex": c, "nombre": n} for c, n in W.PALETA],
-                "arquitectos": sorted(ARQUITECTOS),
-            }
-        )
 
     def g_roles(self, q):
         if q.get("scope", [""])[0] == "agent":
@@ -921,29 +955,7 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             }
         )
 
-    def g_orgs(self, q):
-        return self.responde({"orgs": W.orgs_de_gh()})
 
-    def g_repos(self, q):
-        org = q.get("org", [""])[0]
-        if org:
-            hallados = [
-                {"nombre": n, "detalle": d, "fecha": f, "ruta": ""}
-                for n, d, f in W.repos_de_org(org)
-            ]
-            return self.responde({"repos": hallados})
-        base = os.path.expanduser(q.get("ruta", [""])[0])
-        if not base or not os.path.isdir(base):
-            return self.responde({"repos": [], "error": f"{base or '(empty)'} is not a folder"})
-        # Two different third columns, and saying so beats guessing in the page:
-        # a git repo reports its last commit, any-folder reports what is inside.
-        if q.get("modo", ["git"])[0] == "git":
-            crudo = W.repos_del_disco(base)
-            repos = [{"nombre": n, "ruta": r, "detalle": "", "fecha": f} for n, r, f in crudo]
-        else:
-            crudo = W.carpetas_del_disco(base)
-            repos = [{"nombre": n, "ruta": r, "detalle": d, "fecha": ""} for n, r, d in crudo]
-        return self.responde({"repos": repos})
 
     def g_gente(self, q):
         org = q.get("org", [""])[0]
@@ -1189,6 +1201,51 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             return self.responde({"error": str(e)}, codigo=400)
         return self.responde({"ok": True, "roads": roads.lee(origen)})
 
+    def p_reception(self, q, cuerpo):
+        """One human decision, committed before any city can consume the text."""
+        if cuerpo.get("action") == "configure":
+            try:
+                return self.responde(
+                    reception.configura(
+                        seat.quien_soy(),
+                        cuerpo.get("routing_mode"),
+                        cuerpo.get("rules"),
+                        self.ciudad(q),
+                    )
+                )
+            except reception.ReceptionError as e:
+                return self.responde({"error": str(e)}, codigo=400)
+            except (OSError, sqlite3.Error) as e:
+                return self.responde({"error": f"reception unavailable: {e}"}, codigo=503)
+        if cuerpo.get("action") == "send":
+            try:
+                return self.responde(
+                    reception.envia(cuerpo.get("connection_id"), cuerpo.get("text")),
+                    codigo=202,
+                )
+            except reception.ReceptionError as e:
+                return self.responde({"error": str(e)}, codigo=400)
+            except (OSError, sqlite3.Error) as e:
+                return self.responde({"error": f"reception unavailable: {e}"}, codigo=503)
+        destinos = cuerpo.get("destinations") or []
+        if not isinstance(destinos, list):
+            return self.responde({"error": "destinations must be a list"}, codigo=400)
+        try:
+            resultado = reception.decide(
+                seat.quien_soy(),
+                cuerpo.get("message_id"),
+                cuerpo.get("action"),
+                destinos,
+                cuerpo.get("reason"),
+                self.ciudad(q),
+            )
+        except reception.ReceptionError as e:
+            codigo = 409 if "already" in str(e) or "conflict" in str(e) else 400
+            return self.responde({"error": str(e)}, codigo=codigo)
+        except (OSError, sqlite3.Error) as e:
+            return self.responde({"error": f"reception unavailable: {e}"}, codigo=503)
+        return self.responde(resultado)
+
     def p_mapa(self, q, cuerpo):
         # Bake and serve the map, detached. First run builds the front end and
         # seeds the local D1, so the page polls /api/estado until it is up.
@@ -1237,7 +1294,12 @@ class Manejador(http.server.BaseHTTPRequestHandler):
     # nothing, never a shell fragment". `runtime` maps to `runs.` — the launcher's
     # own key — and the web deliberately cannot reach the terminal: fallback.
     CAMPOS_DE_AGENTE = {
-        "model": ("model", re.compile(r"[a-z0-9][a-z0-9.-]{0,63}"), "that is not a model alias"),
+        # A model name is whatever the CLI in play calls it: `opus`, but also
+        # `gpt-5.6-sol` and OpenCode's `anthropic/claude-sonnet-4`. Slash,
+        # underscore and colon are in; whitespace, quotes and every shell
+        # metacharacter stay out, because this value ends up on a command line.
+        "model": ("model", re.compile(r"[a-z0-9][a-z0-9./:_-]{0,63}"),
+                  "that is not a model name"),
         "effort": ("effort", frozenset(("low", "medium", "high", "xhigh", "max")),
                    "effort is low..max or empty"),
         "runtime": ("runs", frozenset(("claude",) + seat.OTROS_MOTORES),
@@ -1326,8 +1388,11 @@ class Manejador(http.server.BaseHTTPRequestHandler):
             ]
         elif anadir:
             destino = os.path.realpath(os.path.expanduser(anadir))
-            if not os.path.isdir(destino):
-                return self.responde({"error": f"there is no folder at {destino}"}, codigo=400)
+            # A folder, or one exact file. Both are things somebody legitimately
+            # wants an agent to work on — a handbook is a folder, a spec is a
+            # file — and the workspace links either the same way.
+            if not os.path.exists(destino):
+                return self.responde({"error": f"there is nothing at {destino}"}, codigo=400)
             try:
                 workspace.monta(datos, a.slug, destino)
             except (OSError, ValueError) as e:

package/bin/test

@@ -22,7 +22,7 @@ if [ -d .git ] && [ -x .githooks/pre-commit ] \
     && printf '  pre-commit gate armed (core.hooksPath .githooks)\n'
 fi
 
-SUITES=(widgets card parcels domains busca serve seat cities channel committee live-feed runtime claude-runtime runtime-ui runtime-failures stress adapter benchmark demo contracts exit rutas cage broker evidencia admision pairing hall-protocol doctor security workspace avatar crecimiento atajos navegador actualiza launch)
+SUITES=(widgets card parcels domains busca arnes i18n serve seat cities channel connect committee live-feed runtime claude-runtime runtime-ui runtime-failures stress adapter benchmark demo contracts exit rutas cage broker evidencia admision pairing hall-protocol doctor security workspace avatar crecimiento atajos navegador actualiza desinstala launch)
 [ $# -gt 0 ] && SUITES=("$@")
 
 fallos=0
@@ -89,26 +89,40 @@ necesarios = ["bin/agents-city.js", "bin/hall", "bin/seat", "bin/city", "bin/dem
               "plugin/scripts/hall_protocol.py", "plugin/scripts/doctor.py",
               "plugin/scripts/workspace.py", "plugin/scripts/avatar.py",
               "plugin/scripts/crecimiento.py",
-              "plugin/scripts/reset.py", "plugin/scripts/capabilities.py",
+              "plugin/scripts/reset.py", "plugin/scripts/desinstala.py",
+              "plugin/scripts/demos.py", "plugin/scripts/arnes.py",
+              "plugin/channel/runtime/arnes.json", "plugin/scripts/capabilities.py",
               "plugin/scripts/deliberations.py",
               "plugin/scripts/runtime_processes.py",
               "plugin/scripts/runtime_log.py", "plugin/scripts/logs.py",
               "plugin/scripts/launch.py", "plugin/scripts/hook_activity.py",
+              "plugin/scripts/reception.py",
               "plugin/scripts/city-session.sh", "plugin/scripts/city-runtime.sh",
               "plugin/scripts/find-repos.sh",
               "plugin/scripts/busca.py",
               "plugin/channel/bus.js", "plugin/channel/local-hub.js",
               "plugin/channel/client.js", "plugin/channel/adapter.js",
+              "plugin/channel/managed-connect-client.js",
+              "plugin/channel/managed-connect-client.d.ts",
+              "plugin/channel/managed-connect-client.manifest.json",
+              "plugin/channel/trust/agents-city-sandbox-roots.json",
+              "plugin/channel/kinsh_vodozemac_wasm_bg.wasm",
+              "plugin/channel/agents_city_hybrid_crypto_bg.wasm",
+              "plugin/channel/licenses/CONNECT_CLIENT_THIRD_PARTY_NOTICES.md",
+              "plugin/channel/managed-connect-cli.js", "bin/connect",
               "plugin/channel/runtime-gateway.js",
               "plugin/.mcp.json",
               "bin/cities", "bin/road", "bin/bus", "bin/committee", "bin/agents",
-              "bin/reset", "bin/skills", "bin/benchmark", "bin/logs",
+              "bin/reset", "bin/uninstall", "bin/skills", "bin/benchmark", "bin/logs",
+              "demo/graba.py", "demo/grabaciones/software.jsonl",
+              "demo/grabaciones/medicina.jsonl", "demo/grabaciones/legal.jsonl",
               "benchmarks/committee/run.py",
               "benchmarks/latency/live.py", "benchmarks/latency/README.md",
               "benchmarks/latency/fake-native-server.mjs",
               "benchmarks/latency/fake-claude-cli.mjs",
               "benchmarks/stress/run.py", "benchmarks/stress/README.md",
-              "city/web/src/repo-roles.ts",
+              "benchmarks/reception/run.mjs", "benchmarks/reception/README.md",
+              "city/web/src/repo-roles.ts", "city/web/src/vista.ts",
               "demo/show.py", "demo/city/city.yml", "demo/city/ada.md",
               "city/scripts/seed.py", "city/worker/schema.sql", "demo/parcels.yml"]
 problemas = [f"missing: {n}" for n in necesarios if n not in dentro]

package/bin/test-arnes.py

@@ -0,0 +1,192 @@
+#!/usr/bin/env python3
+"""What this product does to somebody else's CLI, and whether it says so.
+
+The whole pitch is that Agents City orchestrates the CLIs people already run,
+with the plugins, skills, MCP servers and settings they already have. That is a
+claim about someone else's machine, and a claim like that is worth exactly as
+much as the command that checks it.
+
+So there are two things to defend here, and the second is the hard one:
+
+  1. the report reads what is actually on the disk, and never invents a fact
+     about a file it could not read;
+  2. the report and the RUNTIME cannot drift. Every value the connectors impose
+     comes out of `arnes.json`, and nothing is imposed that the declaration does
+     not mention. A product that quietly injects an instruction it does not
+     print is exactly what this file exists to catch — and it caught one while
+     it was being written.
+"""
+
+import json
+import os
+import re
+import sys
+import tempfile
+
+AQUI = os.path.dirname(os.path.abspath(__file__))
+RAIZ = os.path.dirname(AQUI)
+sys.path.insert(0, AQUI)
+sys.path.insert(0, os.path.join(RAIZ, "plugin", "scripts"))
+
+import arnes  # noqa: E402
+from testlib import afirma, comprueba, resumen  # noqa: E402
+
+RUNTIME = os.path.join(RAIZ, "plugin", "channel", "runtime")
+
+
+def la_declaracion():
+    print("  the declaration")
+    motores = arnes.declaracion()
+    afirma("· every runtime the product launches is declared",
+           sorted(motores) == ["claude", "codex", "kimi", "opencode"], str(sorted(motores)))
+    for nombre, motor in motores.items():
+        for clave in ("binario", "config", "trato", "hereda", "respeta"):
+            afirma(f"· {nombre} declares {clave}", clave in motor, str(sorted(motor)))
+        for t in motor["trato"]:
+            afirma(f"· {nombre}/{t['clave']} says how it is applied", bool(t.get("via")), str(t))
+            # The reason is not decoration. Somebody reading this report is
+            # deciding whether to trust the product with their machine, and
+            # "because we do" is not an answer they can weigh.
+            afirma(f"· {nombre}/{t['clave']} says why", len(t.get("porque", "")) > 25, str(t))
+
+
+def sin_deriva():
+    print("  the report cannot drift from the behaviour")
+    # Comments are stripped first. A check that cannot tell a value from a
+    # sentence about that value teaches people to write worse comments, and the
+    # comments in these files are load-bearing.
+    def codigo(nombre):
+        texto = open(os.path.join(RUNTIME, f"{nombre}.ts"), encoding="utf-8").read()
+        texto = re.sub(r"/\*.*?\*/", "", texto, flags=re.S)
+        return "\n".join(l for l in texto.split("\n") if not l.strip().startswith("//"))
+
+    fuentes = {n: codigo(n) for n in ("codex", "kimi", "opencode", "claude")}
+    # Claude's deal is applied by the shell launcher, not by claude.ts. Scanning
+    # only the connectors meant this guard passed VACUOUSLY for the one runtime
+    # whose values were respelled somewhere else — the exact failure it exists
+    # to catch, hiding in the place it could not see.
+    fuentes["claude"] += "\n" + open(
+        os.path.join(RAIZ, "plugin", "scripts", "city-session.sh"), encoding="utf-8"
+    ).read()
+    motores = arnes.declaracion()
+
+    # Every declared value is READ from the declaration, never respelled.
+    for nombre, motor in motores.items():
+        for t in motor["trato"]:
+            valor = t["valor"]
+            if len(valor) < 12:
+                continue  # a short literal like "auto" is not a drift risk
+            afirma(
+                f"· {nombre}/{t['clave']} is not spelled a second time in {nombre}.ts",
+                valor not in fuentes[nombre], f"{valor[:60]}… appears inline",
+            )
+
+    # And nothing is imposed that the declaration does not mention. These are
+    # the shapes a runtime uses to put words or policy into somebody's agent.
+    sospechosas = ("developerInstructions", "system_prompt", "systemPrompt",
+                   "approvalPolicy", "permission_mode", "instructions")
+    for nombre, fuente in fuentes.items():
+        declaradas = {t["clave"] for t in motores.get(nombre, {}).get("trato", [])}
+        # A private method named after the key is how a declared value is read.
+        declaradas |= {c[0].lower() + c[1:] for c in declaradas}
+        for aguja in sospechosas:
+            if not re.search(rf"\b{aguja}\b", fuente):
+                continue
+            afirma(
+                f"· {nombre}.ts sets {aguja}, and the declaration says so",
+                aguja in declaradas or _es_metodo_declarado(aguja, declaradas),
+                f"{aguja} is imposed by {nombre}.ts and missing from arnes.json",
+            )
+
+    # The one sentence the product puts into other people's agents lives in
+    # exactly one file. It used to live in two, and one of them was undeclared.
+    frase = "You are one member of an Agents City committee"
+    fuera = [n for n, f in fuentes.items() if frase in f]
+    afirma("· the committee instruction is written in one place only",
+           not fuera, f"also inline in: {fuera}")
+
+    # And the launcher asks for the deal rather than carrying a copy of it.
+    shell = open(os.path.join(RAIZ, "plugin", "scripts", "city-session.sh"),
+                 encoding="utf-8").read()
+    afirma("· the launcher asks arnes.py for Claude's flags",
+           'arnes.py" flags claude' in shell, "")
+    banderas = arnes.banderas("claude")
+    for trozo in ("--settings", "crossSessionInbound", "--disallowed-tools",
+                  "SendMessage,ListAgents"):
+        afirma(f"· and they are built from the declaration: {trozo}",
+               trozo in banderas, banderas)
+    afirma("· a runtime whose deal is not command-line shaped gets no flags",
+           arnes.banderas("codex") == "" and arnes.banderas("opencode") == "",
+           f"codex={arnes.banderas('codex')!r}")
+
+
+def _es_metodo_declarado(aguja, declaradas):
+    """`approvalPolicy` declared, read through a method of the same name."""
+    return any(aguja.lower() == d.lower() for d in declaradas)
+
+
+def lo_que_hay_en_el_disco():
+    print("  it reads the machine, and admits what it cannot read")
+    casa = tempfile.mkdtemp()
+    toml = os.path.join(casa, "config.toml")
+    open(toml, "w", encoding="utf-8").write(
+        '# a comment\n'
+        'model = "gpt-5.6-sol"\n'
+        "model_reasoning_effort = 'max'\n"
+        "suelto = 3\n"
+        "[features]\n"
+        'oculto = "no debe leerse"\n'
+    )
+    plano = arnes._lee_toml_plano(toml)
+    comprueba("· a quoted value is read", plano.get("model"), "gpt-5.6-sol")
+    comprueba("· single quotes too", plano.get("model_reasoning_effort"), "max")
+    comprueba("· and a bare one", plano.get("suelto"), "3")
+    afirma("· a comment is not a setting", "# a comment" not in plano, str(plano))
+    afirma("· and it stops at the first section rather than guessing",
+           "oculto" not in plano, str(plano))
+    comprueba("· a file that is not there is empty, not an error",
+              arnes._lee_toml_plano(os.path.join(casa, "no-hay")), {})
+
+    print("  it never invents a value")
+    afirma("· a long block is counted, not dumped",
+           arnes.resume({"allow": [1, 2, 3], "deny": []}) == "3 entries",
+           arnes.resume({"allow": [1, 2, 3], "deny": []}))
+    afirma("· a long string is cut, and says it was",
+           arnes.resume("x" * 200).endswith("…"), arnes.resume("x" * 200))
+    comprueba("· a short one is left alone", arnes.resume("auto"), "auto")
+
+
+def el_informe():
+    print("  the report")
+    entradas = arnes.informe(instalado=lambda _b: False)
+    comprueba("· one entry per runtime", len(entradas), 4)
+    afirma("· a CLI that is not on this machine is said to be missing",
+           all(not e["instalado"] for e in entradas), "")
+    salida = []
+    arnes.imprime(entradas, di=salida.append)
+    texto = "\n".join(salida)
+    afirma("· it separates the deal from what it inherits and what it leaves alone",
+           "the deal" in texto and "we inherit" in texto and "untouched" in texto, texto[:400])
+    afirma("· it says the deal is what makes the bus the only route",
+           "the only route" in texto, texto[-400:])
+    afirma("· and how to switch the cage off",
+           "CITY_CAGE=0" in texto, texto[-400:])
+    afirma("· a runtime that imposes nothing says so plainly",
+           "nothing — it runs exactly as you configured it" in texto, texto)
+    # It is a report about somebody's machine: it must survive not finding one.
+    vacio = arnes.informe(instalado=lambda _b: True)
+    afirma("· and it renders on a machine with no configuration at all",
+           len(vacio) == 4, str(len(vacio)))
+    json.dumps(entradas)  # the --json door must stay serialisable
+
+
+def main():
+    la_declaracion()
+    sin_deriva()
+    lo_que_hay_en_el_disco()
+    el_informe()
+    return resumen("arnes")
+
+
+if __name__ == "__main__":
+    sys.exit(main())