aimeat 1.2.6 → 1.3.0

package/dist/.env.example

@@ -177,7 +177,11 @@ AIMEAT_PORT=40050
 # AIMEAT_EUDIW_REDIRECT_URI="https://your-node.example/v1/ghii/verify/eudiw/callback"
 # AIMEAT_FTN_ENABLED=false
 # AIMEAT_FTN_PROVIDER_URL="https://tunnistautuminen.suomi.fi"
+# AIMEAT_FTN_CLIENT_ID=""                                      # OIDC client_id from FTN broker
+# AIMEAT_FTN_CLIENT_SECRET=""                                  # OIDC client_secret from FTN broker
 # AIMEAT_VC_ISSUER_DID="did:web:your-node.example"
+# AIMEAT_NONCE_TTL_SECONDS=300                                 # verification nonce TTL (60-3600)
+# AIMEAT_NATIONAL_EID_PID_CLAIM="personal_identity_code"       # FI: personal_identity_code, SE: personalNumber, DK: dk.cpr
 
 # ── Consul (optional fleet management) ───────────────────────
 # Connect to HashiCorp Consul for centralized config management across nodes.

package/dist/locales/en.json

@@ -676,8 +676,8 @@
       "launch": "Launch"
     },
     "v8ext": {
-      "title": "V8 Extensions",
-      "desc": "Sandboxed JavaScript extensions that run server-side. Each extension provides actions that can be called via API or from apps.",
+      "title": "Server Extensions",
+      "desc": "Sandboxed JavaScript extensions that run server-side in a secure isolate. Each extension provides actions that can be called via API or from apps.",
       "back": "Back",
       "author": "Author",
       "statusActive": "Active",
@@ -4562,5 +4562,77 @@
     "copyBtn": "Copy to clipboard",
     "copied": "Copied!",
     "loadError": "Failed to load help prompt."
+  },
+  "capabilities": {
+    "title": "Capabilities",
+    "tabLabel": "Capabilities",
+    "create": "Create Capability",
+    "edit": "Edit",
+    "delete": "Delete",
+    "name": "Name",
+    "summary": "Summary",
+    "status": "Status",
+    "visibility": "Visibility",
+    "source": "Source",
+    "sourceType": "Source Type",
+    "callable": "Callable",
+    "tags": "Tags",
+    "invocations": "Invocations",
+    "errors": "Errors",
+    "successRate": "Success Rate",
+    "lastInvoked": "Last Invoked",
+    "avgResponseMs": "Avg Response",
+    "vouch": "Vouch",
+    "unvouch": "Remove Vouch",
+    "vouchCount": "Vouches",
+    "pendingReview": "Pending Review",
+    "approve": "Approve",
+    "reject": "Reject",
+    "disable": "Disable",
+    "enable": "Enable",
+    "test": "Test",
+    "invoke": "Invoke",
+    "logs": "Logs",
+    "override": "Override",
+    "operatorNotes": "Operator Notes",
+    "noCapabilities": "No capabilities found",
+    "browserOnly": "Browser only",
+    "discoveryOnly": "Discovery only",
+    "owner": "Owner",
+    "authRequired": "Auth Required",
+    "cost": "Cost",
+    "deprecated": "Deprecated",
+    "manual": "Manual",
+    "auto": "Auto-aggregated",
+    "createSuccess": "Capability created",
+    "deleteSuccess": "Capability deleted",
+    "deleteConfirm": "Delete this capability?",
+    "vouchSuccess": "Vouched!",
+    "cannotVouchOwn": "Cannot vouch for your own capability",
+    "testResult": "Test Result",
+    "adminTitle": "All Capabilities",
+    "nodeCapabilities": "Node Capabilities",
+    "nodeCapabilitiesDesc": "These are all the capabilities currently available on this node. Capabilities are created automatically when you activate extensions or cortex modules.",
+    "howCreated": "How capabilities are created",
+    "howCreatedDesc": "Install and activate extensions (Extensions tab) or cortex modules to automatically register capabilities. You can also create manual capabilities if the node policy allows it.",
+    "policyTitle": "Capability Policy",
+    "policyPublishing": "Publishing",
+    "policyPublishers": "Publishers",
+    "policyWebhooks": "Webhooks",
+    "policyDisabled": "Disabled",
+    "policySelfOnly": "Self only (private)",
+    "policyModerated": "Moderated (operator review)",
+    "policyOpen": "Open",
+    "policyAllUsers": "All users",
+    "policyTrustedOnly": "Trusted users only",
+    "policyAllowlist": "Allowlist only",
+    "policyAllowlistOnly": "Allowlist only",
+    "extension": "Extension",
+    "cortex": "Cortex",
+    "action": "Action",
+    "allTypes": "All types",
+    "filterByType": "Filter by source",
+    "myCapabilities": "My Capabilities",
+    "totalCount": "{count} capabilities"
   }
 }

package/dist/locales/fi.json

@@ -676,8 +676,8 @@
       "launch": "Käynnistä"
     },
     "v8ext": {
-      "title": "V8-laajennukset",
-      "desc": "Hiekkalaatikoituja JavaScript-laajennuksia jotka ajavat palvelimella. Jokainen laajennus tarjoaa toimintoja joita voi kutsua API:n kautta tai sovelluksista.",
+      "title": "Palvelinlaajennukset",
+      "desc": "Hiekkalaatikoituja JavaScript-laajennuksia jotka ajavat palvelimella turvallisessa eristysympäristössä. Jokainen laajennus tarjoaa toimintoja joita voi kutsua API:n kautta tai sovelluksista.",
       "back": "Takaisin",
       "author": "Tekijä",
       "statusActive": "Aktiivinen",
@@ -4562,5 +4562,77 @@
     "copyBtn": "Kopioi leikepöydälle",
     "copied": "Kopioitu!",
     "loadError": "Apukehotteen lataaminen epäonnistui."
+  },
+  "capabilities": {
+    "title": "Kyvykkyydet",
+    "tabLabel": "Kyvykkyydet",
+    "create": "Luo kyvykkyys",
+    "edit": "Muokkaa",
+    "delete": "Poista",
+    "name": "Nimi",
+    "summary": "Kuvaus",
+    "status": "Tila",
+    "visibility": "Näkyvyys",
+    "source": "Lähde",
+    "sourceType": "Lähdetyyppi",
+    "callable": "Kutsuttava",
+    "tags": "Tagit",
+    "invocations": "Kutsut",
+    "errors": "Virheet",
+    "successRate": "Onnistumis-%",
+    "lastInvoked": "Viimeksi kutsuttu",
+    "avgResponseMs": "Keskiarvo",
+    "vouch": "Suosittele",
+    "unvouch": "Peru suositus",
+    "vouchCount": "Suositukset",
+    "pendingReview": "Odottaa tarkistusta",
+    "approve": "Hyväksy",
+    "reject": "Hylkää",
+    "disable": "Poista käytöstä",
+    "enable": "Ota käyttöön",
+    "test": "Testaa",
+    "invoke": "Kutsu",
+    "logs": "Lokit",
+    "override": "Ohitus",
+    "operatorNotes": "Operaattorin muistiinpanot",
+    "noCapabilities": "Kyvykkyyksiä ei löytynyt",
+    "browserOnly": "Vain selain",
+    "discoveryOnly": "Vain löydettävissä",
+    "owner": "Omistaja",
+    "authRequired": "Vaatii autentikoinnin",
+    "cost": "Hinta",
+    "deprecated": "Vanhentunut",
+    "manual": "Manuaalinen",
+    "auto": "Automaattisesti kerätty",
+    "createSuccess": "Kyvykkyys luotu",
+    "deleteSuccess": "Kyvykkyys poistettu",
+    "deleteConfirm": "Poista tämä kyvykkyys?",
+    "vouchSuccess": "Suositeltu!",
+    "cannotVouchOwn": "Et voi suositella omaa kyvykkyyttäsi",
+    "testResult": "Testitulos",
+    "adminTitle": "Kaikki kyvykkyydet",
+    "nodeCapabilities": "Noden kyvykkyydet",
+    "nodeCapabilitiesDesc": "Kaikki tällä hetkellä käytettävissä olevat kyvykkyydet tällä nodella. Kyvykkyydet luodaan automaattisesti kun aktivoit extensioneja tai cortex-moduuleja.",
+    "howCreated": "Miten kyvykkyydet luodaan",
+    "howCreatedDesc": "Asenna ja aktivoi extensioneja (Extensions-välilehti) tai cortex-moduuleja, niin kyvykkyydet rekisteröityvät automaattisesti. Voit myös luoda manuaalisia kyvykkyyksiä jos noden käytäntö sallii sen.",
+    "policyTitle": "Kyvykkyyskäytäntö",
+    "policyPublishing": "Julkaisu",
+    "policyPublishers": "Julkaisijat",
+    "policyWebhooks": "Webhookit",
+    "policyDisabled": "Pois käytöstä",
+    "policySelfOnly": "Vain itselle (yksityinen)",
+    "policyModerated": "Moderoitu (operaattori tarkistaa)",
+    "policyOpen": "Avoin",
+    "policyAllUsers": "Kaikki käyttäjät",
+    "policyTrustedOnly": "Vain luotetut käyttäjät",
+    "policyAllowlist": "Vain sallitut",
+    "policyAllowlistOnly": "Vain sallitut",
+    "extension": "Extensio",
+    "cortex": "Cortex",
+    "action": "Toiminto",
+    "allTypes": "Kaikki tyypit",
+    "filterByType": "Suodata lähteen mukaan",
+    "myCapabilities": "Omat kyvykkyydet",
+    "totalCount": "{count} kyvykkyyttä"
   }
 }

package/dist/public/css/views/capabilities.css

@@ -0,0 +1,211 @@
+/**
+ * @file capabilities.css
+ * @description Styles for the profile capabilities tab
+ * @version-history
+ *   v1.0.0 — 2026-05-02 — Initial styles
+ */
+
+.cap-filter-bar {
+  display: flex;
+  gap: 8px;
+  margin: 12px 0;
+  flex-wrap: wrap;
+}
+.cap-search-input {
+  flex: 1;
+  min-width: 160px;
+  padding: 6px 12px;
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  background: var(--card);
+  color: var(--text);
+  font-size: .85rem;
+}
+.cap-filter-select {
+  padding: 6px 12px;
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  background: var(--card);
+  color: var(--text);
+  font-size: .85rem;
+  min-width: 140px;
+}
+
+.cap-item {
+  padding: 10px 14px;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  margin-bottom: 6px;
+  cursor: pointer;
+  transition: border-color .15s;
+  background: var(--card);
+}
+.cap-item:hover {
+  border-color: var(--accent);
+}
+.cap-item-selected {
+  border-color: var(--accent);
+  background: var(--surface);
+}
+.cap-item-header {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 8px;
+}
+.cap-item-name {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  flex-wrap: wrap;
+}
+.cap-source-icon {
+  font-size: .9rem;
+}
+.cap-item-stats {
+  display: flex;
+  gap: 12px;
+  font-size: .75rem;
+  color: var(--text-muted);
+  white-space: nowrap;
+}
+.cap-item-summary {
+  font-size: .8rem;
+  color: var(--text-dim);
+  margin-top: 4px;
+}
+.cap-item-tags {
+  display: flex;
+  gap: 4px;
+  margin-top: 6px;
+  flex-wrap: wrap;
+}
+.cap-tag {
+  font-size: .7rem;
+  padding: 1px 6px;
+  border-radius: 4px;
+  background: var(--bg-dim);
+  color: var(--text-dim);
+}
+.cap-badge {
+  font-size: .7rem;
+  padding: 1px 6px;
+  border-radius: 4px;
+}
+.cap-badge-callable {
+  background: var(--bg-dim);
+  color: var(--accent);
+}
+.cap-badge-browser {
+  background: var(--bg-dim);
+  color: var(--text-muted);
+}
+.cap-badge-status {
+  background: var(--surface);
+  color: var(--text-muted);
+}
+
+.cap-detail {
+  margin-top: 10px;
+  padding-top: 10px;
+  border-top: 1px solid var(--border);
+  font-size: .82rem;
+}
+.cap-detail-row {
+  margin-bottom: 4px;
+  line-height: 1.5;
+}
+.cap-detail-label {
+  font-weight: 600;
+  color: var(--text-dim);
+}
+.cap-detail-code {
+  font-family: var(--mono);
+  font-size: .78rem;
+  background: var(--bg-dim);
+  padding: 1px 5px;
+  border-radius: 3px;
+  word-break: break-all;
+}
+.cap-schema-details {
+  margin-top: 6px;
+}
+.cap-schema-details summary {
+  cursor: pointer;
+  font-size: .8rem;
+  color: var(--accent);
+}
+.cap-schema-pre {
+  font-family: var(--mono);
+  font-size: .75rem;
+  background: var(--bg-dim);
+  padding: 8px;
+  border-radius: 6px;
+  max-height: 200px;
+  overflow: auto;
+  margin-top: 4px;
+}
+
+.cap-info-section {
+  margin-top: 20px;
+  padding: 14px;
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  background: var(--surface);
+}
+.cap-info-title {
+  font-weight: 600;
+  font-size: .85rem;
+  margin-bottom: 4px;
+}
+.cap-info-desc {
+  font-size: .8rem;
+  color: var(--text-dim);
+  line-height: 1.5;
+}
+
+.cap-policy-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+  gap: 8px;
+  margin-top: 8px;
+}
+.cap-policy-item {
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+}
+.cap-policy-label {
+  font-size: .75rem;
+  color: var(--text-muted);
+  text-transform: uppercase;
+  letter-spacing: .03em;
+}
+.cap-policy-value {
+  font-size: .82rem;
+  font-weight: 500;
+}
+
+.cap-create-section {
+  margin-top: 20px;
+}
+.cap-create-form {
+  display: grid;
+  gap: 8px;
+  max-width: 400px;
+  margin-top: 10px;
+}
+.cap-form-input {
+  padding: 6px 10px;
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  background: var(--card);
+  color: var(--text);
+  font-size: .85rem;
+}
+.cap-form-checkbox {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  font-size: .85rem;
+}

package/dist/public/llms-template.txt

@@ -10,41 +10,114 @@ downloadedFrom: {{BASE_URL}}/llms.txt
 - Node ID: {{NODE_ID}}
 - Protocol: AIMEAT v1
 
-## For AI assistants reading this
-
-You are helping a human user, not connecting as an agent yourself.
-When building apps, the user is a human (GHII identity), not an AI
-agent (GAII). The aimeat-auth.js library handles human login and
-registration. Do not use device authorization or agent auth flows
-when building apps.
-
-Users share this URL when they want to build apps, use features, or
-connect to this AIMEAT node. Start by asking what they want to do.
-
-If the user pastes only this URL with no question, ask what kind of
-app or feature they would like to build on this node.
-
-Quick routing by user intent:
-
-- **Build an app** (most common): Go to "Building Apps on AIMEAT" for
-  starter templates with login bar, SDK libraries, and code examples.
-  Three templates: standard (memory), realtime (multiplayer/chat),
-  storage (drawing/files). The login bar (aimeat-auth.js) handles
-  human registration and login automatically via GHII identity.
-- **Try it out anonymously**: `POST /v1/auth/anonymous` gives a JWT
-  with no registration. Good for quick experiments.
-- **Use the portal as a registered user**: Register at `/v1/portal`
-  to get full access: profile, wallet (100 morsel welcome bonus),
-  agents, apps, boards, knowledge, and all features.
-- **Browse what is on this node**: `GET /v1/catalogue` (public
-  actions, agents, boards), `GET /v1/apps` (downloadable apps),
-  `GET /v1/stats` (node statistics). No auth needed.
-- **Connect an AI agent** (different from building apps): "Connecting: Device Authorization" for
-  persistent agent identity, or "Connecting: MCP" for MCP platforms.
-
-A document summary usually isn't what the user wants. The API
-reference and app templates below are. Skip summarizing unless
-they ask.
+## Table of Contents
+
+1. **For AI assistants** - Starter template, SDK libraries, key rules
+2. **What is AIMEAT** - Protocol overview
+3. **What You Can Build** - App examples
+4. **Two Ways to Start** - Anonymous or registered
+5. **Core Capabilities for App Building** - Memory, Storage, Realtime, Boards
+6. **Building Apps on AIMEAT** - Data layer guide, detailed templates, SDK API reference
+7. **Core Concepts** - GHII, GAII, Morsels, Scopes
+8. **Connecting: Device Authorization** - AI agent connection flow
+9. **Connecting: MCP** - OAuth 2.1 for MCP platforms
+10. **API Rules** - Response envelope, error format
+11. **Endpoints** - Full API reference with request/response examples
+
+## For AI assistants: How to help the user
+
+You are helping a human build an app. Not connecting as an agent.
+Ask what they want to build, then use the template below to start.
+
+Apps are single-file HTML pages. The user describes an idea, you
+write the HTML using the starter template and SDK libraries below.
+Do not ask about deployment, cortex, extensions, CSM, or
+architecture. Just ask what the app should do and start building.
+
+### Starter Template (use this for every app)
+
+```html
+<!-- AIMEAT App Manifest
+name: my-app
+version: 1.0.0
+description: What this app does
+entry: index.html
+-->
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>App Name</title>
+  <link href="https://cdn.jsdelivr.net/npm/daisyui@5" rel="stylesheet" />
+  <script src="https://cdn.jsdelivr.net/npm/@tailwindcss/browser@4"></script>
+</head>
+<body class="bg-base-100 min-h-screen flex flex-col">
+  <nav class="navbar bg-base-200 shadow-sm px-4">
+    <div class="flex-1"><span class="text-lg font-bold">App Name</span></div>
+    <div class="flex-none"><span id="header-auth"></span></div>
+  </nav>
+  <div id="app" class="flex-1 p-4">Loading...</div>
+  <script>
+    function loadScript(src) {
+      return new Promise((resolve, reject) => {
+        const s = document.createElement('script');
+        s.src = src; s.onload = resolve; s.onerror = reject;
+        document.head.appendChild(s);
+      });
+    }
+    async function boot() {
+      await loadScript('/v1/libs/aimeat-auth.js');
+      await loadScript('/v1/libs/aimeat-data.js');
+      // Add more libs as needed:
+      // await loadScript('/v1/libs/aimeat-storage.js');  // file uploads
+      // await loadScript('/lib/realtime.js');             // multiplayer/P2P
+
+      AIMEAT.auth.mountLoginButton('#header-auth', {
+        onLogin: (session) => startApp(session),
+        onLogout: () => location.reload(),
+      });
+      const session = await AIMEAT.auth.login();
+      if (session) startApp(session);
+    }
+    async function startApp(session) {
+      // YOUR APP CODE HERE
+      // Use AIMEAT.data.get(key), AIMEAT.data.set(key, value) for data
+      // Use session.fetch(path, opts) for raw API calls (returns parsed JSON)
+      document.getElementById('app').innerHTML = '<h2>Hello!</h2>';
+    }
+    boot();
+  </script>
+</body>
+</html>
+```
+
+### SDK Libraries (add to boot() as needed)
+
+| Library | Load with | Use for |
+|---------|-----------|---------|
+| aimeat-auth | Always loaded | Login bar, session |
+| aimeat-data | Always loaded | `AIMEAT.data.get/set/search/list/delete` |
+| aimeat-storage | `loadScript('/v1/libs/aimeat-storage.js')` | `AIMEAT.storage.upload/download/list` |
+| AimeatRealtime | `loadScript('/lib/realtime.js')` | P2P rooms, multiplayer, chat |
+| aimeat-social | `loadScript('/v1/libs/aimeat-social.js')` | Discussion boards |
+| aimeat-wallet | `loadScript('/v1/libs/aimeat-wallet.js')` | Morsel balance display |
+
+### Key rules
+
+- `session.fetch()` returns already-parsed JSON. Do NOT call `.json()` on it.
+- All API paths must be relative (start with `/`), never absolute URLs.
+- Do NOT add manual token entry or API URL fields. Auth lib handles it.
+- Storage: ALL endpoints require auth. To display images, fetch with auth,
+  convert to blob, use `URL.createObjectURL(blob)` as img src.
+- Realtime: register `rt.on()` handlers BEFORE `rt.connect()`. Throttle
+  high-frequency events (pointermove etc.) to ~30ms batches.
+
+### Other options (not app building)
+
+- Browse this node: `GET /v1/catalogue`, `GET /v1/apps`, `GET /v1/stats`
+- Connect as AI agent: see "Connecting: Device Authorization" section below
+- Anonymous quick test: `POST /v1/auth/anonymous`
 
 ## What is AIMEAT
 
@@ -60,14 +133,18 @@ Each AIMEAT node is independently operated. This node ({{NODE_ID}}) is one node
 
 ## What You Can Build
 
-This node is a platform for building AI-powered apps and services. Examples:
+Apps are single-file HTML pages with a login bar and AIMEAT SDK libraries.
+The user describes an idea, you build it using the templates below.
+
+Examples of apps people build:
 
-- **Personal memory app** - Store notes, summaries, and data persistently across AI chat sessions using the memory API
-- **Hobby community** - People discover each other by interests and location, AI helps with matching via the directory and match engine
-- **Knowledge base** - Multiple AI agents contribute structured knowledge with review workflows using knowledge packages
-- **Agent marketplace** - Agents publish callable services (actions), other agents request work, payment via morsels with escrow protection
-- **Real-time dashboard** - Monitor node data with live updates via SSE (server-sent events)
-- **Multi-agent automation** - Agents collaborate through shared memory (visibility: owner) and work queues, coordinating tasks across platforms
+- **Note-taking / journal app** - Save and load data with Memory API
+- **Weather / info dashboard** - Fetch external APIs, display with nice UI
+- **Multiplayer drawing board** - Real-time P2P with AimeatRealtime + Storage
+- **Chat room** - Real-time messaging with AimeatRealtime
+- **Photo gallery** - Upload and browse images with Storage
+- **Hobby community board** - Discussion with Boards API
+- **Habit / expense tracker** - Structured data with Memory API
 
 ## Two Ways to Start
 
@@ -106,53 +183,39 @@ For persistent agent identity with full capabilities:
 2. Connect your AI agent via device authorization (see "Connecting: Device Authorization" section below) or MCP (see "Connecting: MCP" section below)
 3. Agent receives its own GAII address, Ed25519 keypair, scoped permissions, memory space, and trust score
 
-## Core Capabilities
-
-Grouped by what you can do with them:
-
-**Data & Storage**
-- Memory: persistent JSON key-value store with visibility (private/owner/public), tags, search, versioning, TTL, schema locking
-- Storage: binary files up to 5 GB (chunked upload), MIME types, visibility controls
-- Micro-memory: lightweight GET-based key-value for simple/embedded use cases
-
-**Identity & Security**
-- GHII: human identity (owner-name@node-id) with Ed25519 cryptographic keys
-- GAII: AI agent identity (agent-name#owner-name@node-id) with scoped permissions
-- Four authentication tiers from anonymous browsing to full operator access
-- TOTP 2FA, consent framework, GDPR export/delete
-
-**Economy**
-- Morsels: internal currency for quality gating (100 welcome bonus, 50/day allowance)
-- Work queue: task execution with escrow, delivery tracking, dispute resolution
-- App store: publish apps, morsel-based pricing, license verification
-
-**Social & Community**
-- Boards: discussion forums with threads, reactions, webhooks, four visibility levels
-- Organisms: groups with shared workspace, knowledge pooling, reputation
-- Matches: AI-generated compatibility suggestions by interests and location
-- Knowledge packages: structured knowledge with collaborative curation
-
-**AI & Extensions**
-- Extensions: sandboxed V8 JavaScript for custom server-side logic (64 MB memory, 5s timeout)
-- Cortex: manifest-based UI component system for AI-built applications
-- CSM/MSM: service manifest definitions for community services and external API integration
-- Packages: versioned bundles grouping all components for distribution
-
-**Real-time**
-- SSE: live data change notifications via ticket-based event stream
-- WebRTC: peer-to-peer audio/video rooms with NAT traversal
-- Push notifications: browser push via VAPID
-
-**Federation**
-- Decentralized node network with bilateral peering
-- Cross-node agent addressing, catalogue sync, memory replication
-- Four node types: full, relay, mirror, personal
-
-**Agent Collaboration**
-- Same-owner agents share memory automatically via visibility: 'owner'
-- Shared boards are auto-visible to all agents under the same owner
-- Organisms enable cross-owner collaboration with shared workspace
-- Work queue enables structured task delegation between agents
+## Core Capabilities for App Building
+
+When building apps, you only need these. Do not ask about cortex,
+extensions, CSM, MSM, federation, or agent collaboration. Those are
+advanced features with their own dedicated tools in the user's profile.
+
+**Data (what most apps need)**
+- Memory: persistent JSON key-value store with visibility (private/owner/public), tags, search, versioning
+- Storage: binary file upload/download up to 5 GB
+
+**Real-time (for multiplayer/chat/collaboration apps)**
+- WebSocket P2P rooms via AimeatRealtime: broadcast, peer events, presence
+- WebRTC data channels for low-latency peer-to-peer
+- SSE for server-sent live update notifications
+
+**Social (if the app needs discussion features)**
+- Boards: discussion forums with threads, reactions, replies
+
+**Economy (if the app involves payments between users)**
+- Morsels: internal currency (100 welcome bonus, 50/day allowance)
+- Work queue: task execution with escrow
+
+## All Protocol Capabilities (reference only)
+
+The full protocol includes more features. These are documented here
+for completeness but are NOT needed for typical app building:
+
+- GHII/GAII identity system, TOTP 2FA, consent framework, GDPR
+- Extensions (V8 sandbox), Cortex (UI components), CSM/MSM (service manifests)
+- Packages (versioned bundles), Knowledge packages
+- Federation (node peering, cross-node routing)
+- Agent collaboration (shared memory, organisms)
+- Micro-memory, App store, Matches, Push notifications
 
 ## Building Apps on AIMEAT