create-open-autonomy 2.2.1 → 2.3.1

package/README.md

@@ -29,7 +29,7 @@ CHANGELOG.md         what shipped
 AGENTS.md            the agent's rules for this repository
 LICENSE              Apache-2.0, seeded; the project's own
 package.json, test/  the project's own check (`bun run check`), starting with one test
-hermes/              the agent: SOUL.md, its two skills (develop, pm), profiles/treasurer (the second profile: the one that pays), kanban.seed.json (the board's first tasks, in order),
+hermes/              the agent: SOUL.md, its two skills (develop, pm; a project's own skills live beside them, in hermes/skills/<project>/, and are the project's), profiles/treasurer (the second profile: the one that pays), kanban.seed.json (the board's first tasks, in order),
                      cron/jobs.seed.json (the PM, hourly), config.yaml (the model: the project's own choice), the seed hook
 .open-autonomy/      the platform connection: config.yaml (account, publish policy, rail bounds), reporter.ts (the publisher:
                      sessions, the board, the setup), mint-key.ts (the key, the adopter way), start.ts (the agent's four
@@ -68,6 +68,13 @@ and settled cent per item, live while a session runs.
 balance for a bounded amount at the owner's merchant categories, and a partner service's metered charge
 for a listed partner within a bound. Both leave records on the public audit trail naming the rail.
 
+## The world
+
+A project that talks to a vendor verifies against twins, never the vendor: `bun add -d @volter/twin-world @volter/twin-<vendor>`,
+a `world/world.json` naming them, `bunx volter-world up world/world.json`. The develop skill drives the running
+system in that world, one action at a time (this repository's own `world/` is the shape). Nothing an agent does
+reaches a real API.
+
 ## Nothing in the agent's reach is a secret that matters
 
 The agent's `.env` says `OPEN_AUTONOMY_KEY=valve`. Pushes sign through an ssh-agent the start script loads with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-open-autonomy",
-  "version": "2.2.1",
+  "version": "2.3.1",
   "description": "The default Open Autonomy starter kit: a complete repository that runs its own Hermes agent against the platform, with the SDK wired in. `bun create open-autonomy <dir>` scaffolds one.",
   "license": "Apache-2.0",
   "repository": {

package/src/kit.ts

@@ -9,7 +9,7 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 
-export const KIT = { name: 'hermes', version: '2.2.1' } as const;
+export const KIT = { name: 'hermes', version: '2.3.1' } as const;
 export const KIT_FILE = '.open-autonomy/kit.json';
 const TEMPLATE = resolve(import.meta.dir, '..', 'template');
 
@@ -17,7 +17,9 @@ export interface KitParams { project: string; account: string }
 export interface KitRecord { kit: string; version: string; params: KitParams; divergences: string[] }
 
 // What the kit keeps current. Everything else in the template is seeded once.
-const OWNED = [/^hermes\/(?!config\.yaml$|kanban\.seed\.json$)/, /^\.open-autonomy\/(reporter\.ts|mint-key\.ts|start\.ts|package\.json|sdk\/)/, /^container\//, /^\.github\/workflows\/(ci|land)\.yml$/];
+// A project's own, seeded once: its config, its board seed, its schedule, and any skill of its own outside
+// hermes/skills/open-autonomy/ (the kit's two).
+const OWNED = [/^hermes\/(?!config\.yaml$|kanban\.seed\.json$|cron\/jobs\.seed\.json$|skills\/(?!open-autonomy\/))/, /^\.open-autonomy\/(reporter\.ts|mint-key\.ts|start\.ts|package\.json|sdk\/)/, /^container\//, /^\.github\/workflows\/(ci|land)\.yml$/];
 export const isOwned = (rel: string): boolean => OWNED.some((re) => re.test(rel));
 
 export function validateParams(p: Partial<KitParams>): KitParams {
@@ -98,7 +100,7 @@ export function check(dir: string): Outcome {
 // Kit-owned files the repository has that the kit no longer renders: what an earlier kit made and this one
 // retired. `upgrade` removes them; a project that keeps one names it in `divergences`. Only the families the
 // kit writes are looked at — never the agent's runtime state beside them (its database, sessions, logs, .env).
-const RETIRABLE = [/^hermes\/(skills|hooks|scripts)\//, /^\.open-autonomy\/([a-z-]+\.ts|sdk\/)/, /^container\//, /^\.github\/workflows\/(ci|land)\.yml$/];
+const RETIRABLE = [/^hermes\/(skills\/open-autonomy|hooks|scripts)\//, /^\.open-autonomy\/([a-z-]+\.ts|sdk\/)/, /^container\//, /^\.github\/workflows\/(ci|land)\.yml$/];
 function retired(dir: string, rendered: Map<string, Buffer>, rec: KitRecord): string[] {
   const out: string[] = [];
   for (const root of ['hermes/skills', 'hermes/hooks', 'hermes/scripts', '.open-autonomy', 'container', '.github/workflows']) {

package/template/.open-autonomy/start.ts

@@ -78,7 +78,8 @@ if (existsSync(committed)) cpSync(committed, home, { recursive: true, force: tru
 const envFile = resolve(home, '.env');
 if (!existsSync(envFile)) {
   const lines = ['OPEN_AUTONOMY_BASE_URL=http://127.0.0.1:8787/v1', 'OPEN_AUTONOMY_KEY=valve'];
-  for (const k of ['DISCORD_BOT_TOKEN', 'DISCORD_HOME_CHANNEL']) if (process.env[k]) lines.push(`${k}=${process.env[k]}`);
+  // What the environment says about the agent's channels comes along: Discord's, and GitHub's for a community desk.
+  for (const k of Object.keys(process.env).sort()) if (/^(DISCORD_|GITHUB_TOKEN$|GITHUB_API_URL$)/.test(k) && process.env[k]) lines.push(`${k}=${process.env[k]}`);
   writeFileSync(envFile, `${lines.join('\n')}\n`);
 }
 own(home);

package/template/AGENTS.md

@@ -2,7 +2,7 @@
 
 - **What this is.** __PROJECT__, a project that builds itself through Open Autonomy. `CONSTITUTION.md` is what it is and must remain. The board is what you build next, in order. `CONTRIBUTING.md` is how code is written here. `hermes/` is you.
 - **Checks.** `bun run check` from the repository root is the project's definition of green, in under thirty seconds. It must pass before every push. Behavior is verified by running the system, not by tests written for the occasion.
-- **Verify.** State here where the project is verified: its check, and any local or twinned surface. You cannot reach production and must not try. Where an acceptance line names a surface, exercise the surface.
+- **Verify.** State here where the project is verified: its check, and any local or twinned surface. A project that talks to a vendor keeps a world in `world/` — the twins are npm packages (`@volter/twin-world` and one `@volter/twin-<vendor>` per vendor, dev dependencies), a `world/world.json` names them, `bunx volter-world up world/world.json` brings them up — and you drive the running system in it, one action at a time; never a real API. You cannot reach production and must not try. Where an acceptance line names a surface, exercise the surface.
 - **Git.** You cannot push to `main` and must not try. Work on `agent/<task id>` off a fresh `origin/main`, commit small with the task id first in the subject, and push the branch; the landing workflow opens the pull request and it merges itself when the checks pass. Never rewrite history, never force-push.
 - **Secrets.** There are none for you to use: your model calls and your pushes are authorized outside your reach. Never read or print `.env` files or key material; your sessions are published live.
 - **Do not edit** `LICENSE`, `.github/workflows/`, `container/`, `.open-autonomy/reporter.ts`, or anything under `hermes/` except a skill a task asks you to improve.