create-open-autonomy 2.3.0 → 2.3.1

package/README.md

@@ -68,6 +68,13 @@ and settled cent per item, live while a session runs.
 balance for a bounded amount at the owner's merchant categories, and a partner service's metered charge
 for a listed partner within a bound. Both leave records on the public audit trail naming the rail.
 
+## The world
+
+A project that talks to a vendor verifies against twins, never the vendor: `bun add -d @volter/twin-world @volter/twin-<vendor>`,
+a `world/world.json` naming them, `bunx volter-world up world/world.json`. The develop skill drives the running
+system in that world, one action at a time (this repository's own `world/` is the shape). Nothing an agent does
+reaches a real API.
+
 ## Nothing in the agent's reach is a secret that matters
 
 The agent's `.env` says `OPEN_AUTONOMY_KEY=valve`. Pushes sign through an ssh-agent the start script loads with

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-open-autonomy",
-  "version": "2.3.0",
+  "version": "2.3.1",
   "description": "The default Open Autonomy starter kit: a complete repository that runs its own Hermes agent against the platform, with the SDK wired in. `bun create open-autonomy <dir>` scaffolds one.",
   "license": "Apache-2.0",
   "repository": {

package/src/kit.ts

@@ -9,7 +9,7 @@
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
 import { dirname, join, relative, resolve } from 'node:path';
 
-export const KIT = { name: 'hermes', version: '2.3.0' } as const;
+export const KIT = { name: 'hermes', version: '2.3.1' } as const;
 export const KIT_FILE = '.open-autonomy/kit.json';
 const TEMPLATE = resolve(import.meta.dir, '..', 'template');
 

package/template/AGENTS.md

@@ -2,7 +2,7 @@
 
 - **What this is.** __PROJECT__, a project that builds itself through Open Autonomy. `CONSTITUTION.md` is what it is and must remain. The board is what you build next, in order. `CONTRIBUTING.md` is how code is written here. `hermes/` is you.
 - **Checks.** `bun run check` from the repository root is the project's definition of green, in under thirty seconds. It must pass before every push. Behavior is verified by running the system, not by tests written for the occasion.
-- **Verify.** State here where the project is verified: its check, and any local or twinned surface. You cannot reach production and must not try. Where an acceptance line names a surface, exercise the surface.
+- **Verify.** State here where the project is verified: its check, and any local or twinned surface. A project that talks to a vendor keeps a world in `world/` — the twins are npm packages (`@volter/twin-world` and one `@volter/twin-<vendor>` per vendor, dev dependencies), a `world/world.json` names them, `bunx volter-world up world/world.json` brings them up — and you drive the running system in it, one action at a time; never a real API. You cannot reach production and must not try. Where an acceptance line names a surface, exercise the surface.
 - **Git.** You cannot push to `main` and must not try. Work on `agent/<task id>` off a fresh `origin/main`, commit small with the task id first in the subject, and push the branch; the landing workflow opens the pull request and it merges itself when the checks pass. Never rewrite history, never force-push.
 - **Secrets.** There are none for you to use: your model calls and your pushes are authorized outside your reach. Never read or print `.env` files or key material; your sessions are published live.
 - **Do not edit** `LICENSE`, `.github/workflows/`, `container/`, `.open-autonomy/reporter.ts`, or anything under `hermes/` except a skill a task asks you to improve.