nervur 0.13.0 → 0.15.0

package/README.md

@@ -1,457 +1,152 @@
-# Nervur
-
-The library. Picture a castle: one gate, its own residents, its own law.
-**A ground is the castle** — one sovereign process holding many beings,
-exposing exactly one handler where every message for every resident
-arrives. You arrive at the gate, say _I am X_ with your signature, and
-whom you seek travels inside the letter; the castle answers or keeps
-silence, and a resident that refuses you looks exactly like one that
-never lived there. The castle's capabilities are its **modules** — a
-resident uses only what its blueprint declares — and the terrain under
-the castle is a **floor**: a browser tab, a Linux daemon, a phone, an
-edge worker. The castle is a castle wherever it is built.
-
-Beneath the picture, the mechanics: an address is its own verification
-key, authority is a signature, and every relationship is one ref with
-declared rights — so a reference cannot be forged and no ambient
-authority exists anywhere. The door asks by whose authority and refuses
-every other question. The lineage is the object-capability tradition —
-CapTP, the actor model — with one honest departure: the door verifies who
-is calling, and rights are declared per reference. Pure Crockford
-JavaScript — factory functions, closures for privacy, no `this`, no
-classes, frozen surfaces — with no `node:` import anywhere, so the twelve
-files run wherever JavaScript does; three dependencies (`graphql` for the
-one thing that would be madness to hand-roll, `@noble/curves` and
-`@noble/hashes` for the arithmetic every host must agree on).
-
-## Quickstart
-
-New to the whole thing? [GETTING-STARTED.md](GETTING-STARTED.md) raises
-two castles on two terrains — a server and a browser tab — and has them
-speak; the bench drives that exact story. What follows here is the
-library alone.
-
-`npm install nervur` — what ships is this source, byte for byte. The
-package is a library and carries no command; a ground also needs a floor
-(`@nervur-org/floor-machine` here) — the library is the law and the
-shape, and a host is what it stands on;
-the `nervur` command on an operator's PATH belongs to the
-[`nervurd`](../nervurd/README.md) package, its name twin. Construction is
-synchronous; every call through a door — `pointer`, `mcp`, `gql`, and each
-function they hand back — is async. This runs today, lifted from the
-bench's own passing suites:
-
-```js
-import { Cells, Cipher, Keychain } from '@nervur-org/floor-machine';
-import { Ground, Tools, Voice } from 'nervur';
-
-const DIARY = `({
-  name: 'acme.diary',
-  needs: { modules: [{ module: 'memory', contract: 'nervur.memory' }] },
-  memory: { pages: { type: '[String!]', class: 'data' } },
-  interface: \`
-    type Query { pages: [String!] @rights(is: [SELF, MEMBER]) }
-    type Mutation { write(line: String!): Int @rights(is: [SELF, MEMBER]) }
-  \`,
-  resolvers: {
-    Query: { pages: (_, __, { modules }) => modules.memory.read('pages') ?? [] },
-    Mutation: {
-      write: (_, { line }, { modules }) => {
-        const kept = modules.memory.read('pages') ?? [];
-        kept.push(line);
-        modules.memory.write('pages', kept);
-        return kept.length;
-      },
-    },
-  },
-})`;
-
-const secret = Buffer.from(process.env.NERVUR_SECRET, 'base64'); // 32 bytes, minted once with Tools.secret()
-const shelf = {
-  cells: Cells({ file: 'ground.json' }),
-  cipher: Cipher(),
-  keychain: Keychain(secret),
-};
-
-const heir = Voice(); // keep this one somewhere the machine is not
-const self = Voice(Tools.digest(heir.pk)); // and hand the ground only this
-Ground(shelf).init(self.hand()); // once, ever — a fresh ground offers nothing else
-
-const ground = Ground(shelf); // now it stands, and answers
-const me = Voice(); // keep it: writeFileSync of me.pack(), or it dies with the process
-await ground
-  .serve(self)
-  .pointer('Ground')
-  .then((it) => it.invite({ address: Tools.address(me.pk) }));
-
-const serve = ground.serve(me);
-const admin = await serve.pointer('Ground'); // a pointer is your rights at mint — re-mint after they change
-const diary = await admin.create({
-  program: DIARY,
-  refs: [{ address: Tools.address(me.pk), rights: 'MEMBER' }],
-});
-const mine = await serve.pointer(diary);
-await mine.write({ line: 'first entry' });
-console.log(await mine.pages()); // [ 'first entry' ]
-```
-
-The rights enum here is the default (`SELF MEMBER STRANGER`); declare your
-own `enum Rights` in the interface to replace it. Reboot: construct the
-same `Ground` from the same two arguments — it wakes remembering, and
-offers no `init`, because the identity survived in the cells.
-
-**The wire, when a caller is remote.** An envelope is plain JSON:
-
-```json
-{
-  "from": "G…",
-  "to": "G…",
-  "seq": 1755170000000,
-  "op": { "ask": { "source": "{ pages }", "variables": {} } },
-  "sig": "base64 over canon({from, op, seq, to})"
-}
-```
-
-The ops are `describe`, `introspect`, `ask`, `rotate`, `release`,
-`acceptInvite`. An answer is `{ body, sig }`, signed by the being asked —
-verify against `pkOf(to)`, which `Client` does for you. A refusal is no
-answer at all; how silence rides your transport (a 204, an empty body) is
-the host module's choice. The library never opens a socket: your host
-listens however it likes and hands each envelope to `receive` —
-[the bench's sky.mjs](../bench/sky.mjs) is the reference harness for
-wiring grounds together.
-
-**The runbook, honestly.** Back up two things: the cells and the keychain
-secret — together they are the whole ground. A lost secret is permanent
-loss: nothing decrypts. A stolen secret plus stolen cells is total
-compromise, and rekey does not exist yet — destroy and recreate is
-today's remedy. The bench README's honest limits carry every known gap;
-read them before production.
-
-## The two halves
-
-**The server** is `Ground(Modules)` — modules are the whole of what a ground
-is handed, and the ground is exactly what they offer. The floor is `cells`
-(storage, including the one boot cell) and `keychain` (boot power as two
-operations, seal and unseal — the enclave's own shape once a phone hosts a
-ground); `paths`, `wire`, `contracts` and `blueprints` are
-taken if given; everything else is a module for programs. It installs itself
-the first time and boots from the same two forever after, and hands back
-three things while hiding everything it is made of:
-
-- `address` — its own admin being, aliased `Ground`.
-- `receive(envelope)` — the one handler. Every message for every being on the
-  ground arrives here and routes on the envelope's `to`. An address the
-  ground does not hold is silence. A host module that listens on a port, or
-  an app shell that calls in process, hands its envelopes to this and
-  nothing else — the library never opens a socket. `receive` answers the
-  signed `{ body, sig }` or `undefined` for silence; over HTTP, carry the
-  answer as the 200 response body and silence however you like (`nervurd`
-  uses an empty `204`) — no status code carries meaning, and a caller
-  trusts nothing but a verified signed answer.
-- `serve(voice)` — authority established once, and every face inherits it.
-
-A fresh ground has no identity, and no door for anyone to reach first: it
-offers `init(hand)` and nothing else — no `address`, no `receive`, no
-`serve`. Custody mints the voice off the machine, keeps the heir, and hands
-over `hand()` alone; a pack carrying its own successor is refused. The act
-is spent the moment it lands, and only `rotate(hand)` moves that voice
-after. Both are custody's own calls on the shelf, never doors — which is
-what running-is-custody looks like from the outside, stated rather than
-hidden.
-
-`unproven()` is custody's third call, and it is a read: the addresses whose
-writes have stopped proving, with when each was first and last seen and how
-many writes have been refused. A write is proven against the key on the
-being's `chain/pk` cell, so whoever holds the shelf can overwrite that cell
-and freeze a being's memory while it answers on, correctly signed and
-indistinguishable to every caller. The ground records that in its own host
-rows under `ground/` — no being reads them, nothing goes over the wire — and
-this is where a host reads them back. Show it to whoever operates the
-machine; a ground that has stopped proving its own writes is a custody
-incident, not a bug.
-
-**`serve` is the client, and it has four faces of one door.** `pointer(at)`
-is a plain object with one function per field, generated from the schema that
-caller is allowed to see. `gql(at)` is the raw document. `mcp(at)` is the
-same schema as tools, filtered the same way, so an agent gets exactly what
-its rights allow — a projection into JSON Schema, so scalar fields travel
-whole while unions and custom scalars flatten; the rights filtering happens
-on the SDL before the projection, so what flattens is shape, never
-permission. `client` is the bare envelope underneath all three. Each
-takes an address or an alias; each signs as the identity `serve` was given
-and verifies every answer against the address it asked.
-
-Delivery is local or remote through one API — a local answer and a remote
-one carry the same shape, and the calling code does not branch. Failure
-stays observable, as it always is: a missing endpoint or a dead ground is
-silence, and silence is something local delivery never answers with.
-
-## The files
-
-- [tools.mjs](tools.mjs) — the world's arithmetic, one frozen literal, and it
-  holds nothing: `digest`, `verifies`, `seal`/`unseal`/`secret`, `canon`
-  (canonical bytes), `envelope` (the signed message, numbered), `derive` (a
-  class key from a root), `address`/`pkOf` (StrKey, so every key is a Stellar
-  account and an address is a verification key). Same input, same output, any
-  machine — which is why an attacker computes all of it exactly as well as
-  you do. Nothing here holds a key: `envelope` assembles and numbers the
-  message and asks the voice it is handed to sign. Beside the literal stands
-  `Stamp`, the one stateful thing in the file: each caller mints one and
-  numbers its own envelopes, strictly rising. `Client` and a being's port
-  keep one lane per counterparty, so concurrent calls to the same door
-  land in order on their own; only a bare-envelope caller orders its own.
-- [voice.mjs](voice.mjs) — the identity: three private keys shut in a closure
-  and never reachable from outside. `Voice()` mints one already committed to
-  its own successor, `Voice.revive` wakes a packed one, `Voice.sealTo` seals
-  to a voice's box key and `voice.open` is the only thing that opens it.
-  `succeed()` retires both hands at once — the committed key starts speaking
-  and a fresh box starts reading. The re-wrap is the handover's own
-  choreography: the retiring voice still stands when `succeed()` returns, so
-  the holder opens with the old box and seals to the new one in the same
-  act, then discards the old voice — after which it opens nothing that
-  remains. `pack()` is the one door out — the ground's custody, and
-  precisely why hosting is custody.
-- [blueprint.mjs](blueprint.mjs) — the blueprint law. A program is compiled
-  from one serialisable source with no identity, no ground and no ambient
-  power in it: forbidden names are refused where they are read as powers and
-  shadowed at evaluation, the modules and bindings it needs are declared and
-  typed, the cells it keeps are declared with their class, its rights are its
-  own and every door declares them — a root field without `@rights`, or one
-  naming a right the enum never declared, is refused at compile — and the
-  whole of it digests to one canonical hash, rights included. Reformatting
-  the schema does not move the digest; a resolver digests by its source
-  text, so reformatting the code mints a new program. The forbidden-name
-  scan is a code-only regex, not a parser — a bounded blast radius, stated
-  as such, never a jail.
-- [program.mjs](program.mjs) — a blueprint made executable: every field
-  gated by the `@rights` it declares, resolver or no resolver, and
-  introspection curtained per caller exactly as describe is. Errors never
-  leave the house.
-- [modules.mjs](modules.mjs) — what a ground offers. `Cells` is dumb storage,
-  optionally a file. `Memory` is the memory law: reads free, writes signed by
-  the compartment's current voice, one version per cell, the chain by
-  prove-and-replace. `Clock` and `Entropy` are pinnable, so a program need
-  never reach for the wall. `Paths` resolves an address to an endpoint and
-  vouches for nothing; `Wire` carries; `Dns` is the directory they share.
-- [contract.mjs](contract.mjs) — an interface with a digest and nothing else.
-  What `needs.modules` cites, what a bound module's client is generated from,
-  and what `attest` judges a stander by: more than the contract asks is fine,
-  less is not.
-- [pointer.mjs](pointer.mjs) — `Pointer` and `Mcp`, both read off an SDL, so
-  no client is ever written by hand for a program.
-- [client.mjs](client.mjs) — the bare envelope client, usable on its own.
-  Signs as its voice, and verifies every reply from the address alone:
-  `pkOf(to)` is the key the being was born with, and each handover the reply
-  carries in `succession` is checked against the key before it, so a being
-  that has rotated is still provably itself to a caller that has never met
-  it. A chain that breaks anywhere is a dropped answer.
-- [being.mjs](being.mjs) — the being. `Compartment` seals a cell by its
-  class, `Port` carries authority both ways, `Being` is the door — prove,
-  read rights, execute, sign — and `Registry` creates, takes custody of,
-  activates and destroys, reachable only through the admin being.
-- [admin.mjs](admin.mjs) — the administrative program every ground installs
-  for itself, aliased `Ground`: census, create, activate, destroy, upgrade,
-  alias, attest, invite, drop, wear, and behind `SELF` alone extend; `wears`
-  answers any stranger with the livery being the ground wears. Upgrade is
-  custody moving the one cell that was always the core's to move: the
-  program is replaced in place — address, cells, refs and chain surviving —
-  refused whole when a cell the being holds would go undeclared, and visible
-  to every peer because `describe` answers the program's digest. It refuses
-  the ground's own address; that program moves only through `extend`, which
-  takes the custom part alone and lets the core compose it with the fixed
-  administration.
-- [ground.mjs](ground.mjs) — the sovereign ground, its one handler and
-  `serve`.
-- [index.mjs](index.mjs) — the surface an adopter imports.
-
-## The two reference tables
-
-A being keeps one row per direction, and nothing anywhere keeps a shared
-record of the relation.
-
-- **`refs/`** — who refers to me, and with what rights. This is the inbound
-  reference table: each entry is one capability the being issued, plus the
-  highest envelope number seen from that holder — which is what makes a
-  captured envelope worthless. A holder drops its own row with `release`;
-  the door answers it like any op and the row is gone for good.
-- **`handles/`** — whom I refer to, and under which face. Outbound, and the
-  face is a keypair minted per counterparty, so no two peers can correlate
-  the same being by its keys — timing and shape stay visible to whoever
-  already sees them.
-
-## Classes, not tiers
-
-No super-user stands inside the system — no voice passes every door. The
-host running the ground is custody, not a user: root on the live process
-holds everything, and stands outside every claim made here (the bench's
-honest limits say it whole). A `class` here is a cell's sealing class,
-never a JavaScript class — the code has none. A being holds one root
-secret, and every class of
-cell seals with a key derived from it — so a leaked class key opens one
-class. Today no path hands out a class key without the root: the partition
-prices a future delegation of reading and bounds a bug, it does not defend
-against a present leak. A blueprint declares which cells it keeps and under which class, and a
-resolver may write only those, plus its own refs and handles. Its program,
-its chain and its keys are the core's to move, never its own.
-
-## What an adopter brings
-
-Their own modules, their own programs, their own keys. A program names the
-contracts it needs and runs on any ground that stands them — as a module, or
-as a being, on this ground or another. A ground missing one refuses the
-creation rather than failing later. The regress ends at one cell: the ground
-needs just enough local storage to hold its own seed and where everything
-else lives.
-
-## The floor — what is mandatory, what is yours
-
-`Ground(Modules)` reads exactly seven names from what you hand it; every
-other name passes through untouched as a module for programs.
-
-- **`cells` — mandatory.** The shelf: `peek`/`put`/`keys`/`drop`/`dump`,
-  key to value, nothing else. Ships as a Map, optionally mirrored to one
-  JSON file. Swap it for anything that keeps those five promises
-  **synchronously, to a single writing process** — SQLite through a
-  synchronous driver, localStorage in a tab — the memory law versions
-  writes, it does not lock them, so exactly one ground writes a shelf. A
-  shared or remote store is never a cells swap: it stands behind its own
-  door as a memory being (bench suite 8), whose own ground is the single
-  writer of its own shelf. What sits on it: sealed content, the
-  deliberately unsealed
-  blueprints, and the shape — names, sizes, versions, timing. Sealed
-  content is safe wherever the shelf lives; the shape and the program
-  source are readable by whoever holds it, so where it lives decides who
-  sees those.
-- **`keychain` — mandatory.** Two operations, `seal` and `unseal`, guarding
-  the one cell that boots the ground — the ground hands its boot cell to
-  the keychain and never sees a secret at all. `Keychain(secret)` builds
-  one from 32 bytes; a KMS stands behind the same two operations as an API
-  call; the Secure Enclave stands behind them natively, because sealing
-  without exporting the key is exactly what such hardware does. Choosing
-  the keychain is the host's one security decision: a root-only file
-  restarts unattended and dies with the disk image; a KMS can refuse the
-  next boot — revocation stops tomorrow, it does not evict a thief who
-  already copied (rekey is owed; the bench's honest limits carry it); the
-  Enclave keeps the power in the device, and it never leaves. A keychain
-  that cannot unseal yields no ground at all.
-- **`paths` — optional; defaults to a private in-memory map.** The
-  phonebook: `publish`/`find`, address to endpoint, and it vouches for
-  nothing — a poisoned phonebook makes a being unreachable, never
-  impersonated, because the address verifies every answer.
-- **`wire` — optional; defaults to in-process delivery.** The courier:
-  `carry(endpoint, envelope)`. The library never opens a socket — a host
-  module listens on whatever transport it likes and hands envelopes to
-  `receive`; the wire carries the outbound ones.
-- **`contracts` — optional; empty by default.** The dictionary of
-  interfaces this ground can attest. Required the moment a module is bound
-  by address, so that `memory` offers the same interface under the same
-  digest on every ground and a pretender is refused. A digest pins shape;
-  what the words mean is the contract author's prose to state.
-- **`blueprints` — optional.** `blueprints.ground()` seeds the
-  administration's custom part at install. After that the part moves only
-  through the `extend` door, so a host that keeps its blueprint in a file
-  and hands it over with the CLI never needs this slot at all.
-- **`watch` — optional.** The custodian's eye: a function called at every
-  door decision with one frozen fact, `{ to, from, kind, outcome }`, and
-  the outcomes are a closed set — `no-door`, `unproven`, `replayed`,
-  `mute`, `answered`. It sees outcomes and outsides, never an op body and
-  never a cell — exactly as knowing as the host already is. The caller's
-  silence is untouched; a watch that throws changes nothing; no watch
-  costs nothing. Tracing, metrics and logs are a host package built on
-  this, never the library's.
-
-Boot, in order: a ground over an empty shelf offers `init(hand)` alone.
-Given the hand, it writes the admin being and seals that voice into one cell
-under the keychain. Every boot after: the keychain unseals, the voice
-revives, every being in custody is announced, the ground answers.
-`rotate(hand)` is the only thing that moves that voice, and it certifies the
-handover so every caller follows the ground from its address. `Clock` and
-`Entropy` are not floor: they are ordinary modules a program declares,
-pinnable so a program never reaches for the wall.
-
-## Extending the administration
-
-A ground's administration is a being like any other, and the only one whose
-context holds the registry — so a door that must create, upgrade or destroy
-beings belongs on it and nowhere else. Adopters extend it; nobody replaces
-it.
-
-Hand the custom part to the `extend` door — `SELF`'s alone — and the core
-composes it with the standard administration. What you supply is the part by
-itself, never the whole program, so the acts this ground owes can never go
-missing. The same door replaces the part and removes it. Write it as an
-ordinary blueprint whose schema **extends** the roots:
-
-```js
-const cases = `({
-  name: 'procese.cases',
-  needs: { caller: true, modules: [{ module: 'memory', contract: 'nervur.memory' }] },
-  memory: { 'case/*': { type: 'String', class: 'data' } },
-  interface: \`
-    extend type Mutation {
-      openCase(title: String!): String @rights(is: [SELF, MEMBER])
-    }
-  \`,
-  resolvers: {
-    Mutation: {
-      openCase: (_, { title }, { from, modules, registry }) => {
-        const at = registry.create({ program: CASE, refs: [{ address: from }] });
-        modules.memory.write('case/' + at, title);
-        return at ?? null;
-      },
-    },
-  },
-})`;
-
-await ground
-  .serve(self)
-  .pointer('Ground')
-  .then((it) => it.extend({ program: cases }));
+# nervur
+
+Nervur grown on the working Quo kit. It imports `@quo-systems/js` and adds no
+protocol
+of its own — no wire, no envelope, no judgment, no arithmetic, ever. What
+Nervur is for begins where the constitution stops: the graph, the organs, the
+floor, and the projection from an authored contract into Quo blueprints.
+
+## The rules of this build
+
+1. **`@quo-systems/js` is the whole of the protocol.** It is crossed by its
+   specifier,
+   never by a path. A gap the kit shows is reported to the quo table, never
+   patched here.
+2. **nervur-dream is parked beside this, as reference.** Its mechanics may be
+   lifted — the compiler, the contract reader, the `@needs` directive. Its
+   judgement may not: what a thing enforces, refuses or means is authored fresh
+   against the constitution as it stands today, because dream was built against
+   a protocol that no longer exists.
+3. **Crockford.** Factory functions, closures for privacy, no `this`, frozen
+   surfaces. The kit's class idiom stops at its specifier: the ground factory
+   is the one place a `Warden` instance lives, closed over and never returned.
+4. **One played bench question at a time.** Doubt is settled on the bench, not
+   argued. Nothing lands without an assert that would fail if it broke.
+5. **A being never learns who is calling, but it knows who may reach it.** The
+   first half is the kit's doing: the warden places a voice at step three and
+   hands the field its arguments and its leash, never the caller. Which being
+   was reached already says who called. The second half is Nervur's: the warden
+   keeps the record of which voices reach which beings, and a being is handed
+   its own row to read and to change. No rights and no roles — those are
+   meanings, and the record holds none.
+
+## What stands
+
+**`ground()`** — one closure over one warden, holding beings and judging what
+arrives. `bench/ground.test.js` walks it end to end: a real sealed ask, a real
+answer, and silence where a standing does not reach.
+
+**The outbound relation** — `remember` records an invitation this ground was
+handed and names which of its beings spends it; `ask` seals down that relation,
+posts it at the hints the invitation carried, and reads the answer back. Every
+one of those acts is the kit's. What is Nervur's is the ergonomics: a relation
+is found by whose it is, so one being cannot spend another's; the number is the
+ground's to pick, so no caller counts by hand; and the first ask carries the
+rotation an invitation's heir keys oblige, so nobody meets that trap twice.
+`bench/estate.test.js` stands two houses on two real loopback doors and crosses
+between them.
+
+Silence, unreachable and a relation that is not yours are three different
+things and stay three: silence is `null`, a road that does not answer throws
+out of the carriage, and spending what a being does not hold throws before a
+byte moves.
+
+**`contract(sdl)` and `program(contract, resolvers)`** — the compiler, and
+there is exactly one of it. A being and an organ are both a contract plus
+resolvers, and `program` cannot tell which it is holding; that is not a
+convenience, it is the architecture. A field is read with `hasOwn` and never
+through the prototype chain, exactly the declared arguments reach a resolver
+and no others, a resolver short of a required argument is not called at all,
+and a resolver that throws is answered as silence — nothing here promises that
+an ask is fulfilled, so a refusal a caller must tell apart is carried in the
+answer type instead. `bench/program.test.js` asserts every one of those, and
+asserts the first on a being and an organ side by side.
+
+**The contract is a GraphQL schema** — schema, resolvers and a context, the
+shape every engineer already knows. It is authoring and nothing else: never at
+the wire, never an answer, never a describe. The organs a being reaches outward
+with are declared in the schema itself, with `schema @needs(organs: [...])`,
+and the being's own name is the root type's — `schema { query: Clerk }`.
+
+**`project(contract)`** — the boundary, and there must be exactly one of it.
+Every implementer of Quo speaks the notation and has never heard of Nervur, so
+a contract becomes a Quo blueprint in the kit's own notation before anything
+holds it, and what a stranger verifies is that blueprint's digest. GraphQL is
+nullable by default and the notation is required by default, so `String!`
+becomes `text` and `String` becomes `text?`; the schema's other object and
+input types become record blocks, and their ordering is the notation's own law
+and therefore the kit's `print` to judge. Where GraphQL says something the
+notation has no word for — `Float`, `ID`, an enum, a union, an interface, a
+record field that takes arguments — the contract is refused at build rather
+than guessed at. One word runs the other way: the notation has a field that
+answers nothing and GraphQL insists every field has a type, so `Nothing` in
+answer position is that field's spelling. `bench/projection.test.js` holds it.
+
+**`being(sdl, resolvers)`** — a schema and ordinary functions under it. It is
+compiled by `program` like anything else; what it adds is the wire skin the kit
+leaves open, and the two promises the kit leaves to Nervur: a resolver meets
+its arguments as named values and never bytes, and a being answers **exactly**
+the fields its contract declares. That second one is the gate the digest's
+meaning rests on — the law says what a blueprint does not declare does not
+exist, and the kit dispatches on whatever methods the held object happens to
+have.
+
+**Organs** — the only way a being _acts_ outward. That is not a style choice:
+a being has no warden and no caller, so it cannot mint standing and a field
+answering another being's name hands over a label rather than reach. What it
+can still do is pass on standing it was already given — the constitution says
+data can carry an `invitation`, and an invitation carries the heir keys — so
+"a being cannot hand over reach" is false as a general claim and only the
+minting half is true. A being names the organ aliases it needs in its own
+schema, the ground supplies them at `hold`, and the resolvers are closed over
+exactly those. An organ the schema never asked for is not absent from a check —
+it is absent from the object.
+
+**The organ that crosses** — `errand` mints the reach a being uses to speak to
+another house. It is shut over which being spends the relation and which house
+it stands at, so a being holds one road on its own behalf and nothing it could
+point elsewhere; it never holds the warden and never holds the relation. Which
+being at the far house is still the caller's to name, because the standing
+decides that and the standing is judged over there. The **leash** is handed in
+rather than chosen — the resolver passes on the one the door gave it, whole and
+never a number read off it, because what may go onward is this door's dwell
+subtracted at the moment of sealing, which is later than any moment the being
+could have read. So the remainder reaches the far house without the being
+having chosen it, and a being cannot hand its organ more than it received.
+`bench/errand.test.js` serves one sealed ask at the near house by crossing to
+the far one and answering with what came back.
+
+**Contacts** — who reaches this being, and the two acts that change it:
+`list()`, `admit(keys)` and `remove(voicePk)`. Every one of them goes to the
+warden's own inbound record — `grant`, `amend`, `standing` — read live at the
+moment it is called and never snapshotted, so a being that admitted someone a
+moment ago sees them. Quo keeps that record and refuses to have an opinion
+about it, having no word for member, owner or guest; the opinion is Nervur's,
+and this is the whole of it. The inverse — voices by being, where the warden
+keeps beings by voice — is derived rather than indexed, because a second index
+is a second truth.
+
+The scoping is structural, the same shape `errand` uses: the context is minted
+per `hold` with the being shut inside the closure, so there is no address it
+could name to reach another being's row. It reaches a resolver as the resolver
+factory's second argument, closed over at raise beside the organs, rather than
+as a third argument to every resolver. `bench/contacts.test.js` proves the
+admission and the removal at the door — a real sealed ask that gets in, and
+then meets silence.
+
+Organs are declared inside the contract, with `schema @needs(organs: [...])`.
+That directive is authoring and never reaches the wire: the projection drops
+it, so the blueprint a stranger reads carries no trace of what a being reaches
+outward with, which is inside-the-ground business the wire never sees.
+
+## What is not here yet
+
+`own` and the floor, memory, standings and the graph walked across them, the
+per-call caller, ground-as-a-folder, persistence, register-and-invoke,
+collections-as-beings, per-caller beings.
+
+## The bench
+
+```bash
+npm run gate-nervur
 ```
-
-The composed program is one blueprint with one digest, so `describe` answers
-what this ground's administration actually is, and an outsider can pin it.
-
-Three rules hold, and each refuses the whole extension rather than bending:
-
-1. **Standard door names are reserved.** Declare `create`, `census`,
-   `upgrade`, `destroy`, `alias`, `attest`, `opened`, `invite`, `drop` or
-   `extend` and the part is refused. You cannot change what a standard door
-   means — which is why a stranger may trust that if `create` answers, it
-   created.
-2. **Add only.** Use `extend type Query` / `extend type Mutation`; cell
-   names, module slots and `needs.config` may not collide with the
-   administration's own.
-3. **Close a door the way anything is closed here** — fence it behind a
-   right the ground never grants. The door stands, means what the
-   constitution says, and answers nobody: that is how an appliance ground
-   stops creating beings, without redefining a thing.
-
-The acts stay the core's own: an extension reaches them through the same
-registry face the standard doors use, so it can invent no power the standard
-administration lacked.
-
-## Writing a module
-
-Five rules, each load-bearing:
-
-1. **A frozen object of functions and nothing else** — no classes, no
-   events, no state a being could share through it. State belongs behind a
-   door: a stateful module is a being with cells of its own, bound by
-   address under rule 5.
-2. **Params carry the authority.** The module holds no account, no key, no
-   ambient context: `stripe.charge({ account, apikey, amount })`. This is
-   what makes the same module safe to hand to every being on the ground —
-   without the context it opens nothing.
-3. **It knows nobody.** A module never learns which being calls; per-being
-   authority arrives through the blueprint's declared bindings, typed, with
-   a declared owner.
-4. **Undefined is refusal** — the same silence the door speaks, never an
-   error that narrates.
-5. **A module blueprints will name needs a contract** — the interface whose
-   fields mirror its calls, digested, so the same word means the same thing
-   on every ground. The ground attests a stander against it: more than the
-   contract asks is fine, less is not. A module a being stands remotely is
-   bound as `{ at, contract }`; the floor — cells, keychain, paths, wire —
-   is host code, because it must exist before any being can speak.