rewritable 0.8.0 → 0.9.0

package/seeds/rewritable.html

@@ -407,7 +407,7 @@ window.ANCHORABLE_TAGS = ANCHORABLE_TAGS; // expose for tests
 // ─── Storage ────────────────────────────────────────────────────────
 const RWA = {
   DB:'rwa_'+DOC_UUID, KEY:'self',
-  DOC:'rwa_doc', UNDO:'rwa_undo', HIST:'rwa_hist', FSA:'rwa_fsa', STATE:'rwa_state', VAULT:'rwa_vault',
+  DOC:'rwa_doc', UNDO:'rwa_undo', HIST:'rwa_hist', FSA:'rwa_fsa', STATE:'rwa_state', VAULT:'rwa_vault', SOURCES:'rwa_sources', HOOK_LOG:'rwa_hook_log',
   UNDO_CAP:10, HIST_CAP:1000, NUDGE_THRESHOLD:5,
   K_API:'rwa_apikey', K_MODEL:'rwa_model', K_BACKEND:'rwa_backend',
   // Per-backend base-URL overrides for local OpenAI-compatible servers.
@@ -486,7 +486,7 @@ try {
 const canonLF = s => s == null ? '' : String(s).replace(/\r\n/g, '\n').replace(/\r/g, '\n');
 
 let _db;
-const REQUIRED_STORES = [RWA.DOC, RWA.UNDO, RWA.HIST, RWA.FSA, RWA.STATE, RWA.VAULT];
+const REQUIRED_STORES = [RWA.DOC, RWA.UNDO, RWA.HIST, RWA.FSA, RWA.STATE, RWA.VAULT, RWA.SOURCES, RWA.HOOK_LOG];
 // User-declared store registry. Persisted to RWA.STATE so declarations survive
 // reload. The openDB() upgrade handler creates declared stores on every bump.
 // Populated at bootstrap via loadUserStoreDecls(); mutated by runtime.db.open.
@@ -924,6 +924,15 @@ function emitRuntimeEvent(event, payload) {
   for (const cb of [...runtimeEvents[event]]) {
     try { cb(payload); } catch (_) { /* swallow user-cb errors */ }
   }
+  // I8 (v0.9 §9) — fire installed hooks for the mapped lifecycle event. 'modify' (an edit commit,
+  // carrying instruction/lensMeta) → on-commit; 'mode' → on-mode-change (with the previous mode).
+  // Fire-and-forget: wrapped so a firing failure can never propagate into the commit/mode path.
+  try {
+    if (typeof fireHooks === 'function') {
+      if (event === 'modify') fireHooks('on-commit', { event: 'on-commit', instruction: payload && payload.instruction, lensMeta: payload && payload.lensMeta });
+      else if (event === 'mode') { const previous = _lastHookMode; _lastHookMode = payload && payload.mode; fireHooks('on-mode-change', { event: 'on-mode-change', mode: payload && payload.mode, previous }); }
+    }
+  } catch (_) { /* hook firing never breaks the emitter */ }
 }
 
 // === Cross-container bus (workspace-presence subset) ========================
@@ -1329,9 +1338,21 @@ function workspacePeerKnown(peer, known) {
   return !!(peer && ((peer.uuid && known.has('uuid:' + peer.uuid)) || (peer.file && known.has('file:' + peer.file))));
 }
 
+function safeWorkspaceHref(url) {
+  // peer.url arrives over the public presence bus from another page in the origin,
+  // so it is untrusted. escRuntimeHtml blocks attribute breakout but NOT a
+  // `javascript:`/`data:` scheme, which would execute on click. Resolve and accept
+  // only navigable web/file schemes; fall back to '#' for anything else or unparsable.
+  try {
+    const u = new URL(url, location.href);
+    if (u.protocol === 'http:' || u.protocol === 'https:' || u.protocol === 'file:') return u.href;
+  } catch (_) {}
+  return '#';
+}
+
 function workspacePresenceCard(peer, known) {
   const isKnown = workspacePeerKnown(peer, known);
-  const href = peer.url || '#';
+  const href = safeWorkspaceHref(peer.url);
   const aff = peer.affordances && peer.affordances.length ? peer.affordances.map(a => a.kind).join(', ') : 'baseline';
   return '<a class="rwa-ws-card rwa-ws-live-card" href="' + escRuntimeHtml(href) + '">' +
     '<span class="rwa-ws-kind">' + escRuntimeHtml(peer.kind || 'document') + '</span>' +
@@ -5098,11 +5119,30 @@ window.submitLens = submitLens;
 // workspaces (audit R7) can carry richer identifiers (e.g. signed source
 // keys per the action-spec) without changing the rwa_hist schema.
 function getActiveActor() {
+  // I12 — when a multi-agent role is active, commits attribute to it (agents:${role}); the role is
+  // the actor of record (rendered as a history badge). Else fall back to the backend/model string.
+  if (activeAgentRole) return 'agents:' + activeAgentRole;
   const backend = sessionStorage.getItem(RWA.K_BACKEND) || 'openrouter';
   if (backend === 'bridge') return 'bridge:claude-p';
   if (backend === 'bridge-session') return 'bridge:claude-session';
   return sessionStorage.getItem(RWA.K_MODEL) || RWA.MODEL;
 }
+// I12 — the modify() system prompt, keyed by the active agent's role. An active (verified) agent's
+// system_prompt swaps the per-kind FRAMING; the shared SYSTEM_PROMPT_RULES (tool protocol, frozen-
+// zone rules, data-rwa-id) are always appended so editing still works. No agent → the singleton.
+function resolveSystemPrompt() {
+  if (activeAgentRole) {
+    const rec = Array.from(installedAgents.values()).find(a => a.role === activeAgentRole && a.verified);
+    if (rec && typeof rec.manifest.system_prompt === 'string') return rec.manifest.system_prompt + '\n' + SYSTEM_PROMPT_RULES;
+  }
+  return SYSTEM_PROMPT;
+}
+// I12 — the role-scoped vault gate: exact vault:<ns> membership in the agent's vault_namespace_set
+// (mirrors _skVaultAllowed against the agent record instead of the skill's permissions).
+function _agVaultAllowed(agent, ns) {
+  const set = (agent && Array.isArray(agent.vault_namespace_set)) ? agent.vault_namespace_set : [];
+  return set.indexOf('vault:' + ns) !== -1;
+}
 
 // Resolve the user-selected backend into a transport config.
 // kind:'openai_compat' covers openrouter/ollama/lmstudio — same wire protocol,
@@ -6304,6 +6344,17 @@ let activeView = null;
 // runtimeDescribe()/runtimeListSkills(). The agent can never write the zone (it is
 // data-rwa-frozen); only the runtime rewrites it (increment 7, registry-aware commit).
 const installedSkills = new Map();
+// I12 (v0.9 §12) — installed AGENT registry. Map<agentId, {agentId, role, verified, manifest,
+// envelope}>. Populated at boot from the frozen #rwa-agents zone (readTrustworthyAgents). Identity
+// is the author key; activeAgentRole is the in-tab active role (null = none; not persisted — boot
+// starts with no agent active per §12).
+const installedAgents = new Map();
+let activeAgentRole = null;
+// I8 (v0.9 §9) — hook firing state. activeHooks holds skillIds currently executing (re-entrancy
+// guard, Inv 23); _lastHookMode tracks the prior mode for on-mode-change's `previous`; _hookSeq
+// makes rwa_hook_log keys unique within a millisecond.
+const activeHooks = new Set();
+let _lastHookMode = null, _hookSeq = 0;
 
 const RWA_VIEW_RESERVED_IDS = ['rwa-doc-mount', 'rwa-lens', 'rwa-runtime'];
 const RWA_VIEW_RESERVED_MARKERS = ['rwa:frozen:begin', 'rwa:frozen:end', 'data-rwa-frozen'];
@@ -6475,6 +6526,62 @@ async function _skVerify(env) {
     return !!(await crypto.subtle.verify({ name: 'Ed25519' }, key, _skFromB64(sig), await _skSigningMessage(skill, skill.code)));
   } catch (_) { return false; } // Ed25519 unsupported / bad bytes → verified:false (honest)
 }
+// ── I12 (v0.9 §12) — rwa-agent/1 canon (LIVE mirror of cli/src/skill-manifest.mjs canonicalAgent/
+// agentSigningMessage/agentId/verifyAgentEnvelope/validateAgentInstall). An agent is a role-scoped,
+// signed identity (role + system_prompt + vault_namespace_set; NO code). Same canon as the CLI so a
+// seed-live verify == the CLI-static verify for the same bytes.
+const _AG_ROLE_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+function _agCanonicalAgent(a) { a = a || {}; return JSON.stringify({ author_pubkey: a.author_pubkey ?? null, description: a.description ?? null, role: a.role ?? null, system_prompt: a.system_prompt ?? null, vault_namespace_set: Array.isArray(a.vault_namespace_set) ? a.vault_namespace_set : [], version: a.version ?? null }); }
+async function _agSigningMessage(a) { return _skSha256(_skUtf8(_agCanonicalAgent(a))); }
+async function _agAgentId(role, pubkey) { return _skB64url(await _skSha256(_skConcat(_skUtf8(String(role)), _skNUL, _skUtf8(String(pubkey))))); }
+async function _agVerify(env) {
+  const sig = env && env.signature;
+  if (!sig) return false;
+  const agent = env.agent || {};
+  try {
+    const key = await crypto.subtle.importKey('raw', _skFromB64(agent.author_pubkey), { name: 'Ed25519' }, false, ['verify']);
+    return !!(await crypto.subtle.verify({ name: 'Ed25519' }, key, _skFromB64(sig), await _agSigningMessage(agent)));
+  } catch (_) { return false; }
+}
+function _agPromptInjectionRisk(s) { const p = String(s ?? ''); return p.includes('`') || p.includes('${') || /<\/?DOC>/i.test(p); }
+function _agValidateInstall(agent, signed) {
+  agent = agent || {}; const errors = [];
+  if (/\0/.test(String(agent.role == null ? '' : agent.role))) errors.push('invalid_agent_id');
+  if (typeof agent.role !== 'string' || !_AG_ROLE_RE.test(agent.role)) errors.push('invalid_role');
+  if (typeof agent.system_prompt !== 'string' || _agPromptInjectionRisk(agent.system_prompt)) errors.push('agent_prompt_injection_risk');
+  const set = agent.vault_namespace_set;
+  if (set != null && !Array.isArray(set)) errors.push('invalid_permission');
+  for (const p of (Array.isArray(set) ? set : [])) {
+    try { if (_skParsePermission(p).tier !== 'vault') errors.push('invalid_permission'); }
+    catch (e) { errors.push(/unknown_permission_tier/.test(e.message) ? 'unknown_permission_tier' : 'invalid_permission'); }
+  }
+  if (!signed) errors.push('unsigned_agent');
+  return { ok: errors.length === 0, errors };
+}
+// §12 inter-agent bus message shape (mirror of cli validateAgentMessage/agentMessage). Data-model
+// only; the request→response choreography is the conductor's job, correlated by id.
+function _agValidateMessage(m) {
+  m = m || {}; const errors = [];
+  if (m.type !== 'request' && m.type !== 'response') errors.push('invalid_type');
+  if (typeof m.id !== 'string' || !m.id) errors.push('invalid_id');
+  if (typeof m.from_role !== 'string' || !_AG_ROLE_RE.test(m.from_role)) errors.push('invalid_from_role');
+  if (typeof m.to_role !== 'string' || !_AG_ROLE_RE.test(m.to_role)) errors.push('invalid_to_role');
+  if (!('payload' in m)) errors.push('missing_payload');
+  return { ok: errors.length === 0, errors };
+}
+function _agBuildMessage(type, fromRole, toRole, payload, id) {
+  const m = { type, id, from_role: fromRole, to_role: toRole, payload };
+  const v = _agValidateMessage(m);
+  if (!v.ok) throw new RwaEditError('invalid_agent_message', null, { errors: v.errors });
+  return m;
+}
+// runtime.agents.message — convenience builder from the ACTIVE role. A request mints a fresh
+// correlation id; a response echoes the request's id (pass it as `id`). The caller publishes it
+// over the bus (a conductor skill with bus:agents:* permission), per §12.
+function runtimeAgentMessage(type, toRole, payload, id) {
+  if (!activeAgentRole) throw new RwaEditError('no_active_agent', null, {});
+  return _agBuildMessage(type, activeAgentRole, toRole, payload, id || (type === 'request' ? crypto.randomUUID() : undefined));
+}
 // Locate the inner HTML of the agent-unreachable <div data-rwa-frozen id="rwa-skills">
 // in the DOC TEXT (boot has the doc string before render). Only the frozen zone is
 // trusted; base64 envelopes contain no </div> so a flat scan is safe.
@@ -6510,6 +6617,87 @@ async function readTrustworthySkills(doc) {
   }
   return out;
 }
+// I12 (v0.9 §12) — the frozen #rwa-agents zone (coexists with #rwa-skills). Same strict
+// frozen-attribute read as _skExtractZone so an agent-committed lookalike div can't forge an agent.
+function _agExtractZone(doc) {
+  const open = /<div\b[^>]*\bid="rwa-agents"[^>]*>/i.exec(String(doc || ''));
+  if (!open || !tagHasFrozenAttr(open[0])) return null;
+  const start = open.index + open[0].length;
+  const end = doc.indexOf('</div>', start);
+  return end < 0 ? null : doc.slice(start, end);
+}
+// Parse installed agents from the frozen zone, re-verifying each signature. Soft-fail. Returns a
+// Map<agentId, {agentId, role, verified, manifest, envelope}>. Mirrors readTrustworthySkills.
+async function readTrustworthyAgents(doc) {
+  const out = new Map();
+  const zone = _agExtractZone(doc);
+  if (!zone) return out;
+  const blocks = zone.matchAll(/<script\s+type="application\/rwa-agent\+json">([\s\S]*?)<\/script>/g);
+  for (const m of blocks) {
+    let env;
+    try { env = JSON.parse(new TextDecoder().decode(_skFromB64(m[1].trim()))); } catch (_) { continue; }
+    const agent = env && env.agent;
+    if (!agent || typeof agent.role !== 'string') continue;
+    const verified = await _agVerify(env);
+    const id = await _agAgentId(agent.role, agent.author_pubkey);
+    out.set(id, { agentId: id, role: agent.role, verified, manifest: agent, envelope: env });
+  }
+  return out;
+}
+// I5 (v0.9 §4) — per-author source index (rwa_sources, keyed by public key):
+//   { pubkey, count, first_seen, name_history:[{ name, first_seen_at_name }] }
+// name_history is APPEND-ONLY and holds one entry per DISTINCT name a key has published, in first-
+// seen order (Invariant 22). It anchors author identity across renames: the install dialog shows a
+// same-key name change ("previously published [old]"). DATES are best-effort — the frozen-zone bytes
+// carry no timestamps (determinism), so a cleared-IDB reload reconciles names from the in-file
+// manifests with the reconcile time as first_seen_at_name. Identity itself is always the key.
+async function _skSourceGet(pubkey) {
+  if (!pubkey) return null;
+  try { return (await idbGet(RWA.SOURCES, pubkey)) || null; } catch (_) { return null; }
+}
+// Append (name, now) for a key, creating the record if absent. Idempotent per distinct name.
+async function _skSourceRecord(pubkey, name, at) {
+  if (!pubkey || !name) return;
+  const now = at || Date.now();
+  let rec = await _skSourceGet(pubkey);
+  if (!rec) rec = { pubkey, count: 0, first_seen: now, name_history: [] };
+  if (!Array.isArray(rec.name_history)) rec.name_history = [];
+  if (!rec.name_history.some(e => e.name === name)) rec.name_history.push({ name, first_seen_at_name: now });
+  rec.count = (rec.count | 0) + 1;
+  try { await idbPut(RWA.SOURCES, rec, pubkey); } catch (_) { /* best-effort; never blocks an install */ }
+}
+// Boot reconcile: ensure every (pubkey, name) present in the live registry has a name_history entry.
+// Rebuilds from the in-file manifests so an IDB-cleared reload still knows the recorded renames.
+async function runtimeBuildSourceIndex() {
+  const now = Date.now(), byKey = new Map();
+  for (const s of installedSkills.values()) {
+    const pk = s.manifest && s.manifest.author_pubkey;
+    if (!pk || !s.name) continue;
+    if (!byKey.has(pk)) byKey.set(pk, new Set());
+    byKey.get(pk).add(s.name);
+  }
+  for (const [pk, names] of byKey) {
+    let rec = await _skSourceGet(pk);
+    if (!rec) rec = { pubkey: pk, count: 0, first_seen: now, name_history: [] };
+    if (!Array.isArray(rec.name_history)) rec.name_history = [];
+    const known = new Set(rec.name_history.map(e => e.name));
+    let changed = false;
+    for (const nm of names) if (!known.has(nm)) { rec.name_history.push({ name: nm, first_seen_at_name: now }); changed = true; }
+    if ((rec.count | 0) < names.size) { rec.count = names.size; changed = true; }
+    if (changed) { try { await idbPut(RWA.SOURCES, rec, pk); } catch (_) {} }
+  }
+}
+// What prior names has this author (key) published, other than the incoming one? Returns the prior
+// names (newest-first) + the most-recent prior, for the dialog's rename note. A rename surfaces only
+// when the incoming name is genuinely NEW for the key (so a same-name re-install / I10 update is not
+// a "rename").
+async function _skNameChange(pubkey, name) {
+  const rec = await _skSourceGet(pubkey);
+  const hist = (rec && Array.isArray(rec.name_history)) ? rec.name_history : [];
+  const priorNames = hist.filter(e => e.name !== name).map(e => ({ name: e.name, date: e.first_seen_at_name })).reverse();
+  const isRename = priorNames.length > 0 && !hist.some(e => e.name === name);
+  return { priorNames, nameChange: isRename ? { prev: priorNames[0] } : null };
+}
 function runtimeListSkills() {
   return Array.from(installedSkills.values()).map(s => ({ skillId: s.skillId, kind: s.kind, name: s.name, verified: s.verified }));
 }
@@ -6583,6 +6771,25 @@ function _skVaultAllowed(skill, ns) {
   const perms = (skill.manifest && Array.isArray(skill.manifest.permissions)) ? skill.manifest.permissions : [];
   return perms.indexOf('vault:' + ns) !== -1;
 }
+// §5 (I1) — the bridge's per-call bus gate: exact-string bus:<topic> match, no wildcards.
+function _skBusAllowed(skill, topic) {
+  const perms = (skill.manifest && Array.isArray(skill.manifest.permissions)) ? skill.manifest.permissions : [];
+  return perms.indexOf('bus:' + topic) !== -1;
+}
+// §6 (I3) — the bridge's per-call fs gate: the (already traversal-checked) path must fall under
+// a declared fsa:<scope> subtree (left-anchored prefix, no wildcards).
+function _skFsAllowed(skill, path) {
+  const perms = (skill.manifest && Array.isArray(skill.manifest.permissions)) ? skill.manifest.permissions : [];
+  for (const p of perms) {
+    if (String(p).startsWith('fsa:')) { const scope = String(p).slice(4); if (path === scope || path.startsWith(scope + '/')) return true; }
+  }
+  return false;
+}
+// §7 (I4) — the bridge's per-call idb gate: exact-string idb:<store> match, no wildcards.
+function _skIdbAllowed(skill, store) {
+  const perms = (skill.manifest && Array.isArray(skill.manifest.permissions)) ? skill.manifest.permissions : [];
+  return perms.indexOf('idb:' + store) !== -1;
+}
 
 // ─── Install dialog (shannon, v0.8 §1) — the trust anchor. Mirrors of the cli
 // consent helpers (permissionToProse/compoundRisk/capabilityScan/levenshtein). ──────
@@ -6601,12 +6808,32 @@ function _skPermProse(perm) {
     if (v === '*') return 'Read and write credentials stored under ANY vault namespace — every credential you have stored. Use only for vault administration.';
     return 'Read and write credentials stored under ' + v + '.';
   }
+  if (s.startsWith('bus:')) {
+    return 'Send and receive messages on the "' + s.slice(4) + '" channel shared with other rewritables on this machine.';
+  }
+  if (s.startsWith('fsa:')) {
+    return 'Read and write files under "' + s.slice(4) + '" in this document\'s private storage.';
+  }
+  if (s.startsWith('idb:')) {
+    return 'Read and write the "' + s.slice(4) + '" data store in this document\'s database.';
+  }
+  if (s.startsWith('hook:')) {
+    const ev = s.slice(5);
+    const when = ev === 'on-commit' ? 'every time the document is saved' : ev === 'on-open' ? 'every time the document opens' : ev === 'on-mode-change' ? 'every time you switch modes' : ev;
+    return 'Run automatically ' + when + ' (no network or credential access).';
+  }
   return s;
 }
 function _skCompoundRisk(perms) {
   perms = Array.isArray(perms) ? perms : [];
-  if (perms.some(p => String(p).startsWith('vault:')) && perms.some(p => String(p).startsWith('network:')))
+  const has = (t) => perms.some(p => String(p).startsWith(t + ':'));
+  const hasVault = has('vault'), hasNetwork = has('network'), hasBus = has('bus'), hasFsa = has('fsa'), hasIdb = has('idb');
+  if (hasVault && hasNetwork)
     return 'This skill can both read your stored credentials AND make network requests. A skill with this combination can send credentials to its allowed destination — intentionally or by mistake. Install only if you fully trust this author.';
+  if (hasBus && (hasVault || hasNetwork))
+    return 'This skill can message other rewritables on this machine AND ' + (hasVault ? 'read your stored credentials' : 'make network requests') + '. Together these let it coordinate a multi-step action across your workspace — intentionally or by mistake. Install only if you fully trust this author.';
+  if ((hasFsa || hasIdb) && (hasNetwork || hasVault || hasBus))
+    return 'This skill can ' + (hasFsa ? 'read and write files in this document' : 'read and write this document\'s stored data') + ' AND ' + (hasNetwork ? 'make network requests' : hasVault ? 'read your stored credentials' : 'message other rewritables on this machine') + '. Together these let it move your local data off this document — intentionally or by mistake. Install only if you fully trust this author.';
   return null;
 }
 function _skCapabilityScan(code) {
@@ -6635,6 +6862,26 @@ function _skLevenshtein(a, b) {
   for (let i = 1; i <= m; i++) { const cur = [i]; for (let j = 1; j <= n; j++) cur[j] = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1)); prev = cur; }
   return prev[n];
 }
+// I5 (v0.9 §4) — Unicode-confusable skeleton. NFKC + toLowerCase fold case, fullwidth forms,
+// ligatures, and mathematical-alphanumeric letters to ASCII; this baked table folds the
+// CROSS-SCRIPT homoglyphs NFKC leaves alone (Cyrillic, Greek, Armenian, a few Latin-extended).
+// CURATED, not the full UTS #39 confusables.txt: every entry maps a non-ASCII glyph that renders
+// ~identically to an ASCII letter. ASCII→ASCII is NEVER folded (legit "tool"/"toml" stay distinct).
+// Byte-mirror of cli/src/skill-manifest.mjs CONFUSABLES. Keys are post-NFKC-lowercase codepoints.
+const _SK_CONFUSABLES = {
+  'а': 'a', 'е': 'e', 'о': 'o', 'р': 'p', 'с': 'c',
+  'у': 'y', 'х': 'x', 'к': 'k', 'ѕ': 's', 'і': 'i',
+  'ј': 'j', 'ԁ': 'd', 'һ': 'h', 'ԛ': 'q', 'ԝ': 'w',
+  'ѵ': 'v', 'ӏ': 'l', 'ɠ': 'g',
+  'α': 'a', 'ο': 'o', 'ρ': 'p', 'ε': 'e', 'ι': 'i',
+  'κ': 'k', 'ν': 'v', 'υ': 'u', 'χ': 'x', 'τ': 't',
+  'ϲ': 'c', 'ϳ': 'j',
+  'օ': 'o', 'ո': 'n',
+  'ı': 'i', 'ɑ': 'a', 'ɡ': 'g',
+};
+function _skNormalize(s) { return String(s == null ? '' : s).normalize('NFKC').toLowerCase(); }
+function _skSkeleton(s) { let out = ''; for (const ch of _skNormalize(s)) out += (_SK_CONFUSABLES[ch] || ch); return out; }
+function _skSkeletonDistance(a, b) { return _skLevenshtein(_skSkeleton(a), _skSkeleton(b)); }
 // §3.4 install gates (mirror cli validateInstall).
 const _SK_VAULT_NS = /^[a-z0-9_](?:[a-z0-9_-]{0,62}[a-z0-9_])?$/;
 // §4 permission grammar (mirror cli parsePermission) — validates the VALUE, not
@@ -6658,6 +6905,32 @@ function _skParsePermission(p) {
     if (value.length > 64 || !_SK_VAULT_NS.test(value)) throw new Error(`invalid vault namespace: ${value}`);
     return { tier, value };
   }
+  if (tier === 'bus') {
+    // §5 (I1): topic 1–96 chars, start alphanumeric, charset [A-Za-z0-9:_./%-], NOT a
+    // runtime-reserved prefix (rwa_/rwa:/skills:/workspace:). Mirror of cli parsePermission.
+    if (!value || value.length > 96 || !/^[A-Za-z0-9][A-Za-z0-9:_./%-]*$/.test(value) || /^(?:rwa[:_]|skills:|workspace:)/.test(value))
+      throw new Error(`invalid bus topic: ${value}`);
+    return { tier, value };
+  }
+  if (tier === 'fsa') {
+    // §6 (I3): relative OPFS scope — lowercase [a-z0-9_/-], start+end alphanumeric/underscore,
+    // ≤128 chars, no '.'/'..' (excluded by charset), not _rwa/-prefixed. Mirror of cli.
+    if (!value || value.length > 128 || /^_rwa(?:\/|$)/.test(value) || !/^[a-z0-9_](?:[a-z0-9_/-]*[a-z0-9_])?$/.test(value))
+      throw new Error(`invalid fsa scope: ${value}`);
+    return { tier, value };
+  }
+  if (tier === 'idb') {
+    // §7 (I4): store ^[A-Za-z0-9_][A-Za-z0-9_-]{0,62}$ (≤64 octets, no wildcards); never rwa_*
+    // (reserved) or rwa_vault — distinct subcodes so the dialog can explain. Mirror of cli.
+    if (/^rwa_/.test(value)) throw new Error(value === 'rwa_vault' ? 'idb_vault_store_forbidden' : 'idb_reserved_store');
+    if (!/^[A-Za-z0-9_][A-Za-z0-9_-]{0,62}$/.test(value)) throw new Error(`invalid idb store: ${value}`);
+    return { tier, value };
+  }
+  if (tier === 'hook') {
+    // §9 (I8): lifecycle event, exact enum, no wildcards. Unknown event → unknown_permission_tier.
+    if (value === 'on-commit' || value === 'on-open' || value === 'on-mode-change') return { tier, value };
+    throw new Error(`unknown_permission_tier: hook event ${value}`);
+  }
   throw new Error(`unknown_permission_tier: ${tier}`);
 }
 function _skValidateInstall(skill, vr) {
@@ -6672,11 +6945,19 @@ function _skValidateInstall(skill, vr) {
   // F7: validate each permission's VALUE via the grammar, not just the tier.
   for (const p of perms) {
     try { _skParsePermission(p); }
-    catch (e) { errors.push(/unknown_permission_tier/.test(e.message) ? 'unknown_permission_tier' : 'invalid_permission'); }
+    catch (e) {
+      const m = e.message;
+      if (/unknown_permission_tier/.test(m)) errors.push('unknown_permission_tier');
+      else if (m === 'idb_reserved_store' || m === 'idb_vault_store_forbidden') errors.push(m); // §7 distinct subcodes
+      else errors.push('invalid_permission');
+    }
   }
   if (skill.kind === 'compute' && perms.length > 0) errors.push('compute_with_permissions');
+  // §9 (I8): a hook is compute-only — only hook:<event> perms; any other tier → compute_with_permissions.
+  if (skill.kind === 'hook' && perms.some(p => { try { return _skParsePermission(p).tier !== 'hook'; } catch (_) { return false; } })) errors.push('compute_with_permissions');
   if (!vr.signed && perms.length > 0) errors.push('unsigned_with_permissions');
-  if (skill.kind === 'tool' && !vr.verified) errors.push('unsigned_capability');
+  // Tools AND hooks carry capability (a hook runs autonomously) → must be signed+verified.
+  if ((skill.kind === 'tool' || skill.kind === 'hook') && !vr.verified) errors.push('unsigned_capability');
   return { ok: errors.length === 0, errors };
 }
 // §1 — the structured trust info the dialog renders.
@@ -6684,22 +6965,54 @@ async function runtimeReviewSkill(envelope) {
   const skill = (envelope && envelope.skill) || {};
   const perms = Array.isArray(skill.permissions) ? skill.permissions : [];
   const vr = { signed: !!(envelope && envelope.signature), verified: await _skVerify(envelope) };
-  let lookalike = null;
+  let levMatch = null, skelMatch = null;
   for (const s of installedSkills.values()) {
+    if (!s.manifest || s.manifest.author_pubkey === skill.author_pubkey) continue; // same author ≠ impersonation
     const d = _skLevenshtein(s.name, skill.name);
     // A DIFFERENT key with the same/near name is impersonation. Exact-name (d===0) ALWAYS fires —
     // it's the strongest spoof and the §3.3 case lookalike is responsible for; a near miss (1–2 edits)
     // fires only when both names are long enough that 1–2 edits is "similar", not "unrelated".
     const exact = d === 0, near = d >= 1 && d <= 2 && String(skill.name).length >= 4 && String(s.name).length >= 4;
-    if (s.manifest && s.manifest.author_pubkey !== skill.author_pubkey && (exact || near)) { lookalike = s.name; break; }
+    if (!levMatch && (exact || near)) levMatch = s.name;
+    // I5 — Unicode-confusable (skeleton) match. Fires only when confusable folding COLLAPSED a real
+    // byte difference (sd < normalized-Levenshtein) — i.e. a cross-script homoglyph that renders
+    // identically — NOT on an honest ASCII near-miss (where sd === ld). That distinction is what lets
+    // an exact ASCII name from a different key WARN (Invariant 10) while a homoglyph BLOCKS.
+    if (!skelMatch) {
+      const sd = _skSkeletonDistance(s.name, skill.name);
+      const ld = _skLevenshtein(_skNormalize(s.name), _skNormalize(skill.name));
+      if (sd <= 1 && sd < ld) skelMatch = s.name;
+    }
   }
+  // skeleton (homoglyph) takes precedence over a plain Levenshtein warn; a signed skeleton match is
+  // a hard BLOCK (the skill carries capability to escalate), an unsigned one only warns.
+  const lookalike = skelMatch || levMatch;
+  const lookalikeKind = skelMatch ? 'skeleton' : (levMatch ? 'levenshtein' : null);
+  const lookalikeBlock = !!(skelMatch && vr.signed);
+  // I10 (Shape C) — the update delta. If this skillId is already installed, surface the
+  // permission change (added/removed, order-invariant case-sensitive set ops) so the dialog
+  // can show it and require explicit re-affirmation — no silent permission escalation on update.
+  let update = { isUpdate: false, added: [], removed: [], changed: false };
+  try {
+    const prevS = installedSkills.get(await _skSkillId(skill.name, skill.author_pubkey));
+    if (prevS) {
+      const oldPerms = (prevS.manifest && Array.isArray(prevS.manifest.permissions)) ? prevS.manifest.permissions : [];
+      const oldSet = new Set(oldPerms), newSet = new Set(perms);
+      const added = perms.filter(p => !oldSet.has(p)), removed = oldPerms.filter(p => !newSet.has(p));
+      update = { isUpdate: true, added: added.map(p => ({ perm: p, prose: _skPermProse(p) })), removed: removed.map(p => ({ perm: p, prose: _skPermProse(p) })), changed: added.length > 0 || removed.length > 0 };
+    }
+  } catch (_) { /* a malformed name/id can't match an install → treat as fresh; gates reject it downstream */ }
+  // I5 — per-author name_history: surface a same-key rename so identity reads across name changes.
+  const nameInfo = await _skNameChange(skill.author_pubkey, skill.name);
   return {
     name: skill.name, version: skill.version, kind: skill.kind,
     purpose: skill.description || '(no description provided)',
     author_pubkey: skill.author_pubkey, signed: vr.signed, verified: vr.verified,
     permissions: perms.map(p => ({ perm: p, prose: _skPermProse(p) })),
     compoundRisk: _skCompoundRisk(perms), scanNotes: _skCapabilityScan(skill.code),
-    lookalike, gates: _skValidateInstall(skill, vr),
+    lookalike, lookalikeKind, lookalikeBlock,
+    priorNames: nameInfo.priorNames, nameChange: nameInfo.nameChange,
+    gates: _skValidateInstall(skill, vr), update,
   };
 }
 // §7 — serialize the registry into the frozen #rwa-skills zone. CANONICAL: sorted by
@@ -6739,6 +7052,10 @@ function _skSkillsRegion() {
 async function runtimeInstallSkill(envelope) {
   const review = await runtimeReviewSkill(envelope);
   if (!review.gates.ok) return { ok: false, errors: review.gates.errors };
+  // I5 — a signed skill whose name skeleton-folds to a DIFFERENT author's installed skill is a
+  // homoglyph impersonation: refuse before any code is registered (Invariant 21). Unsigned skills
+  // can't escalate, so review.lookalikeBlock is false for them — they only warn in the dialog.
+  if (review.lookalikeBlock) return { ok: false, errors: ['lookalike_skeleton_blocked'] };
   const forbidden = _skCodeForbidden((envelope.skill || {}).code);
   if (forbidden) return { ok: false, errors: [forbidden] };
   const skill = envelope.skill, id = await _skSkillId(skill.name, skill.author_pubkey);
@@ -6750,6 +7067,9 @@ async function runtimeInstallSkill(envelope) {
     if (prev) installedSkills.set(id, prev); else installedSkills.delete(id);
     return { ok: false, errors: [(e && e.code) || (e && e.message) || 'persist_failed'] };
   }
+  // I5 — record this (key, name) in the per-author name_history (best-effort; never fails the
+  // install). On a same-key rename the new name is appended; identity stays anchored on the key.
+  await _skSourceRecord(skill.author_pubkey, skill.name);
   return { ok: true, skillId: id };
 }
 // §7 — remove a skill + persist the emptied/updated zone (same rollback discipline).
@@ -6765,6 +7085,126 @@ async function runtimeUninstallSkill(skillId) {
   }
   return { ok: true };
 }
+// ── I12 (v0.9 §12) — agent registry ops. The #rwa-agents zone is built/committed exactly like
+// #rwa-skills (skillId-sorted base64 envelopes, runtimeRegionCommit reachability:'frozen'); the two
+// zones coexist and the region primitive commits each atomically. insertAt is the no-zone fallback
+// (a fresh skill-host has no agents zone yet → the first install appends one).
+function buildAgentZone(agents) {
+  const blocks = Array.from(agents.values())
+    .filter(a => a.envelope)
+    .sort((a, b) => (a.agentId < b.agentId ? -1 : a.agentId > b.agentId ? 1 : 0))
+    .map(a => '<script type="application/rwa-agent+json">' + _skB64(_skUtf8(JSON.stringify(a.envelope))) + '<\/script>')
+    .join('');
+  return '<div data-rwa-frozen id="rwa-agents">' + blocks + '</div>';
+}
+function _agAgentsRegion() {
+  return {
+    frozenId: 'rwa-agents',
+    select(doc) {
+      const open = /<div\b[^>]*\bid="rwa-agents"[^>]*>/i.exec(doc);
+      if (!open) return null;
+      const close = doc.indexOf('</div>', open.index + open[0].length);
+      return close < 0 ? null : [open.index, close + 6];
+    },
+    insertAt(doc) { return doc.length; },
+    build() { return buildAgentZone(installedAgents); },
+  };
+}
+function runtimeListAgents() {
+  return Array.from(installedAgents.values()).map(a => ({ role: a.role, author_pubkey: a.manifest && a.manifest.author_pubkey, verified: a.verified }));
+}
+function runtimeAgentActive() {
+  if (!activeAgentRole) return null;
+  const rec = Array.from(installedAgents.values()).find(a => a.role === activeAgentRole);
+  return rec ? { role: rec.role, author_pubkey: rec.manifest && rec.manifest.author_pubkey } : null;
+}
+// Switch the active role. The trust anchor is the signature: an unverified (tampered) agent can be
+// installed but NEVER activated (unverified_agent), so a tampered prompt can't drive modify().
+function runtimeSetActiveAgent(role) {
+  if (role == null) { activeAgentRole = null; return; }
+  const rec = Array.from(installedAgents.values()).find(a => a.role === role);
+  if (!rec) throw new RwaEditError('agent_not_found', null, { role });
+  if (!rec.verified) throw new RwaEditError('unverified_agent', null, { role });
+  activeAgentRole = role;
+}
+// §12 — validate + verify + register an agent, then persist the #rwa-agents zone (same discipline as
+// runtimeInstallSkill: rollback the in-memory map on a persist failure). A signed-but-unverified
+// agent registers (verified:false) but can't activate.
+async function runtimeInstallAgent(envelope) {
+  const agent = (envelope && envelope.agent) || {};
+  const signed = !!(envelope && envelope.signature);
+  const gate = _agValidateInstall(agent, signed);
+  if (!gate.ok) return { ok: false, errors: gate.errors };
+  const verified = await _agVerify(envelope);
+  const id = await _agAgentId(agent.role, agent.author_pubkey);
+  const prev = installedAgents.get(id);
+  installedAgents.set(id, { agentId: id, role: agent.role, verified, manifest: agent, envelope });
+  try {
+    await runtimeRegionCommit({ regions: [_agAgentsRegion()], actor: prev ? 'agent:update' : 'agent:install', reachability: 'frozen' });
+  } catch (e) {
+    if (prev) installedAgents.set(id, prev); else installedAgents.delete(id);
+    return { ok: false, errors: [(e && e.code) || (e && e.message) || 'persist_failed'] };
+  }
+  return { ok: true, agentId: id, verified };
+}
+async function runtimeUninstallAgent(agentId) {
+  const prev = installedAgents.get(agentId);
+  if (!prev) return { ok: false, errors: ['not_installed'] };
+  installedAgents.delete(agentId);
+  if (activeAgentRole && prev.role === activeAgentRole && !Array.from(installedAgents.values()).some(a => a.role === activeAgentRole)) activeAgentRole = null;
+  try {
+    await runtimeRegionCommit({ regions: [_agAgentsRegion()], actor: 'agent:uninstall', reachability: 'frozen' });
+  } catch (e) {
+    installedAgents.set(agentId, prev);
+    return { ok: false, errors: [(e && e.code) || (e && e.message) || 'persist_failed'] };
+  }
+  return { ok: true };
+}
+// ── I8 (v0.9 §9) — hook firing. Installed `hook` skills that declare hook:<event> run (compute-only,
+// no bridge) when the mapped lifecycle event fires. Fire-and-forget: never blocks/throws into the
+// emitter (Inv 24); deterministic skillId order; re-entrancy-guarded (Inv 23); every run logged to
+// rwa_hook_log (Inv 25). A hook must be verified (boot re-check) to fire.
+function _hooksForEvent(hookEvent) {
+  return Array.from(installedSkills.values())
+    .filter(s => s && s.kind === 'hook' && s.verified && Array.isArray(s.manifest && s.manifest.permissions) && s.manifest.permissions.indexOf('hook:' + hookEvent) !== -1)
+    .sort((a, b) => (a.skillId < b.skillId ? -1 : a.skillId > b.skillId ? 1 : 0));
+}
+function _hookLog(entry) {
+  return idbPut(RWA.HOOK_LOG, entry, entry.ts + '-' + (_hookSeq++)).catch(() => {});
+}
+function fireHooks(hookEvent, input) {
+  for (const h of _hooksForEvent(hookEvent)) {
+    if (activeHooks.has(h.skillId)) continue; // a hook can't re-fire its own event
+    activeHooks.add(h.skillId);
+    const t0 = Date.now(), sid = h.skillId;
+    let p; try { p = Promise.resolve(runtimeInvokeSkill(sid, input)); } catch (e) { p = Promise.reject(e); }
+    p.then(
+      result => _hookLog({ skillId: sid, event: hookEvent, ts: t0, input, result, duration: Date.now() - t0 }),
+      err => _hookLog({ skillId: sid, event: hookEvent, ts: t0, input, error: String((err && err.message) || err), duration: Date.now() - t0 })
+    ).then(() => activeHooks.delete(sid), () => activeHooks.delete(sid));
+  }
+}
+// The audit trail. getAll in key (≈ chronological) order; never throws.
+async function runtimeHookLog() {
+  try {
+    const db = await openDB();
+    return await new Promise((res) => { const tx = db.transaction(RWA.HOOK_LOG); const r = tx.objectStore(RWA.HOOK_LOG).getAll(); r.onsuccess = () => res(r.result || []); tx.onerror = () => res([]); });
+  } catch (_) { return []; }
+}
+// Boot prune: drop entries older than 30d, then cap to the 1000 most recent.
+async function _hookLogPrune() {
+  try {
+    const db = await openDB();
+    const read = (fn) => new Promise((res) => { const tx = db.transaction(RWA.HOOK_LOG); const r = tx.objectStore(RWA.HOOK_LOG)[fn](); r.onsuccess = () => res(r.result || []); tx.onerror = () => res([]); });
+    const keys = await read('getAllKeys'), vals = await read('getAll');
+    const cutoff = Date.now() - 30 * 24 * 3600 * 1000;
+    const pairs = keys.map((k, i) => ({ k, ts: (vals[i] && vals[i].ts) || 0 }));
+    const fresh = pairs.filter(p => p.ts >= cutoff);
+    const drop = pairs.filter(p => p.ts < cutoff).map(p => p.k)
+      .concat(fresh.length > 1000 ? fresh.sort((a, b) => a.ts - b.ts).slice(0, fresh.length - 1000).map(p => p.k) : []);
+    for (const k of drop) await idbDel(RWA.HOOK_LOG, k);
+  } catch (_) {}
+}
 // §1 — the install dialog (trust anchor). Renders the review and resolves with the user's choice.
 function showSkillInstallDialog(envelope) {
   return runtimeReviewSkill(envelope).then(rv => new Promise(resolve => {
@@ -6777,11 +7217,45 @@ function showSkillInstallDialog(envelope) {
     const authorHtml = rv.signed
       ? (rv.verified ? 'Signed by key <code>' + _skEsc(String(rv.author_pubkey).slice(0, 12)) + '…</code>' : '⚠ Signature does NOT verify — the code may have been modified.')
       : '⚠ Unsigned — the runtime can\'t verify the author or that the code is unmodified.';
+    // I10 (Shape C) — on an update whose permissions changed, surface the delta and make the
+    // affirm button explicitly about the NEW permissions. No silent escalation: the install
+    // call still fires only on the click below.
+    const upd = rv.update || { isUpdate: false, changed: false, added: [], removed: [] };
+    const updHtml = (upd.isUpdate && upd.changed)
+      ? '<div style="background:#fef3c7;border-radius:8px;padding:10px 12px;margin:.8em 0"><strong>You already installed this skill. This version changes what it can do:</strong>'
+        + (upd.added.length ? '<p style="margin:.6em 0 .2em;color:#b45309"><strong>+ Newly requested permissions</strong></p><ul style="margin:.2em 0;padding-left:1.2em">' + upd.added.map(p => '<li>' + _skEsc(p.prose) + '</li>').join('') + '</ul>' : '')
+        + (upd.removed.length ? '<p style="margin:.6em 0 .2em;color:#6b7280"><strong>− No longer requested</strong></p><ul style="margin:.2em 0;padding-left:1.2em;color:#6b7280">' + upd.removed.map(p => '<li>' + _skEsc(p.prose) + '</li>').join('') + '</ul>' : '')
+        + '</div>'
+      : '';
+    const affirmText = (upd.isUpdate && upd.changed) ? 'I have reviewed the new permissions and want to update this skill'
+      : upd.isUpdate ? 'Update this skill'
+      : 'I have reviewed this skill and want to install it';
+    // I5 — tiered lookalike notice. A signed homoglyph (lookalikeBlock) is a hard impersonation
+    // block (red, install suppressed); an unsigned homoglyph (kind:'skeleton') is a severe warning;
+    // an honest ASCII near-miss (kind:'levenshtein') is the existing amber name-collision warning.
+    const lookalikeHtml = rv.lookalikeBlock
+      ? '<p style="background:#fee2e2;border:1px solid #ef4444;border-radius:8px;padding:8px 10px;margin:.6em 0">⚠️ This name uses characters that look identical to <strong>' + _skEsc(rv.lookalike) + '</strong> from a DIFFERENT author. This is a known impersonation pattern, so installation is blocked. Identity is the key, not the name.</p>'
+      : rv.lookalikeKind === 'skeleton'
+      ? '<p style="background:#fef3c7;border-radius:8px;padding:8px 10px;margin:.6em 0">⚠️ This name uses characters that look identical to <strong>' + _skEsc(rv.lookalike) + '</strong>, which you installed from a DIFFERENT key. Review the key carefully — identity is the key, not the name.</p>'
+      : rv.lookalike
+      ? '<p style="background:#fef3c7;border-radius:8px;padding:8px 10px;margin:.6em 0">⚠ This name closely matches <strong>' + _skEsc(rv.lookalike) + '</strong>, which you installed from a DIFFERENT key. The author is identified by the key, not the name.</p>'
+      : '';
+    // I5 — same-key rename note (informational, non-permission). Suppressed under a homoglyph block
+    // (impersonation supersedes). Anchors identity on the key: "the author is identified by the key".
+    const nc = rv.nameChange;
+    const nameChangeHtml = (nc && nc.prev && !rv.lookalikeBlock)
+      ? '<p style="background:#eff6ff;border-radius:8px;padding:8px 10px;margin:.6em 0">ℹ️ This author previously published a skill named <strong>' + _skEsc(nc.prev.name) + '</strong>'
+        + (typeof nc.prev.date === 'number' ? ' on ' + _skEsc(new Date(nc.prev.date).toLocaleDateString()) : '')
+        + '. The current name is <strong>' + _skEsc(rv.name) + '</strong>. The author is identified by the key, not the name.</p>'
+      : '';
+    const canInstall = rv.gates.ok && !rv.lookalikeBlock;
     card.innerHTML =
       '<h2 style="margin:0 0 .2em;font-size:1.25rem">Install ' + _skEsc(rv.name) + '?</h2>' +
       '<p style="margin:.2em 0 1em;color:#444"><strong>What it claims to do:</strong> ' + _skEsc(rv.purpose) + '</p>' +
       '<p style="margin:.2em 0"><strong>Author.</strong> ' + authorHtml + '</p>' +
-      (rv.lookalike ? '<p style="background:#fef3c7;border-radius:8px;padding:8px 10px;margin:.6em 0">⚠ This name closely matches <strong>' + _skEsc(rv.lookalike) + '</strong>, which you installed from a DIFFERENT key. The author is identified by the key, not the name.</p>' : '') +
+      lookalikeHtml +
+      nameChangeHtml +
+      updHtml +
       '<p style="margin:1em 0 .2em"><strong>What it can do on your machine</strong></p>' + permsHtml +
       (rv.compoundRisk ? '<p style="background:#fee2e2;border-radius:8px;padding:8px 10px;margin:.6em 0">⚠ ' + _skEsc(rv.compoundRisk) + '</p>' : '') +
       (rv.scanNotes.length ? '<p style="margin:1em 0 .2em"><strong>Notes from the runtime\'s code review</strong></p><ul style="margin:.2em 0;padding-left:1.2em;color:#555">' + rv.scanNotes.map(n => '<li>' + _skEsc(n) + '</li>').join('') + '</ul>' : '') +
@@ -6789,7 +7263,7 @@ function showSkillInstallDialog(envelope) {
       (rv.gates.ok ? '' : '<p style="background:#fee2e2;border-radius:8px;padding:8px 10px;margin:.6em 0">Cannot install: ' + _skEsc(rv.gates.errors.join(', ')) + '</p>') +
       '<div style="display:flex;gap:10px;margin-top:1.2em;justify-content:flex-end">' +
         '<button data-act="cancel" style="padding:9px 16px;border:1px solid #ccc;border-radius:10px;background:#fff;cursor:pointer">Cancel</button>' +
-        (rv.gates.ok ? '<button data-act="install" style="padding:9px 16px;border:none;border-radius:10px;background:var(--gray-900,#111);color:#fff;cursor:pointer">I have reviewed this skill and want to install it</button>' : '') +
+        (canInstall ? '<button data-act="install" style="padding:9px 16px;border:none;border-radius:10px;background:var(--gray-900,#111);color:#fff;cursor:pointer">' + _skEsc(affirmText) + '</button>' : '') +
       '</div>';
     overlay.appendChild(card); document.body.appendChild(overlay);
     const close = (r) => { overlay.remove(); resolve(r); };
@@ -6797,10 +7271,49 @@ function showSkillInstallDialog(envelope) {
     const ib = card.querySelector('[data-act=install]'); if (ib) ib.onclick = async () => close(await runtimeInstallSkill(envelope));
   }));
 }
-// §1.3 — install trigger: pick a .rwa-skill.json, parse, show the dialog.
+// I12 (v0.9 §12) — the AGENT install dialog (SHOULD): role + author key + vault namespaces +
+// a system-prompt preview (≤200 chars). The install button is offered only for a VERIFIED agent
+// whose record passes the gates; a tampered (unverified) or gate-failing record shows the reason
+// and suppresses install. The trust anchor is the key, not the role.
+function showAgentInstallDialog(envelope) {
+  const agent = (envelope && envelope.agent) || {};
+  const signed = !!(envelope && envelope.signature);
+  return Promise.resolve(_agVerify(envelope)).then(verified => new Promise(resolve => {
+    const gates = _agValidateInstall(agent, signed);
+    const prev = document.getElementById('rwa-agent-install'); if (prev) prev.remove();
+    const overlay = document.createElement('div'); overlay.id = 'rwa-agent-install';
+    overlay.style.cssText = 'position:fixed;inset:0;z-index:99999;background:rgba(0,0,0,.45);display:flex;align-items:center;justify-content:center;';
+    const card = document.createElement('div');
+    card.style.cssText = 'background:#fff;max-width:560px;width:92%;max-height:86vh;overflow:auto;border-radius:18px;padding:26px 28px;font:14px/1.5 var(--font-ui,system-ui);box-shadow:0 12px 48px rgba(0,0,0,.28);';
+    const nsSet = Array.isArray(agent.vault_namespace_set) ? agent.vault_namespace_set : [];
+    const nsHtml = nsSet.length ? '<ul style="margin:.4em 0;padding-left:1.2em">' + nsSet.map(n => '<li>' + _skEsc(n) + '</li>').join('') + '</ul>' : '<p style="color:#666">No credential namespaces — this role reads/writes no vault entries.</p>';
+    const promptPreview = String(agent.system_prompt == null ? '' : agent.system_prompt).slice(0, 200);
+    const authorHtml = signed
+      ? (verified ? 'Signed by key <code>' + _skEsc(String(agent.author_pubkey).slice(0, 12)) + '…</code>' : '⚠ Signature does NOT verify — this record was modified. It cannot be activated.')
+      : '⚠ Unsigned — agents must be signed; this cannot be installed.';
+    const canInstall = gates.ok && verified;
+    card.innerHTML =
+      '<h2 style="margin:0 0 .2em;font-size:1.25rem">Install agent role “' + _skEsc(agent.role) + '”?</h2>' +
+      '<p style="margin:.2em 0 1em;color:#444"><strong>Purpose.</strong> ' + _skEsc(agent.description || '(no description provided)') + '</p>' +
+      '<p style="margin:.2em 0"><strong>Author.</strong> ' + authorHtml + ' <em>The author is identified by the key, not the role name.</em></p>' +
+      '<p style="margin:1em 0 .2em"><strong>Credentials this role can reach</strong></p>' + nsHtml +
+      '<p style="margin:1em 0 .2em"><strong>Role instructions (preview)</strong></p><pre style="white-space:pre-wrap;background:#f6f6f6;border-radius:8px;padding:8px 10px;margin:.2em 0;color:#333;font:12px/1.5 var(--font-mono,monospace)">' + _skEsc(promptPreview) + (String(agent.system_prompt || '').length > 200 ? '…' : '') + '</pre>' +
+      '<p style="margin:1.2em 0 .4em;color:#444"><strong>An active role drives edits with its own instructions and reaches only its declared credentials.</strong> The runtime shows you what the role <em>can</em> do, not whether it <em>should</em>.</p>' +
+      (gates.ok ? '' : '<p style="background:#fee2e2;border-radius:8px;padding:8px 10px;margin:.6em 0">Cannot install: ' + _skEsc(gates.errors.join(', ')) + '</p>') +
+      '<div style="display:flex;gap:10px;margin-top:1.2em;justify-content:flex-end">' +
+        '<button data-act="cancel" style="padding:9px 16px;border:1px solid #ccc;border-radius:10px;background:#fff;cursor:pointer">Cancel</button>' +
+        (canInstall ? '<button data-act="install" style="padding:9px 16px;border:none;border-radius:10px;background:var(--gray-900,#111);color:#fff;cursor:pointer">I have reviewed this role and want to install it</button>' : '') +
+      '</div>';
+    overlay.appendChild(card); document.body.appendChild(overlay);
+    const close = (r) => { overlay.remove(); resolve(r); };
+    card.querySelector('[data-act=cancel]').onclick = () => close({ ok: false, errors: ['cancelled'] });
+    const ib = card.querySelector('[data-act=install]'); if (ib) ib.onclick = async () => close(await runtimeInstallAgent(envelope));
+  }));
+}
+// §1.3 / §12 — install trigger: pick a .rwa-skill.json OR .rwa-agent.json, parse, dispatch by format.
 function runtimePromptInstall() {
-  const inp = document.createElement('input'); inp.type = 'file'; inp.accept = '.rwa-skill.json,application/json,.json';
-  inp.onchange = () => { const f = inp.files && inp.files[0]; if (!f) return; const rd = new FileReader(); rd.onload = () => { let env; try { env = JSON.parse(rd.result); } catch (_) { setStatus && setStatus('err', 'invalid .rwa-skill.json'); return; } showSkillInstallDialog(env); }; rd.readAsText(f); };
+  const inp = document.createElement('input'); inp.type = 'file'; inp.accept = '.rwa-skill.json,.rwa-agent.json,application/json,.json';
+  inp.onchange = () => { const f = inp.files && inp.files[0]; if (!f) return; const rd = new FileReader(); rd.onload = () => { let env; try { env = JSON.parse(rd.result); } catch (_) { setStatus && setStatus('err', 'invalid skill/agent JSON'); return; } if (env && env.format === 'rwa-agent/1') showAgentInstallDialog(env); else showSkillInstallDialog(env); }; rd.readAsText(f); };
   inp.click();
 }
 
@@ -6839,6 +7352,9 @@ const SKILL_WORKER_PROLOGUE = `(function(){
   function _installBridge(){
     RUNTIME.fetch=function(url,opts){ return _bridge('bridge:fetch',{ url:String(url), opts:_serializeOpts(opts) }); };
     RUNTIME.vault={ get:function(ns,k){ return _bridge('bridge:vault',{op:'get',ns:ns,key:k}); }, set:function(ns,k,v){ return _bridge('bridge:vault',{op:'set',ns:ns,key:k,val:v}); }, has:function(ns,k){ return _bridge('bridge:vault',{op:'has',ns:ns,key:k}); } };
+    RUNTIME.bus={ publish:function(topic,message){ return _bridge('bridge:bus:publish',{ topic:String(topic), message:message }); } };
+    RUNTIME.fs={ read:function(p){ return _bridge('bridge:fs',{op:'read',path:String(p)}); }, write:function(p,d){ return _bridge('bridge:fs',{op:'write',path:String(p),data:d}); }, del:function(p){ return _bridge('bridge:fs',{op:'del',path:String(p)}); }, list:function(p){ return _bridge('bridge:fs',{op:'list',path:String(p)}); } };
+    RUNTIME.db={ get:function(s,k){ return _bridge('bridge:idb',{op:'get',store:String(s),key:k}); }, put:function(s,k,v){ return _bridge('bridge:idb',{op:'put',store:String(s),key:k,value:v}); }, del:function(s,k){ return _bridge('bridge:idb',{op:'del',store:String(s),key:k}); }, all:function(s){ return _bridge('bridge:idb',{op:'all',store:String(s)}); } };
   }
   self.onmessage=function(e){
     var msg=e.data; if(!msg) return;
@@ -6858,9 +7374,18 @@ const SKILL_WORKER_PROLOGUE = `(function(){
 // bridged fetch/vault with per-call origin/namespace enforcement on THIS (main) thread.
 // Per-invocation identity_tag binds responses; 5s timeout; spawn -> invoke -> terminate.
 // (Vault: increment 8. The worker-scoped CSP that walls remote import() is the frozen-<head> 7b meta.)
-function runtimeInvokeSkill(skillId, input) {
+function runtimeInvokeSkill(skillId, input, opts) {
   const skill = installedSkills.get(skillId);
   if (!skill) return Promise.reject(new Error('skill_not_found'));
+  // I12 — run under a role: vault ops gate on the AGENT's vault_namespace_set (the role is the
+  // capability boundary for this invoke). Resolve BEFORE any Worker spawns so a bad role fails fast.
+  let agentRec = null;
+  const agentRole = opts && opts.agentRole;
+  if (agentRole != null) {
+    agentRec = Array.from(installedAgents.values()).find(a => a.role === agentRole) || null;
+    if (!agentRec) return Promise.reject(new Error('agent_not_found'));
+    if (!agentRec.verified) return Promise.reject(new Error('unverified_agent'));
+  }
   const isTool = skill.kind === 'tool';
   // §3.4/Inv 20 gate at the capability boundary: a `tool` that did not re-verify from the bytes
   // (unsigned, or signed-then-tampered → boot re-verify flips verified:false) must NOT reach the
@@ -6903,7 +7428,10 @@ function runtimeInvokeSkill(skillId, input) {
       }
       if (msg.type === 'bridge:vault') {
         const pl = msg.payload || {};
-        if (!_skVaultAllowed(skill, pl.ns)) { reply(msg.id, false, { error: 'vault_namespace_denied' }); return; } // §6 per-call gate
+        // I12 — under an active role the AGENT's vault_namespace_set is the gate (role-scoped);
+        // otherwise the skill's own vault: permissions. Either way an out-of-scope ns is denied.
+        const vaultOk = agentRec ? _agVaultAllowed(agentRec.manifest, pl.ns) : _skVaultAllowed(skill, pl.ns);
+        if (!vaultOk) { reply(msg.id, false, { error: 'vault_namespace_denied' }); return; } // §6 per-call gate
         try {
           if (pl.op === 'get') reply(msg.id, true, { result: await runtimeVaultGet(pl.ns, pl.key) });
           else if (pl.op === 'has') reply(msg.id, true, { result: await runtimeVaultHas(pl.ns, pl.key) });
@@ -6912,6 +7440,55 @@ function runtimeInvokeSkill(skillId, input) {
         } catch (e) { reply(msg.id, false, { error: String(e && e.message || 'vault_error') }); }
         return;
       }
+      if (msg.type === 'bridge:bus:publish') {
+        const pl = msg.payload || {};
+        if (!_skBusAllowed(skill, pl.topic)) { reply(msg.id, false, { error: 'bus_topic_denied' }); return; } // §5 per-call gate
+        // Inv 23: bound the payload (structured-clone-safe + ≤65536 bytes via the JSON proxy)
+        // so a skill can't flood subscribers. A non-serializable payload fails closed.
+        let enc; try { enc = JSON.stringify(pl.message); } catch (_) { reply(msg.id, false, { error: 'bus_error' }); return; }
+        if (enc != null && enc.length > 65536) { reply(msg.id, false, { error: 'bus_error' }); return; }
+        try { runtimeBusPublish(pl.topic, pl.message); reply(msg.id, true, { result: true }); }
+        catch (_) { reply(msg.id, false, { error: 'bus_error' }); }
+        return;
+      }
+      if (msg.type === 'bridge:fs') {
+        const pl = msg.payload || {}, op = pl.op, p = pl.path;
+        // Reject traversal/invalid paths BEFORE the scope check (mirror of assertUserFsPath); a
+        // declared scope is a left-anchored prefix, so a '..'-free path is safe to literal-match.
+        if (typeof p !== 'string' || !p || p.startsWith('/') || p.startsWith('_rwa/') || p.split('/').some(s => s === '.' || s === '..')) { reply(msg.id, false, { error: 'fs_path_denied' }); return; }
+        if (!_skFsAllowed(skill, p)) { reply(msg.id, false, { error: 'fs_permission_denied' }); return; } // §6 per-call gate
+        try {
+          let result;
+          if (op === 'read') result = await runtimeFsRead(p);
+          else if (op === 'write') { await runtimeFsWrite(p, pl.data); result = true; }
+          else if (op === 'del') { await runtimeFsDel(p); result = true; }
+          else if (op === 'list') result = await runtimeFsList(p);
+          else { reply(msg.id, false, { error: 'fs_path_invalid' }); return; }
+          reply(msg.id, true, { result });
+        } catch (e) {
+          const m = String(e && e.message || ''), nm = e && e.name;
+          const code = (nm === 'QuotaExceededError' || /quota/i.test(m)) ? 'fs_quota_exceeded'
+            : (nm === 'SecurityError' || /OPFS is not available|not supported/i.test(m)) ? 'fs_unsupported'
+            : (nm === 'NotFoundError' || /no file at/i.test(m)) ? 'fs_path_not_found'
+            : 'fs_write_failed';
+          reply(msg.id, false, { error: code });
+        }
+        return;
+      }
+      if (msg.type === 'bridge:idb') {
+        const pl = msg.payload || {}, op = pl.op, store = pl.store;
+        if (!_skIdbAllowed(skill, store)) { reply(msg.id, false, { error: 'idb_store_denied' }); return; } // §7 per-call gate
+        try {
+          let result;
+          if (op === 'get') result = await runtimeDbGet(store, pl.key);
+          else if (op === 'put') { await runtimeDbPut(store, pl.key, pl.value); result = true; }
+          else if (op === 'del') { await runtimeDbDel(store, pl.key); result = true; }
+          else if (op === 'all') result = await runtimeDbAll(store);
+          else { reply(msg.id, false, { error: 'invalid_argument' }); return; }
+          reply(msg.id, true, { result });
+        } catch (e) { reply(msg.id, false, { error: String(e && e.message || 'idb_error') }); }
+        return;
+      }
     };
     w.onerror = (e) => finish(reject, new Error('runtime_error: ' + (e.message || '')));
     w.postMessage({ type: 'init', identity_tag, bridged: isTool });
@@ -6958,6 +7535,15 @@ function runtimeDescribe() {
     affordances.push({ kind: s.kind, name: s.name, skillId: s.skillId, provenance: 'installed', verified: s.verified || false });
     seen.add(key);
   }
+  // I12/SD-04 — union INSTALLED agents (kind:'agent', name:role). Same shape as the static
+  // parseAgentZone projection so live == static (cross-surface affordance convergence).
+  for (const a of installedAgents.values()) {
+    if (!a || typeof a.role !== 'string') continue;
+    const key = 'agent\0' + a.role;
+    if (seen.has(key)) continue;
+    affordances.push({ kind: 'agent', name: a.role, agentId: a.agentId, provenance: 'installed', verified: a.verified || false });
+    seen.add(key);
+  }
   return {
     rwa: 'self-description/1',
     source: 'live',
@@ -7382,7 +7968,7 @@ async function modify(instr, lensMeta = null, opts = null) {
     const frozenZones = extractFrozenZones(cur);
 
     const messages = [
-      { role: 'system', content: SYSTEM_PROMPT },
+      { role: 'system', content: resolveSystemPrompt() },
       { role: 'user', content: buildUserPrompt(instr, cur, frozenZones) }
     ];
 
@@ -7569,7 +8155,7 @@ async function modifyViaBridge(instr, lensMeta = null) {
     const vOpts = { assets: vimg.assets, orphans: vimg.orphans };
     const frozenZones = extractFrozenZones(cur);
 
-    const prompt = SYSTEM_PROMPT + '\n\n' + buildUserPrompt(instr, cur, frozenZones) +
+    const prompt = resolveSystemPrompt() + '\n\n' + buildUserPrompt(instr, cur, frozenZones) +
       '\n\nThis backend is single-shot (no tool-calling protocol). Output ONLY a single JSON envelope as your last response, no markdown fences, no commentary, no preamble. The envelope MUST be one of these three exact shapes:\n\n' +
       '{"tool":"apply_dsl_plan","envelope":{"version":"rwa-edit-dsl/1","ops":[/* per the rules above */]}}\n\n' +
       '{"tool":"apply_edits","envelope":{"version":"rwa-edit/1","edits":[{"find":"...","replace":"..."}]}}\n\n' +
@@ -8105,6 +8691,19 @@ document.addEventListener('keydown', e => {
       const skMap = await readTrustworthySkills(doc);
       installedSkills.clear();
       skMap.forEach((v, k) => installedSkills.set(k, v));
+      // I12 — rebuild the agent registry from the frozen #rwa-agents zone (re-verify each). No agent
+      // is active by default; an unverified (tampered) agent is registered but can't activate.
+      const agMap = await readTrustworthyAgents(doc);
+      installedAgents.clear();
+      agMap.forEach((v, k) => installedAgents.set(k, v));
+      // I5 — reconcile the per-author name_history (rwa_sources) from the in-file manifests, so a
+      // fresh load (or an IDB-cleared one) still knows the renames recorded in the frozen zone.
+      await runtimeBuildSourceIndex();
+      // I8 — seed the mode tracker for on-mode-change's `previous`, prune the hook log, then fire
+      // on-open hooks (fire-and-forget so a hook can never slow first paint; results logged).
+      _lastHookMode = rwaMode;
+      await _hookLogPrune();
+      fireHooks('on-open', { event: 'on-open', docUuid: DOC_UUID });
     } catch (_) { /* no installed skills */ }
     await _vaultReimportSession().catch(() => {}); // v0.8 §6 — restore an unlocked vault within the tab session
     // Spec §7: expose the public runtime API. Only constructed on the success
@@ -8148,6 +8747,8 @@ document.addEventListener('keydown', e => {
       showInstallDialog: showSkillInstallDialog, // v0.8 §1 — render the consent dialog for an envelope → resolves with the choice
       promptInstall: runtimePromptInstall, // v0.8 §1.3 — pick a .rwa-skill.json → show the dialog
       vault: { get: runtimeVaultGet, set: runtimeVaultSet, has: runtimeVaultHas, namespaces: runtimeVaultNamespaces, unlock: runtimeVaultUnlock, lock: runtimeVaultLock, isLocked: runtimeVaultIsLocked }, // v0.8 §6
+      agents: { list: runtimeListAgents, active: runtimeAgentActive, setActive: runtimeSetActiveAgent, install: runtimeInstallAgent, uninstall: runtimeUninstallAgent, message: runtimeAgentMessage, showInstallDialog: showAgentInstallDialog }, // v0.9 §12 — multi-agent roles
+      hookLog: runtimeHookLog, // v0.9 §9 — the hook audit trail (rwa_hook_log)
     };
     // `status` is a getter so each read returns a fresh snapshot of
     // dirty/fsa/storage; an enumerable data prop would let stale references