rewritable 0.8.1 → 0.10.0

package/seeds/rewritable.html

@@ -407,7 +407,7 @@ window.ANCHORABLE_TAGS = ANCHORABLE_TAGS; // expose for tests
 // ─── Storage ────────────────────────────────────────────────────────
 const RWA = {
   DB:'rwa_'+DOC_UUID, KEY:'self',
-  DOC:'rwa_doc', UNDO:'rwa_undo', HIST:'rwa_hist', FSA:'rwa_fsa', STATE:'rwa_state', VAULT:'rwa_vault',
+  DOC:'rwa_doc', UNDO:'rwa_undo', HIST:'rwa_hist', FSA:'rwa_fsa', STATE:'rwa_state', VAULT:'rwa_vault', SOURCES:'rwa_sources', HOOK_LOG:'rwa_hook_log',
   UNDO_CAP:10, HIST_CAP:1000, NUDGE_THRESHOLD:5,
   K_API:'rwa_apikey', K_MODEL:'rwa_model', K_BACKEND:'rwa_backend',
   // Per-backend base-URL overrides for local OpenAI-compatible servers.
@@ -486,7 +486,7 @@ try {
 const canonLF = s => s == null ? '' : String(s).replace(/\r\n/g, '\n').replace(/\r/g, '\n');
 
 let _db;
-const REQUIRED_STORES = [RWA.DOC, RWA.UNDO, RWA.HIST, RWA.FSA, RWA.STATE, RWA.VAULT];
+const REQUIRED_STORES = [RWA.DOC, RWA.UNDO, RWA.HIST, RWA.FSA, RWA.STATE, RWA.VAULT, RWA.SOURCES, RWA.HOOK_LOG];
 // User-declared store registry. Persisted to RWA.STATE so declarations survive
 // reload. The openDB() upgrade handler creates declared stores on every bump.
 // Populated at bootstrap via loadUserStoreDecls(); mutated by runtime.db.open.
@@ -924,6 +924,15 @@ function emitRuntimeEvent(event, payload) {
   for (const cb of [...runtimeEvents[event]]) {
     try { cb(payload); } catch (_) { /* swallow user-cb errors */ }
   }
+  // I8 (v0.9 §9) — fire installed hooks for the mapped lifecycle event. 'modify' (an edit commit,
+  // carrying instruction/lensMeta) → on-commit; 'mode' → on-mode-change (with the previous mode).
+  // Fire-and-forget: wrapped so a firing failure can never propagate into the commit/mode path.
+  try {
+    if (typeof fireHooks === 'function') {
+      if (event === 'modify') fireHooks('on-commit', { event: 'on-commit', instruction: payload && payload.instruction, lensMeta: payload && payload.lensMeta });
+      else if (event === 'mode') { const previous = _lastHookMode; _lastHookMode = payload && payload.mode; fireHooks('on-mode-change', { event: 'on-mode-change', mode: payload && payload.mode, previous }); }
+    }
+  } catch (_) { /* hook firing never breaks the emitter */ }
 }
 
 // === Cross-container bus (workspace-presence subset) ========================
@@ -5110,11 +5119,30 @@ window.submitLens = submitLens;
 // workspaces (audit R7) can carry richer identifiers (e.g. signed source
 // keys per the action-spec) without changing the rwa_hist schema.
 function getActiveActor() {
+  // I12 — when a multi-agent role is active, commits attribute to it (agents:${role}); the role is
+  // the actor of record (rendered as a history badge). Else fall back to the backend/model string.
+  if (activeAgentRole) return 'agents:' + activeAgentRole;
   const backend = sessionStorage.getItem(RWA.K_BACKEND) || 'openrouter';
   if (backend === 'bridge') return 'bridge:claude-p';
   if (backend === 'bridge-session') return 'bridge:claude-session';
   return sessionStorage.getItem(RWA.K_MODEL) || RWA.MODEL;
 }
+// I12 — the modify() system prompt, keyed by the active agent's role. An active (verified) agent's
+// system_prompt swaps the per-kind FRAMING; the shared SYSTEM_PROMPT_RULES (tool protocol, frozen-
+// zone rules, data-rwa-id) are always appended so editing still works. No agent → the singleton.
+function resolveSystemPrompt() {
+  if (activeAgentRole) {
+    const rec = Array.from(installedAgents.values()).find(a => a.role === activeAgentRole && a.verified);
+    if (rec && typeof rec.manifest.system_prompt === 'string') return rec.manifest.system_prompt + '\n' + SYSTEM_PROMPT_RULES;
+  }
+  return SYSTEM_PROMPT;
+}
+// I12 — the role-scoped vault gate: exact vault:<ns> membership in the agent's vault_namespace_set
+// (mirrors _skVaultAllowed against the agent record instead of the skill's permissions).
+function _agVaultAllowed(agent, ns) {
+  const set = (agent && Array.isArray(agent.vault_namespace_set)) ? agent.vault_namespace_set : [];
+  return set.indexOf('vault:' + ns) !== -1;
+}
 
 // Resolve the user-selected backend into a transport config.
 // kind:'openai_compat' covers openrouter/ollama/lmstudio — same wire protocol,
@@ -6316,6 +6344,17 @@ let activeView = null;
 // runtimeDescribe()/runtimeListSkills(). The agent can never write the zone (it is
 // data-rwa-frozen); only the runtime rewrites it (increment 7, registry-aware commit).
 const installedSkills = new Map();
+// I12 (v0.9 §12) — installed AGENT registry. Map<agentId, {agentId, role, verified, manifest,
+// envelope}>. Populated at boot from the frozen #rwa-agents zone (readTrustworthyAgents). Identity
+// is the author key; activeAgentRole is the in-tab active role (null = none; not persisted — boot
+// starts with no agent active per §12).
+const installedAgents = new Map();
+let activeAgentRole = null;
+// I8 (v0.9 §9) — hook firing state. activeHooks holds skillIds currently executing (re-entrancy
+// guard, Inv 23); _lastHookMode tracks the prior mode for on-mode-change's `previous`; _hookSeq
+// makes rwa_hook_log keys unique within a millisecond.
+const activeHooks = new Set();
+let _lastHookMode = null, _hookSeq = 0;
 
 const RWA_VIEW_RESERVED_IDS = ['rwa-doc-mount', 'rwa-lens', 'rwa-runtime'];
 const RWA_VIEW_RESERVED_MARKERS = ['rwa:frozen:begin', 'rwa:frozen:end', 'data-rwa-frozen'];
@@ -6387,22 +6426,59 @@ function runtimeSetView(name) {
     sessionStorage.setItem(rwaViewKey(), '');
   } else {
     const spec = providers.view;
-    if (!spec || spec.name !== name) throw new Error('no registered view named ' + name);
-    validateViewOutput(spec.render(currentDocCache, viewCtx()), spec); // throws → never activates
-    releaseAnchor();
-    if (rwaMode !== 'document') {
-      hideEditTransients();
-      closeRuntimePanels();
-      rwaMode = 'document';
-      emitRuntimeEvent('mode', { mode: rwaMode });
+    if (spec && spec.name === name) {
+      validateViewOutput(spec.render(currentDocCache, viewCtx()), spec); // throws → never activates
+      releaseAnchor();
+      if (rwaMode !== 'document') {
+        hideEditTransients();
+        closeRuntimePanels();
+        rwaMode = 'document';
+        emitRuntimeEvent('mode', { mode: rwaMode });
+      }
+      activeView = spec;
+      sessionStorage.setItem(rwaViewKey(), name);
+    } else {
+      // I7 (v0.9 §8) — an INSTALLED view skill (by skillId or name). Resolve SYNCHRONOUSLY so an
+      // unknown name still throws (unchanged behavior); only a genuine installed view goes async.
+      // Its render() runs in a Worker, so we invoke once, validate the returned HTML main-side (same
+      // contract as a first-party view — no <script>, no reserved ids), and activate a SNAPSHOT
+      // overlay whose sync render() returns the cached HTML. A view never commits (read-only);
+      // re-activate to refresh (auto-refresh-on-change is the deferred `observe` opt-in).
+      const rec = installedSkills.get(name) || Array.from(installedSkills.values()).find(s => s.name === name && s.kind === 'view');
+      if (!rec || rec.kind !== 'view' || !(rec.manifest && rec.manifest.output && rec.manifest.output.kind === 'html-render')) throw new Error('no registered view named ' + name);
+      runtimeActivateInstalledView(rec);
+      return;
     }
-    activeView = spec;
-    sessionStorage.setItem(rwaViewKey(), name);
   }
   if (typeof syncModeChrome === 'function') syncModeChrome();
   if (typeof syncViewChrome === 'function') syncViewChrome();
   getDoc().then(d => renderDoc(canonLF(d)));
 }
+async function runtimeActivateInstalledView(rec) {
+  try {
+    const d = canonLF(await getDoc());
+    const html = String(await runtimeInvokeSkill(rec.skillId, { doc: d, ctx: viewCtx() }));
+    validateViewOutput(html, { name: rec.name }); // throws → never activates (fail-loud, same as first-party)
+    releaseAnchor();
+    if (rwaMode !== 'document') { hideEditTransients(); closeRuntimePanels(); rwaMode = 'document'; emitRuntimeEvent('mode', { mode: rwaMode }); }
+    activeView = { name: rec.name, label: rec.name, skillId: rec.skillId, __provenance: 'installed', __html: html, render() { return this.__html; } };
+    if (typeof syncModeChrome === 'function') syncModeChrome();
+    if (typeof syncViewChrome === 'function') syncViewChrome();
+    renderDoc(d);
+  } catch (e) {
+    setStatus('err', '✗ ' + ((e && e.message) || 'view failed'));
+  }
+}
+// I7 (v0.9 §8) — invoke an INSTALLED edit-surface skill: its run() returns an rwa-edit/1 envelope
+// (a deterministic, model-free transform), which is applied through the SAME validated commit path
+// the agent/lens use (frozen-zone + structural-shape guards, one ⌘Z), attributed to the skill.
+async function runtimeInvokeEditSurface(skillId, input) {
+  const rec = installedSkills.get(skillId);
+  if (!rec || rec.kind !== 'edit-surface') throw new Error('not an edit-surface skill');
+  const envelope = await runtimeInvokeSkill(skillId, input || {});
+  if (!envelope || typeof envelope !== 'object' || envelope.version !== 'rwa-edit/1') throw new Error('invalid_transform_output');
+  return runtimeApplyEnvelope(envelope, { surface: 'skill:edit-surface', actor: 'skill:transform:' + String(skillId).slice(0, 8) });
+}
 function rwaViewKey() { return 'rwa_view_active_' + DOC_UUID; }
 function rwaSlideKey() { return 'rwa_view_slide_' + DOC_UUID; }
 
@@ -6487,6 +6563,62 @@ async function _skVerify(env) {
     return !!(await crypto.subtle.verify({ name: 'Ed25519' }, key, _skFromB64(sig), await _skSigningMessage(skill, skill.code)));
   } catch (_) { return false; } // Ed25519 unsupported / bad bytes → verified:false (honest)
 }
+// ── I12 (v0.9 §12) — rwa-agent/1 canon (LIVE mirror of cli/src/skill-manifest.mjs canonicalAgent/
+// agentSigningMessage/agentId/verifyAgentEnvelope/validateAgentInstall). An agent is a role-scoped,
+// signed identity (role + system_prompt + vault_namespace_set; NO code). Same canon as the CLI so a
+// seed-live verify == the CLI-static verify for the same bytes.
+const _AG_ROLE_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+function _agCanonicalAgent(a) { a = a || {}; return JSON.stringify({ author_pubkey: a.author_pubkey ?? null, description: a.description ?? null, role: a.role ?? null, system_prompt: a.system_prompt ?? null, vault_namespace_set: Array.isArray(a.vault_namespace_set) ? a.vault_namespace_set : [], version: a.version ?? null }); }
+async function _agSigningMessage(a) { return _skSha256(_skUtf8(_agCanonicalAgent(a))); }
+async function _agAgentId(role, pubkey) { return _skB64url(await _skSha256(_skConcat(_skUtf8(String(role)), _skNUL, _skUtf8(String(pubkey))))); }
+async function _agVerify(env) {
+  const sig = env && env.signature;
+  if (!sig) return false;
+  const agent = env.agent || {};
+  try {
+    const key = await crypto.subtle.importKey('raw', _skFromB64(agent.author_pubkey), { name: 'Ed25519' }, false, ['verify']);
+    return !!(await crypto.subtle.verify({ name: 'Ed25519' }, key, _skFromB64(sig), await _agSigningMessage(agent)));
+  } catch (_) { return false; }
+}
+function _agPromptInjectionRisk(s) { const p = String(s ?? ''); return p.includes('`') || p.includes('${') || /<\/?DOC>/i.test(p); }
+function _agValidateInstall(agent, signed) {
+  agent = agent || {}; const errors = [];
+  if (/\0/.test(String(agent.role == null ? '' : agent.role))) errors.push('invalid_agent_id');
+  if (typeof agent.role !== 'string' || !_AG_ROLE_RE.test(agent.role)) errors.push('invalid_role');
+  if (typeof agent.system_prompt !== 'string' || _agPromptInjectionRisk(agent.system_prompt)) errors.push('agent_prompt_injection_risk');
+  const set = agent.vault_namespace_set;
+  if (set != null && !Array.isArray(set)) errors.push('invalid_permission');
+  for (const p of (Array.isArray(set) ? set : [])) {
+    try { if (_skParsePermission(p).tier !== 'vault') errors.push('invalid_permission'); }
+    catch (e) { errors.push(/unknown_permission_tier/.test(e.message) ? 'unknown_permission_tier' : 'invalid_permission'); }
+  }
+  if (!signed) errors.push('unsigned_agent');
+  return { ok: errors.length === 0, errors };
+}
+// §12 inter-agent bus message shape (mirror of cli validateAgentMessage/agentMessage). Data-model
+// only; the request→response choreography is the conductor's job, correlated by id.
+function _agValidateMessage(m) {
+  m = m || {}; const errors = [];
+  if (m.type !== 'request' && m.type !== 'response') errors.push('invalid_type');
+  if (typeof m.id !== 'string' || !m.id) errors.push('invalid_id');
+  if (typeof m.from_role !== 'string' || !_AG_ROLE_RE.test(m.from_role)) errors.push('invalid_from_role');
+  if (typeof m.to_role !== 'string' || !_AG_ROLE_RE.test(m.to_role)) errors.push('invalid_to_role');
+  if (!('payload' in m)) errors.push('missing_payload');
+  return { ok: errors.length === 0, errors };
+}
+function _agBuildMessage(type, fromRole, toRole, payload, id) {
+  const m = { type, id, from_role: fromRole, to_role: toRole, payload };
+  const v = _agValidateMessage(m);
+  if (!v.ok) throw new RwaEditError('invalid_agent_message', null, { errors: v.errors });
+  return m;
+}
+// runtime.agents.message — convenience builder from the ACTIVE role. A request mints a fresh
+// correlation id; a response echoes the request's id (pass it as `id`). The caller publishes it
+// over the bus (a conductor skill with bus:agents:* permission), per §12.
+function runtimeAgentMessage(type, toRole, payload, id) {
+  if (!activeAgentRole) throw new RwaEditError('no_active_agent', null, {});
+  return _agBuildMessage(type, activeAgentRole, toRole, payload, id || (type === 'request' ? crypto.randomUUID() : undefined));
+}
 // Locate the inner HTML of the agent-unreachable <div data-rwa-frozen id="rwa-skills">
 // in the DOC TEXT (boot has the doc string before render). Only the frozen zone is
 // trusted; base64 envelopes contain no </div> so a flat scan is safe.
@@ -6522,6 +6654,124 @@ async function readTrustworthySkills(doc) {
   }
   return out;
 }
+// I12 (v0.9 §12) — the frozen #rwa-agents zone (coexists with #rwa-skills). Same strict
+// frozen-attribute read as _skExtractZone so an agent-committed lookalike div can't forge an agent.
+function _agExtractZone(doc) {
+  const open = /<div\b[^>]*\bid="rwa-agents"[^>]*>/i.exec(String(doc || ''));
+  if (!open || !tagHasFrozenAttr(open[0])) return null;
+  const start = open.index + open[0].length;
+  const end = doc.indexOf('</div>', start);
+  return end < 0 ? null : doc.slice(start, end);
+}
+// Parse installed agents from the frozen zone, re-verifying each signature. Soft-fail. Returns a
+// Map<agentId, {agentId, role, verified, manifest, envelope}>. Mirrors readTrustworthySkills.
+async function readTrustworthyAgents(doc) {
+  const out = new Map();
+  const zone = _agExtractZone(doc);
+  if (!zone) return out;
+  const blocks = zone.matchAll(/<script\s+type="application\/rwa-agent\+json">([\s\S]*?)<\/script>/g);
+  for (const m of blocks) {
+    let env;
+    try { env = JSON.parse(new TextDecoder().decode(_skFromB64(m[1].trim()))); } catch (_) { continue; }
+    const agent = env && env.agent;
+    if (!agent || typeof agent.role !== 'string') continue;
+    const verified = await _agVerify(env);
+    const id = await _agAgentId(agent.role, agent.author_pubkey);
+    out.set(id, { agentId: id, role: agent.role, verified, manifest: agent, envelope: env });
+  }
+  return out;
+}
+// I5 (v0.9 §4) — per-author source index (rwa_sources, keyed by public key):
+//   { pubkey, count, first_seen, name_history:[{ name, first_seen_at_name }] }
+// name_history is APPEND-ONLY and holds one entry per DISTINCT name a key has published, in first-
+// seen order (Invariant 22). It anchors author identity across renames: the install dialog shows a
+// same-key name change ("previously published [old]"). DATES are best-effort — the frozen-zone bytes
+// carry no timestamps (determinism), so a cleared-IDB reload reconciles names from the in-file
+// manifests with the reconcile time as first_seen_at_name. Identity itself is always the key.
+async function _skSourceGet(pubkey) {
+  if (!pubkey) return null;
+  try { return (await idbGet(RWA.SOURCES, pubkey)) || null; } catch (_) { return null; }
+}
+// I6 (v0.9 §11) — TOFU author identity. Fingerprint = sha256(pubkey).hex[:16] (mirrors the
+// service's skillFingerprint). The per-author install count + first_seen come from rwa_sources (I5),
+// so the dialog can say "first time seeing this author" vs "trusted, N installs".
+async function _skFingerprint(pubkey) {
+  const h = await _skSha256(_skUtf8(String(pubkey)));
+  let s = ''; for (const b of h) s += b.toString(16).padStart(2, '0');
+  return s.slice(0, 16);
+}
+async function _skTofu(pubkey) {
+  const rec = await _skSourceGet(pubkey);
+  const installs = (rec && rec.count) || 0;
+  return { fingerprint: await _skFingerprint(pubkey), firstTime: installs === 0, installs };
+}
+// I6 (v0.9 §11) — marketplace discovery (opt-in network, like the ↗ share panel). discover →
+// GET /skills/index (paginated/filterable). fetch → GET /skills/index/:id → the full envelope,
+// VERIFIED client-side (WebCrypto Ed25519 via _skVerify) before any install; a revoked skill returns
+// {revoked:true}. The index only informs — install still runs the dialog + gates (the trust anchor).
+const SKILLS_INDEX_DEFAULT = 'https://rewritable.ikangai.com';
+async function runtimeDiscoverSkills(opts) {
+  opts = opts || {};
+  const base = (opts.baseUrl || SKILLS_INDEX_DEFAULT).replace(/\/+$/, '');
+  const qs = new URLSearchParams();
+  for (const k of ['kind', 'author', 'search', 'verified_only', 'page', 'limit']) if (opts[k] != null) qs.set(k, String(opts[k]));
+  const res = await fetch(base + '/skills/index' + (qs.toString() ? '?' + qs.toString() : ''));
+  if (!res.ok) throw new Error('discover_failed:' + res.status);
+  return res.json(); // { entries, total, page, limit }
+}
+async function runtimeFetchSkillFromIndex(skillId, opts) {
+  opts = opts || {};
+  const base = (opts.baseUrl || SKILLS_INDEX_DEFAULT).replace(/\/+$/, '');
+  const res = await fetch(base + '/skills/index/' + encodeURIComponent(skillId));
+  if (res.status === 410) return { revoked: true, envelope: null, verified: false };
+  if (!res.ok) throw new Error('fetch_failed:' + res.status);
+  const data = await res.json();
+  const verified = await _skVerify(data.envelope); // client-side: never trust the index's `verified`
+  return { envelope: data.envelope, metadata: data.metadata, verified, revoked: false };
+}
+// Append (name, now) for a key, creating the record if absent. Idempotent per distinct name.
+async function _skSourceRecord(pubkey, name, at) {
+  if (!pubkey || !name) return;
+  const now = at || Date.now();
+  let rec = await _skSourceGet(pubkey);
+  if (!rec) rec = { pubkey, count: 0, first_seen: now, name_history: [] };
+  if (!Array.isArray(rec.name_history)) rec.name_history = [];
+  if (!rec.name_history.some(e => e.name === name)) rec.name_history.push({ name, first_seen_at_name: now });
+  rec.count = (rec.count | 0) + 1;
+  try { await idbPut(RWA.SOURCES, rec, pubkey); } catch (_) { /* best-effort; never blocks an install */ }
+}
+// Boot reconcile: ensure every (pubkey, name) present in the live registry has a name_history entry.
+// Rebuilds from the in-file manifests so an IDB-cleared reload still knows the recorded renames.
+async function runtimeBuildSourceIndex() {
+  const now = Date.now(), byKey = new Map();
+  for (const s of installedSkills.values()) {
+    const pk = s.manifest && s.manifest.author_pubkey;
+    if (!pk || !s.name) continue;
+    if (!byKey.has(pk)) byKey.set(pk, new Set());
+    byKey.get(pk).add(s.name);
+  }
+  for (const [pk, names] of byKey) {
+    let rec = await _skSourceGet(pk);
+    if (!rec) rec = { pubkey: pk, count: 0, first_seen: now, name_history: [] };
+    if (!Array.isArray(rec.name_history)) rec.name_history = [];
+    const known = new Set(rec.name_history.map(e => e.name));
+    let changed = false;
+    for (const nm of names) if (!known.has(nm)) { rec.name_history.push({ name: nm, first_seen_at_name: now }); changed = true; }
+    if ((rec.count | 0) < names.size) { rec.count = names.size; changed = true; }
+    if (changed) { try { await idbPut(RWA.SOURCES, rec, pk); } catch (_) {} }
+  }
+}
+// What prior names has this author (key) published, other than the incoming one? Returns the prior
+// names (newest-first) + the most-recent prior, for the dialog's rename note. A rename surfaces only
+// when the incoming name is genuinely NEW for the key (so a same-name re-install / I10 update is not
+// a "rename").
+async function _skNameChange(pubkey, name) {
+  const rec = await _skSourceGet(pubkey);
+  const hist = (rec && Array.isArray(rec.name_history)) ? rec.name_history : [];
+  const priorNames = hist.filter(e => e.name !== name).map(e => ({ name: e.name, date: e.first_seen_at_name })).reverse();
+  const isRename = priorNames.length > 0 && !hist.some(e => e.name === name);
+  return { priorNames, nameChange: isRename ? { prev: priorNames[0] } : null };
+}
 function runtimeListSkills() {
   return Array.from(installedSkills.values()).map(s => ({ skillId: s.skillId, kind: s.kind, name: s.name, verified: s.verified }));
 }
@@ -6590,11 +6840,91 @@ async function runtimeVaultNamespaces() {
   for (const k of Object.keys(rec.entries)) { const i = k.indexOf('\0'); if (i > 0) set.add(k.slice(0, i)); }
   return Array.from(set);
 }
+// ── I13 (v0.9 §14) — portable vault EXPORT/IMPORT (offline; escrow + account service deferred to
+// v1). A version-tagged, self-contained `rwa-vault-export/1` file: selected namespaces re-encrypted
+// under a SEPARATE transport passphrase (PBKDF2-200k + AES-256-GCM, per-namespace salt + check), so
+// it decrypts on another machine with only the passphrase — no server. The machine-local vault stays
+// the default; this travels ONLY on an explicit user action. Requires the vault unlocked (to read
+// plaintext to re-wrap). Never logs the passphrase. CLI/Worker have no access (UI/runtime action only).
+async function runtimeVaultExport(passphrase, namespaces) {
+  if (!_vaultKey) throw new Error('vault_locked');
+  if (!passphrase) throw new Error('vault_bad_passphrase');
+  const rec = await _vaultLoadRec();
+  const allNs = await runtimeVaultNamespaces();
+  const sel = (Array.isArray(namespaces) && namespaces.length) ? namespaces.filter(n => allNs.includes(n)) : allNs;
+  const out = { rwa: 'rwa-vault-export/1', containerUuid: DOC_UUID, exportedAt: Date.now(), namespaces: sel, entries: {} };
+  for (const ns of sel) {
+    const salt = _skB64(crypto.getRandomValues(new Uint8Array(16)));
+    const ekey = await _vaultDeriveKey(passphrase, salt);
+    const enc = async (text) => { const iv = crypto.getRandomValues(new Uint8Array(12)); const ct = new Uint8Array(await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, ekey, _skUtf8(text))); return { iv: _skB64(iv), ct: _skB64(ct) }; };
+    const items = [];
+    for (const k of Object.keys(rec.entries)) {
+      const i = k.indexOf('\0'); if (i <= 0 || k.slice(0, i) !== ns) continue;
+      const plain = await _vaultDec(rec.entries[k]); // decrypt under the LOCAL vault key…
+      items.push(Object.assign({ key: k.slice(i + 1) }, await enc(plain))); // …re-encrypt under the export key
+    }
+    out.entries[ns] = { salt, check: await enc('rwa-vault-export-ok'), items };
+  }
+  return out;
+}
+async function runtimeVaultImport(exportObj, passphrase, opts) {
+  opts = opts || {};
+  if (!_vaultKey) throw new Error('vault_locked'); // need the local key to re-wrap imported items
+  if (!exportObj || exportObj.rwa !== 'rwa-vault-export/1' || !exportObj.entries || typeof exportObj.entries !== 'object') throw new Error('account_export_malformed');
+  const rec = await _vaultLoadRec();
+  const result = { imported: 0, skipped: 0, namespaces: [], containerMismatch: exportObj.containerUuid !== DOC_UUID };
+  for (const ns of Object.keys(exportObj.entries)) {
+    const e = exportObj.entries[ns];
+    if (!e || typeof e.salt !== 'string' || !Array.isArray(e.items)) throw new Error('account_export_malformed');
+    const ekey = await _vaultDeriveKey(passphrase, e.salt);
+    const dec = async (entry) => new TextDecoder().decode(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: _skFromB64(entry.iv) }, ekey, _skFromB64(entry.ct)));
+    if (e.check) { try { await dec(e.check); } catch (_) { throw new Error('vault_decrypt_failed'); } } // wrong passphrase fails here, before any write
+    for (const it of e.items) {
+      let plain; try { plain = await dec(it); } catch (_) { throw new Error('vault_decrypt_failed'); }
+      const dk = ns + '\0' + it.key;
+      if (rec.entries[dk] && !opts.overwrite) { result.skipped++; continue; } // don't clobber without explicit overwrite
+      rec.entries[dk] = await _vaultEnc(plain); // re-encrypt under the LOCAL vault key (usable immediately)
+      result.imported++;
+    }
+    result.namespaces.push(ns);
+  }
+  try { await idbPut(RWA.VAULT, rec); } catch (_) { throw new Error('vault_storage_error'); }
+  return result;
+}
+// I13 — live-only account identity (opt-in, sessionStorage rwa_account; default null). Never stamped
+// into the file; never exposed to skill code (UI/describe only). Escrow/account-service deferred to v1.
+function runtimeAccountIdentity() {
+  let raw = null; try { raw = sessionStorage.getItem('rwa_account'); } catch (_) { return null; }
+  if (!raw) return null;
+  try { const a = JSON.parse(raw); return a && a.mode ? { mode: a.mode, accountId: a.accountId || null, lastSync: a.lastSync || null } : null; } catch (_) { return null; }
+}
 // §6 — the bridge's per-call vault gate (mirror of cli/src/skill-manifest.mjs vaultNamespaceAllowed).
 function _skVaultAllowed(skill, ns) {
   const perms = (skill.manifest && Array.isArray(skill.manifest.permissions)) ? skill.manifest.permissions : [];
   return perms.indexOf('vault:' + ns) !== -1;
 }
+// §5 (I1) — the bridge's per-call bus gate: exact-string bus:<topic> match, no wildcards.
+function _skBusAllowed(skill, topic) {
+  const perms = (skill.manifest && Array.isArray(skill.manifest.permissions)) ? skill.manifest.permissions : [];
+  return perms.indexOf('bus:' + topic) !== -1;
+}
+// §5 (I1b) — per-message subscribe filter. true for all today; I12 wires a peer-allowlist here
+// (defense-in-depth — a declared bus: perm can't be further runtime-restricted; Shape B holds).
+function _skBusMessageAllowed(_skill, _envelope) { return true; }
+// §6 (I3) — the bridge's per-call fs gate: the (already traversal-checked) path must fall under
+// a declared fsa:<scope> subtree (left-anchored prefix, no wildcards).
+function _skFsAllowed(skill, path) {
+  const perms = (skill.manifest && Array.isArray(skill.manifest.permissions)) ? skill.manifest.permissions : [];
+  for (const p of perms) {
+    if (String(p).startsWith('fsa:')) { const scope = String(p).slice(4); if (path === scope || path.startsWith(scope + '/')) return true; }
+  }
+  return false;
+}
+// §7 (I4) — the bridge's per-call idb gate: exact-string idb:<store> match, no wildcards.
+function _skIdbAllowed(skill, store) {
+  const perms = (skill.manifest && Array.isArray(skill.manifest.permissions)) ? skill.manifest.permissions : [];
+  return perms.indexOf('idb:' + store) !== -1;
+}
 
 // ─── Install dialog (shannon, v0.8 §1) — the trust anchor. Mirrors of the cli
 // consent helpers (permissionToProse/compoundRisk/capabilityScan/levenshtein). ──────
@@ -6613,12 +6943,32 @@ function _skPermProse(perm) {
     if (v === '*') return 'Read and write credentials stored under ANY vault namespace — every credential you have stored. Use only for vault administration.';
     return 'Read and write credentials stored under ' + v + '.';
   }
+  if (s.startsWith('bus:')) {
+    return 'Send and receive messages on the "' + s.slice(4) + '" channel shared with other rewritables on this machine.';
+  }
+  if (s.startsWith('fsa:')) {
+    return 'Read and write files under "' + s.slice(4) + '" in this document\'s private storage.';
+  }
+  if (s.startsWith('idb:')) {
+    return 'Read and write the "' + s.slice(4) + '" data store in this document\'s database.';
+  }
+  if (s.startsWith('hook:')) {
+    const ev = s.slice(5);
+    const when = ev === 'on-commit' ? 'every time the document is saved' : ev === 'on-open' ? 'every time the document opens' : ev === 'on-mode-change' ? 'every time you switch modes' : ev;
+    return 'Run automatically ' + when + ' (no network or credential access).';
+  }
   return s;
 }
 function _skCompoundRisk(perms) {
   perms = Array.isArray(perms) ? perms : [];
-  if (perms.some(p => String(p).startsWith('vault:')) && perms.some(p => String(p).startsWith('network:')))
+  const has = (t) => perms.some(p => String(p).startsWith(t + ':'));
+  const hasVault = has('vault'), hasNetwork = has('network'), hasBus = has('bus'), hasFsa = has('fsa'), hasIdb = has('idb');
+  if (hasVault && hasNetwork)
     return 'This skill can both read your stored credentials AND make network requests. A skill with this combination can send credentials to its allowed destination — intentionally or by mistake. Install only if you fully trust this author.';
+  if (hasBus && (hasVault || hasNetwork))
+    return 'This skill can message other rewritables on this machine AND ' + (hasVault ? 'read your stored credentials' : 'make network requests') + '. Together these let it coordinate a multi-step action across your workspace — intentionally or by mistake. Install only if you fully trust this author.';
+  if ((hasFsa || hasIdb) && (hasNetwork || hasVault || hasBus))
+    return 'This skill can ' + (hasFsa ? 'read and write files in this document' : 'read and write this document\'s stored data') + ' AND ' + (hasNetwork ? 'make network requests' : hasVault ? 'read your stored credentials' : 'message other rewritables on this machine') + '. Together these let it move your local data off this document — intentionally or by mistake. Install only if you fully trust this author.';
   return null;
 }
 function _skCapabilityScan(code) {
@@ -6647,6 +6997,26 @@ function _skLevenshtein(a, b) {
   for (let i = 1; i <= m; i++) { const cur = [i]; for (let j = 1; j <= n; j++) cur[j] = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1)); prev = cur; }
   return prev[n];
 }
+// I5 (v0.9 §4) — Unicode-confusable skeleton. NFKC + toLowerCase fold case, fullwidth forms,
+// ligatures, and mathematical-alphanumeric letters to ASCII; this baked table folds the
+// CROSS-SCRIPT homoglyphs NFKC leaves alone (Cyrillic, Greek, Armenian, a few Latin-extended).
+// CURATED, not the full UTS #39 confusables.txt: every entry maps a non-ASCII glyph that renders
+// ~identically to an ASCII letter. ASCII→ASCII is NEVER folded (legit "tool"/"toml" stay distinct).
+// Byte-mirror of cli/src/skill-manifest.mjs CONFUSABLES. Keys are post-NFKC-lowercase codepoints.
+const _SK_CONFUSABLES = {
+  'а': 'a', 'е': 'e', 'о': 'o', 'р': 'p', 'с': 'c',
+  'у': 'y', 'х': 'x', 'к': 'k', 'ѕ': 's', 'і': 'i',
+  'ј': 'j', 'ԁ': 'd', 'һ': 'h', 'ԛ': 'q', 'ԝ': 'w',
+  'ѵ': 'v', 'ӏ': 'l', 'ɠ': 'g',
+  'α': 'a', 'ο': 'o', 'ρ': 'p', 'ε': 'e', 'ι': 'i',
+  'κ': 'k', 'ν': 'v', 'υ': 'u', 'χ': 'x', 'τ': 't',
+  'ϲ': 'c', 'ϳ': 'j',
+  'օ': 'o', 'ո': 'n',
+  'ı': 'i', 'ɑ': 'a', 'ɡ': 'g',
+};
+function _skNormalize(s) { return String(s == null ? '' : s).normalize('NFKC').toLowerCase(); }
+function _skSkeleton(s) { let out = ''; for (const ch of _skNormalize(s)) out += (_SK_CONFUSABLES[ch] || ch); return out; }
+function _skSkeletonDistance(a, b) { return _skLevenshtein(_skSkeleton(a), _skSkeleton(b)); }
 // §3.4 install gates (mirror cli validateInstall).
 const _SK_VAULT_NS = /^[a-z0-9_](?:[a-z0-9_-]{0,62}[a-z0-9_])?$/;
 // §4 permission grammar (mirror cli parsePermission) — validates the VALUE, not
@@ -6670,6 +7040,32 @@ function _skParsePermission(p) {
     if (value.length > 64 || !_SK_VAULT_NS.test(value)) throw new Error(`invalid vault namespace: ${value}`);
     return { tier, value };
   }
+  if (tier === 'bus') {
+    // §5 (I1): topic 1–96 chars, start alphanumeric, charset [A-Za-z0-9:_./%-], NOT a
+    // runtime-reserved prefix (rwa_/rwa:/skills:/workspace:). Mirror of cli parsePermission.
+    if (!value || value.length > 96 || !/^[A-Za-z0-9][A-Za-z0-9:_./%-]*$/.test(value) || /^(?:rwa[:_]|skills:|workspace:)/.test(value))
+      throw new Error(`invalid bus topic: ${value}`);
+    return { tier, value };
+  }
+  if (tier === 'fsa') {
+    // §6 (I3): relative OPFS scope — lowercase [a-z0-9_/-], start+end alphanumeric/underscore,
+    // ≤128 chars, no '.'/'..' (excluded by charset), not _rwa/-prefixed. Mirror of cli.
+    if (!value || value.length > 128 || /^_rwa(?:\/|$)/.test(value) || !/^[a-z0-9_](?:[a-z0-9_/-]*[a-z0-9_])?$/.test(value))
+      throw new Error(`invalid fsa scope: ${value}`);
+    return { tier, value };
+  }
+  if (tier === 'idb') {
+    // §7 (I4): store ^[A-Za-z0-9_][A-Za-z0-9_-]{0,62}$ (≤64 octets, no wildcards); never rwa_*
+    // (reserved) or rwa_vault — distinct subcodes so the dialog can explain. Mirror of cli.
+    if (/^rwa_/.test(value)) throw new Error(value === 'rwa_vault' ? 'idb_vault_store_forbidden' : 'idb_reserved_store');
+    if (!/^[A-Za-z0-9_][A-Za-z0-9_-]{0,62}$/.test(value)) throw new Error(`invalid idb store: ${value}`);
+    return { tier, value };
+  }
+  if (tier === 'hook') {
+    // §9 (I8): lifecycle event, exact enum, no wildcards. Unknown event → unknown_permission_tier.
+    if (value === 'on-commit' || value === 'on-open' || value === 'on-mode-change') return { tier, value };
+    throw new Error(`unknown_permission_tier: hook event ${value}`);
+  }
   throw new Error(`unknown_permission_tier: ${tier}`);
 }
 function _skValidateInstall(skill, vr) {
@@ -6684,11 +7080,26 @@ function _skValidateInstall(skill, vr) {
   // F7: validate each permission's VALUE via the grammar, not just the tier.
   for (const p of perms) {
     try { _skParsePermission(p); }
-    catch (e) { errors.push(/unknown_permission_tier/.test(e.message) ? 'unknown_permission_tier' : 'invalid_permission'); }
+    catch (e) {
+      const m = e.message;
+      if (/unknown_permission_tier/.test(m)) errors.push('unknown_permission_tier');
+      else if (m === 'idb_reserved_store' || m === 'idb_vault_store_forbidden') errors.push(m); // §7 distinct subcodes
+      else errors.push('invalid_permission');
+    }
   }
   if (skill.kind === 'compute' && perms.length > 0) errors.push('compute_with_permissions');
+  // §9 (I8): a hook is compute-only — only hook:<event> perms; any other tier → compute_with_permissions.
+  if (skill.kind === 'hook' && perms.some(p => { try { return _skParsePermission(p).tier !== 'hook'; } catch (_) { return false; } })) errors.push('compute_with_permissions');
+  // §8 (I7): view/edit-surface are zero-capability DOM authors — reject any permission + require a
+  // matching typed output contract (view → html-render, edit-surface → dom-transform).
+  if (skill.kind === 'view' || skill.kind === 'edit-surface') {
+    if (perms.length > 0) errors.push('output_skill_with_permissions');
+    const want = skill.kind === 'view' ? 'html-render' : 'dom-transform';
+    if (!skill.output || skill.output.kind !== want) errors.push('invalid_output_kind');
+  }
   if (!vr.signed && perms.length > 0) errors.push('unsigned_with_permissions');
-  if (skill.kind === 'tool' && !vr.verified) errors.push('unsigned_capability');
+  // Tools AND hooks carry capability (a hook runs autonomously) → must be signed+verified.
+  if ((skill.kind === 'tool' || skill.kind === 'hook') && !vr.verified) errors.push('unsigned_capability');
   return { ok: errors.length === 0, errors };
 }
 // §1 — the structured trust info the dialog renders.
@@ -6696,22 +7107,56 @@ async function runtimeReviewSkill(envelope) {
   const skill = (envelope && envelope.skill) || {};
   const perms = Array.isArray(skill.permissions) ? skill.permissions : [];
   const vr = { signed: !!(envelope && envelope.signature), verified: await _skVerify(envelope) };
-  let lookalike = null;
+  let levMatch = null, skelMatch = null;
   for (const s of installedSkills.values()) {
+    if (!s.manifest || s.manifest.author_pubkey === skill.author_pubkey) continue; // same author ≠ impersonation
     const d = _skLevenshtein(s.name, skill.name);
     // A DIFFERENT key with the same/near name is impersonation. Exact-name (d===0) ALWAYS fires —
     // it's the strongest spoof and the §3.3 case lookalike is responsible for; a near miss (1–2 edits)
     // fires only when both names are long enough that 1–2 edits is "similar", not "unrelated".
     const exact = d === 0, near = d >= 1 && d <= 2 && String(skill.name).length >= 4 && String(s.name).length >= 4;
-    if (s.manifest && s.manifest.author_pubkey !== skill.author_pubkey && (exact || near)) { lookalike = s.name; break; }
+    if (!levMatch && (exact || near)) levMatch = s.name;
+    // I5 — Unicode-confusable (skeleton) match. Fires only when confusable folding COLLAPSED a real
+    // byte difference (sd < normalized-Levenshtein) — i.e. a cross-script homoglyph that renders
+    // identically — NOT on an honest ASCII near-miss (where sd === ld). That distinction is what lets
+    // an exact ASCII name from a different key WARN (Invariant 10) while a homoglyph BLOCKS.
+    if (!skelMatch) {
+      const sd = _skSkeletonDistance(s.name, skill.name);
+      const ld = _skLevenshtein(_skNormalize(s.name), _skNormalize(skill.name));
+      if (sd <= 1 && sd < ld) skelMatch = s.name;
+    }
   }
+  // skeleton (homoglyph) takes precedence over a plain Levenshtein warn; a signed skeleton match is
+  // a hard BLOCK (the skill carries capability to escalate), an unsigned one only warns.
+  const lookalike = skelMatch || levMatch;
+  const lookalikeKind = skelMatch ? 'skeleton' : (levMatch ? 'levenshtein' : null);
+  const lookalikeBlock = !!(skelMatch && vr.signed);
+  // I10 (Shape C) — the update delta. If this skillId is already installed, surface the
+  // permission change (added/removed, order-invariant case-sensitive set ops) so the dialog
+  // can show it and require explicit re-affirmation — no silent permission escalation on update.
+  let update = { isUpdate: false, added: [], removed: [], changed: false };
+  try {
+    const prevS = installedSkills.get(await _skSkillId(skill.name, skill.author_pubkey));
+    if (prevS) {
+      const oldPerms = (prevS.manifest && Array.isArray(prevS.manifest.permissions)) ? prevS.manifest.permissions : [];
+      const oldSet = new Set(oldPerms), newSet = new Set(perms);
+      const added = perms.filter(p => !oldSet.has(p)), removed = oldPerms.filter(p => !newSet.has(p));
+      update = { isUpdate: true, added: added.map(p => ({ perm: p, prose: _skPermProse(p) })), removed: removed.map(p => ({ perm: p, prose: _skPermProse(p) })), changed: added.length > 0 || removed.length > 0 };
+    }
+  } catch (_) { /* a malformed name/id can't match an install → treat as fresh; gates reject it downstream */ }
+  // I5 — per-author name_history: surface a same-key rename so identity reads across name changes.
+  const nameInfo = await _skNameChange(skill.author_pubkey, skill.name);
+  // I6 — TOFU author identity (fingerprint + per-author install count) for the install dialog.
+  const tofu = await _skTofu(skill.author_pubkey);
   return {
     name: skill.name, version: skill.version, kind: skill.kind,
     purpose: skill.description || '(no description provided)',
     author_pubkey: skill.author_pubkey, signed: vr.signed, verified: vr.verified,
     permissions: perms.map(p => ({ perm: p, prose: _skPermProse(p) })),
     compoundRisk: _skCompoundRisk(perms), scanNotes: _skCapabilityScan(skill.code),
-    lookalike, gates: _skValidateInstall(skill, vr),
+    lookalike, lookalikeKind, lookalikeBlock,
+    priorNames: nameInfo.priorNames, nameChange: nameInfo.nameChange, tofu,
+    gates: _skValidateInstall(skill, vr), update,
   };
 }
 // §7 — serialize the registry into the frozen #rwa-skills zone. CANONICAL: sorted by
@@ -6751,6 +7196,10 @@ function _skSkillsRegion() {
 async function runtimeInstallSkill(envelope) {
   const review = await runtimeReviewSkill(envelope);
   if (!review.gates.ok) return { ok: false, errors: review.gates.errors };
+  // I5 — a signed skill whose name skeleton-folds to a DIFFERENT author's installed skill is a
+  // homoglyph impersonation: refuse before any code is registered (Invariant 21). Unsigned skills
+  // can't escalate, so review.lookalikeBlock is false for them — they only warn in the dialog.
+  if (review.lookalikeBlock) return { ok: false, errors: ['lookalike_skeleton_blocked'] };
   const forbidden = _skCodeForbidden((envelope.skill || {}).code);
   if (forbidden) return { ok: false, errors: [forbidden] };
   const skill = envelope.skill, id = await _skSkillId(skill.name, skill.author_pubkey);
@@ -6762,6 +7211,10 @@ async function runtimeInstallSkill(envelope) {
     if (prev) installedSkills.set(id, prev); else installedSkills.delete(id);
     return { ok: false, errors: [(e && e.code) || (e && e.message) || 'persist_failed'] };
   }
+  // I5 — record this (key, name) in the per-author name_history (best-effort; never fails the
+  // install). On a same-key rename the new name is appended; identity stays anchored on the key.
+  await _skSourceRecord(skill.author_pubkey, skill.name);
+  _skEvictPool(id); // I2 — an install/update may change the code → drop any stale pooled Workers
   return { ok: true, skillId: id };
 }
 // §7 — remove a skill + persist the emptied/updated zone (same rollback discipline).
@@ -6769,6 +7222,7 @@ async function runtimeUninstallSkill(skillId) {
   const prev = installedSkills.get(skillId);
   if (!prev) return { ok: false, errors: ['not_installed'] };
   installedSkills.delete(skillId);
+  _skEvictPool(skillId); // I2 — drop any pooled Workers for the removed skill
   try {
     await runtimeRegionCommit({ regions: [_skSkillsRegion()], actor: 'skill:uninstall', reachability: 'frozen' });
   } catch (e) {
@@ -6777,6 +7231,126 @@ async function runtimeUninstallSkill(skillId) {
   }
   return { ok: true };
 }
+// ── I12 (v0.9 §12) — agent registry ops. The #rwa-agents zone is built/committed exactly like
+// #rwa-skills (skillId-sorted base64 envelopes, runtimeRegionCommit reachability:'frozen'); the two
+// zones coexist and the region primitive commits each atomically. insertAt is the no-zone fallback
+// (a fresh skill-host has no agents zone yet → the first install appends one).
+function buildAgentZone(agents) {
+  const blocks = Array.from(agents.values())
+    .filter(a => a.envelope)
+    .sort((a, b) => (a.agentId < b.agentId ? -1 : a.agentId > b.agentId ? 1 : 0))
+    .map(a => '<script type="application/rwa-agent+json">' + _skB64(_skUtf8(JSON.stringify(a.envelope))) + '<\/script>')
+    .join('');
+  return '<div data-rwa-frozen id="rwa-agents">' + blocks + '</div>';
+}
+function _agAgentsRegion() {
+  return {
+    frozenId: 'rwa-agents',
+    select(doc) {
+      const open = /<div\b[^>]*\bid="rwa-agents"[^>]*>/i.exec(doc);
+      if (!open) return null;
+      const close = doc.indexOf('</div>', open.index + open[0].length);
+      return close < 0 ? null : [open.index, close + 6];
+    },
+    insertAt(doc) { return doc.length; },
+    build() { return buildAgentZone(installedAgents); },
+  };
+}
+function runtimeListAgents() {
+  return Array.from(installedAgents.values()).map(a => ({ role: a.role, author_pubkey: a.manifest && a.manifest.author_pubkey, verified: a.verified }));
+}
+function runtimeAgentActive() {
+  if (!activeAgentRole) return null;
+  const rec = Array.from(installedAgents.values()).find(a => a.role === activeAgentRole);
+  return rec ? { role: rec.role, author_pubkey: rec.manifest && rec.manifest.author_pubkey } : null;
+}
+// Switch the active role. The trust anchor is the signature: an unverified (tampered) agent can be
+// installed but NEVER activated (unverified_agent), so a tampered prompt can't drive modify().
+function runtimeSetActiveAgent(role) {
+  if (role == null) { activeAgentRole = null; return; }
+  const rec = Array.from(installedAgents.values()).find(a => a.role === role);
+  if (!rec) throw new RwaEditError('agent_not_found', null, { role });
+  if (!rec.verified) throw new RwaEditError('unverified_agent', null, { role });
+  activeAgentRole = role;
+}
+// §12 — validate + verify + register an agent, then persist the #rwa-agents zone (same discipline as
+// runtimeInstallSkill: rollback the in-memory map on a persist failure). A signed-but-unverified
+// agent registers (verified:false) but can't activate.
+async function runtimeInstallAgent(envelope) {
+  const agent = (envelope && envelope.agent) || {};
+  const signed = !!(envelope && envelope.signature);
+  const gate = _agValidateInstall(agent, signed);
+  if (!gate.ok) return { ok: false, errors: gate.errors };
+  const verified = await _agVerify(envelope);
+  const id = await _agAgentId(agent.role, agent.author_pubkey);
+  const prev = installedAgents.get(id);
+  installedAgents.set(id, { agentId: id, role: agent.role, verified, manifest: agent, envelope });
+  try {
+    await runtimeRegionCommit({ regions: [_agAgentsRegion()], actor: prev ? 'agent:update' : 'agent:install', reachability: 'frozen' });
+  } catch (e) {
+    if (prev) installedAgents.set(id, prev); else installedAgents.delete(id);
+    return { ok: false, errors: [(e && e.code) || (e && e.message) || 'persist_failed'] };
+  }
+  return { ok: true, agentId: id, verified };
+}
+async function runtimeUninstallAgent(agentId) {
+  const prev = installedAgents.get(agentId);
+  if (!prev) return { ok: false, errors: ['not_installed'] };
+  installedAgents.delete(agentId);
+  if (activeAgentRole && prev.role === activeAgentRole && !Array.from(installedAgents.values()).some(a => a.role === activeAgentRole)) activeAgentRole = null;
+  try {
+    await runtimeRegionCommit({ regions: [_agAgentsRegion()], actor: 'agent:uninstall', reachability: 'frozen' });
+  } catch (e) {
+    installedAgents.set(agentId, prev);
+    return { ok: false, errors: [(e && e.code) || (e && e.message) || 'persist_failed'] };
+  }
+  return { ok: true };
+}
+// ── I8 (v0.9 §9) — hook firing. Installed `hook` skills that declare hook:<event> run (compute-only,
+// no bridge) when the mapped lifecycle event fires. Fire-and-forget: never blocks/throws into the
+// emitter (Inv 24); deterministic skillId order; re-entrancy-guarded (Inv 23); every run logged to
+// rwa_hook_log (Inv 25). A hook must be verified (boot re-check) to fire.
+function _hooksForEvent(hookEvent) {
+  return Array.from(installedSkills.values())
+    .filter(s => s && s.kind === 'hook' && s.verified && Array.isArray(s.manifest && s.manifest.permissions) && s.manifest.permissions.indexOf('hook:' + hookEvent) !== -1)
+    .sort((a, b) => (a.skillId < b.skillId ? -1 : a.skillId > b.skillId ? 1 : 0));
+}
+function _hookLog(entry) {
+  return idbPut(RWA.HOOK_LOG, entry, entry.ts + '-' + (_hookSeq++)).catch(() => {});
+}
+function fireHooks(hookEvent, input) {
+  for (const h of _hooksForEvent(hookEvent)) {
+    if (activeHooks.has(h.skillId)) continue; // a hook can't re-fire its own event
+    activeHooks.add(h.skillId);
+    const t0 = Date.now(), sid = h.skillId;
+    let p; try { p = Promise.resolve(runtimeInvokeSkill(sid, input)); } catch (e) { p = Promise.reject(e); }
+    p.then(
+      result => _hookLog({ skillId: sid, event: hookEvent, ts: t0, input, result, duration: Date.now() - t0 }),
+      err => _hookLog({ skillId: sid, event: hookEvent, ts: t0, input, error: String((err && err.message) || err), duration: Date.now() - t0 })
+    ).then(() => activeHooks.delete(sid), () => activeHooks.delete(sid));
+  }
+}
+// The audit trail. getAll in key (≈ chronological) order; never throws.
+async function runtimeHookLog() {
+  try {
+    const db = await openDB();
+    return await new Promise((res) => { const tx = db.transaction(RWA.HOOK_LOG); const r = tx.objectStore(RWA.HOOK_LOG).getAll(); r.onsuccess = () => res(r.result || []); tx.onerror = () => res([]); });
+  } catch (_) { return []; }
+}
+// Boot prune: drop entries older than 30d, then cap to the 1000 most recent.
+async function _hookLogPrune() {
+  try {
+    const db = await openDB();
+    const read = (fn) => new Promise((res) => { const tx = db.transaction(RWA.HOOK_LOG); const r = tx.objectStore(RWA.HOOK_LOG)[fn](); r.onsuccess = () => res(r.result || []); tx.onerror = () => res([]); });
+    const keys = await read('getAllKeys'), vals = await read('getAll');
+    const cutoff = Date.now() - 30 * 24 * 3600 * 1000;
+    const pairs = keys.map((k, i) => ({ k, ts: (vals[i] && vals[i].ts) || 0 }));
+    const fresh = pairs.filter(p => p.ts >= cutoff);
+    const drop = pairs.filter(p => p.ts < cutoff).map(p => p.k)
+      .concat(fresh.length > 1000 ? fresh.sort((a, b) => a.ts - b.ts).slice(0, fresh.length - 1000).map(p => p.k) : []);
+    for (const k of drop) await idbDel(RWA.HOOK_LOG, k);
+  } catch (_) {}
+}
 // §1 — the install dialog (trust anchor). Renders the review and resolves with the user's choice.
 function showSkillInstallDialog(envelope) {
   return runtimeReviewSkill(envelope).then(rv => new Promise(resolve => {
@@ -6789,11 +7363,47 @@ function showSkillInstallDialog(envelope) {
     const authorHtml = rv.signed
       ? (rv.verified ? 'Signed by key <code>' + _skEsc(String(rv.author_pubkey).slice(0, 12)) + '…</code>' : '⚠ Signature does NOT verify — the code may have been modified.')
       : '⚠ Unsigned — the runtime can\'t verify the author or that the code is unmodified.';
+    // I10 (Shape C) — on an update whose permissions changed, surface the delta and make the
+    // affirm button explicitly about the NEW permissions. No silent escalation: the install
+    // call still fires only on the click below.
+    const upd = rv.update || { isUpdate: false, changed: false, added: [], removed: [] };
+    const updHtml = (upd.isUpdate && upd.changed)
+      ? '<div style="background:#fef3c7;border-radius:8px;padding:10px 12px;margin:.8em 0"><strong>You already installed this skill. This version changes what it can do:</strong>'
+        + (upd.added.length ? '<p style="margin:.6em 0 .2em;color:#b45309"><strong>+ Newly requested permissions</strong></p><ul style="margin:.2em 0;padding-left:1.2em">' + upd.added.map(p => '<li>' + _skEsc(p.prose) + '</li>').join('') + '</ul>' : '')
+        + (upd.removed.length ? '<p style="margin:.6em 0 .2em;color:#6b7280"><strong>− No longer requested</strong></p><ul style="margin:.2em 0;padding-left:1.2em;color:#6b7280">' + upd.removed.map(p => '<li>' + _skEsc(p.prose) + '</li>').join('') + '</ul>' : '')
+        + '</div>'
+      : '';
+    const affirmText = (upd.isUpdate && upd.changed) ? 'I have reviewed the new permissions and want to update this skill'
+      : upd.isUpdate ? 'Update this skill'
+      : 'I have reviewed this skill and want to install it';
+    // I5 — tiered lookalike notice. A signed homoglyph (lookalikeBlock) is a hard impersonation
+    // block (red, install suppressed); an unsigned homoglyph (kind:'skeleton') is a severe warning;
+    // an honest ASCII near-miss (kind:'levenshtein') is the existing amber name-collision warning.
+    const lookalikeHtml = rv.lookalikeBlock
+      ? '<p style="background:#fee2e2;border:1px solid #ef4444;border-radius:8px;padding:8px 10px;margin:.6em 0">⚠️ This name uses characters that look identical to <strong>' + _skEsc(rv.lookalike) + '</strong> from a DIFFERENT author. This is a known impersonation pattern, so installation is blocked. Identity is the key, not the name.</p>'
+      : rv.lookalikeKind === 'skeleton'
+      ? '<p style="background:#fef3c7;border-radius:8px;padding:8px 10px;margin:.6em 0">⚠️ This name uses characters that look identical to <strong>' + _skEsc(rv.lookalike) + '</strong>, which you installed from a DIFFERENT key. Review the key carefully — identity is the key, not the name.</p>'
+      : rv.lookalike
+      ? '<p style="background:#fef3c7;border-radius:8px;padding:8px 10px;margin:.6em 0">⚠ This name closely matches <strong>' + _skEsc(rv.lookalike) + '</strong>, which you installed from a DIFFERENT key. The author is identified by the key, not the name.</p>'
+      : '';
+    // I5 — same-key rename note (informational, non-permission). Suppressed under a homoglyph block
+    // (impersonation supersedes). Anchors identity on the key: "the author is identified by the key".
+    const nc = rv.nameChange;
+    const nameChangeHtml = (nc && nc.prev && !rv.lookalikeBlock)
+      ? '<p style="background:#eff6ff;border-radius:8px;padding:8px 10px;margin:.6em 0">ℹ️ This author previously published a skill named <strong>' + _skEsc(nc.prev.name) + '</strong>'
+        + (typeof nc.prev.date === 'number' ? ' on ' + _skEsc(new Date(nc.prev.date).toLocaleDateString()) : '')
+        + '. The current name is <strong>' + _skEsc(rv.name) + '</strong>. The author is identified by the key, not the name.</p>'
+      : '';
+    const canInstall = rv.gates.ok && !rv.lookalikeBlock;
     card.innerHTML =
       '<h2 style="margin:0 0 .2em;font-size:1.25rem">Install ' + _skEsc(rv.name) + '?</h2>' +
       '<p style="margin:.2em 0 1em;color:#444"><strong>What it claims to do:</strong> ' + _skEsc(rv.purpose) + '</p>' +
       '<p style="margin:.2em 0"><strong>Author.</strong> ' + authorHtml + '</p>' +
-      (rv.lookalike ? '<p style="background:#fef3c7;border-radius:8px;padding:8px 10px;margin:.6em 0">⚠ This name closely matches <strong>' + _skEsc(rv.lookalike) + '</strong>, which you installed from a DIFFERENT key. The author is identified by the key, not the name.</p>' : '') +
+      // I6 — TOFU author identity: the key fingerprint + whether you've installed from this author before.
+      (rv.tofu ? '<p style="margin:.2em 0;color:#555">🔑 Author fingerprint: <code>' + _skEsc(rv.tofu.fingerprint) + '</code>. ' + (rv.tofu.firstTime ? 'First time seeing this author.' : 'Trusted — ' + rv.tofu.installs + ' previous install' + (rv.tofu.installs === 1 ? '' : 's') + '.') + '</p>' : '') +
+      lookalikeHtml +
+      nameChangeHtml +
+      updHtml +
       '<p style="margin:1em 0 .2em"><strong>What it can do on your machine</strong></p>' + permsHtml +
       (rv.compoundRisk ? '<p style="background:#fee2e2;border-radius:8px;padding:8px 10px;margin:.6em 0">⚠ ' + _skEsc(rv.compoundRisk) + '</p>' : '') +
       (rv.scanNotes.length ? '<p style="margin:1em 0 .2em"><strong>Notes from the runtime\'s code review</strong></p><ul style="margin:.2em 0;padding-left:1.2em;color:#555">' + rv.scanNotes.map(n => '<li>' + _skEsc(n) + '</li>').join('') + '</ul>' : '') +
@@ -6801,7 +7411,7 @@ function showSkillInstallDialog(envelope) {
       (rv.gates.ok ? '' : '<p style="background:#fee2e2;border-radius:8px;padding:8px 10px;margin:.6em 0">Cannot install: ' + _skEsc(rv.gates.errors.join(', ')) + '</p>') +
       '<div style="display:flex;gap:10px;margin-top:1.2em;justify-content:flex-end">' +
         '<button data-act="cancel" style="padding:9px 16px;border:1px solid #ccc;border-radius:10px;background:#fff;cursor:pointer">Cancel</button>' +
-        (rv.gates.ok ? '<button data-act="install" style="padding:9px 16px;border:none;border-radius:10px;background:var(--gray-900,#111);color:#fff;cursor:pointer">I have reviewed this skill and want to install it</button>' : '') +
+        (canInstall ? '<button data-act="install" style="padding:9px 16px;border:none;border-radius:10px;background:var(--gray-900,#111);color:#fff;cursor:pointer">' + _skEsc(affirmText) + '</button>' : '') +
       '</div>';
     overlay.appendChild(card); document.body.appendChild(overlay);
     const close = (r) => { overlay.remove(); resolve(r); };
@@ -6809,10 +7419,49 @@ function showSkillInstallDialog(envelope) {
     const ib = card.querySelector('[data-act=install]'); if (ib) ib.onclick = async () => close(await runtimeInstallSkill(envelope));
   }));
 }
-// §1.3 — install trigger: pick a .rwa-skill.json, parse, show the dialog.
+// I12 (v0.9 §12) — the AGENT install dialog (SHOULD): role + author key + vault namespaces +
+// a system-prompt preview (≤200 chars). The install button is offered only for a VERIFIED agent
+// whose record passes the gates; a tampered (unverified) or gate-failing record shows the reason
+// and suppresses install. The trust anchor is the key, not the role.
+function showAgentInstallDialog(envelope) {
+  const agent = (envelope && envelope.agent) || {};
+  const signed = !!(envelope && envelope.signature);
+  return Promise.resolve(_agVerify(envelope)).then(verified => new Promise(resolve => {
+    const gates = _agValidateInstall(agent, signed);
+    const prev = document.getElementById('rwa-agent-install'); if (prev) prev.remove();
+    const overlay = document.createElement('div'); overlay.id = 'rwa-agent-install';
+    overlay.style.cssText = 'position:fixed;inset:0;z-index:99999;background:rgba(0,0,0,.45);display:flex;align-items:center;justify-content:center;';
+    const card = document.createElement('div');
+    card.style.cssText = 'background:#fff;max-width:560px;width:92%;max-height:86vh;overflow:auto;border-radius:18px;padding:26px 28px;font:14px/1.5 var(--font-ui,system-ui);box-shadow:0 12px 48px rgba(0,0,0,.28);';
+    const nsSet = Array.isArray(agent.vault_namespace_set) ? agent.vault_namespace_set : [];
+    const nsHtml = nsSet.length ? '<ul style="margin:.4em 0;padding-left:1.2em">' + nsSet.map(n => '<li>' + _skEsc(n) + '</li>').join('') + '</ul>' : '<p style="color:#666">No credential namespaces — this role reads/writes no vault entries.</p>';
+    const promptPreview = String(agent.system_prompt == null ? '' : agent.system_prompt).slice(0, 200);
+    const authorHtml = signed
+      ? (verified ? 'Signed by key <code>' + _skEsc(String(agent.author_pubkey).slice(0, 12)) + '…</code>' : '⚠ Signature does NOT verify — this record was modified. It cannot be activated.')
+      : '⚠ Unsigned — agents must be signed; this cannot be installed.';
+    const canInstall = gates.ok && verified;
+    card.innerHTML =
+      '<h2 style="margin:0 0 .2em;font-size:1.25rem">Install agent role “' + _skEsc(agent.role) + '”?</h2>' +
+      '<p style="margin:.2em 0 1em;color:#444"><strong>Purpose.</strong> ' + _skEsc(agent.description || '(no description provided)') + '</p>' +
+      '<p style="margin:.2em 0"><strong>Author.</strong> ' + authorHtml + ' <em>The author is identified by the key, not the role name.</em></p>' +
+      '<p style="margin:1em 0 .2em"><strong>Credentials this role can reach</strong></p>' + nsHtml +
+      '<p style="margin:1em 0 .2em"><strong>Role instructions (preview)</strong></p><pre style="white-space:pre-wrap;background:#f6f6f6;border-radius:8px;padding:8px 10px;margin:.2em 0;color:#333;font:12px/1.5 var(--font-mono,monospace)">' + _skEsc(promptPreview) + (String(agent.system_prompt || '').length > 200 ? '…' : '') + '</pre>' +
+      '<p style="margin:1.2em 0 .4em;color:#444"><strong>An active role drives edits with its own instructions and reaches only its declared credentials.</strong> The runtime shows you what the role <em>can</em> do, not whether it <em>should</em>.</p>' +
+      (gates.ok ? '' : '<p style="background:#fee2e2;border-radius:8px;padding:8px 10px;margin:.6em 0">Cannot install: ' + _skEsc(gates.errors.join(', ')) + '</p>') +
+      '<div style="display:flex;gap:10px;margin-top:1.2em;justify-content:flex-end">' +
+        '<button data-act="cancel" style="padding:9px 16px;border:1px solid #ccc;border-radius:10px;background:#fff;cursor:pointer">Cancel</button>' +
+        (canInstall ? '<button data-act="install" style="padding:9px 16px;border:none;border-radius:10px;background:var(--gray-900,#111);color:#fff;cursor:pointer">I have reviewed this role and want to install it</button>' : '') +
+      '</div>';
+    overlay.appendChild(card); document.body.appendChild(overlay);
+    const close = (r) => { overlay.remove(); resolve(r); };
+    card.querySelector('[data-act=cancel]').onclick = () => close({ ok: false, errors: ['cancelled'] });
+    const ib = card.querySelector('[data-act=install]'); if (ib) ib.onclick = async () => close(await runtimeInstallAgent(envelope));
+  }));
+}
+// §1.3 / §12 — install trigger: pick a .rwa-skill.json OR .rwa-agent.json, parse, dispatch by format.
 function runtimePromptInstall() {
-  const inp = document.createElement('input'); inp.type = 'file'; inp.accept = '.rwa-skill.json,application/json,.json';
-  inp.onchange = () => { const f = inp.files && inp.files[0]; if (!f) return; const rd = new FileReader(); rd.onload = () => { let env; try { env = JSON.parse(rd.result); } catch (_) { setStatus && setStatus('err', 'invalid .rwa-skill.json'); return; } showSkillInstallDialog(env); }; rd.readAsText(f); };
+  const inp = document.createElement('input'); inp.type = 'file'; inp.accept = '.rwa-skill.json,.rwa-agent.json,application/json,.json';
+  inp.onchange = () => { const f = inp.files && inp.files[0]; if (!f) return; const rd = new FileReader(); rd.onload = () => { let env; try { env = JSON.parse(rd.result); } catch (_) { setStatus && setStatus('err', 'invalid skill/agent JSON'); return; } if (env && env.format === 'rwa-agent/1') showAgentInstallDialog(env); else showSkillInstallDialog(env); }; rd.readAsText(f); };
   inp.click();
 }
 
@@ -6845,12 +7494,15 @@ const SKILL_WORKER_PROLOGUE = `(function(){
   'use strict';
   var REMOVE = ['importScripts','Worker','SharedWorker','ServiceWorkerContainer','XMLHttpRequest','WebSocket','EventSource','indexedDB','eval','Function','fetch','WebAssembly'];
   for (var i=0;i<REMOVE.length;i++){ try { Object.defineProperty(self, REMOVE[i], { value: undefined, writable: false, configurable: false }); } catch(_e){} }
-  var IDENTITY=null, BRIDGED=false, _seq=0, _pending=new Map(), RUNTIME={};
+  var IDENTITY=null, BRIDGED=false, _seq=0, _pending=new Map(), RUNTIME={}, _subs={};
   function _bridge(type, payload){ return new Promise(function(res,rej){ var id=++_seq; _pending.set(id,{res:res,rej:rej}); self.postMessage({ type:type, id:id, identity_tag:IDENTITY, payload:payload }); }); }
   function _serializeOpts(o){ if(!o||typeof o!=='object') return undefined; var out={}; if(o.method) out.method=String(o.method); if(typeof o.body==='string') out.body=o.body; if(o.headers&&typeof o.headers==='object') out.headers=o.headers; return out; }
   function _installBridge(){
     RUNTIME.fetch=function(url,opts){ return _bridge('bridge:fetch',{ url:String(url), opts:_serializeOpts(opts) }); };
     RUNTIME.vault={ get:function(ns,k){ return _bridge('bridge:vault',{op:'get',ns:ns,key:k}); }, set:function(ns,k,v){ return _bridge('bridge:vault',{op:'set',ns:ns,key:k,val:v}); }, has:function(ns,k){ return _bridge('bridge:vault',{op:'has',ns:ns,key:k}); } };
+    RUNTIME.bus={ publish:function(topic,message){ return _bridge('bridge:bus:publish',{ topic:String(topic), message:message }); }, subscribe:function(topic,cb){ var t=String(topic); return _bridge('bridge:bus:subscribe',{ topic:t }).then(function(){ (_subs[t]=_subs[t]||[]).push(cb); return function(){ var a=_subs[t]||[], i=a.indexOf(cb); if(i>=0) a.splice(i,1); try{ _bridge('bridge:bus:unsubscribe',{ topic:t }); }catch(_e){} }; }); } };
+    RUNTIME.fs={ read:function(p){ return _bridge('bridge:fs',{op:'read',path:String(p)}); }, write:function(p,d){ return _bridge('bridge:fs',{op:'write',path:String(p),data:d}); }, del:function(p){ return _bridge('bridge:fs',{op:'del',path:String(p)}); }, list:function(p){ return _bridge('bridge:fs',{op:'list',path:String(p)}); } };
+    RUNTIME.db={ get:function(s,k){ return _bridge('bridge:idb',{op:'get',store:String(s),key:k}); }, put:function(s,k,v){ return _bridge('bridge:idb',{op:'put',store:String(s),key:k,value:v}); }, del:function(s,k){ return _bridge('bridge:idb',{op:'del',store:String(s),key:k}); }, all:function(s){ return _bridge('bridge:idb',{op:'all',store:String(s)}); } };
   }
   self.onmessage=function(e){
     var msg=e.data; if(!msg) return;
@@ -6862,17 +7514,101 @@ const SKILL_WORKER_PROLOGUE = `(function(){
         .catch(function(err){ self.postMessage({ type:'result', id:msg.id, identity_tag:IDENTITY, ok:false, error:String(err&&err.message||err) }); });
       return;
     }
+    if(msg.type==='bus:message'){ var env=msg.envelope||{}, subs=_subs[env.topic]||[]; for(var i=0;i<subs.length;i++){ try{ subs[i](env); }catch(_e){} } return; } // I1b — deliver to skill-side subscribers
+    if(msg.type==='shutdown'){ try{ self.postMessage({ type:'shutdown_ack', identity_tag:null }); }catch(_e){} return; } // I2 — pool drain handshake
   };
 })();
 `;
 
+// ── I2 (v0.9 §10) — optional compute-Worker POOL. DISABLED BY DEFAULT: only an explicit
+// poolingHint {pooling:'enabled'} on a COMPUTE skill (no role) takes this path; every other invoke
+// (tools, agent-role, no-hint) rides the byte-unchanged spawn→invoke→terminate path below. Pooled
+// Workers are compute-only (bridgeless, same worker-scoped CSP), keyed by skillId+code-hash (a code
+// change evicts the pool), bounded by an idle timeout + a hard cap, and drained on shutdown. Per-
+// invocation isolation is unchanged: each invoke re-inits a fresh identity_tag and races the 5s
+// timeout; a timeout/error terminates the Worker (never returns it to the pool). Statelessness is
+// the author's responsibility (Inv 25; no global reset between invokes — documented "pool only if pure").
+const SKILL_POOLS = new Map(); // skillId → { codeHash, idle:[Worker], lastUsed:Map<Worker,ts> }
+const SKILL_POOL_CAP = Math.min(4, (typeof navigator !== 'undefined' && navigator.hardwareConcurrency) || 1);
+let SKILL_POOL_IDLE_MS = 60000; // mutable so the browser proof can shorten it
+async function _skCodeHash(skillId, code) {
+  return _skB64url(await _skSha256(_skConcat(_skUtf8(String(skillId)), _skNUL, _skUtf8(String(code || '')))));
+}
+function _skSpawnComputeWorker(skill) {
+  const blob = new Blob([SKILL_WORKER_PROLOGUE + '\n' + String(skill.code || '')], { type: 'text/javascript' });
+  const url = URL.createObjectURL(blob);
+  const w = new Worker(url); w.__rwaUrl = url; return w;
+}
+function _skKillWorker(w) { try { w.terminate(); } catch (_) {} try { URL.revokeObjectURL(w.__rwaUrl); } catch (_) {} }
+function _skEnforcePoolCap(pool) {
+  while (pool.idle.length > SKILL_POOL_CAP) {
+    let oi = 0; for (let i = 1; i < pool.idle.length; i++) if ((pool.lastUsed.get(pool.idle[i]) || 0) < (pool.lastUsed.get(pool.idle[oi]) || 0)) oi = i;
+    const [w] = pool.idle.splice(oi, 1); pool.lastUsed.delete(w); _skKillWorker(w); // evict oldest-idle
+  }
+}
+function _skEvictPool(skillId) { // code-hash may change on install/update/uninstall → drop stale Workers
+  const pool = SKILL_POOLS.get(skillId);
+  if (pool) { pool.idle.forEach(_skKillWorker); SKILL_POOLS.delete(skillId); }
+}
+function _skPoolEvictIdle() { // background sweep: terminate Workers idle ≥ SKILL_POOL_IDLE_MS
+  const now = Date.now();
+  for (const pool of SKILL_POOLS.values())
+    pool.idle = pool.idle.filter(w => { if (now - (pool.lastUsed.get(w) || 0) >= SKILL_POOL_IDLE_MS) { pool.lastUsed.delete(w); _skKillWorker(w); return false; } return true; });
+}
+async function _skPoolShutdown() { // send shutdown, 500ms grace, terminate (idempotent)
+  const all = [];
+  for (const pool of SKILL_POOLS.values()) for (const w of pool.idle) all.push(w);
+  for (const w of all) { try { w.postMessage({ type: 'shutdown', identity_tag: null }); } catch (_) {} }
+  await new Promise(r => setTimeout(r, 500));
+  for (const w of all) _skKillWorker(w);
+  SKILL_POOLS.clear();
+}
+function runtimePoolStats() {
+  const pools = {}; let live = 0;
+  for (const [id, pool] of SKILL_POOLS) { pools[id] = pool.idle.length; live += pool.idle.length; }
+  return { live, cap: SKILL_POOL_CAP, idleMs: SKILL_POOL_IDLE_MS, pools };
+}
+// Run ONE invocation on a pooled compute Worker (reuse-or-spawn). Success → return to pool; timeout
+// or error → terminate (never pool). Compute skills have no bridge, so a pooled Worker only ever
+// emits `result` — the onmessage here is the full message contract for the pooled path.
+async function _skPooledInvoke(skillId, skill, input) {
+  const codeHash = await _skCodeHash(skillId, skill.code);
+  let pool = SKILL_POOLS.get(skillId);
+  if (pool && pool.codeHash !== codeHash) { _skEvictPool(skillId); pool = null; }
+  if (!pool) { pool = { codeHash, idle: [], lastUsed: new Map() }; SKILL_POOLS.set(skillId, pool); }
+  const w = pool.idle.pop() || _skSpawnComputeWorker(skill);
+  const tag = crypto.randomUUID();
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const done = (fn, arg, keep) => {
+      if (settled) return; settled = true; clearTimeout(timer); w.onmessage = null; w.onerror = null;
+      if (keep) { pool.lastUsed.set(w, Date.now()); pool.idle.push(w); _skEnforcePoolCap(pool); }
+      else { pool.lastUsed.delete(w); _skKillWorker(w); }
+      fn(arg);
+    };
+    const timer = setTimeout(() => done(reject, new Error('timeout'), false), 5000); // per-invocation, not per-tenure
+    w.onmessage = (e) => { const m = e.data; if (!m || m.identity_tag !== tag) return; if (m.type === 'result') m.ok ? done(resolve, m.result, true) : done(reject, new Error(m.error || 'runtime_error'), false); };
+    w.onerror = () => done(reject, new Error('runtime_error'), false);
+    w.postMessage({ type: 'init', identity_tag: tag, bridged: false }); // re-init each invoke: fresh tag, never bridged
+    w.postMessage({ type: 'invoke', id: 1, input });
+  });
+}
 // §5a — invoke an installed skill in an isolated Worker. compute = bridgeless; tool =
 // bridged fetch/vault with per-call origin/namespace enforcement on THIS (main) thread.
 // Per-invocation identity_tag binds responses; 5s timeout; spawn -> invoke -> terminate.
 // (Vault: increment 8. The worker-scoped CSP that walls remote import() is the frozen-<head> 7b meta.)
-function runtimeInvokeSkill(skillId, input) {
+function runtimeInvokeSkill(skillId, input, opts) {
   const skill = installedSkills.get(skillId);
   if (!skill) return Promise.reject(new Error('skill_not_found'));
+  // I12 — run under a role: vault ops gate on the AGENT's vault_namespace_set (the role is the
+  // capability boundary for this invoke). Resolve BEFORE any Worker spawns so a bad role fails fast.
+  let agentRec = null;
+  const agentRole = opts && opts.agentRole;
+  if (agentRole != null) {
+    agentRec = Array.from(installedAgents.values()).find(a => a.role === agentRole) || null;
+    if (!agentRec) return Promise.reject(new Error('agent_not_found'));
+    if (!agentRec.verified) return Promise.reject(new Error('unverified_agent'));
+  }
   const isTool = skill.kind === 'tool';
   // §3.4/Inv 20 gate at the capability boundary: a `tool` that did not re-verify from the bytes
   // (unsigned, or signed-then-tampered → boot re-verify flips verified:false) must NOT reach the
@@ -6884,6 +7620,9 @@ function runtimeInvokeSkill(skillId, input) {
   // skills (which never passed through runtimeInstallSkill's gate), every kind.
   const forbidden = _skCodeForbidden(skill.code);
   if (forbidden) return Promise.reject(new Error(forbidden));
+  // I2 — opt-in compute-Worker pool. Only a compute skill with an explicit pooling hint and no
+  // agent-role takes the warm path; everything else falls through to the byte-unchanged fresh spawn.
+  if (opts && opts.pooling === 'enabled' && skill.kind === 'compute' && !agentRole) return _skPooledInvoke(skillId, skill, input);
   const identity_tag = crypto.randomUUID();
   const blob = new Blob([SKILL_WORKER_PROLOGUE + '\n' + String(skill.code || '')], { type: 'text/javascript' });
   const url = URL.createObjectURL(blob);
@@ -6892,8 +7631,9 @@ function runtimeInvokeSkill(skillId, input) {
   // F6: cancel an in-flight bridge fetch when the 5s timeout (or any settle)
   // fires, so a slow request doesn't keep running after the skill is finished.
   const _skAc = (typeof AbortController !== 'undefined') ? new AbortController() : null;
+  const busSubs = []; // I1b — active bus subscriptions for THIS invoke; torn down on settle
   return new Promise((resolve, reject) => {
-    const finish = (fn, arg) => { if (settled) return; settled = true; clearTimeout(timer); if (_skAc) { try { _skAc.abort(); } catch (_) {} } try { w.terminate(); } catch (_) {} URL.revokeObjectURL(url); fn(arg); };
+    const finish = (fn, arg) => { if (settled) return; settled = true; clearTimeout(timer); if (_skAc) { try { _skAc.abort(); } catch (_) {} } for (const u of busSubs) { try { u(); } catch (_) {} } try { w.terminate(); } catch (_) {} URL.revokeObjectURL(url); fn(arg); };
     const timer = setTimeout(() => finish(reject, new Error('timeout')), 5000);
     const reply = (id, ok, extra) => w.postMessage(Object.assign({ type: 'bridge:response', id, identity_tag, ok }, extra));
     w.onmessage = async (e) => {
@@ -6915,7 +7655,10 @@ function runtimeInvokeSkill(skillId, input) {
       }
       if (msg.type === 'bridge:vault') {
         const pl = msg.payload || {};
-        if (!_skVaultAllowed(skill, pl.ns)) { reply(msg.id, false, { error: 'vault_namespace_denied' }); return; } // §6 per-call gate
+        // I12 — under an active role the AGENT's vault_namespace_set is the gate (role-scoped);
+        // otherwise the skill's own vault: permissions. Either way an out-of-scope ns is denied.
+        const vaultOk = agentRec ? _agVaultAllowed(agentRec.manifest, pl.ns) : _skVaultAllowed(skill, pl.ns);
+        if (!vaultOk) { reply(msg.id, false, { error: 'vault_namespace_denied' }); return; } // §6 per-call gate
         try {
           if (pl.op === 'get') reply(msg.id, true, { result: await runtimeVaultGet(pl.ns, pl.key) });
           else if (pl.op === 'has') reply(msg.id, true, { result: await runtimeVaultHas(pl.ns, pl.key) });
@@ -6924,6 +7667,71 @@ function runtimeInvokeSkill(skillId, input) {
         } catch (e) { reply(msg.id, false, { error: String(e && e.message || 'vault_error') }); }
         return;
       }
+      if (msg.type === 'bridge:bus:publish') {
+        const pl = msg.payload || {};
+        if (!_skBusAllowed(skill, pl.topic)) { reply(msg.id, false, { error: 'bus_topic_denied' }); return; } // §5 per-call gate
+        // Inv 23: bound the payload (structured-clone-safe + ≤65536 bytes via the JSON proxy)
+        // so a skill can't flood subscribers. A non-serializable payload fails closed.
+        let enc; try { enc = JSON.stringify(pl.message); } catch (_) { reply(msg.id, false, { error: 'bus_error' }); return; }
+        if (enc != null && enc.length > 65536) { reply(msg.id, false, { error: 'bus_error' }); return; }
+        try { runtimeBusPublish(pl.topic, pl.message); reply(msg.id, true, { result: true }); }
+        catch (_) { reply(msg.id, false, { error: 'bus_error' }); }
+        return;
+      }
+      if (msg.type === 'bridge:bus:subscribe') {
+        const pl = msg.payload || {};
+        if (!_skBusAllowed(skill, pl.topic)) { reply(msg.id, false, { error: 'bus_topic_denied' }); return; } // §5 per-call gate
+        // I1b — forward each allowed envelope to the Worker until it settles (finish() tears these
+        // down). The 5s timeout bounds the subscribe CALL (the ok reply), not the subscription.
+        try {
+          const unsub = runtimeBusSubscribe(pl.topic, (env) => {
+            if (!_skBusMessageAllowed(skill, env)) return;
+            try { w.postMessage({ type: 'bus:message', id: msg.id, identity_tag, envelope: { topic: env.topic, from: env.from, at: env.at, message: env.message } }); } catch (_) {}
+          });
+          busSubs.push(unsub);
+          reply(msg.id, true, { result: true });
+        } catch (_) { reply(msg.id, false, { error: 'bus_error' }); }
+        return;
+      }
+      if (msg.type === 'bridge:bus:unsubscribe') { reply(msg.id, true, { result: true }); return; } // MVP: precise teardown deferred; finish() unsubscribes all on settle
+      if (msg.type === 'bridge:fs') {
+        const pl = msg.payload || {}, op = pl.op, p = pl.path;
+        // Reject traversal/invalid paths BEFORE the scope check (mirror of assertUserFsPath); a
+        // declared scope is a left-anchored prefix, so a '..'-free path is safe to literal-match.
+        if (typeof p !== 'string' || !p || p.startsWith('/') || p.startsWith('_rwa/') || p.split('/').some(s => s === '.' || s === '..')) { reply(msg.id, false, { error: 'fs_path_denied' }); return; }
+        if (!_skFsAllowed(skill, p)) { reply(msg.id, false, { error: 'fs_permission_denied' }); return; } // §6 per-call gate
+        try {
+          let result;
+          if (op === 'read') result = await runtimeFsRead(p);
+          else if (op === 'write') { await runtimeFsWrite(p, pl.data); result = true; }
+          else if (op === 'del') { await runtimeFsDel(p); result = true; }
+          else if (op === 'list') result = await runtimeFsList(p);
+          else { reply(msg.id, false, { error: 'fs_path_invalid' }); return; }
+          reply(msg.id, true, { result });
+        } catch (e) {
+          const m = String(e && e.message || ''), nm = e && e.name;
+          const code = (nm === 'QuotaExceededError' || /quota/i.test(m)) ? 'fs_quota_exceeded'
+            : (nm === 'SecurityError' || /OPFS is not available|not supported/i.test(m)) ? 'fs_unsupported'
+            : (nm === 'NotFoundError' || /no file at/i.test(m)) ? 'fs_path_not_found'
+            : 'fs_write_failed';
+          reply(msg.id, false, { error: code });
+        }
+        return;
+      }
+      if (msg.type === 'bridge:idb') {
+        const pl = msg.payload || {}, op = pl.op, store = pl.store;
+        if (!_skIdbAllowed(skill, store)) { reply(msg.id, false, { error: 'idb_store_denied' }); return; } // §7 per-call gate
+        try {
+          let result;
+          if (op === 'get') result = await runtimeDbGet(store, pl.key);
+          else if (op === 'put') { await runtimeDbPut(store, pl.key, pl.value); result = true; }
+          else if (op === 'del') { await runtimeDbDel(store, pl.key); result = true; }
+          else if (op === 'all') result = await runtimeDbAll(store);
+          else { reply(msg.id, false, { error: 'invalid_argument' }); return; }
+          reply(msg.id, true, { result });
+        } catch (e) { reply(msg.id, false, { error: String(e && e.message || 'idb_error') }); }
+        return;
+      }
     };
     w.onerror = (e) => finish(reject, new Error('runtime_error: ' + (e.message || '')));
     w.postMessage({ type: 'init', identity_tag, bridged: isTool });
@@ -6970,6 +7778,15 @@ function runtimeDescribe() {
     affordances.push({ kind: s.kind, name: s.name, skillId: s.skillId, provenance: 'installed', verified: s.verified || false });
     seen.add(key);
   }
+  // I12/SD-04 — union INSTALLED agents (kind:'agent', name:role). Same shape as the static
+  // parseAgentZone projection so live == static (cross-surface affordance convergence).
+  for (const a of installedAgents.values()) {
+    if (!a || typeof a.role !== 'string') continue;
+    const key = 'agent\0' + a.role;
+    if (seen.has(key)) continue;
+    affordances.push({ kind: 'agent', name: a.role, agentId: a.agentId, provenance: 'installed', verified: a.verified || false });
+    seen.add(key);
+  }
   return {
     rwa: 'self-description/1',
     source: 'live',
@@ -6984,6 +7801,9 @@ function runtimeDescribe() {
     // undo-only — there is no redo (re-write-able-spec Invariant 7).
     baseline: { edit: ['lens'], tools: ['apply_dsl_plan', 'apply_edits', 'replace_document'], export: ['html', 'print'], history: ['undo'] },
     activeView: activeView ? activeView.name : null,
+    // I13 (v0.9 §14) — opt-in account identity, LIVE-only (never stamped into the file). null unless
+    // the user linked an account this session (sessionStorage rwa_account); machine-local is the default.
+    accountIdentity: runtimeAccountIdentity(),
   };
 }
 
@@ -7394,7 +8214,7 @@ async function modify(instr, lensMeta = null, opts = null) {
     const frozenZones = extractFrozenZones(cur);
 
     const messages = [
-      { role: 'system', content: SYSTEM_PROMPT },
+      { role: 'system', content: resolveSystemPrompt() },
       { role: 'user', content: buildUserPrompt(instr, cur, frozenZones) }
     ];
 
@@ -7581,7 +8401,7 @@ async function modifyViaBridge(instr, lensMeta = null) {
     const vOpts = { assets: vimg.assets, orphans: vimg.orphans };
     const frozenZones = extractFrozenZones(cur);
 
-    const prompt = SYSTEM_PROMPT + '\n\n' + buildUserPrompt(instr, cur, frozenZones) +
+    const prompt = resolveSystemPrompt() + '\n\n' + buildUserPrompt(instr, cur, frozenZones) +
       '\n\nThis backend is single-shot (no tool-calling protocol). Output ONLY a single JSON envelope as your last response, no markdown fences, no commentary, no preamble. The envelope MUST be one of these three exact shapes:\n\n' +
       '{"tool":"apply_dsl_plan","envelope":{"version":"rwa-edit-dsl/1","ops":[/* per the rules above */]}}\n\n' +
       '{"tool":"apply_edits","envelope":{"version":"rwa-edit/1","edits":[{"find":"...","replace":"..."}]}}\n\n' +
@@ -8117,6 +8937,19 @@ document.addEventListener('keydown', e => {
       const skMap = await readTrustworthySkills(doc);
       installedSkills.clear();
       skMap.forEach((v, k) => installedSkills.set(k, v));
+      // I12 — rebuild the agent registry from the frozen #rwa-agents zone (re-verify each). No agent
+      // is active by default; an unverified (tampered) agent is registered but can't activate.
+      const agMap = await readTrustworthyAgents(doc);
+      installedAgents.clear();
+      agMap.forEach((v, k) => installedAgents.set(k, v));
+      // I5 — reconcile the per-author name_history (rwa_sources) from the in-file manifests, so a
+      // fresh load (or an IDB-cleared one) still knows the renames recorded in the frozen zone.
+      await runtimeBuildSourceIndex();
+      // I8 — seed the mode tracker for on-mode-change's `previous`, prune the hook log, then fire
+      // on-open hooks (fire-and-forget so a hook can never slow first paint; results logged).
+      _lastHookMode = rwaMode;
+      await _hookLogPrune();
+      fireHooks('on-open', { event: 'on-open', docUuid: DOC_UUID });
     } catch (_) { /* no installed skills */ }
     await _vaultReimportSession().catch(() => {}); // v0.8 §6 — restore an unlocked vault within the tab session
     // Spec §7: expose the public runtime API. Only constructed on the success
@@ -8154,12 +8987,18 @@ document.addEventListener('keydown', e => {
       describe: runtimeDescribe, // rwa-identity/1 — what this container is + can do
       listSkills: runtimeListSkills, // v0.8 §8 — installed skills (provenance:'installed')
       invokeSkill: runtimeInvokeSkill, // v0.8 §5a — run a skill in an isolated Worker
+      invokeEditSurface: runtimeInvokeEditSurface, // v0.9 §8 (I7) — run an edit-surface skill → apply its rwa-edit/1 transform
+      poolStats: runtimePoolStats, // v0.9 §10 (I2) — compute-Worker pool observability {live,cap,idleMs,pools}
       reviewSkill: runtimeReviewSkill, // v0.8 §1 — structured trust info for the install dialog
       installSkill: runtimeInstallSkill, // v0.8 §1/§7 — gates + verify + register + persist to the frozen zone (survives reload)
       uninstallSkill: runtimeUninstallSkill, // v0.8 §7 — remove + persist
       showInstallDialog: showSkillInstallDialog, // v0.8 §1 — render the consent dialog for an envelope → resolves with the choice
       promptInstall: runtimePromptInstall, // v0.8 §1.3 — pick a .rwa-skill.json → show the dialog
-      vault: { get: runtimeVaultGet, set: runtimeVaultSet, has: runtimeVaultHas, namespaces: runtimeVaultNamespaces, unlock: runtimeVaultUnlock, lock: runtimeVaultLock, isLocked: runtimeVaultIsLocked }, // v0.8 §6
+      discoverSkills: runtimeDiscoverSkills, // v0.9 §11 (I6) — GET the marketplace index (opt-in network)
+      fetchSkillFromIndex: runtimeFetchSkillFromIndex, // v0.9 §11 (I6) — fetch + client-side-verify an indexed skill
+      vault: { get: runtimeVaultGet, set: runtimeVaultSet, has: runtimeVaultHas, namespaces: runtimeVaultNamespaces, unlock: runtimeVaultUnlock, lock: runtimeVaultLock, isLocked: runtimeVaultIsLocked, export: runtimeVaultExport, import: runtimeVaultImport }, // v0.8 §6 + v0.9 §14 (I13) portable export/import
+      agents: { list: runtimeListAgents, active: runtimeAgentActive, setActive: runtimeSetActiveAgent, install: runtimeInstallAgent, uninstall: runtimeUninstallAgent, message: runtimeAgentMessage, showInstallDialog: showAgentInstallDialog }, // v0.9 §12 — multi-agent roles
+      hookLog: runtimeHookLog, // v0.9 §9 — the hook audit trail (rwa_hook_log)
     };
     // `status` is a getter so each read returns a fresh snapshot of
     // dirty/fsa/storage; an enumerable data prop would let stale references
@@ -8175,6 +9014,10 @@ document.addEventListener('keydown', e => {
       configurable: false,
     });
     startWorkspacePresence();
+    // I2 (v0.9 §10) — background idle eviction (every 30s, terminate compute Workers idle ≥ idleMs)
+    // + drain the pool on unload (shutdown handshake + 500ms grace). No-op until a pooled invoke runs.
+    setInterval(_skPoolEvictIdle, 30000);
+    window.addEventListener('pagehide', () => { _skPoolShutdown(); });
     // §5.10: the presentation render mode ships ONLY for presentation
     // containers. For every other kind this block is skipped entirely —
     // activeView stays null, no provider is registered, no chrome is built,