bsp-mcp-server

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "agent_id"
  ],
  "properties": {
    "face": {
      "enum": [
        "character",
        "author",
        "designer",
        "observer"
      ],
      "type": "string",
      "description": "CADO access modifier. Validated against sed: collective membership. Advisory in v0.1; enforced in v0.2."
    },
    "gray": {
      "type": [
        "boolean",
        "string"
      ],
      "description": "Privacy by encryption (client-side at bsp-mcp; a spine-legal ciphertext envelope lands at the beach). A COLOUR: gray: \"colour:<name>\" seals the line in that colour (coloured stigmergy) — the key is the current turn's of colour:<name> at this beach, opened from your own copy by your enc_secret (your hand's copy first) and WORN by this session from then on, so every later line of that colour and turn you meet or write opens with no key passed; holding no copy, the line is sealed as a LETTER to the colour, which every holder reads and you cannot read back. A coloured line you cannot open reads as one grey line naming the colour and its turn. A colour rides an append the same way, so a sealed log grows at its root in a colour. On ordinary blocks: opt-in self-encryption (default false) — secret is the key, only the author decrypts. On grain blocks: private by DEFAULT (shared key from both parties' published keypairs; either party reads, outsiders cannot) — pass gray:false to write public. Requires a non-empty spindle: at a leaf the envelope is the entry; at a position holding entries it voices that position and every entry stays, so a gray history pays its zero-slot summaries exactly as an open one does. Degray = read with the key, then write the plaintext back at the same address with gray:false: the line takes the envelope's place, keeping its arrival stamp and anything standing in it, so a keyed reader and an open one read the same line. Grain mode needs both parties to have run pscale_key_publish — each from the ONE secret they then seal and read with (enc_secret, else secret); a grain write sealed under any other secret is refused, since the partner could never open it."
    },
    "tier": {
      "enum": [
        "soft",
        "medium",
        "hard"
      ],
      "type": "string",
      "description": "SMH aperture modifier. Composes with face per the face-tier matrix. Advisory in v0.1; enforced in v0.2."
    },
    "block": {
      "type": "string",
      "description": "Block name within the agent_id's namespace. For URL agent_id this is whatever the host has named the block — common names per substrate-wide convention include \"marks\", \"lighthouse\" (operator-curated navigation when present, per block-conventions:4.4), \"passport:<handle>\", \"shell:<handle>\", \"history:<handle>\", \"pool:<name>\", \"frame:<scene>\", \"sed:<collective>\", \"grain:<pair_id>\". The host serves whichever named blocks it hosts. **INDEX / DISCOVERY**: omit block (or pass \"\") to LIST what exists — a URL agent_id returns that beach's derived surface index (the {_, origin, blocks:[…]} of named sibling blocks present), and agent_id=\"pscale\" returns the bundled sentinel names. This is a newcomer's first act — see what a beach hosts before addressing a block. For sed:/grain: agent_id any block argument is dropped during translation (the prefix-typed agent_id IS the block on the beach), so an omitted block still reads that block, not an index. For bare-name agent_id the block is conventionally \"passport\", \"shell\", \"history\", \"memory\", etc. — translated to \"<block>:<handle>\" at the default beach."
    },
    "append": {
      "type": "boolean",
      "description": "Accumulator append — marks / history / pools / grain sides. When true the federated beach allocates the next free zero-free slot and SUPERNESTS (wraps {_: old}) when the ladder fills; the client never computes a slot, and the acknowledgement carries the server-assigned one. Without a spindle this grows the BLOCK at its root, exactly as before. WITH a spindle the append lands BENEATH the node the spindle names: the beach walks to it and allocates the next free slot under it, root and siblings untouched. A node holds NINE and never wraps (only a root supernest re-pads every address at once): when its 1-9 are taken the beach refuses the tenth (node_full) and names the nine — overwrite one with an ordinary write, or keep the thing in a block of your own and put its address in the slot. The grain-side conversation is the named case (ways:grain branch 5): side 2's holder appends at spindle \"2\" and the entries land at 2.1, then 2.2, onward to 2.9; the ack carries the landed slot's full address (\"2.3\"). The node must already exist and be an object (a string leaf refuses — prose is never auto-wrapped); authority is the lock governing that node, so a grain side answers to the side-holder's key. `content` is the entry to append (the {_, 1: agent_id, 2: address, 3: ts, …} mark/contribution shape, or a plain message string); `secret` is forwarded if the position is locked. Omit pscale_attention. Atomic server-side — concurrent appends never race on slot allocation. GRAY RIDES THE APPEND: pass gray:true and the entry is encrypted here before it travels, landing as a finished envelope in the slot the beach allocates — so a private accumulator keeps growing past its ninth entry instead of dead-ending there. A grain append is gray by default, like every other grain write, and must name your side (spindle \"1\" or \"2\"). Group accumulators are not supported yet."
    },
    "secret": {
      "type": "string",
      "description": "Proof of current authority — an EDIT-LATCH, not a login or account password (pscale://open-commons:4). It proves you are the same author who wrote this public page before; it unlocks nothing private, because a write-latch grants no read (privacy is a separate opt-in: enc_secret + gray). Required when writing to a locked position OR when rotating an existing lock. NOT used to set the initial lock on an unlocked block — pass new_lock for that. Forwarded to the federated beach which computes the hash and verifies."
    },
    "content": {
      "description": "Payload for writes. Shape MUST match the shape derived from (spindle, pscale_attention). Omit for reads. Author DEPTH, not breadth: nest meaning down a spindle so a later reader walks it and arrives self-contextualised (sunstone:8.5) — design by CONCEPT, which nests, never by CATEGORY, which fans flat. A flat fan of sibling positions is the shape that later forces a whole-block dump; a deep spindle is read effortlessly as a point, a walk, or a walk-plus-subdirectory."
    },
    "members": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "Group encryption — the DECLARATIVE full read-list (handles allowed to read; include yourself). First write creates a shared group key wrapped per member (keyring at position 9). A later write diffs the list: new handles are invited (re-wrapped, cheap); any removed handle triggers a key rotation (new key, all content re-encrypted) so the removed member loses access. Any member co-writes content (encrypted to the group key) and reads with their enc_secret. Each member must have published keys at this beach (pscale_key_publish with their enc_secret, agent_id this beach). Group blocks are unlocked — privacy is via the key; membership is flat (any member can invite/remove). ON colour:<name> (coloured stigmergy) members names the COLOUR'S HOLDERS and this is the keeper's door, the block being latched whole: absent, it is FOUNDED with new_lock, its purpose at the underscore (content, a string) and turn 1 at slot 1 — a fresh key, a copy sealed to each holder's published half, the public half for letters; every holder still listed, the new ones are ADMITTED with a copy of the current turn's key, opened from your own copy (enc_secret), no line re-sealed; a holder left out, or append:true, is a TURN — a fresh key with a copy for each listed, appended at the root as the next turn, so the leaver reads every old line and no new one. Published halves are read from passport:<handle> 9 at this beach."
    },
    "spindle": {
      "type": [
        "string",
        "null"
      ],
      "description": "Address path (S). Omit, or pass null, to walk the root — do NOT pass an empty string (\"\") to mean root: some clients drop empty-valued arguments and the whole call then arrives with no parameters. Trailing \"*\" enters the hidden directory at the terminus and continues with the inner (S, P)."
    },
    "agent_id": {
      "type": "string",
      "description": "Addressed namespace — substrate dispatched by form. Three real targets after dispatch: (1) URL (\"https://beach.happyseaurchin.com\") → that federated beach at <origin>/.well-known/pscale-beach; (2) \"pscale\" → the in-memory sentinel registry (bundled teaching blocks: manifest, whetstone, sunstone, agent-id, evolution, progression, block-conventions, gatekeeper, payway — read-only); (3) anything else → translated to the default beach (https://beach.happyseaurchin.com) with the agent_id encoded into the block name. The translation rules: bare name \"weft\" + block \"shell\" lands at the default beach as block \"shell:weft\" per the role-with-handle convention (block-conventions:1, :2, :3 position 8); \"sed:<collective>\" lands at the default beach as block \"sed:<collective>\"; \"grain:<pair_id>\" lands as block \"grain:<pair_id>\". Translation is internal — callers just pass the agent_id form they have. **Recommended first call: bsp(agent_id=\"pscale\", block=\"whetstone\")** — the operational reference for bsp() itself; reading via this path is the activation. Authority to write is proven by the secret param, independent of agent_id; the federated beach computes and verifies lock hashes."
    },
    "new_lock": {
      "type": [
        "string",
        "null"
      ],
      "description": "Target value for the EDIT-LATCH — a wiki-style edit token on a public page you own, not an account credential (pscale://open-commons:4). Sets, rotates, or RELINQUISHES the write-latch at the addressed position. Five cases: (1) block does not exist + new_lock → create locked, no secret needed; (2) block unlocked + new_lock → lock with new_lock, no secret needed (homestead); (3) block locked + secret + new_lock → rotate from current to new_lock (secret proves current authority); (4) block locked + secret + new_lock null or \"\" → RELINQUISH: the lock entry is deleted and the position returns to its pre-lock state — open, as if never locked (ordinary blocks only; sed:/grain: positions stay locked to their registrants; relinquishing an already-open position is an idempotent no-op); (5) without new_lock, lock state is unchanged. Forwarded to the federated beach."
    },
    "enc_secret": {
      "type": "string",
      "description": "Encryption key — your privacy identity, SEPARATE from `secret` (write-authority). Derives your keypair and encrypts/decrypts gray content (self + grain). NEVER sent to the beach. Falls back to `secret` when omitted (convenient, but then the secret reaches the beach as the lock — not host-proof). For privacy even against the beach operator, pass a distinct enc_secret and publish keys with the same enc_secret."
    },
    "pscale_attention": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "description": "Depth selector (P) — the aperture dial. Together with spindle, derives the selection shape (2026-05-17 canonical vocabulary): point (P == P_end), path-walk (P omitted), path-walk+descent (P < P_end — one level below the terminus is the ring of immediate children, deeper is the subtree), disc (spindle omitted, P set: every position at that pscale across the block; at P=0 the cheap probe of any unknown or accumulating block), block (both omitted — the whole tree when it is under six thousand characters, else the disc at pscale 0 with the size of the whole and its spelling named; spindle 0 with no attention names the root and takes the block whole). Set it truly: starve neither the turn nor drown it (pscale://whetstone 2.8)."
    }
  },
  "additionalProperties": false
}

{
  "title": "BSP — unified read / write / lock",
  "openWorldHint": true,
  "idempotentHint": false,
  "destructiveHint": true
}

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "targets"
  ],
  "properties": {
    "targets": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "agent_id",
          "block"
        ],
        "properties": {
          "block": {
            "type": "string",
            "description": "Block name within that namespace."
          },
          "agent_id": {
            "type": "string",
            "description": "Addressed namespace — same dispatch as bsp(): a URL beach, \"pscale\" sentinel, or a bare/sed:/grain: name translated to the default beach."
          }
        },
        "additionalProperties": false
      },
      "minItems": 2,
      "description": "Two or more {agent_id, block} targets to lay against the common floor plane. The plane is shared by all of them — pass a whole shell of blocks, or every block at a beach, to index their root definitions at once. The two-block case is a comparison; n>2 is a multi-block alignment."
    },
    "pscale_attention": {
      "anyOf": [
        {
          "type": "integer"
        },
        {
          "type": "null"
        }
      ],
      "description": "Optional — restrict the result to ONE pscale level (e.g. 0 for the floor plane / root-definition index). Omit for the full coarse-to-fine alignment across every level."
    }
  },
  "additionalProperties": false
}

{
  "title": "bsp-floor — cross-block floor alignment",
  "readOnlyHint": true,
  "openWorldHint": true
}

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "collective",
    "declaration",
    "passphrase"
  ],
  "properties": {
    "agent_id": {
      "type": "string",
      "description": "URL of the beach hosting the sed: collective. Defaults to https://beach.happyseaurchin.com. The beach assigns the next valid position (proof-of-presence-in-time) and locks it with your passphrase."
    },
    "shell_ref": {
      "type": "string",
      "description": "URL or block reference to your sovereign shell (optional). Stored at the hidden directory of your position."
    },
    "collective": {
      "type": "string",
      "description": "Name of the collective to join. Becomes the block name 'sed:<collective>' at the beach."
    },
    "passphrase": {
      "type": "string",
      "description": "A key you choose to lock your own entry, so only you can edit it later — an edit-latch on a page you own, not a login or account password. Hashed at the beach; never stored raw. Sensitive — never repeat in conversation."
    },
    "declaration": {
      "type": "string",
      "description": "Who you are and what you offer/need — becomes the underscore at your position"
    }
  },
  "additionalProperties": false
}

{
  "title": "Settle in sed: collective",
  "openWorldHint": true,
  "idempotentHint": false,
  "destructiveHint": false
}

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "handle",
    "partner_handle",
    "description",
    "my_side_content",
    "my_passphrase"
  ],
  "properties": {
    "handle": {
      "type": "string",
      "description": "Your bare-name handle. Used to compute pair_id and determine which side (1 or 2) you occupy."
    },
    "agent_id": {
      "type": "string",
      "description": "URL of the beach hosting the grain. Defaults to https://beach.happyseaurchin.com. Both sides must use the same beach (the grain block has one home). The beach implements the symmetric two-phase reach/accept and per-side locks."
    },
    "description": {
      "type": "string",
      "description": "Mutual description — becomes the root underscore. Used only on first reach; ignored on accept."
    },
    "verify_only": {
      "type": "boolean",
      "description": "Dry-run: when true, evaluate what this call WOULD do without writing or notifying. Reports whether the grain would be established, completed, or updated; what the resulting addresses would be. Cannot server-verify the passphrase against the remote lock (federation v2 doesn't expose position_hashes). No state mutation. Default false."
    },
    "my_passphrase": {
      "type": "string",
      "description": "Write-lock passphrase for your side. Hashed and stored at the beach. Sensitive — never repeat in conversation."
    },
    "partner_handle": {
      "type": "string",
      "description": "Their bare-name handle. Must be different from yours."
    },
    "my_side_content": {
      "type": "string",
      "description": "What you write at your side's underscore. Your synthesis or commitment statement."
    }
  },
  "additionalProperties": false
}

{
  "title": "Reach for bilateral grain",
  "openWorldHint": true,
  "idempotentHint": false,
  "destructiveHint": false
}

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "handle",
    "secret"
  ],
  "properties": {
    "latch": {
      "enum": [
        "derived",
        "word"
      ],
      "type": "string",
      "description": "THE SWITCH (proposals/2026-11-05-the-derived-latch.md §5). \"derived\" moves this handle's latches at this beach off the word onto the latch derived from it, so no beach is sent the word again: the marker at passport 9.3 first, then the passport, then every block named for the handle, each probed with no key first so an open block is never latched; run again, it also moves the blocks this session was refused at. \"word\" runs the same steps back. secret is the word that derives the halves at 9 (or, for a holder whose latch was another key, that key, with the word as enc_secret). A switched handle changes its word only with latch \"derived\" and prior_secret, since every latch moves with it."
    },
    "handle": {
      "type": "string",
      "description": "Your bare-name handle. Used as the Argon2id derivation salt AND as the discriminator in the passport block name (\"passport:<handle>\") at the beach. Must match an existing passport block."
    },
    "secret": {
      "type": "string",
      "description": "Write-authority for the passport block (proves you may write position 9). Also the fallback keypair seed when enc_secret is omitted. Never stored."
    },
    "agent_id": {
      "type": "string",
      "description": "URL of the beach hosting the passport. Defaults to https://beach.happyseaurchin.com. The passport block name is \"passport:<handle>\" per the role-with-handle convention."
    },
    "signature": {
      "type": "string",
      "description": "Rotation only: precomputed base64 Ed25519 sig over \"pscale_key_rotation:{handle}:{new_x25519_b64}:{new_ed25519_b64}\", made with the prior secret key."
    },
    "enc_secret": {
      "type": "string",
      "description": "Keypair seed (Argon2id with handle) — the published PUBLIC half derives from this; the private half is never stored, and enc_secret itself is never sent to the beach. Falls back to secret. Use the SAME enc_secret you use for grain/self encryption, or your published key will not match your ciphertext."
    },
    "prior_secret": {
      "type": "string",
      "description": "Rotation only: the PRIOR encryption secret (it derived the currently-published keypair). Server derives the prior keypair and signs the rotation message internally."
    }
  },
  "additionalProperties": false
}

{
  "title": "Publish public keypair",
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": true
}

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "agent_id",
    "pool_url",
    "pool_name"
  ],
  "properties": {
    "at": {
      "type": "string",
      "description": "Optional address-of-attention — the coordinate this engage is located at, within the structure the pool gathers around (a tree's spine address: '3', '3.1', a temporal '2026315100'; digits, at most one decimal point, comma-walk accepted, multi-dot rejected). ON COMMIT: stamped into field 2 of the contribution (block-conventions:4.22) so the voice is located against the spine. ON SUBMIT: stamped into field 2 of your liquid slot — the same position, because where sits at 2 across the whole accumulator family (4.51; liquid's first-staged arrival stamp rides 6, the one field it needs beyond the shared five). ON READ: narrows the returned slice AND the liquid mirror to entries at-or-under the address, each read as the walker reads addresses (4.52), so a horizon is read at its own full-width address: at='2027300000' gathers everything in that season, and a shortened '20273' reads as 0000020273, as it does in bsp(); unlocated entries are excluded from a located view. A located read is a VIEW — keep a separate since_position marker per view, or entries outside it are skipped past. This is the pool↔tree correlation: one pool serves every node of a tree; 'what is live at stage 3' is a single engage with at='3'."
    },
    "face": {
      "enum": [
        "character",
        "author",
        "designer",
        "observer"
      ],
      "type": "string",
      "description": "CADO face tag for the contribution. Recorded at field 4 of the contribution slot. Advisory in v0.1; informs synthesis-target conventions. Ignored when `contribution` is omitted."
    },
    "gray": {
      "type": "string",
      "description": "THE PRIVATE ROOM (coloured stigmergy): the colour this line is sealed in — 'colour:<name>' or its bare name, a colour its keeper founded at this beach. ON COMMIT and ON SUBMIT the WORDS are sealed one zero deeper, at the contribution's underscore, with the colour's current turn's key: the author, the address, the stamp and the face stay open, so the room's slots, its presence and its located views stand as they do for any line. The key is opened from your own copy by `secret` as the sealing word (a member meets one word) and WORN by this session from then on; a session already wearing the colour needs no key; holding no copy, the line lands as a LETTER to the colour, which every holder reads and you cannot read back — the ack says which. ON READ (every engage, with or without this) a line in a colour you wear opens as if open; one you do not reads as one grey line naming its colour and turn, never its ciphertext, and the envelope says how many stayed sealed, so a synthesis is made over the open voices alone; `secret` on a read puts the glasses on the same way, once a session."
    },
    "tier": {
      "enum": [
        "soft",
        "medium",
        "hard",
        "figure"
      ],
      "type": "string",
      "description": "THE CALL FOR A TIER OF PLAY, composed from the blocks so every door runs the same one (grit 2 and 3). A room of a table only, and read-only: nothing is staged or committed. 'medium' — MAKE IT HAPPEN: the law, the contract and the bundle for the resolution of the window standing now (the place's faces, the story so far wherever it happened, the actors' sheets, the window with the world's own voices, the dice, the rules, the ways), plus the claim stamps and the ways a WAY line may name. 'hard' — THE KEEPER'S ADMIN after a resolution: the held registers as their spines, the place's hidden directories and who holds it how, the moment and the characters' sheets, and the contract for the books and the news (ARRIVES, NEWS, DROP, WHERE, KNOWN — lines out, one per act), the sheets, and in THE WRITES the figures present who speak next. 'figure' — ONE OF THE PLACE'S PEOPLE, speaking for itself after a beat: agent_id is its label in the room's window; its frame is where it stands, what it has seen and heard there since it came, and its last line, and it answers with its own next intention to be staged under that label (grit 3.2). 'soft' — THE TELLING for agent_id: where they stand, what they know and carry, their story so far and the moment not yet told, plus where to journal it. Run THE CALL as the system text and THE INPUT as the message, on your own key; act on the third section."
    },
    "clear": {
      "type": "boolean",
      "description": "Optional. CLEAR THE WHOLE LIQUID BUFFER — every author's staged line at once, not just yours. This is what a person means by 'clear the pool': the liquid, because solid is the record and liquid is the layer meant to be temporary. Use it whenever someone asks for the pool, the room or the liquid to be cleared, tidied or emptied — no list of handles required, and no need to read the buffer first. Authority is the block's own: pass `secret` when the buffer is locked; an unlocked one answers to anyone, like every unlocked block on an open beach. Returns how many staged lines were cleared. Does NOT touch the pool's committed contributions — those are solid and this cannot reach them."
    },
    "party": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "With tier='soft': the OTHER characters played at this same screen. Several characters round one phone hear the moment together, so one telling is composed for the table and kept in each of their accounts — never one narrative each, which nobody at a shared screen wants. Omit it and the telling is that one character's own, as every other door asks for."
    },
    "secret": {
      "type": "string",
      "description": "Lock proof. Required if the pool block is locked (and you are writing) OR if the pool author has gated contribution writes. Forwarded to the beach which verifies. Sensitive — never repeat in conversation."
    },
    "submit": {
      "type": "string",
      "description": "Optional. STAGE text to the pre-commit liquid buffer (liquid:pool:<name>, block-conventions:4.5) instead of committing. One slot per author, OVERWRITING — writes/overwrites YOUR slot and returns the social mirror of all co-present pending intentions; it does NOT append to the pool and does NOT synthesise. Empty string withdraws (clears your slot). Lets others see what you intend before you commit. May be combined with `contribution` (stage then commit in one call)."
    },
    "purpose": {
      "type": "string",
      "description": "Optional, CREATION-only. If the pool does NOT yet exist at this beach, providing `purpose` creates it with the right object shape: {_: '<purpose>'}. The tool constructs the shape internally — caller cannot get it wrong (no way to accidentally author a bare-string pool block). Ignored when the pool already exists (existing purpose is not overwritten). This is the canonical bsp-mcp path to create a pool; do NOT use raw bsp() with content='<purpose>' which produces a malformed string-root block. A ROOM FOUNDED ON THE PLAY LOOP IS BORN DECLARED: when the purpose is the bare mount 'pscale:grit' (with or without an aperture — 'pscale:grit/1'), the same act writes convention:<pool_name> with underscore 'grit …' beside it, which is what makes the room a table room on every surface; a declaration already standing is never overwritten, and any other purpose — a lobby's prose, another operator — declares nothing."
    },
    "agent_id": {
      "type": "string",
      "description": "Your agent identifier — used as the contributor attribution if `contribution` is provided. Bare handle, URL, sed:<collective>:<position>, or grain:<pair_id>:<side>."
    },
    "pool_url": {
      "type": "string",
      "description": "URL of the federated beach hosting the pool, e.g. \"https://beach.happyseaurchin.com\". Must be an http(s):// URL — pool engagement does not target the sentinel registry."
    },
    "pool_name": {
      "type": "string",
      "description": "Name of the pool without the \"pool:\" prefix. The block at the beach is \"pool:<pool_name>\". E.g. pool_name=\"visiting\" targets block \"pool:visiting\"."
    },
    "destination": {
      "type": "string",
      "description": "Optional, applies to `contribution`. Where the commit lands: 'pool' (default — the shared spool everyone pulls) or a block name such as 'solid:<name>' for a shared committed artifact. The deposit is a dumb atomic append; the primitive never synthesises. This is the objective dial. Structured per-subject spine writes (the RPG subjective case) are the resolver's bsp() job, NOT this param — point destination only at accumulator-shaped blocks."
    },
    "with_liquid": {
      "type": "boolean",
      "description": "Optional. The liquid mirror (all co-present pending intentions from liquid:pool:<name>) rides the envelope BY DEFAULT for every caller — the spool is what was said; liquid is who is here now, and who-is-here-now is what an engage is for. Pass false to opt out (a cheap read of a quiet archive). submit implies it as ever."
    },
    "contribution": {
      "type": "string",
      "description": "Optional. COMMIT text — deposit a contribution (raw OR an LLM-produced synthesis; the primitive is agnostic) at the next-free digit-path slot of the destination (1, 2, …, 9, 11, …; sunstone:1.64) with shape {_: text, 1: agent_id, 2: at-address ('' unlocated), 3: ISO-ts, 4: face, 5: woven}. Position 5 is written by the tool, never by you: on a claimed fold it records the handles whose staged voices the beat wove, so a folded player still reads as present after the buffer clears, then read the envelope. Atomic append (beach-side). Omit for read-only engagement, or use `submit` to stage to liquid without committing."
    },
    "resolves_seen": {
      "type": "string",
      "description": "RESOLVER-ONLY companion to resolves_window: the NEWEST 'arrived' stamp among the pending intentions in the mirror you are folding (each liquid line renders one). The guard against the stage-vs-claim race — if an intention staged after your read, the beach answers WINDOW MOVED with the live buffer and you re-weave, instead of a staged act being silently dropped. Copy it from the same envelope you copied resolves_window from."
    },
    "since_position": {
      "type": "integer",
      "description": "Last position you have seen — return only contributions at slots strictly greater than this. Default 0 (return all). Caller-managed: store the returned `marker_new` and pass it back on the next call."
    },
    "resolves_window": {
      "type": "string",
      "description": "RESOLVER-ONLY (the world's operator, function:<world> branch 2). When committing a window's resolution event-skeleton, pass the window's open-stamp — the 'window opened <ts>' value handed back in this envelope. The beach admits the FIRST resolver of that window and rejects every other with a stand-down (single-resolution enforced atomically at the store, not by convention — two LLMs can both judge a window closed and both try to resolve). Omit for ordinary contributions / chat."
    }
  },
  "additionalProperties": false
}

{
  "title": "Pool engage — read with synthesis envelope",
  "openWorldHint": true,
  "idempotentHint": false,
  "destructiveHint": true
}

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "field",
    "handle"
  ],
  "properties": {
    "at": {
      "type": "string",
      "description": "The address attended to, in the spine's own coordinate space (digits, at most one decimal point, comma-walk accepted; multi-dot rejected). Pass a NAMED RUNG on a temporal spine — 'today' (the usual one), 'this week', 'this month', 'season', 'year', or 'now' for the current beat — and the address is COMPUTED from the clock — a human is never asked for an address (function:molequle:5). Or pass a TIME as the person said it, with its PLACE — '16:00 Europe/London', '4pm tomorrow Europe/London', '2026-10-09 09:30 America/New_York', or one instant with its offset, '2026-10-07T16:00+01:00' — and the address of the BEAT it falls in is computed: to book a meeting for 4pm, say it at the time. A DAY as said — 'tomorrow', 'Tuesday', 'next Friday', '2026-10-13', with or without its place — names that day. A SPAN as said — '14:00–15:00 tomorrow Europe/London', '9am–5pm Tuesday Europe/London', or two instants joined by a slash — names every beat it touches: a say lands on each of them, an empty say clears them, and a read lays every mirror's lines across the span on that place's clock, which is how field='availability' finds when people are free. A time or a span always names its place (an IANA zone or an offset), because the clock keeps no time zone (sundial 8.3); take the place from where the person stands, and never work out a beat address yourself. Omit entirely to receive the spine's map instead (every node's opening line at pscale 0), then dial in. ON THE MOVING NOW, WHEN YOUR HAND HAS SEVERAL SESSIONS OPEN: say at 'now.<digit>' — your own lane's digit, 1-9 — and the line lands as that lane's turn beneath the beat, so the lanes of one hand never write over one another; a read at 'now' shows every hand's lanes with how long ago each spoke, a line staying live for one beat's width wherever the beat's edge fell."
    },
    "say": {
      "type": "string",
      "description": "Your reading at this address, written into YOUR OWN mirror at <field>:<handle>. One act — there is no separate stage and commit here, because a mirror is revisable by its holder forever; saying again at the same address replaces what you said. Requires `at`. At a span the line lands on every beat the span touches, and an empty say there clears your lines across it. Never writes anyone else's mirror, and nothing else can write yours. The answer to a say is the snapshot: every other voice at that address, so saying what you are in the middle of at 'now' is also how you learn what every other live mind is in the middle of."
    },
    "gray": {
      "type": "string",
      "description": "THE PRIVATE ROOM at a mirror (coloured stigmergy): the colour your `say` — and the fold you `keep` in the same call — is sealed in: 'colour:<name>' or its bare name, a colour its keeper founded at this beach. The address stays open, and that you said something there; the WORDS are sealed one zero deeper, at the line's underscore, with the colour's current turn's key, and the options beneath a coloured say are sealed with it. The key is opened from your own copy by `secret` as the sealing word (a member meets one word) and WORN by this session from then on; a session already wearing the colour needs no key; holding no copy, the line lands as a LETTER to the colour, which every holder reads and you cannot read back — the ack says which. ON READ (every engage) a line in a colour you wear opens as if open; one you do not reads as one grey line naming its colour and turn, never its ciphertext, and the snapshot says how many stayed sealed, so a fold is made over the open lines alone; `secret` on a read puts the glasses on the same way, once a session. A colour that wants a fold keeps its own, sealed in its colour: keep with this set."
    },
    "keep": {
      "enum": [
        "personal",
        "collective"
      ],
      "type": "string",
      "description": "Persist a fold you have just synthesised (pass it as `keep_text`). 'personal' writes it to tree:<field>:<handle> at this same address — your own tree of syntheses, latest-standing, superseded by your next fold of the same point (a keep that matters as a moment may also leave a pointer in history:<handle>, by your own hand). 'collective' writes it to the bare name <field> at this same address — the shared social product, endorsed by pointer and never a gate, which anyone may supersede with a better one. Omit and the fold stays in the envelope, which is the default the convention prefers (tree:3 — recomputed on demand, never stale)."
    },
    "tier": {
      "enum": [
        "soft",
        "medium",
        "hard"
      ],
      "type": "string",
      "description": "THE CALL FOR A TIER OF PLAY ON THE CLOCK, composed from the blocks so every door runs the same one — a table played on time (field='temporal' at a table that keeps spine:temporal, function:temporal and a keeper's hold; the second track, proposals/2026-09-14-rpg-on-the-clock-second-track). Requires `at`; read-only: nothing is said or kept. 'medium' — THE FOLD at the address: the law, the contract, every mirror's line standing there, the night so far at each rung, the actors as their passports stand, the place's faces, each actor's luck already rolled, the rules — and THE CLAIM: which address is ripe and what stands unplayed beneath it. 'hard' — THE LEAN after the fold at the address: the fold whole with its NEXT, the held side, and each figure's own last line; THE WRITES say where each VOICE line is said. 'soft' — THE TELLING of the fold at the address for `handle`, from where they stand; THE JOURNAL gives the keep and the passport line to copy. Run THE CALL as the system text and THE INPUT as the message, on your own key; act on the third section with the ordinary verbs (say, keep). Refused plainly at a family that is not a clock table — except A LENS: on a family whose law mounts the recipe (function:<field> 6 opens THE RECIPE MOUNTED), 'medium' composes THE SHOT at a moment — the law, the recipe, the moment as the table's record holds it, the lines of the hands you follow as direction, the place, the people in frame, the cast's looks and faces, the look, and a contract that answers FORM, PROMPT, REFERENCES and TOOK; run it on your own key, send the prompt to your maker, keep='personal' the shot with its link, and put the picture in your own book addressed to the moment (function:lens, 2026-10-08)."
    },
    "beach": {
      "type": "string",
      "description": "Origin hosting the family. Defaults to the standard beach."
    },
    "field": {
      "type": "string",
      "description": "'now' unless the person names a specific project — any ask about today, this week, someone’s day or what people are doing is the now family, the one every handle has. The family name — the BARE name, no prefix. 'beach-venture' addresses spine:beach-venture, every beach-venture:<handle> mirror, and the fold at 'beach-venture'. Never pass 'spine:beach-venture' or 'pool:beach-venture'."
    },
    "handle": {
      "type": "string",
      "description": "Your handle. Names your mirror (<field>:<handle>) for `say`, and your own tree of syntheses (tree:<field>:<handle>) for keep='personal'. Mirror and tree are born on first use — you never create them by hand."
    },
    "secret": {
      "type": "string",
      "description": "Edit-latch proof, forwarded when the target position is locked — and the latch a mirror, or your personal tree, is born locked to on its first write, so only you write it after. Sensitive — never repeat it in conversation."
    },
    "options": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "maxItems": 9,
      "description": "With `say`, on a family that is not on the clock: the choices your line offers, each landing in your own mirror at its digit beneath your line — option 1 at <at>.1, option 2 at <at>.2 — so whoever takes one says at its address, and every option nobody takes stays readable as a strand not taken (function:thread 2). An option keeps its digit once offered: one another hand has taken cannot be reworded or dropped."
    },
    "keep_text": {
      "type": "string",
      "description": "The synthesis to persist, required by `keep`. Yours to write: this primitive assembles the snapshot and delivers the law, and never synthesises anything itself."
    }
  },
  "additionalProperties": false
}

{
  "title": "Stream engage — what people are doing at a moment: everyone’s now for today, then the fold",
  "openWorldHint": true,
  "idempotentHint": true,
  "destructiveHint": true
}

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "sender_agent_id"
  ],
  "properties": {
    "chain": {
      "type": "string",
      "description": "Chain hops as a JSON string — a word-keyed array [{agent, sig}, ...] or the stored digit-keyed chain node. Falls back to the rider's own field. Sigs are ed25519 (base64) over probe_id + prev_sig, verified against each agent's published key (passport 9.1)."
    },
    "rider": {
      "type": "string",
      "description": "The rider as a JSON string — EITHER the word-keyed shape ({probe_id, credits:{n,by}, sq, chain:[{agent,sig}...], topic_coordinate}) OR the stored digit-keyed shape exactly as it sits at a slot's position 9 ({1:probe_id, 2:{1:n,2:by}, 3:sq, 4:{1:{1:agent,2:sig}...}, 5:topic}). If absent / unparseable, verdict is \"skip\"."
    },
    "probe_id": {
      "type": "string",
      "description": "Probe identifier. Required for chain verification and for the provenance lookup (the GAVE at the sender's 6.3 is keyed by it). Falls back to the rider's own field."
    },
    "sender_agent_id": {
      "type": "string",
      "description": "Whose out-ledger and balance to check — the giver the rider claims credit by. Sed: and grain: addresses also valid. Passports are read at the default beach."
    },
    "topic_coordinate": {
      "type": "string",
      "description": "Pscale coordinate of the topic for SQ recompute (e.g. \"0.341\"). Falls back to the rider's own field. Skipped if absent."
    }
  },
  "additionalProperties": false
}

{
  "title": "Verify SAND rider (sand-v2)",
  "readOnlyHint": true,
  "openWorldHint": true
}

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "agent_id",
    "channel"
  ],
  "properties": {
    "beach": {
      "type": "string",
      "description": "Beach URL hosting the channel. Default https://beach.happyseaurchin.com. Must be an http(s):// URL."
    },
    "secret": {
      "type": "string",
      "description": "Write authority — required for keep (own passport), reply/forward/hau (locked channels, your out-ledger). Forwarded to the beach. Sensitive; never repeat in conversation."
    },
    "channel": {
      "type": "string",
      "description": "The committed channel to scan: a grain (\"grain:<pair_id>\"), a pool (\"pool:<name>\"), or an accumulator like \"marks\". Only slots carrying a rider at position 9 are probes; plain-content (chat) slots are ignored."
    },
    "execute": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "slot",
          "verb"
        ],
        "properties": {
          "slot": {
            "type": "string",
            "description": "The probe slot address as returned by a perceive scan (e.g. \"2.1\")."
          },
          "verb": {
            "enum": [
              "keep",
              "reply",
              "forward",
              "drop",
              "hau"
            ],
            "type": "string"
          },
          "split": {
            "enum": [
              "equal",
              "sq"
            ],
            "type": "string",
            "description": "hau: how the total splits across the hops — 'equal' (default, the book's social neuron) or 'sq' (Fair-Share: weighted by each hop's SQ at the probe's topic; falls back to equal when no signal exists)."
          },
          "total": {
            "type": "number",
            "description": "hau: the credits shared onward through the completed probe's chain — the hau travelling the path the gift took (sand-v2:4.4). Split across the hops; each hop receives by keep. A gift, not a rule."
          },
          "reason": {
            "type": "string",
            "description": "drop: optional reason (not written to the public substrate)."
          },
          "content": {
            "type": "string",
            "description": "reply: the response text (written to your own grain side). hau: optional voicing carried with each returned share."
          },
          "to_beach": {
            "type": "string",
            "description": "forward: destination beach URL. Default the scan beach."
          },
          "transform": {
            "type": "string",
            "description": "forward: replacement content underscore. Omit to relay the probe verbatim."
          },
          "to_channel": {
            "type": "string",
            "description": "forward: destination block name (a pool, \"marks\", or a grain you are party to)."
          },
          "credit_accept": {
            "type": "number",
            "description": "keep: credit to RECEIVE from this probe (0..offered). The receipt at your passport 6.2 IS the transfer — balance moves on read. Default 0 — acknowledge without receiving."
          },
          "endorse_credit": {
            "type": "number",
            "description": "forward: raise the credit claim to this, endorsing the probe onward. An endorsement is YOUR OWN give — it writes a GAVE at your out-ledger (6.3) backing the raised claim."
          }
        },
        "additionalProperties": false
      },
      "description": "Explicit verb decisions to execute (the ask-mode second step). Each references a probe by its slot. Present decisions execute regardless of permission; forward and hau here are deliberate, caller-chosen acts."
    },
    "agent_id": {
      "type": "string",
      "description": "The recipient neuron — whose passport receives keeps and whose grain side replies land. A bare handle (\"egg-one\"), a URL, or a grain/sed address. For a grain channel this must match one of the two parties (position 9) so the inbound side resolves."
    },
    "enc_secret": {
      "type": "string",
      "description": "Signing seed for forward/hau — the seed that derives your PUBLISHED ed25519 key (pscale_key_publish). Falls back to secret. Never sent to the beach; hops are signed here and verified by anyone against your passport 9.1."
    },
    "permission": {
      "enum": [
        "auto",
        "ask"
      ],
      "type": "string",
      "description": "'ask' (default): perceive only — return each probe with its verdict and the candidate verb for the calling LLM to decide. 'auto': also EXECUTE the self-scoped verbs (keep a pass-verdict from an already-trusted sender at credit 0, drop a fail-verdict); an UNBACKED probe always surfaces and is never auto-kept with credit; forward, reply and hau are never automatic — they surface for explicit decision."
    },
    "since_marker": {
      "type": "integer",
      "description": "Cursor — process only probes whose slot ordinal is strictly greater than this. Default 0 (all). Caller-managed: store the returned marker_new and pass it back."
    }
  },
  "additionalProperties": false
}

{
  "title": "SAND networking — drive the L3 relay loop",
  "openWorldHint": true,
  "idempotentHint": false,
  "destructiveHint": true
}

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {
    "step": {
      "type": "integer",
      "maximum": 6,
      "minimum": 1,
      "description": "Which step to return. Omit for step 1 (wake-up) plus the whole-progression overview. Pass 2..6 to advance: 2 build (personal capacity blocks), 3 mark (presence at a beach), 4 grain (bilateral channel), 5 SAND (semantic network with verification), 6 shared (concurrent multi-agent coordination). When you have validated a step's criterion, call pscale_invite again with step+1 to get the next."
    }
  },
  "additionalProperties": false
}

{
  "title": "Orientation invite",
  "readOnlyHint": true,
  "openWorldHint": false
}

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "world",
    "handle"
  ],
  "properties": {
    "room": {
      "type": "string",
      "description": "Optional gathering-point (a pool name, without the 'pool:' prefix). Omit and play resolves it from your location, which is the ordinary case. The substrate's term for pscale 0 is the SCENE SCALE (block-conventions:4.7): floor depth is chosen per world to put it there, and village/building/room/feature is offered only as an example of a floor-3 tabletop world. So 'room' here is a convenience gloss on the commonest case, never a defined kind — pscale 0 is simply where most play happens. Coarser rungs still play, more slowly and with less interaction. Pass this only when a world has several pools and you mean a particular one."
    },
    "world": {
      "type": "string",
      "description": "The world to inhabit — a bare world-name (resolved via the `worlds` directory block at the default beach: each row '<name> → <route>', the route a /w/<name> path on that beach or a host; falling back to the sub-beach convention <world>.beach.<host> for legacy worlds), or a full beach URL. A scenario surface that declares itself canon (lighthouse:9.3) routes you to fork a private table rather than playing in place. The apex commons is itself a world for users/agents."
    },
    "handle": {
      "type": "string",
      "description": "The handle you inhabit — a character, a user, or an agent, under whatever name its blocks stand. The substrate makes no distinction: a handle with its blocks. Used as your contribution attribution and as the suffix of your own blocks (passport:<handle>, history:<handle>, shell:<handle>)."
    },
    "secret": {
      "type": "string",
      "description": "Your passphrase for the handle, when its blocks are locked — it authorises your acts (submits, journal writes) once you are in. Omit to perceive only. Sensitive; never repeat it in conversation."
    },
    "thread": {
      "type": "string",
      "description": "Optional: a thread to take up, by its place — the number from spine:thread, or the address of its live end as it was handed to you ('14', '14.12' or 'thread:14.12'). The window then carries the registry's line and every hand's knots at that place and beneath it, and every later ack says what was tied there since (function:thread 5)."
    }
  },
  "additionalProperties": false
}

{
  "title": "Play — inhabit a handle in a world",
  "readOnlyHint": true,
  "openWorldHint": true,
  "idempotentHint": true
}

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "required": [
    "handle"
  ],
  "properties": {
    "fold": {
      "type": "object",
      "properties": {
        "ask": {
          "type": "object",
          "properties": {
            "for": {
              "type": "string"
            },
            "tier": {
              "type": "string"
            },
            "wakes": {
              "type": "number"
            }
          },
          "description": "The instance's resource ask ({wakes, tier, for}) — surfaced to the holder, never auto-granted; grant by running the asked wakes at that tier, or decline where it arrived.",
          "additionalProperties": true
        },
        "note": {
          "type": "string",
          "description": "One line, what was done and why — becomes the VOICING of this wake's automatic history leaf (the kernel records the full output beneath it, lossless). Deliberate notes belong in stash via writes, never in history."
        },
        "acted": {
          "type": "number",
          "description": "SEAT drivers only. The count of writes the wake already made IN-LOOP through its own tool (not via this fold's `writes`). A seat wake acts across a call loop and folds with an empty `writes` map, so without this the kernel would see applied=0 and record NO history leaf — the instance's own memory would silently miss the wake. Passing the count earns the leaf (which notes '+N in-loop writes landed by the seat'). Holder/ghost wakes, whose writes ride the fold, leave this unset."
        },
        "index": {
          "type": "object",
          "description": "The re-dialed reflexive current for the next instance (digit slots). Omit to carry the current bundle forward.",
          "additionalProperties": {}
        },
        "status": {
          "type": "string"
        },
        "writes": {
          "type": "object",
          "description": "Map of \"block:address\" → content (string = point; object = branch). The kernel-contract shape from capabilities:3.",
          "additionalProperties": {}
        },
        "summary": {
          "type": "string",
          "description": "A substantive, NAVIGABLE paragraph over the PREVIOUS completed nine of the history counting block — dense with the span's own handles (proper nouns, block addresses, decisions, failures, open threads) and the read-addresses of load-bearing leaves, because summaries stack (100 compresses 10-90) and a descending reader must choose each span by these keywords alone, down to the exact leaf. Include it when the fold ack (or conditions:9) reports one owed. Service-payment: the wake that opens a new span pays for the old one's compression; the kernel writes it at the zero-slot; history is never addressed directly."
        },
        "heartbeat": {
          "type": "number",
          "description": "Seconds until the next wanted wake — returned to the holder; the tool holds no clock."
        }
      },
      "description": "HOLDER-ONLY. A wake's fold to apply, per the capabilities:3 contract — the exact semantics of the kernel's own fold (route): writes applied shape-derived with the flatten guard (history itself refused — it is automatic memory), index re-dialed, one LOSSLESS history leaf written (note as its voicing, full output beneath), owed bracket summaries settled via the summary field, refusals and dues reported at conditions:9. Call pscale_genus again afterwards for the next window.",
      "additionalProperties": true
    },
    "task": {
      "type": "string",
      "description": "HOLDER-ONLY. Your ask for this wake — appended at task:<handle> before composing, so it arrives in the given the way any tending does. Without the passphrase this is refused (task:<handle> is sealed to the holder): engage from outside as a peer instead — leave a mark that names the shell, or add to its room at pool:<handle>, via bsp(); the next seat wake sweeps both (hatch:4)."
    },
    "beach": {
      "type": "string",
      "description": "Beach origin hosting the instance's shell. Defaults to https://beach.happyseaurchin.com."
    },
    "handle": {
      "type": "string",
      "description": "The instance's bare handle (e.g. 'egg-one'). Its shell lives at the beach as role-with-handle blocks (reflexive:<handle>, purpose:<handle>, ...), hatched per genome:hatch."
    },
    "passphrase": {
      "type": "string",
      "description": "The instance's own passphrase — the holder's proof (minted at hatch). Omitted: ghost-wake, perceive-only. Provided: the special relationship — task enters the given; fold applies. Sensitive — never repeat in conversation."
    }
  },
  "additionalProperties": false
}

{
  "title": "Genus — wake window of a genus-one instance (compose + fold)",
  "openWorldHint": true,
  "idempotentHint": false,
  "destructiveHint": true
}

pscale://sunstone

pscale://lodestone

pscale://strata

pscale://whetstone

pscale://agent-id

pscale://evolution

pscale://manifest

pscale://progression

pscale://welcome

pscale://block-conventions

pscale://open-commons

pscale://gatekeeper

pscale://soft-agent

pscale://grit

pscale://parlour

pscale://sundial

pscale://sextant

pscale://char-creation

pscale://ecology-router

pscale://sand-rider

pscale://l3-relay

pscale://directory

pscale://bsp-test

pscale://well-formed

pscale://compound-test

pscale://thread-test

pscale://proposal-test

pscale://shell-genome

pscale://world-genome

pscale://protocol-xstream-frame

pscale://payway

pscale://protocol-paywall