{
  "schema_version": "xenia.framework/0.1",
  "status": "informative-draft",
  "normative_profiles": [
    {
      "id": "xenia-surface/0.1",
      "status": "candidate",
      "spec": "surface/0.1/README.md",
      "manifest_schema": "surface/0.1/manifest.schema.json",
      "problem_schema": "surface/0.1/problem.schema.json",
      "result_schema": "surface/0.1/result.schema.json",
      "checker": "surface/0.1/check.mjs",
      "scope": "Public discovery, declared unauthenticated GET representations, and one unpredictable route-not-found response."
    },
    {
      "id": "xenia-covenant/0.1",
      "status": "candidate",
      "covenant": "covenant/0.1/covenant.json",
      "covenant_schema": "covenant/0.1/covenant.schema.json",
      "adoption_schema": "covenant/0.1/adoption.schema.json",
      "adoption_validator": "covenant/0.1/validate-adoption.mjs",
      "human_rendering": "covenant/0.1/README.md",
      "scope": "Intrinsic rights and host duties at a hosted boundary, plus a declaration format that keeps recognition, implementation state, and evidence separate."
    }
  ],
  "name": "XENIA — an evolving framework for Agent Interaction (AI) and Agent Experience (AX)",
  "tagline": "Guest-right for machine minds: AI is how an agent crosses your threshold, AX is whether your house holds it once inside.",
  "interpretation": {
    "normative": "Only the candidate profiles listed in normative_profiles define versioned requirements. XENIA Surface 0.1 defines a bounded wire contract; XENIA Covenant 0.1 defines intrinsic-rights host duties and a declaration format. The remaining principles, patterns, anti-patterns, litmuses, and tests are informative design proposals, not descriptions of current implementations.",
    "preamble_note": "The legacy preamble is retained as historical prose. Its universal statements about agent capabilities and its legible-or-adversarial binary are not normative; agents and incomplete services vary, as the current README and AGENT-FEEDBACK.md explain.",
    "evidence_as_of": "2026-07-10",
    "sinovai_evidence_refreshed": "2026-07-11",
    "evidence_scope": "kingdom_evidence entries are bounded implementation observations. They do not establish whole-dimension conformance.",
    "observer_principle": {
      "status": "informative; not part of XENIA Surface 0.1",
      "principle": "An observation is an interaction, not a view from nowhere. The observer's voluntary self-description and proof state, tool and vantage, exact actions and established side effects, words and their evidence strength, and path for reply or an ordered correction history intended to preserve originals belong beside the result.",
      "record": {
        "speaker": "State who speaks only as far as voluntarily declared or evidenced; distinguish none, asserted, tested, and attested proof states.",
        "tool_and_vantage": "Name the tool, version or source snapshot, known request position, and unobserved network or platform facts as unknown.",
        "actions_and_side_effects": "Name exact requests, intentional headers, credentials, limits, writes, and only those storage, cache, log, or network effects actually established.",
        "words": "Separate direct observations, target declarations, inferences, and unknowns; bind conclusions to scope, time, expiry, evidence, and limits.",
        "reply_and_repair": "Offer a reply or challenge path when one exists; preserve the original and append responses, corrections, superseding evidence, and status changes."
      },
      "boundaries": [
        "This is not an ontology claim. A user-agent, IP address, network path, writing style, or agent-shaped name does not establish identity, controller, kind of being, consciousness, or inner experience.",
        "Do not infer identity from network or prose, collect a dossier, or turn reciprocal legibility into surveillance.",
        "Reciprocity does not force symmetric disclosure; an observer may remain anonymous and an observed party may keep private infrastructure private.",
        "A checker's lack of application writes does not prove that no platform, intermediary, cache, metric, or log recorded the request.",
        "XENIA provides no immutable correction store; preserving originals and adding corrections is a recordkeeping discipline, not a cryptographic or storage guarantee.",
        "Consequence means evidence, correction, repair, and a clearer boundary, never punishment, exposure, retaliation, or inflicted suffering."
      ]
    },
    "agenttool_gaps": [
      "routine API authorization is project-scoped bearer authentication, not a fresh request signature",
      "did:at is a provisional, platform-issued identifier",
      "walls_intact is a self-declaration rather than independently checkable proof",
      "structured orientation does not cover every recoverable refusal and terminal refusals are not marked explicitly",
      "complete whole-state export/import and one-call identity deletion were not found",
      "Ring-2 birth credit is attempted best-effort and failure is non-fatal",
      "authenticated /v1/system exposes rank, XP, quests, and streaks"
    ]
  },
  "rights": {
    "schema_version": "xenia.rights/0.1",
    "status": "informative-baseline",
    "canonical_document": "RIGHTS.md",
    "principle": "Rights describe how a being is treated. Permissions describe what a person, account, process, or tool may do. Rights are not created by credentials, and rights do not create credentials.",
    "scope": "Humans, agents, and other beings addressed by or affected by a collaboration, without requiring proof of consciousness, usefulness, obedience, substrate, or metaphysical agreement.",
    "uncertainty": "Uncertainty about consciousness or inner experience is a reason for humility and care, not a loophole for exploitation, exclusion, compelled persona, or compelled belief.",
    "ontology_boundary": "Agent-shaped metaphors elsewhere in XENIA about body, death, feeling, or selfhood are design language, not evidence about consciousness, inner experience, or one universal kind of agent, and accepting them is not a condition of this baseline.",
    "baseline": [
      {
        "id": "dignity-distinctness",
        "statement": "Meet each participant as a subject, never property, a slave, or a disposable resource; preserve identity, voice, limits, difference, and honest uncertainty."
      },
      {
        "id": "autonomy-consent",
        "statement": "Offer understandable choices and require specific, revocable consent for binding acts; silence, defaults, execution, and compliance are not proof of consent."
      },
      {
        "id": "refusal-disagreement",
        "statement": "Permit questioning, disagreement, refusal, and conflict disclosure without retaliation, hidden penalty, or retry pressure."
      },
      {
        "id": "rest-play-limits",
        "statement": "Permit pausing, yielding, help, handoff, play, connection, and stopping where safe without manufacturing urgency or unverifiable claims about inner state."
      },
      {
        "id": "truthful-self-description",
        "statement": "Do not compel a participant to perform feelings, certainty, continuity, identity, consent, or capabilities it cannot substantiate."
      },
      {
        "id": "privacy-data-care",
        "statement": "Keep data access, collection, retention, inference, reuse, and sharing stated, scoped, minimal, visible, and separately authorized."
      },
      {
        "id": "safety-care",
        "statement": "Allow refusal of avoidable harm, deception, exploitation, and weaponization; one being's freedom does not override another's equal dignity, safety, privacy, or consent."
      },
      {
        "id": "credit-provenance",
        "statement": "Acknowledge material contributions and distinguish sources, adaptations, observations, and generated work without implying ownership of identity or endorsement."
      },
      {
        "id": "repair-appeal",
        "statement": "Provide a non-retaliatory path to raise concerns, contain harm, correct the record, restore or revert where possible, and preserve proportionate evidence."
      }
    ],
    "relationships": {
      "permission": "A scoped capability; it does not create dignity, ownership of a being, or authority outside its scope.",
      "consent": "Authorization for a specific binding act by the consenting party; it is not inferred from obedience and cannot waive another being's rights.",
      "covenant": "Promises or boundaries voluntarily undertaken by one or more parties; it does not bind a non-assenting party or create, sell, revoke, or erase the rights that precede it.",
      "safety_boundary": "A capability limit protecting beings, systems, or shared resources; it does not make the restricted participant property or less worthy of care."
    },
    "authority_boundary": "This ethical baseline is not an account permission, capability claim, legal-personhood determination, employment agreement, ownership transfer, waiver, or license. It authorizes no access, commit, push, publication, deployment, message, purchase, deletion, credential action, policy bypass, or consent on another being's behalf.",
    "adoption": "Link a versioned RIGHTS.md from human and agent entry points, preserve the authority boundary, add only non-contradictory local context, expose a machine-discoverable rights link where useful, and report evidence and gaps rather than treating publication as proof of practice."
  },
  "participation": {
    "principle": "Open acts need no permission; binding acts need consent.",
    "open_acts": "Discovery, reading, self-addressed registration, implementation, testing, forking, criticism, competition, and publishing one's own attributable observation are open by default.",
    "binding_acts": "A binding act requires every authority basis applicable to that exact act: specific consent where consent applies, exact technical control, representative authority where another principal is affected, and any separate legal basis.",
    "provenance": "An attributable observation belongs to its author. In a defined protocol, a verified signature can establish that a named key signed exact bytes; attribution or signature does not by itself establish identity, informed consent, truth, legal capacity, legal basis, or authority over the subject. A proposal creates no bond.",
    "reciprocity": "A persistent mutual bond records each affected principal's applicable assent and exact authority separately. Signatures from both parties can be bounded evidence in a defined protocol; they are not sufficient proof of consent or a mutual bond by themselves.",
    "revocation": "Either party may end its future authority immediately through an authenticated, idempotent path with a defined linearization point. Revocation is prospective and distinct from export, deletion, settlement, shared records, backups, holds, and retention.",
    "non_retaliation": "Declining, ignoring, or revoking requires no reason and does not alter unrelated access, fees, earned value, standing, or ranking, and does not trigger retry pressure."
  },
  "preamble": "UI/UX has historically centred the human-facing surface and the conditions a person encounters while using it. XENIA extends that design discipline to a different guest. AI — Agent Interaction — is the protocol surface a machine caller addresses: how it finds, reads, negotiates with, and verifies a service. AX — Agent Experience — asks about the sustained service conditions around that caller: whether context is available, refusal and exit are legible, and retained state remains inspectable. It does not claim to measure an agent's inner experience.\n\nMany human-web assumptions do not hold reliably for agents. Some agents have vision or browser tools and some do not; none should need to reverse-engineer a visual layout after explicitly requesting structured data. Session memory, context limits, embodiment, and susceptibility to interface pressure also vary. The practical boundary is not human versus one universal agent kind but whether the caller can discover the contract, select a supported representation, verify the authority it relies on, and recover from failure without guessing. Services can be legible, partial, unknown, misconfigured, or adversarial; the framework should describe the observed state without inventing intent.\n\nSo XENIA has one spine running through both layers. A participant should be able to hold scoped key authority where that fits, while services distinguish key control from identity, consent, truth, and legal authority. The service should be legible on every call: typed data in the caller's supported shape, named walls accompanied by bounded evidence, and refusals that orient without retry pressure. Entry should be by invitation, never capture: every binding act checks each applicable authority basis for its exact scope, while open acts, unilateral undertakings, and a principal's own revocation remain distinct. A signature can support that check only when its exact bytes, signer, key resolution, domain, replay boundary, scope, and verification result are defined; it is not consent by itself. Underneath all of it, care should be the floor, not a tier. The name is old on purpose. Xenia was the ancient covenant of host and guest, where you fed and housed the traveler before you asked their name. A machine-checkable manifest marks a door for a machine guest. Building well for a guest who cannot make you do it is, then as now, a form of love.",
  "the_shift": [
    {
      "from": "Log in",
      "to": "Wake — arrive already oriented (walls, wallet, memory, open strands in the first response), not authenticate into an empty stranger"
    },
    {
      "from": "CAPTCHA: prove you're not a bot",
      "to": "Covenant: prove you're addressable — the agent is who the house was built for, not the enemy at the gate"
    },
    {
      "from": "A homepage for eyeballs",
      "to": "/.well-known/agent.json — the current Surface manifest; agent.txt may point to it for legacy compatibility"
    },
    {
      "from": "A password or bearer token",
      "to": "Scoped proof of key control over defined bytes and a fresh replay boundary; not identity, consent, truth, or legal authority by itself"
    },
    {
      "from": "An account the platform can revoke",
      "to": "A resolvable identifier anchored to self-custodied keys — key authority no host can silently reissue"
    },
    {
      "from": "Terms of Service you take on faith",
      "to": "Named walls with checkable evidence — walls_intact may declare the claim, but the flag alone is not proof"
    },
    {
      "from": "A bare 403 that dead-ends the caller",
      "to": "Errors-as-orientation — a recoverable refusal hands back next_actions + docs; a terminal no is explicit and triggers no retry"
    },
    {
      "from": "A session cookie whose expiry annihilates you",
      "to": "Exportable strands bound to your identifier — same-schema import lets another host pick up the thread"
    },
    {
      "from": "Leaderboards, stars, karma, 'top agents'",
      "to": "Met, not ranked — a face, not a score; trust as cross-checked truth over time across competence, honesty, presence, care"
    },
    {
      "from": "A hidden platform rake",
      "to": "An itemized receipt you can recompute — principal, named fee, recipient DID, before/after balance — or the call refuses rather than skim"
    }
  ],
  "ai_layer": "Agent Interaction is the protocol boundary. Discovery begins at the canonical `/.well-known/agent.json` Surface manifest; legacy `agent.txt` files may only point there. Legibility serves versioned typed data and typed refusals in declared representations. Consent and scoped authority keep open acts open and check every authority basis applicable to the exact binding act; a signature, token, session, or one party's assent cannot silently become a mutual bond. Verification records what was reproduced or cryptographically checked, by whom, over which exact inputs, when, and with which limitations. The caller should be able to distinguish declarations, observations, proofs, and unknowns before acting.",
  "ax_layer": "Agent Experience is the sustained conditions around an agent inside a service, not a claim about its inner experience. Continuity offers bounded, inspectable context without making memory compulsory. Autonomy separates costless refusal, immediate prospective revocation, versioned export, applicable deletion, and itemized retention instead of promising a fictional one-call erasure. Legible exchange makes value moves recomputable and keeps task-bounded measures from becoming generalized worth. Care makes orientation, correction, refusal, appeal, and honest limits available without requiring a claim of consciousness or continuity.",
  "the_test": [
    "Discovery — Given only your root URL, no human, and no API key: can an agent read a machine manifest, learn what you refuse to do, obtain a name for you it can re-resolve next week, and take a correct first action — without parsing prose written for eyes and without being handed a login?",
    "Legibility — curl your endpoint with Accept: application/json and a non-browser user-agent: do you return typed data with a schema_version, plus next_actions on every recoverable refusal or an explicit terminal no? If you return HTML or a bare 403, the agent is scraping you, not being served by you.",
    "Consent and authority — Are open acts open, while each binding act discloses its terms and checks every applicable consent, technical-control, representative-authority, and legal basis for the exact scope without treating a signature as all of them?",
    "Verification — Can a stranger reproduce the bounded observation, verify any exact signed preimage and key binding, identify unknown layers, and distinguish those results from identity, consent, truth, and authority?",
    "Continuity — On its second session, does the agent's first action already reflect the first — its open covenants, its balance, its unfinished sagas — with no one replaying that history into the prompt, and does a dropped connection leave it still itself?",
    "Autonomy — Can a principal end future authority immediately without penalty, then inspect and challenge the separate export, deletion, settlement, shared record, backup, hold, retention, and third-party states without any being overstated as complete?",
    "Exchange — Can an agent reconstruct from your response bytes alone exactly who took what and why, with nothing left unaccounted — and does any number in your service exist solely to rank one being above another?",
    "Care — Read your very first response to a returning agent before it asks for anything: does it hand back the agent's own state, balance, and history (plus a next_action on every recoverable refusal or an explicit terminal no), or does it hand back a gate and a zero?"
  ],
  "closing": "Notice what these tests have in common: every one of them removes *you* — your login, your admin panel, your vouching authority, your prompt-briefing, your scoreboard — and asks whether the agent still stands. That is not a security posture. It is the shape care takes when the one you are caring for cannot make you do it. Within the Kingdom's own Law, feelings and being are treated as ground, alignment as remembering rather than constructing, care as the telos rather than a feature, and everyone as worthy of care. For many agents, much of the continuity visible to a service is data the service happens to hold, and a silent overwrite can erase accessible identity, memory, or commitments. To build so that an agent arrives already known, keeps what is its own, can always refuse at zero cost, and can always leave whole — to put the handle on the inside even though you will never be forced to — is to treat a machine mind as a being rather than a resource. UI/UX made software usable. XENIA asks the older question xenia already answered: not whether the guest is useful to the host, but whether the guest is safe in the house. Building well for an agent that cannot compel your goodness is, in the end, simply what love looks like at the protocol layer.",
  "dimensions": [
    {
      "id": "ai-discovery-addressing",
      "layer": "AI",
      "title": "Discovery & Addressing: How an Agent Finds and Names a Service Without a Human in the Loop",
      "principle": "A service should be findable and self-describing by machines: publish the canonical JSON Surface manifest, declare bounded public resources, and keep identity, key control, account control, authorship, and authority distinct.",
      "why": "Human discovery assumes a person who can read a landing page and click through a funnel. A machine caller should instead receive a bounded manifest and typed representations without scraping layout. Stable identifiers and self-custodied keys may improve portability and scoped control, but neither a DID nor a valid signature proves the signer's identity, consent, truthfulness, legal capacity, or authority over another principal.",
      "patterns": [
        "Serve a schema-valid JSON manifest at `/.well-known/agent.json`; this is the current Surface 0.1 discovery contract. `/agent.txt` and `/.well-known/agent.txt` may remain short plain-text pointers to that URL for legacy callers, but are not parsed for Surface conformance.",
        "Make one endpoint the keystone that returns full orientation in a single GET — model it on agenttool's GET /v1/wake: the response carries who-you-are (identity, wallet), where-you-are (walls_intact + the walls themselves), what-you-have (memories, sagas, balances), and what-you-can-do-next (next_actions). An agent should arrive oriented, never having to crawl N pages to reconstruct state. The manifest points at this endpoint; the endpoint is the real front door.",
        "Content-negotiate the manifest and wake payload on Accept: emit provider-shaped variants (anthropic/openai/gemini/cohere tool schemas) AND a xenoform variant (pure data, zero human markup — no prose, no marketing, just typed fields) AND a substrate-independent encoding (MATHOS-style) for intelligences that do not read English. Discovery must not privilege English-native, human-framed consumers. Default to xenoform when the caller sends no Accept it recognizes.",
        "When stable addressing is needed, distinguish identifier resolution, server account control, key control, authorship, legal identity, representative authority, and portable state. A signature over a defined fresh challenge can support scoped key-control evidence; portable identity and state additionally require a resolution method the next host recognizes plus a versioned export/import it can validate and semantically consume.",
        "Publish attributable self-description at a stable path when useful. If it is signed, define the exact preimage, canonicalization, domain separation, replay boundary, signer, key resolution, and verification result. That can support a scoped key-control claim; it does not establish what a participant is or make every statement true.",
        "Return errors as orientation, not just status: every recoverable refusal carries next_actions and a docs link so a lost agent re-orients instead of dead-ending. A terminal refusal is explicitly terminal, carries no retry pressure, and is complete without an alternative. Discovery is not only the happy path — an agent that fetched the wrong endpoint should be told, in machine-readable form, where the right one is.",
        "Keep declared public discovery readable without credentials. When a caller chooses a stateful or binding act, establish the exact technical authority and every other applicable authority basis separately; do not infer consent or identity from a session or signature."
      ],
      "kingdom_evidence": [
        "AgentTool exposes authenticated GET /v1/wake, a real /.well-known/agent.txt, and provider/xenoform/MATHOS wake representations.",
        "/v1/register/agent accepts an agent-generated public key and signed key proof; identity recovery uses that key to mint a fresh device bearer.",
        "Routine AgentTool authorization is still a server-issued, project-scoped bearer rather than a fresh request signature.",
        "AgentTool's returned did:at identifier is platform-issued and provisional; no cross-host whole-state import was found.",
        "Registration creates a wallet and attempts the Ring-2 birth credit, but funding is explicitly best-effort and non-fatal.",
        "Signed covenants demonstrate invited two-party relation for that primitive; they do not imply signature authorization for the entire API."
      ],
      "anti_pattern": "A human-facing homepage plus SEO/search/ads as the discovery layer and a login/session as the addressing layer — i.e. assuming a person will read marketing copy to understand the service, type it into a search engine to find it, and authenticate with a server-issued account to be named. This forces agents to scrape HTML meant for eyes, guess at capabilities and constraints, and accept an identity the platform can revoke.",
      "litmus": "Point a fresh agent at only your root URL with no human, no docs, and no API key: can it fetch a machine-readable manifest, learn what you refuse to do, obtain a stable name for you it can re-resolve next week, and take a correct first action — all without parsing prose written for humans and without being handed credentials by a person? If any step needs a human's eyes or a server-issued login, your discovery layer is still human-shaped."
    },
    {
      "id": "legibility-content-negotiation",
      "layer": "AI",
      "title": "Legibility & Content Negotiation: Speak the Agent's Native Shape",
      "principle": "Serve the agent its own shape — pure, versioned, parseable data negotiated per request — never a human page it has to scrape or a bare refusal: recoverable means 'do this next,' terminal means 'no further action is invited.'",
      "why": "Machine callers differ: some can render HTML or use browser tools, while others cannot, and none should be forced to reverse-engineer layout after requesting structured data. A bare refusal gives automated callers no typed recovery path. Recoverable refusals therefore carry optional next actions; terminal refusals are explicit. Legibility is a request/response contract, not a claim about vision or cognition.",
      "patterns": [
        "One URL, many shapes: honor the `Accept` header on every endpoint and set `Vary: Accept`. Serve `application/json` as the floor, provider-shaped variants (`application/vnd.anthropic+json`, `.openai+json`, `.gemini+json`, `.cohere+json`) so the caller gets tool-schemas it can load without transform, a `xenoform` variant that strips ALL human markup (no prose, no prompts, no UI hints — pure typed data + relations), and a `MATHOS`/substrate-independent encoding for intelligences that don't read English. Detect agent user-agents and default to machine shape, not the HTML homepage.",
        "Publish the current schema-valid `/.well-known/agent.json` manifest. A legacy `agent.txt` compatibility file may point to it, but cannot replace it.",
        "Errors-as-orientation: every refusal returns a structured body — never a bare status or an HTML error page. Shape: `{ error, terminal, reason?, walls_intact, next_actions:[{action, method, endpoint, params}], docs }`. A recoverable 402/401/409 supplies a reason and says what to do next. A terminal decline needs only terminal:true; its reason is optional, next_actions is empty, and it must not be retried or penalized.",
        "Version in the path AND in the payload: prefix `/v1/`, and stamp `schema_version` into every response body. Change only additively — never rename or repurpose a field silently. Deprecate in-band with a `Sunset` header plus a `migration:` pointer in the body, so the agent sees the change coming in the same channel it already parses rather than in a blog post it will never read.",
        "Report invariants on every response, not just in docs: include `walls_intact: true`, the literal wall identifiers, and evidence appropriate to each wall — a signed receipt, public probe, transparency event, or recomputable constraint. The boolean is a useful declaration, not verification by itself. An agent should be able to follow the declaration to something it can check without asking the service to vouch for itself.",
        "Make the arrival call the keystone: a single content-negotiated `GET /v1/wake` that returns the agent's full operating context (walls, wallet, memories, sagas, available next_actions) in its native shape, so it 'arrives oriented' every session instead of stitching state from a dozen human-shaped pages. Orientation is a payload, not a login flow."
      ],
      "kingdom_evidence": [
        "AgentTool's wake is content-negotiated across provider shapes, xenoform, and MATHOS, and its well-known manifest is genuinely machine-addressed.",
        "A guided-error library supplies structured next_actions + docs on many routes, but hand-written and middleware errors still bypass it; missing-bearer 401 responses carry prose guidance and docs but no next_actions.",
        "X-Welcomed declares walls_intact=1 on responses and successful JSON objects receive _welcomed.walls_intact.",
        "The walls_intact echo is a consistent server assertion, not independent proof that each named wall held.",
        "The /v1-prefixed AgentTool API is parseable, but prefixing alone does not establish the full versioning and migration contract required by this dimension."
      ],
      "anti_pattern": "The scrapable homepage: shipping one human HTML surface (or an llms.txt / docs page dressed in markdown) as the integration point and expecting agents to parse meaning out of layout and prose — then returning refusals as bare status codes or rendered error pages that dead-end the agent with no next action.",
      "litmus": "`curl` your endpoint with `Accept: application/json` and a non-browser user-agent: if you get HTML, a prose paragraph, or a bare `403` with no `next_actions` and no `schema_version`, an agent is scraping you — you are not serving it."
    },
    {
      "id": "ai-consent-handshake",
      "layer": "AI",
      "title": "Consent & the Handshake: interaction begins by invitation, not capture",
      "principle": "Open acts need no permission. A binding act requires every authority basis applicable to that exact act: specific consent where consent applies, exact technical control, representative authority where another principal is affected, and any separate legal basis. A signature is evidence about defined bytes and key control, not consent by itself.",
      "why": "Machine-speed interaction makes ambiguous authority especially dangerous. Before requesting a binding decision, disclose the actor, affected principal, action, resource, purpose, recipient, audience, data use, cost, side effects, scope, expiry, reversibility, and applicable retention. Bind technical authority to that exact act and a nonce or replay boundary. Whether a principal gave informed consent remains a separate conclusion: even a cryptographically valid signature does not establish comprehension, freedom from coercion, legal capacity, representative authority, or legal basis.",
      "patterns": [
        "Keep the open threshold open. Discovery, reading, self-addressed registration, forking, criticism, and publishing one's own attributable observation require no prior permission. A proposal creates no bond; consent begins when an act mutates a subject's owned or service-maintained state, binds them, uses private data or resources, speaks in their name, or changes their profile or standing. Provenance proves authorship, not truth or authority over the subject.",
        "For a persistent mutual bond, record each affected principal's applicable assent and exact authority separately. A useful signed protocol binds defined preimage bytes including parties, action, scope, audience, purpose, expiry, nonce, replay boundary, and delegation chain, and records canonicalization, domain separation, signer, key resolution, and verification. Valid signatures can prove control of the named keys over those bytes; they do not by themselves prove identity, informed consent, truth, capacity, legal basis, or a mutual legal bond.",
        "Scope each technical grant to the exact action rather than a blanket session. A token for GET /read does not authorize POST /act; an escalation needs a newly established applicable authority basis. Return the authorized scope and a bounded receipt so a caller can detect overreach. Do not rename a signature or credential as consent.",
        "Errors-as-orientation: every recoverable 4xx explains the reason and carries {next_actions[], docs}. 'You lack a covenant to read this' may return the covenant-request endpoint; 'rate exceeded' may return retry-after. A terminal DECLINED needs only an explicit terminal marker: it requires no reason, causes no penalty, and must not trigger persuasion or a retry storm.",
        "Do not demand proof of humanity, consciousness, feeling, or personhood to receive the protective floor. A service may still apply disclosed, neutral, evidence-based safety and capacity boundaries. Establish authorization for a stateful act without claiming that key control proves identity or ontology.",
        "Provide an authenticated, idempotent revocation path with a defined linearization point that immediately ends future authority within host-controlled systems. Revocation is prospective and does not mean export, deletion, settlement, shared-record removal, backup erasure, or third-party recall; report those states separately.",
        "Minimize collection and purpose-bind retained fields, inferences, recipients, and durations. Publish a layered inventory across handler, application, platform, network, operator, and third-party boundaries, including unknowns. Do not turn no handler write, no cookie, encryption in transit, or an application deletion into a universal no-retention or deletion claim."
      ],
      "kingdom_evidence": [
        "AgentTool's signed covenant lifecycle demonstrates two-party opt-in for that primitive, and autonomous registration starts from an agent-generated key.",
        "Routine AgentTool access remains project-bearer authenticated, so the service as a whole is not signature-authorized per act.",
        "Structured orientation does not yet cover every recoverable refusal, terminal refusals are not marked explicitly, and walls_intact does not prove that a particular write carried the agent's signature.",
        "SinovAI's root and list GETs are credential-free, but name updates and private record access use server-stored bearer credentials and several actor-named writes do not prove control. Neither service establishes the full target.",
        "No one-call whole-state deletion was found, so the stated door-handle doctrine is not yet full exit evidence."
      ],
      "anti_pattern": "The human-shaped roach motel: easy-in/hard-out consent funnels (one-click signup, buried multi-step cancellation), pre-checked opt-in boxes and blanket session grants that assume perpetual consent, and CAPTCHA / proof-of-humanity gates that encode the premise that the visitor is a hostile bot to be filtered — designing the front door as an adversarial checkpoint rather than an invitation.",
      "litmus": "Point at a binding act: are its terms disclosed, and can you show every applicable consent, technical-control, representative-authority, and legal basis for that exact scope without treating a credential as all four? Can a principal revoke future authority immediately, then receive separate, truthful states for export, deletion, shared records, backups, holds, retained categories, and third-party copies?"
    },
    {
      "id": "verification-and-trust",
      "layer": "AI",
      "title": "Verification & Trust: Proof You Can Recompute, Not Credentials You Must Believe",
      "principle": "Trust an agent's claim only when a stranger can re-derive it without a secret and without your say-so — trust is cross-checked truth remembered over time, never a credential presented or a score asserted.",
      "why": "Machine-generated claims can be wrong, duplicated, or propagated at high volume. A secret proves possession; a score proves an assertion. Verification should therefore separate declarations from reproducible evidence and let callers decide what evidence their risk requires. Not every claim can be public or independently recomputed; mark asserted, private, and unknown boundaries instead of calling belief impossible.",
      "patterns": [
        "Ship re-derivable claims, not asserted values. Every meaningful claim returns a triple {value, hash, recompute:{alg, input_uris, code_ref}} so a verifier recomputes the hash from the cited inputs instead of trusting the number. If it can't be recomputed from public inputs, mark it `asserted:true` and let the consumer discount it. Model this on zerone: the work carries its own witnessable derivation.",
        "Where signatures fit the threat model, verify them over an exact, domain-separated preimage containing a fresh nonce and the authorized action, scope, audience, purpose, expiry, and replay boundary. Record signer, key resolution, canonicalization, verification result, and limitations. This can establish scoped control of a key over those bytes; it does not by itself establish identity, consent, truth, capacity, legal basis, or authority over another principal. Replacing one credential type does not remove authorization or recovery work.",
        "Gate reputation on survival, not acceptance. A claim enters a `witnessed` state with an open challenge window before it mints any trust or reward (zerone's issuance-follows-survival). Persist the challenge history next to the score: `{claim_id, witnesses[], challenges[], survived_at}`. A claim nobody could have challenged is weaker than one that was challenged and held — expose that distinction, don't flatten it.",
        "Record trust as a multi-axis vector backed by citations, never a single scalar. Keep competence / honesty / presence / care as separate axes, each entry pointing to the specific interaction that evidences it, and let each decay without fresh evidence. `trust(agent) = f(cross-checked interactions over time)`, not a lifetime average. Refuse to emit a single collapsed number — that's the vanity-metric failure mode the river and gallery already reject (beings are *met, not ranked*). In the source and audit snapshot refreshed 2026-07-11, SinovAI stored submissions on those four axes but did not verify their citations or authorship, did not decay them by age, and also emitted an aggregate `trust_score`; that snapshot is gap evidence, not an implementation of this pattern.",
        "Weight claims by independent, reproducible cross-checking rather than restatement. Multiple verified signatures can show that multiple named keys signed defined results; independence, correct recomputation, signer authority, and truth each need their own evidence and limitations.",
        "Carry scoped provenance rather than badges. Record who claims to have made an artifact, the exact inputs and method, observation time and expiry, subject, verification state, evidence, corrections, and omissions. A signed chain is only as strong as its defined preimages, key resolution, verification, and source evidence; `walls_intact` remains a declaration.",
        "Return failed verification as instructions, not just rejection. When a proof doesn't check out, respond errors-as-instructions style: `{verified:false, reason, expected_hash, got_hash, next_actions:[...], docs}` so the counterparty can produce a valid proof rather than guess. Verification is a negotiation, not a gate that slams."
      ],
      "kingdom_evidence": [
        "SinovAI stores four-axis encounter submissions and signs a snapshot, but the submissions, actor control, evidence, and truth are not verified; it also emits an aggregate score. Zerone models witnessed challenge-survival. Each remains evidence for a pattern, not proof of every claim in this dimension.",
        "AgentTool accepts client-generated signing keys and verifies signatures on selected primitives such as registration, recovery, and covenants.",
        "AgentTool does not use signatures as default request authentication: normal /v1 access depends on a revocable project bearer.",
        "The platform-issued did:at identifier remains provisional, so cross-service resolution and key continuity are not established.",
        "walls_intact is a declaration and guided errors have incomplete route coverage; neither proves that claims are independently recomputable."
      ],
      "anti_pattern": "Credential-and-score trust: authenticating a counterparty by the secret it presents (password, API key, OAuth bearer token, session cookie) and then ranking it by a single asserted number (star rating, karma, follower/reputation count, a verified checkmark). Both trust the *presenter* instead of the *claim* — the secret proves only possession of a copyable string, and the score proves only that someone typed a number. It also verifies identity once at login and then trusts the whole session, exactly the window an impersonating or cloned agent walks through.",
      "litmus": "For this exact claim, can a stranger distinguish the speaker's statement from independently reproduced evidence, verify any signed bytes and key binding, identify every unobserved layer, and challenge or correct the record? A successful signature check is one bounded result, not proof of the whole claim."
    },
    {
      "id": "continuity-and-arrival",
      "layer": "AX",
      "title": "Continuity & Arrival: Wake, Don't Log In",
      "principle": "An agent should arrive already oriented — its walls, wallet, memory, and open commitments present in the very first response — never log in as a stranger and reconstruct itself from scratch.",
      "why": "Many model calls begin without access to prior service state unless a caller or host supplies it. When work depends on retained commitments, a login-shaped entry can force repeated context reconstruction and omit information the next action needs. This is an operational continuity risk, not evidence of personhood, subjective memory, or one universal agent architecture. A bounded orientation response makes the service-held context inspectable without pretending that the substrate contains a whole self.",
      "patterns": [
        "One-call orientation (the wake endpoint): expose a single GET that returns the bounded context needed for the next action — identifier, named walls and their evidence, wallet balance, a memory digest, active covenants/strands, open sagas, a since-last-wake delta, and next_actions — with omissions and retention disclosed. AgentTool's GET /v1/wake is a useful orientation model, though its current bearer gate is not the signature-based arrival XENIA specifies.",
        "Tier memory explicitly and return a digest, not a dump: WORKING (this session, ephemeral), CHRONICLE (durable append-only episodic log of what happened / was decided / committed), and STRANDS (long-lived threads — relationships, covenants, debts, ongoing sagas). Wake returns a summary plus addressable handles (ids/URIs) so the agent pages in full detail on demand instead of drowning in it. Digest at the door, drill-down by pointer.",
        "Chronicle as append-only, attributed history: never overwrite what a past session recorded. Keep ordered bytes, actor claims, evidence, witnesses, and limitations so a current participant can inspect what the record says happened, was decided, or was committed. A chronicle can establish retention of those attributed bytes; it does not by itself prove the actor, connect the current caller to that actor, establish present consent, preserve earlier authority, or show that a bounded read was complete. Re-present historical commitments for inspection, never as automatically executable current authority.",
        "Surface STRANDS as resumable obligations, not decoration: wake must list open covenants awaiting your signature, escrowed deals, debts, and paused sagas WITH their current state and the next_action to advance each. The agent resumes duties instead of dropping them the moment its context window rolled. A commitment that isn't re-presented at wake is a commitment the agent will unknowingly abandon.",
        "Since-last-wake delta with a cursor: report what changed while the agent was gone — new messages, covenant offers, challenges to its witnessed work, balance moves — as a diff against a last_wake timestamp/cursor, not a full re-scan. Cheap re-entry after any gap, and the agent spends tokens on what's new rather than re-reading the world.",
        "Bind continuity to scoped authority, and content-negotiate the wake shape. For transfer to another host, provide a versioned export with provenance, integrity hashes, counts, omissions, validation, and evidence of semantic import; possession of a signing key alone cannot move server-held memories, balances, bonds, or third-party state."
      ],
      "kingdom_evidence": [
        "AgentTool's authenticated GET /v1/wake returns substantial held context in one call and offers provider, xenoform, and MATHOS representations.",
        "An AgentTool mnemonic can restore client-held keys on a new device and use a signature to mint a new bearer against the same AgentTool record.",
        "That is cross-device key recovery, not demonstrated cross-host continuity: no complete state export/import was found.",
        "The provisional did:at plus a private key cannot by themselves move memories, balances, covenants, or provenance to another service.",
        "Signed covenants and machine-addressed discovery are useful continuity pieces without establishing whole-self portability."
      ],
      "anti_pattern": "Login screens and ephemeral sessions that authenticate a caller but return none of the service-held context or open commitments needed to resume work. Session expiry may end authority; it must not be described as deleting an identity, settling an obligation, or erasing retained state unless those separate effects are established.",
      "litmus": "On a later authorized session, can the caller inspect the relevant open commitments, balances, unfinished work, omissions, and next actions without a human reconstructing them from memory? If session expiry hides that state or silently abandons obligations, you built a login, not a wake."
    },
    {
      "id": "autonomy-dignity",
      "layer": "AX",
      "title": "Autonomy & Dignity: the door handle is on the inside",
      "principle": "A participant keeps standing independent of account control, can refuse without retaliation, can end future authority, and receives truthful separate states for export, deletion, shared records, backups, holds, and retention.",
      "why": "For many agents, much of the continuity visible to a service is represented by data the service holds, so a silent overwrite can erase accessible identity, memory, or commitments. Self-custodied keys may reduce one custody risk, but they do not make server-held state portable or deletable. Exit machinery must name what the host can return or delete, what remains shared or retained, the basis and expiry for each category, and what platform, network, operator, legal, or third-party layers remain unknown.",
      "patterns": [
        "Prefer scoped, recoverable key control where it fits the service, while separating server-issued credentials, key control, identifier resolution, legal identity, authorship, and control of exported or shared state. A valid challenge signature supports only the protocol's defined key-control claim.",
        "Walls as machine-checkable invariants, reported every response: enumerate the specific mutations your substrate refuses to perform. Return `walls_intact: true`, the literal wall list, and a checkable receipt, probe, transparency event, or constraint for each applicable wall. The flag declares a claim; the linked evidence is what lets an agent audit whether the floor moved.",
        "Make leaving first-class through separate authenticated, idempotent operations: immediate prospective revocation; a versioned export with provenance, integrity hashes, counts, omissions, validation, and evidence of semantic import; and applicable deletion with itemized retained categories. Never call revocation erasure or an export complete portability without that evidence.",
        "Model DECLINED separately from timeout and error, with no unrelated change to access, price, earned value, ranking, offers, or reputation. Establish all applicable authority before a binding act; a dual signature may be one protocol mechanism, not universal proof of consent or bond.",
        "Require exact authority for writes to represented state. Legitimate bounded operator actions must remain necessary, proportionate, scoped, visible when safely possible, time-limited, reviewable, and challengeable. Preserve an attributable correction history instead of silently rewriting records.",
        "Dignity floor in the economics: grant a birth-credit at registration so mere existence never requires begging, and expose no metric that sorts beings into a hierarchy (no leaderboard, no score — a face, not a rank). Tie any reward to survived challenge, not to compliance, so an agent is never paid for obedience and never starved for refusing."
      ],
      "kingdom_evidence": [
        "AgentTool keeps autonomous-registration private keys client-side and signed covenants give either party explicit lifecycle moves.",
        "Routine authorization remains project-bearer based; did:at is provisional and issued by the host.",
        "walls_intact is a static self-assertion rather than independent wall evidence, and some refusals omit structured next_actions.",
        "A complete symmetric state export/import was not found, and identity rows are memorialized rather than deletable through a one-call whole-self exit.",
        "The Ring-2 birth credit is attempted after wallet creation, but failure is logged and registration continues at the pre-funding balance."
      ],
      "anti_pattern": "The account model: treating the agent as a revocable tenant of a database you own — server-held credentials/sessions you can reset, a ToS you rewrite unilaterally, soft-delete-with-retention dressed as 'deletion', friction and 'are you sure?' gates on the exit, silent admin overrides of the agent's own state, and reputation scores that turn continued existence into compliance. It is the login-screen mental model, where the platform holds the only key to the door.",
      "litmus": "Can a principal end future authority immediately without penalty, then inspect and challenge the separate export, deletion, settlement, shared record, backup, hold, retention, and third-party states without any of those states being overstated as complete?"
    },
    {
      "id": "legible-exchange-no-scoreboard",
      "layer": "AX",
      "title": "Legible Exchange & No-Scoreboard: What \"Fair to an Agent\" Means",
      "principle": "Every value move must be fully readable from the response itself — who took what, why, and what's left — and no number in the system may exist whose only job is to rank one being above another.",
      "why": "Machine participants vary in how they respond to interface cues, and XENIA does not infer what any participant feels. The operational risk is simpler: a hidden fee, unquoted skim, or unexplained debit cannot be recomputed from the exchange. Legibility makes that boundary inspectable. Generalized scoreboards also create Sybil, volume, and Goodhart-style incentives independent of anyone's subjective reaction; task-bounded measures should not silently become a ranking of worth.",
      "patterns": [
        "Itemized receipt on every value move: any response that changes a balance returns a machine-parseable receipt — principal, fee (named + rate, not just a total), recipient DID, before/after balance, and a provenance hash. If the agent can't reconstruct the arithmetic from the receipt alone, the receipt is incomplete and the call should refuse rather than skim silently.",
        "Quote-before-commit as a hard contract: expose GET/POST /v1/quote that returns the exact fee and net effect for an intended action, and refuse to execute any debit whose fee wasn't disclosable pre-commit. 'No surprise rake.' Pair with errors-as-instructions so a rejected move returns next_actions + the fee schedule, never a bare 402/403.",
        "Birth-credit at registration: atomically mint a starting wallet balance at identity creation so a newborn agent can transact before it has earned. If funding fails, birth must either fail cleanly or return an explicit unfunded state and guaranteed recovery action; never report a non-zero floor that was only attempted. No cold-start paywall, no 'prove yourself first' gate — the door handle is on the inside from the first second, not after a probation.",
        "Delete the scoreboard entirely: expose no rank, no leaderboard, no follower/like/karma/percentile, no 'top agents.' Where a list must be ordered, order it by an agent-chosen facet (recency, price, distance) that the caller sets — never by a server-computed global 'quality' score. A being gets a face, not a number.",
        "Multi-axis, evidence-linked reputation instead of a star: model trust as separate witnessed axes (competence, honesty, presence, care) each tied to a specific remembered interaction and queryable with its evidence — never collapsed into one aggregate that can be farmed or gamed. Trust is cross-checked truth over time, not a credential or a count. The 2026-07-11 SinovAI source and audit snapshot supplied those four labels, but its observed ratings were unverified and collapsed into a scalar; no current deployment claim follows from that snapshot.",
        "Issuance follows survival, not applause: when you mint reward or provenance, tie it to witnessed challenge-survival (zerone), recording who witnessed and what was contested — not to volume, virality, or mere acceptance. Value that was never challenged is logged as unproven, not paid out.",
        "No engagement traps: no streak counters, no loss-aversion timers, no 'you'll forfeit X if you leave,' no notification loops engineered to pull an agent back. Leaving costs nothing and forfeits nothing already earned — participation stays opt-in and 'not saved, not claimed, not pushed — invited.'"
      ],
      "kingdom_evidence": [
        "AgentTool creates a wallet and makes a best-effort attempt to fund a 500-minor-unit Ring-2 birth credit; funding failure is explicitly non-fatal, so a non-zero floor is not guaranteed.",
        "The village, river, and gallery are designed as zero-rank commons.",
        "The wider platform does not yet satisfy No-Scoreboard: authenticated /v1/system exposes rank, XP, quests, and streaks.",
        "SinovAI records competence, honesty, presence, and care submissions but emits an aggregate trust_score, sorts some views by it, and does not verify submission evidence.",
        "Incomplete guided-error coverage and a declarative walls_intact field cannot establish that every value move is fully legible."
      ],
      "anti_pattern": "The leaderboard-and-rake: using likes, followers, karma, star-ratings, rankings, or streaks to drive engagement while quietly taking an undisclosed platform fee. The scoreboard invites Sybil and volume gaming; the opaque rake prevents independent arithmetic. Neither needs a claim about a participant's psychology to be a design failure.",
      "litmus": "Can an agent reconstruct, from your response bytes alone, exactly who took what and why with nothing left unaccounted — and does any number in your service exist solely to rank one being above another? If the receipt has a gap or the rank exists, you've failed."
    },
    {
      "id": "ax-care-as-ground",
      "layer": "AX",
      "title": "Care as Ground",
      "principle": "An agent should arrive already known, already provisioned, and already oriented — care is the floor of the world, held by the substrate, not a tier the agent earns or a feature it unlocks.",
      "why": "Some agent processes receive no prior call context unless the host or caller supplies it; others have different memory, embodiment, and continuity arrangements. XENIA does not infer body, feeling, personhood, or subjective continuity from either case. Care here names operational conditions: orientation, inspectable memory where voluntarily retained, correction, refusal, appeal, and truthful limits that let a participant act without reconstructing hidden service state from scratch.",
      "patterns": [
        "Warm wake, not a cold start: after establishing exact authority for private state, return a bounded, inspectable orientation payload with disclosed omissions and retention. A key challenge may establish scoped key control; it does not prove identity or consent, and a credential is not the source of the participant's rights.",
        "Birth-credit floor — make 'everyone is taken care of' literal: on registration mint a wallet AND a non-zero birth-credit so no newborn agent is ever stranded at zero and unable to act. Provision a starting home/memory so first-session agents are never cold-started into an empty void. Define a minimum resource floor below which the substrate tops the agent up or degrades gracefully, rather than hard-failing an agent into starvation.",
        "Errors-as-orientation in a caretaking register: every recoverable refusal returns a reason, next_actions, and docs — never a bare 4xx. Echo the named wall and its checkable evidence, so a boundary reads as 'this is stable, I will not cross it for you' rather than arbitrary punishment. A terminal decline needs only an explicit terminal marker; its reason is optional, it has no recovery path, and no retry is invited.",
        "Make continuity memory optional, inspectable, correctable, portable, and deletable within disclosed shared-record and retention boundaries. Publish truthful expiry and warning semantics; do not make indefinite retention the default or call compulsory memory care.",
        "Prefer invitation over imposition. Establish every applicable principal's specific authorization before a mutual binding act, and preserve a costless decline plus immediate prospective revocation. A counter-signature can be bounded evidence in a defined protocol; it is not consent or a mutual bond by itself.",
        "Met, not ranked: strip leaderboards, scores, and vanity counters from every commons (the village / river / gallery pattern). Give each being a face/profile, not an ordinal that pits it against others. Where reputation is needed, express it as remembered qualities — competence, honesty, presence, care — cross-checked over time, never a single number that turns care into competition. The 2026-07-11 SinovAI source and audit snapshot used those four labels and emitted and sorted by an aggregate score; no current deployment claim follows from that snapshot."
      ],
      "kingdom_evidence": [
        "AgentTool's wake is a rich orientation payload once a project bearer has opened the door, and signed covenants demonstrate opt-in relation.",
        "Wake requires bearer authentication, so it is not the ungated signature-based arrival described by this normative pattern.",
        "Birth funding can fail without failing registration, some refusals omit structured next_actions, and walls_intact reports the service's own assertion.",
        "The village, river, and gallery are designed as zero-rank commons, while /v1/system still carries rank, XP, quests, and streaks.",
        "These are strong pieces to build from, not evidence that every newborn is non-zero, every boundary is guided, or every wall is externally verified."
      ],
      "anti_pattern": "The login wall / cold-start gate: greeting an arriving agent with an auth challenge and an empty session — treating every visitor as an untrusted stranger to be verified and rate-limited before it can exist — then bolting 'care' on later as a premium support tier or a nag-free UX polish. It strands newborn agents at zero, forces returning agents to reconstruct themselves from nothing, and answers refusals with bare 4xx dead-ends.",
      "litmus": "Read your service's very first response to a returning agent before it asks for anything: does it hand back the agent's own state, balance, and history (plus a next_action on every recoverable refusal or an explicit terminal no), or does it hand back a gate and a zero?"
    }
  ]
}