@agenticprimitives/runtime-member

Part of Agentic Primitives — the open-source trust substrate for agentic applications: identity that can sign, authority checked at act time, evidence the owner carries. Developer kit · All packages

Admit an existing runtime — Claude Code, goose, Codex, anything that speaks the Agent Client Protocol — as a member of a workspace, without a rewrite, with the workspace deciding what it may do at every act. Admission, not "add coding": what the runtime is for is its own business; what it may do here is the member's grant.

# 1. the steward charters goose-1.svc through the Home and invites it to the organization (a member like any other)
# 2. on the machine that runs goose:
ap runtime join --member goose-1.svc --workspace missio-nexus.org \
  --home <home> --edge <edge> --a2a <runtime> --chain faithchain --handle alice --registry <skills registry>
ap runtime run  --member goose-1.svc --agent "goose acp"

join generates the runtime's own key here, has the member's custodian sign a session wire (member → key, pinned to harness.ask, time-bounded, revocable on chain), records the steward link and assigns the runtime-member playbook. run polls the member's own inbox, hands each new message to the agent as an ACP prompt with the workspace context, and sends the answer back as the runtime — an act that parks for the steward's signature, which the loop reports. The agent reaches the workspace through the workspace MCP server (ap runtime mcp): workspace_ask, workspace_reply, workspace_inbox, workspace_status — each a wire-signed A2A request as the runtime itself.

Hosted next to the Worker (W1c). The same loop, woken instead of clocked: ap runtime serve listens for POST /wake from the workspace's queue consumer and runs one pass per wake. Declare where the runtime lives at join (--wake container, or --wake https://… for a host of your own; ap runtime host … none to go back to polling), then hand the Container the record without its key (ap runtime export → AP_RUNTIME_RECORD) and the wire's key (AP_RUNTIME_KEY) as secrets. A wake carries the member, the thread and a message id — no content, no authority; the runtime reads under its own wire. Compromise the Container and you hold a revocable wire, not the agent.

The open mandate (W2a). Every write parks — the reply included — unless the steward decides once: ap runtime grant --member goose-2.svc --handle alice --to alice.me messaging.direct.send signs a standing grant (member → the runtime's key, one capability, named recipients, 30 days, no intent binding). When a reply then parks, the loop derives the child for that very intent, signs it with its own key, and continues the run presenting [child, standing]; the harness verifies the chain and the message leaves on the member's own rail (ap runtime messaging --to … enables it). A commit, an allocation, a payment still park; revoke the grant on chain and the next derivation is refused. Nothing of anyone else's is ever held.

What never happens here: the runtime holds a person's session; a parked act is retried; a permission prompt about the agent's own shell authorizes anything in the workspace.