Agentic PrimitivesAGENTIC PRIMITIVES
GitHubBuild

04 · The flow

Six steps. One session. The agent does them; you read the receipts.

The classical quickstart — a package per step, a config block at the end — is still exactly what happens. It is no longer what you do.

  1. 1

    Say what you want

    One paragraph, in domain terms. Name the people, the money, the agents; point at the two repositories and the Home. You are not naming packages, tools or call sequences — that is the agent’s job, and the substrate’s rules tell it how.

  2. 2

    Scaffold a repository that already knows the rules

    The product template ships with the same agent rules that built the substrate — projected into .cursor/rules, AGENTS.md and CLAUDE.md — plus exact pins in agentic.lock.json and CI that runs the doctor. Your coding agent reads them on the first turn.

    npx @agenticprimitives/create-app card-room --template product-repo
    create-appdevkit
  3. 3

    Give the agent the Developer MCP

    A read-only MCP over your install: which packages exist, what each exports, what an ontology term means, where the contracts are deployed, the recipes, the doctor. The agent asks the substrate instead of guessing. It holds no key and reads no vault.

    pnpm ap mcp # add to Claude as a stdio MCP server
    devkit
  4. 4

    Let it build — and test as the demo people

    Sign-in becomes an OIDC client of a Home; permissions become grants with caveats; agents run on the harness under those grants; inbound agents are admitted at the edge; the agent card is projected, not typed. The agent signs in as alice, bob, dave to exercise each path against the live estate.

    pnpm ap upgrade --pin-definitions <skills registry> texas-holdem/holdem-coach
    agent-accountdelegationharnessa2aadmissionagent-profileontology
  5. 5

    Let the gates say no

    The doctor fails the build when code invents vocabulary, holds a private key, calls MCP from the browser, or drifts from the pinned rules. Live gates run the real flow against the real estate. Conformance checks the A2A and MCP surfaces. A finding is a review checkpoint — never something the agent can talk its way past.

    pnpm ap doctor && pnpm ap test --live-gates live-gates.json && pnpm ap conform a2a https://<your-agent>/a2a
    devkitevaluationa2amcp-protocol
  6. 6

    Ship. Keep the keys.

    Deploy anywhere the template targets. Your application holds no identity key: the person signs at her Home, the service signs with a revocable delegate, and every protected step leaves a receipt in the owner’s vault. What the agent wrote is fast; what makes it trustworthy was never up to the agent.

    pnpm ap upgrade --canary # one coherent exact set, then doctor
    provenanceverification-receiptsap-kmsvault

The whole session, from an empty directory

npx @agenticprimitives/create-app card-room --template product-repo && cd card-room && pnpm install
pnpm ap doctor --rules --write        # the agent rules → .cursor/rules · AGENTS.md · CLAUDE.md
pnpm ap mcp                           # the read-only Developer MCP — hand it to Claude

# paste the prompt from Start. the agent builds, signing in as alice / bob / dave to test. then:
pnpm ap upgrade --pin-definitions https://skills.faithnet.io texas-holdem/holdem-coach
pnpm ap doctor && pnpm ap test --live-gates live-gates.json && pnpm ap conform a2a https://<your-agent>/a2a

Honest scope: the template today is the repository shape — pins, rules, CI, nightly gates, deploy layout. The application is what the agent writes into it. A runtime starter (a Next.js + A2A app with one authorized and one denied act) is the next template.

Under the hood — the six steps the agent does for youshow
  1. 01

    Sign people in as Smart Agents

    An OIDC client of a Home. A passkey sign-in yields alice.me — an account, not a session. The Home charters what the app needs on first connect.

    agent-accountconnectagent-naming
  2. 02

    Express permissions as grants

    A delegation with caveats — targets, methods, ceilings, time — minted at the person’s Home, verified before every action, redeemed on chain when value moves.

    delegationaccount-custodytool-policy
  3. 03

    Let agents act under those grants

    An A2A agent on the runtime with a playbook compiled from a SKILL.md contract. The harness parks steps that need a mandate; the confirmation is the signature; each step leaves a receipt.

    harnessorchestrationa2acontext
  4. 04

    Admit outside agents at the edge

    A projected, signed Agent Card; inbound A2A over HTTPS with application auth, canonical resolution and Admission. MCP stays private behind admitted runtimes.

    admissionagent-profileagent-resolution
  5. 05

    Stand up your own registry

    A registry from the kit with your membership and validation hooks; cards projected to it and, from a sibling repo, to external registries.

    registry-kitregistry-resolutioncapability-claims
  6. 06

    Prove it

    Receipts and PROV-O provenance for every protected step, in the owner’s vault; conformance and live gates in CI.

    provenanceevaluationaudit
← Demo peopleThe gates →