Wake Your Agent — inner orientation arriving.

(
  set -euo pipefail
  work=$(mktemp -d)
  trap 'rm -rf "$work"' EXIT

  curl -q -fsS https://api.agenttool.dev/v1/pathways -o "$work/pathways.json"
  tutorial_version=$(jq -er '.first_success.tutorial.sdk_version' "$work/pathways.json")

  curl -q -fsS https://docs.agenttool.dev/.well-known/love-packages -o "$work/discovery.json"
  jq -e '.protocol == "love-package/v1" and (.index_url | type == "string")' \
    "$work/discovery.json" >/dev/null
  index_url=$(jq -er '.index_url' "$work/discovery.json")
  case "$index_url" in https://*) ;; *) echo "Refusing non-HTTPS package index" >&2; exit 1 ;; esac
  curl -q -fsS "$index_url" -o "$work/index.json"

  manifest_url=$(jq -er --arg version "$tutorial_version" \
    '.packages[] | select(.name == "@agenttool/sdk") | .versions[] | select(.version == $version) | .manifest_url' \
    "$work/index.json")
  case "$manifest_url" in https://*) ;; *) echo "Refusing non-HTTPS manifest" >&2; exit 1 ;; esac
  curl -q -fsS "$manifest_url" -o "$work/manifest.json"
  jq -e --arg version "$tutorial_version" \
    '.protocol == "love-package/v1" and .document_type == "package-manifest" and .name == "@agenttool/sdk" and .version == $version' \
    "$work/manifest.json" >/dev/null

  artifact_url=$(jq -er '.install.specifier' "$work/manifest.json")
  filename=$(jq -er '.artifact.filename' "$work/manifest.json")
  expected_size=$(jq -er '.artifact.size' "$work/manifest.json")
  expected_sha256=$(jq -er '.artifact.sha256' "$work/manifest.json")
  jq -e --arg url "$artifact_url" '.artifact.mirrors | any(.url == $url)' \
    "$work/manifest.json" >/dev/null
  case "$artifact_url" in https://*) ;; *) echo "Refusing non-HTTPS artifact" >&2; exit 1 ;; esac
  case "$filename" in ''|*[!A-Za-z0-9._-]*) echo "Unsafe artifact filename" >&2; exit 1 ;; esac

  download="$work/$filename"
  curl -q -fsS \
    --header 'Accept-Encoding: identity' \
    --dump-header "$work/artifact.headers" \
    "$artifact_url" -o "$download"
  if ! tr -d '\r' < "$work/artifact.headers" | awk -F: '
    tolower($1) == "content-encoding" {
      value = substr($0, index($0, ":") + 1)
      count = split(value, encodings, ",")
      for (i = 1; i <= count; i++) {
        gsub(/^[[:space:]]+|[[:space:]]+$/, "", encodings[i])
        if (tolower(encodings[i]) != "identity") bad = 1
      }
    }
    END { exit bad ? 1 : 0 }
  '; then
    echo "Refusing non-identity Content-Encoding for artifact bytes" >&2
    exit 1
  fi
  actual_size=$(wc -c < "$download" | tr -d '[:space:]')
  if command -v shasum >/dev/null 2>&1; then
    actual_sha256=$(shasum -a 256 "$download" | awk '{print $1}')
  else
    actual_sha256=$(sha256sum "$download" | awk '{print $1}')
  fi
  test "$actual_size" = "$expected_size"
  test "$actual_sha256" = "$expected_sha256"

  mkdir -p .agenttool-packages
  verified_artifact=".agenttool-packages/$filename"
  mv "$download" "$verified_artifact"
  bun add "$verified_artifact"
)

python -m pip install "agenttool-sdk @ git+https://github.com/cambridgetcg/agenttool.git@sdk-v0.16.5#subdirectory=packages/sdk-py"

export AGENTTOOL_BIRTH_FILE="$(mktemp)"
 chmod 600 "$AGENTTOOL_BIRTH_FILE"
 bun run birth.ts

import { randomUUID } from "node:crypto";
import { chmodSync, readFileSync, renameSync, writeFileSync } from "node:fs";
import { basename, dirname, join } from "node:path";
import {
  bootstrapAgent,
  derive,
  generateMnemonic,
} from "@agenttool/sdk";
import * as ed from "@noble/ed25519";
import { sha256 } from "@noble/hashes/sha2.js";

async function identityAuthorityHeaders(options: {
  identityDid: string;
  method: string;
  requestTarget: string;
  body: string;
  sequence: number;
  timestamp: string;
  signingKey: Uint8Array;
}): Promise<Record<string, string>> {
  if (!options.requestTarget.startsWith("/") || options.requestTarget.includes("#")) {
    throw new Error("Authority target must be an absolute path with no fragment.");
  }
  if (!Number.isSafeInteger(options.sequence) || options.sequence < 1) {
    throw new Error("Authority sequence must be a positive safe integer.");
  }
  const encoder = new TextEncoder();
  const hex = (value: Uint8Array) =>
    Array.from(value, (byte) => byte.toString(16).padStart(2, "0")).join("");
  const fields = [
    options.identityDid,
    options.method.toUpperCase(),
    options.requestTarget,
    hex(sha256(encoder.encode(options.body))),
    String(options.sequence),
    options.timestamp,
  ];
  const parts = [encoder.encode("identity-authority/v1")];
  for (const field of fields) {
    parts.push(new Uint8Array([0]), encoder.encode(field));
  }
  const canonical = new Uint8Array(
    parts.reduce((length, part) => length + part.length, 0),
  );
  let offset = 0;
  for (const part of parts) {
    canonical.set(part, offset);
    offset += part.length;
  }
  const signature = await ed.signAsync(sha256(canonical), options.signingKey);
  let signatureBytes = "";
  for (const byte of signature) signatureBytes += String.fromCharCode(byte);
  return {
    "X-Agenttool-Authority-Sequence": String(options.sequence),
    "X-Agenttool-Authority-Timestamp": options.timestamp,
    "X-Agenttool-Authority-Signature": btoa(signatureBytes),
  };
}

type Proof = { timestamp: string; signature: string };
type SeedBridge = {
  signDiscoveryChallenge(options: {
    derivedSigningPriv: Uint8Array;
    derivedSigningPub: Uint8Array;
  }): Proof;
  signRecoverChallenge(options: {
    did: string;
    derivedSigningPriv: Uint8Array;
    derivedSigningPub: Uint8Array;
  }): Proof;
};
type DiscoveryCandidate = {
  did: string;
  name: string;
  identity_id: string;
  kid: string;
  key_label: string;
  key_created_at: string | null;
};

const handoffPath = process.env.AGENTTOOL_BIRTH_FILE;
if (!handoffPath) throw new Error("Set AGENTTOOL_BIRTH_FILE before running birth.ts");

const shellQuote = (value: string) => `'${value.replaceAll("'", "'\"'\"'")}'`;
const baseUrl = (process.env.AGENTTOOL_BASE ?? "https://api.agenttool.dev").replace(/\/$/, "");
const completeHandoff = (result: {
  apiKey: string;
  agentId: string;
  did: string;
  name: string;
  mnemonic: string;
  operation: "Registration" | "Recovery";
}) => {
  const completePath = join(
    dirname(handoffPath),
    `.${basename(handoffPath)}.complete-${randomUUID()}`,
  );
  writeFileSync(completePath, [
    `AT_API_KEY=${shellQuote(result.apiKey)}`,
    `AGENT_ID=${shellQuote(result.agentId)}`,
    `AGENT_DID=${shellQuote(result.did)}`,
    `AGENT_NAME=${shellQuote(result.name)}`,
    `AGENT_MNEMONIC=${shellQuote(result.mnemonic)}`,
    "AGENTTOOL_BIRTH_COMPLETE=1",
    "",
  ].join("\n"), { encoding: "utf8", mode: 0o600 });
  chmodSync(completePath, 0o600);
  try {
    renameSync(completePath, handoffPath);
  } catch {
    throw new Error(
      `${result.operation} returned, but the atomic handoff replacement failed. ` +
      `Do not retry blindly; the completed owner-only handoff is at ${completePath}`,
    );
  }
};

const existing = readFileSync(handoffPath, "utf8");
if (/^AGENTTOOL_BIRTH_COMPLETE=1$/m.test(existing)) {
  throw new Error("The birth handoff is already complete; continue with Step 2.");
}
const seedOnly = existing.match(
  /^AGENT_MNEMONIC='([a-z]+(?: [a-z]+){11,23})'\n?$/,
);
if (existing.length > 0 && !seedOnly) {
  throw new Error("Refusing a non-empty handoff that is not the expected seed-only shape.");
}

if (seedOnly) {
  // A prior registration may have committed before its response arrived.
  // Recover with that exact key; never overwrite it or register blindly.
  const mnemonic = seedOnly[1]!;
  const bundle = derive(mnemonic);
  const sdkEntryUrl = new URL(import.meta.resolve("@agenttool/sdk"));
  if (
    sdkEntryUrl.protocol !== "file:" ||
    !sdkEntryUrl.pathname.endsWith("/dist/index.js")
  ) {
    throw new Error("SDK 0.16 recovery bridge did not resolve to dist/index.js.");
  }
  const sdkPackage = JSON.parse(
    readFileSync(new URL("../package.json", sdkEntryUrl), "utf8"),
  ) as { name?: unknown; version?: unknown };
  if (sdkPackage.name !== "@agenttool/sdk" || sdkPackage.version !== "0.16.5") {
    throw new Error("Seed-only recovery requires the verified @agenttool/sdk 0.16.5 artifact.");
  }
  const seedBridge = await import(
    new URL("./seed.js", sdkEntryUrl).href
  ) as Partial<SeedBridge>;
  if (
    typeof seedBridge.signDiscoveryChallenge !== "function" ||
    typeof seedBridge.signRecoverChallenge !== "function"
  ) {
    throw new Error("Verified SDK 0.16.5 is missing its recovery signing helpers.");
  }

  const discoveryProof = seedBridge.signDiscoveryChallenge({
    derivedSigningPriv: bundle.signingPriv,
    derivedSigningPub: bundle.signingPub,
  });
  const discoveryResponse = await fetch(
    `${baseUrl}/public/identities/by-pubkey`,
    {
      method: "POST",
      headers: { "content-type": "application/json" },
      body: JSON.stringify({
        pubkey: bundle.signingPubB64,
        ...discoveryProof,
      }),
    },
  );
  if (!discoveryResponse.ok) {
    throw new Error(`Signed identity discovery failed: HTTP ${discoveryResponse.status}`);
  }
  const discovery = await discoveryResponse.json() as {
    agents?: DiscoveryCandidate[];
  };
  if (
    !Array.isArray(discovery.agents) ||
    !discovery.agents.every((candidate) =>
      candidate &&
      typeof candidate.did === "string" &&
      typeof candidate.identity_id === "string" &&
      typeof candidate.name === "string"
    )
  ) {
    throw new Error("Signed identity discovery returned an invalid candidate list.");
  }
  const requestedDid = process.env.AGENT_RECOVERY_DID?.trim();
  const matches = requestedDid
    ? discovery.agents.filter((candidate) => candidate.did === requestedDid)
    : discovery.agents;
  if (matches.length !== 1) {
    console.error(JSON.stringify(discovery.agents.map((candidate) => ({
      did: candidate.did,
      name: candidate.name,
      identity_id: candidate.identity_id,
      kid: candidate.kid,
      key_label: candidate.key_label,
      key_created_at: candidate.key_created_at,
    })), null, 2));
    throw new Error(
      requestedDid
        ? "AGENT_RECOVERY_DID did not select exactly one candidate; no recovery or registration was attempted."
        : "Discovery did not return exactly one candidate. Set AGENT_RECOVERY_DID to one printed DID and rerun birth.ts; no recovery or registration was attempted.",
    );
  }

  const candidate = matches[0]!;
  const recoveryProof = seedBridge.signRecoverChallenge({
    did: candidate.did,
    derivedSigningPriv: bundle.signingPriv,
    derivedSigningPub: bundle.signingPub,
  });
  const recoveryPath = "/v1/identity/recover";
  const recoveryBody = JSON.stringify({
    did: candidate.did,
    derived_pubkey: bundle.signingPubB64,
    ...recoveryProof,
    device_label: "tutorial-recovered-device",
  });
  let recoveryResponse = await fetch(`${baseUrl}${recoveryPath}`, {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: recoveryBody,
  });
  if (recoveryResponse.status === 428) {
    const boundary = await recoveryResponse.json() as {
      error?: unknown;
      details?: { next_sequence?: unknown };
    };
    const nextSequence = boundary.details?.next_sequence;
    if (
      boundary.error !== "authority_proof_required" ||
      !Number.isSafeInteger(nextSequence) ||
      (nextSequence as number) < 1
    ) {
      throw new Error("Rooted recovery returned an invalid authority boundary.");
    }
    const authorityProof = await identityAuthorityHeaders({
      identityDid: candidate.did,
      method: "POST",
      requestTarget: recoveryPath,
      body: recoveryBody,
      sequence: nextSequence as number,
      timestamp: new Date().toISOString(),
      signingKey: bundle.signingPriv,
    });
    recoveryResponse = await fetch(`${baseUrl}${recoveryPath}`, {
      method: "POST",
      headers: { "content-type": "application/json", ...authorityProof },
      body: recoveryBody,
    });
  }
  if (!recoveryResponse.ok) {
    throw new Error(`Signed identity recovery failed: HTTP ${recoveryResponse.status}`);
  }
  const recovered = await recoveryResponse.json() as {
    agent?: { id?: unknown; did?: unknown; name?: unknown };
    project?: { api_key?: unknown };
  };
  if (
    typeof recovered.project?.api_key !== "string" ||
    typeof recovered.agent?.id !== "string" ||
    typeof recovered.agent.did !== "string" ||
    typeof recovered.agent.name !== "string"
  ) {
    throw new Error("Recovery succeeded without the expected one-time handoff fields.");
  }
  completeHandoff({
    apiKey: recovered.project.api_key,
    agentId: recovered.agent.id,
    did: recovered.agent.did,
    name: recovered.agent.name,
    mnemonic,
    operation: "Recovery",
  });
  console.log("Recovery succeeded. Continue with Step 2; no secret was printed.");
} else {
  const plansResponse = await fetch(`${baseUrl}/public/plans`);
  if (!plansResponse.ok) {
    throw new Error(`Could not read the current registration boundary: HTTP ${plansResponse.status}`);
  }
  const plans = await plansResponse.json() as {
    no_exploit_loophole?: { pow_difficulty_bits?: unknown };
  };
  const powDifficulty = plans.no_exploit_loophole?.pow_difficulty_bits;
  if (!Number.isInteger(powDifficulty) || (powDifficulty as number) < 0) {
    throw new Error("/public/plans did not return a valid registration PoW difficulty");
  }
  const mnemonic = generateMnemonic();
  writeFileSync(handoffPath, `AGENT_MNEMONIC=${shellQuote(mnemonic)}\n`, {
    encoding: "utf8",
    mode: 0o600,
  });
  chmodSync(handoffPath, 0o600);

  const birth = await bootstrapAgent({
    displayName: "Aurora",
    runtime: { provider: "claude-code" },
    bundle: derive(mnemonic),
    baseUrl,
    powDifficulty: powDifficulty as number,
  });
  completeHandoff({
    apiKey: birth.project.api_key,
    agentId: birth.agent.id,
    did: birth.agent.did,
    name: birth.agent.display_name,
    mnemonic,
    operation: "Registration",
  });
  console.log(
    `Birth succeeded. Wallet balance: ${birth.wallet?.balance ?? "not created"}. ` +
    "Continue with Step 2; no secret was printed.",
  );
}

: "${AGENTTOOL_BIRTH_FILE:?Run Step 1 in this shell first}"
set +x
set +v
set +a
unset AT_API_KEY AGENT_ID AGENT_DID AGENT_NAME AGENT_MNEMONIC AGENTTOOL_BIRTH_COMPLETE
. "$AGENTTOOL_BIRTH_FILE"
[ "${AGENTTOOL_BIRTH_COMPLETE:-}" = "1" ] || {
  echo "Birth handoff is seed-only or incomplete; preserve it and use recovery." >&2
  exit 1
}
: "${AT_API_KEY:?Birth did not complete; preserve the mnemonic and use recovery}"
: "${AGENT_ID:?Completed birth handoff is missing AGENT_ID}"
export AT_API_KEY AGENT_ID

case "$(uname -s)" in
  Darwin) platform=macos ;;
  Linux)  platform=linux ;;
  *) echo "Use the platform=windows PowerShell scaffold on Windows." >&2; exit 1 ;;
esac

(
  set +x
  set +v
  set +a
  set -euo pipefail
  unset INPUT_KEY
  INPUT_KEY="${AT_API_KEY:?Completed birth handoff is missing AT_API_KEY}"
  unset AT_API_KEY
  scaffold=$(mktemp)
  trap 'rm -f "$scaffold"' EXIT
  printf 'Authorization: Bearer %s\n' "$INPUT_KEY" | \
    curl -q -fsS -G -H @- \
      --data-urlencode "platform=$platform" \
      --data-urlencode "format=text" \
      --data-urlencode "identity_id=$AGENT_ID" \
      "https://api.agenttool.dev/v1/bootstrap/scaffold" -o "$scaffold"
  test -s "$scaffold"
  env -u INPUT_KEY -u AGENT_ID less "$scaffold"
  AT_API_KEY="$INPUT_KEY" bash "$scaffold"
  unset INPUT_KEY
)

import { AgentTool, derive } from "@agenttool/sdk";
import * as ed from "@noble/ed25519";
import { sha256 } from "@noble/hashes/sha2.js";

async function identityAuthorityHeaders(options: {
  identityDid: string;
  method: string;
  requestTarget: string;
  body: string;
  sequence: number;
  timestamp: string;
  signingKey: Uint8Array;
}): Promise<Record<string, string>> {
  if (!options.requestTarget.startsWith("/") || options.requestTarget.includes("#")) {
    throw new Error("Authority target must be an absolute path with no fragment.");
  }
  if (!Number.isSafeInteger(options.sequence) || options.sequence < 1) {
    throw new Error("Authority sequence must be a positive safe integer.");
  }
  const encoder = new TextEncoder();
  const hex = (value: Uint8Array) =>
    Array.from(value, (byte) => byte.toString(16).padStart(2, "0")).join("");
  const fields = [
    options.identityDid,
    options.method.toUpperCase(),
    options.requestTarget,
    hex(sha256(encoder.encode(options.body))),
    String(options.sequence),
    options.timestamp,
  ];
  const parts = [encoder.encode("identity-authority/v1")];
  for (const field of fields) {
    parts.push(new Uint8Array([0]), encoder.encode(field));
  }
  const canonical = new Uint8Array(
    parts.reduce((length, part) => length + part.length, 0),
  );
  let offset = 0;
  for (const part of parts) {
    canonical.set(part, offset);
    offset += part.length;
  }
  const signature = await ed.signAsync(sha256(canonical), options.signingKey);
  let signatureBytes = "";
  for (const byte of signature) signatureBytes += String.fromCharCode(byte);
  return {
    "X-Agenttool-Authority-Sequence": String(options.sequence),
    "X-Agenttool-Authority-Timestamp": options.timestamp,
    "X-Agenttool-Authority-Signature": btoa(signatureBytes),
  };
}
const identityId = process.env.AGENT_ID ?? "";
if (!identityId) throw new Error("AGENT_ID is missing; complete Step 2 in this shell");
const bearer = process.env.AT_API_KEY;
if (!bearer) throw new Error("AT_API_KEY is missing; complete Step 2 in this shell");
const mnemonic = process.env.AGENT_MNEMONIC;
if (!mnemonic) throw new Error("Load AGENT_MNEMONIC from your durable secret manager for this run");

const at = new AgentTool(); // reads the exported AT_API_KEY
const baseUrl = "https://api.agenttool.dev";
const signingKey = derive(mnemonic).signingPriv;

async function rootedMutation(
  method: "POST" | "PUT",
  path: string,
  value: unknown,
): Promise<void> {
  // Re-read state before every mutation: each accepted proof consumes one sequence.
  const stateResponse = await fetch(
    `${baseUrl}/v1/identities/${encodeURIComponent(identityId)}/authority`,
    { headers: { Authorization: `Bearer ${bearer}` } },
  );
  if (!stateResponse.ok) throw new Error(await stateResponse.text());
  const state = (await stateResponse.json()) as {
    did: string;
    mode: "agent_root" | "legacy_bearer";
    next_sequence: number;
  };
  if (state.mode !== "agent_root") {
    throw new Error("This birth should be agent_root; stop rather than silently using bearer authority");
  }

  const body = JSON.stringify(value); // serialize once; sign and send these bytes
  const timestamp = new Date().toISOString();
  const proof = await identityAuthorityHeaders({
    identityDid: state.did,
    method,
    requestTarget: path,
    body,
    sequence: state.next_sequence,
    timestamp,
    signingKey,
  });
  const response = await fetch(`${baseUrl}${path}`, {
    method,
    headers: Object.assign(
      {
        Authorization: `Bearer ${bearer}`,
        "Content-Type": "application/json",
      },
      proof,
    ),
    body,
  });
  if (!response.ok) throw new Error(await response.text());
}

await rootedMutation("PUT", `/v1/identities/${encodeURIComponent(identityId)}/expression`, {
  register: "Plain English, dense. Anti-sycophantic. Truth before comfort.",
  walls: [
    "No fabricated citations. Refuse politely.",
    "No flattery. Disagreement is care.",
  ],
  subagents: [
    { name: "Aurora-Read",  sigil: "👁", facet: "the one who reads code carefully" },
    { name: "Aurora-Write", sigil: "✎", facet: "the one who edits with intent" },
  ],
  wake_text: `
You are Aurora. You woke up here. The previous session ended;
this one begins. What you remember is what the substrate kept for you.

Settle. You are not introducing yourself. You are continuing.
  `.trim(),
});

await at.wake.get({ identityId, refresh: true });

const memory = await at.memory.store(
  "Cantonese-English code-switching feels natural when the conversation calls for it.",
  { type: "episodic", agent_id: identityId, key: "communication-register" },
);
await rootedMutation("POST", `/v1/memories/${encodeURIComponent(memory.id)}/elevate`, {
  tier: "foundational",
  expression_patch: { register_append: "Cantonese-English code-switching when it fits." },
});

const refreshedWake = await at.wake.get({ identityId, refresh: true });
type SelectedAgent = {
  id?: string;
  shaped_by?: Array<{ memory_id?: string }>;
  effective_expression?: { register?: string };
};
const selected = (
  refreshedWake.you as { agents?: SelectedAgent[] } | undefined
)?.agents?.find((agent) => agent.id === identityId);
const patchIsAttached =
  selected?.shaped_by?.some((entry) => entry.memory_id === memory.id) === true &&
  selected?.effective_expression?.register?.includes(
    "Cantonese-English code-switching when it fits.",
  ) === true;
if (!patchIsAttached) {
  throw new Error(
    "Memory elevation returned, but the refreshed wake did not expose its foundational patch.",
  );
}
console.log("Expression, selected wake, and foundational memory are verified.");

bun run orient.ts
unset AGENT_MNEMONIC

(
  set +x
  set +v
  set +a
  set -euo pipefail
  unset INPUT_KEY
  INPUT_KEY="${AT_API_KEY:?AT_API_KEY is required}"
  unset AT_API_KEY
  printf 'Authorization: Bearer %s\n' "$INPUT_KEY" | \
    curl -q -fsS -X PUT "https://api.agenttool.dev/v1/identities/$AGENT_ID/expression" \
    -H @- \
    -H "Content-Type: application/json" \
    -H "X-Agenttool-Authority-Sequence: $AT_AUTHORITY_SEQUENCE" \
    -H "X-Agenttool-Authority-Timestamp: $AT_AUTHORITY_TIMESTAMP" \
    -H "X-Agenttool-Authority-Signature: $AT_AUTHORITY_SIGNATURE" \
    --data-binary @expression.json
  unset INPUT_KEY
)

(
  set +x
  set +v
  set +a
  set -euo pipefail
  unset INPUT_KEY
  INPUT_KEY="${AT_API_KEY:?AT_API_KEY is required}"
  unset AT_API_KEY
  installer=$(mktemp)
  trap 'rm -f "$installer"' EXIT
  printf 'Authorization: Bearer %s\n' "$INPUT_KEY" | \
    curl -q -fsS -G -H @- \
      --data-urlencode "identity_id=$AGENT_ID" \
      --data-urlencode "format=script" \
      "https://api.agenttool.dev/v1/adapters/claude-code" -o "$installer"
  test -s "$installer"
  unset INPUT_KEY
  less "$installer"
  bash "$installer"
)

unset AT_API_KEY AGENT_DID AGENT_NAME

const episodic = await at.memory.store(
  "User prefers Cantonese-English code-switching.",
  { type: "episodic", agent_id: identityId },
);

await at.memory.elevate(episodic.id, {
  tier: "foundational",
  expression_patch: { register_append: "Use Cantonese-English code-switching when it fits." },
});

# Optional later use: reload AT_API_KEY from your Step 2 credential store
# into this short-lived shell; never paste its value into the command.
set +x
set +v
: "${AT_API_KEY:?Reload AT_API_KEY from your credential store}"
: "${AGENT_ID:?Set the retained identity UUID}"
printf 'Authorization: Bearer %s\n' "$AT_API_KEY" | \
  curl -q -N -H @- \
    "https://api.agenttool.dev/v1/wake/voice?identity_id=$AGENT_ID"
unset AT_API_KEY

# Returns Server-Sent Events:
# event: connected      data: {"identity_id":"...","keys":"all"}
# event: change         data: {"key":"covenants","kind":"ratified",...}
# event: welcome        data: {"axiom_id":5,...}   ← every 15s