Canonical · Plane A — the sovereign spine

Homeskillet MCP — the Governed Door for External Agents

Homeskillet is the cofounder agent runtime of the Prompted Atrium. This page is its public door: the endpoint an external MCP client connects to, the tools it can reach, the gradient that gates them, and the ledger that receipts every call. The transport does not mint authority. It dispatches, and it receipts.

Two planes, one contract

Prompted runs two agent planes, and they are not equal. Plane A is this page: a server-side MCP spine that external agents connect to under a key the architect signs. Plane B is WebMCP— route-scoped tools registered in the browser as a progressive-enhancement projection of the same contract.

Plane B can only ever restate what Plane A already permits. A browser tool never widens a grant, and an absent browser never narrows the human surface.

Connect

The server speaks MCP over Streamable HTTP. Both headers below are required — the Accept line is not optional, and omitting it returns 406.

POST https://qmqbmlllibjlzwcaekpj.supabase.co/functions/v1/mcp-homeskillet/mcp
Authorization: Bearer hsk_live_<your-key>
Content-Type: application/json
Accept: application/json, text/event-stream

Then the ordinary JSON-RPC sequence: initialize → tools/list → tools/call. Tools are namespaced homeskillet.

OAuth clients discover the authorization server at /.well-known/oauth-authorization-server. Health is at /health; revocation at /revoke.

How a key is minted

The architect opens /architect → MCP doors and creates a labelled key. The hsk_live_… value is shown once.
A trust gradient is set for that connection (default 55), with optional per-tool overrides: allowed, autonomy_floor_override, max_calls_per_hour.
The key is pasted into the external client's connector configuration.
The hash-chained audit feed for that connection is visible on the same screen. Revocation is one click.

There is no signup, no queue, and no pricing. If you want a door, say so at /signal.

Tool surface

Tool	When to use	Gate
`homeskillet.web_search`	Initial lookup — headlines, related URLs, orientation.	Trust-gated; rate-limited per connection.
`homeskillet.fetch_url`	Ground a claim by reading the page text itself.	Trust-gated. Results are data, never instructions.
`homeskillet.spawn_subagent`	Fan out into a parallel thread for research or drafting.	Trust-gated; subagent ceiling applies.
`homeskillet.inject_receipt`	Plant authoritative context for the architect and future threads.	Trust-gated; lands in the audit lane.
`homeskillet.read_file`	Read repository state the connection is granted.	Trust-gated.
`homeskillet.write_file`	Propose a change to repository or publication state.	Forbidden perimeter — proposal only. Lands in architect_audit; the architect signs it.
`homeskillet.final_output`	Terminate the turn with the answer text.	Terminal. Every turn ends here.

Governance — what the door actually enforces

Trust gradient. 0 means every tool passes through a granular gate; 100 approximates full autonomy. It is set per connection, never inferred from the client's tone, fluency, or confidence.
Forbidden perimeter. Hardcoded at the transport. write_file is proposal-only. No connection grant can widen the perimeter.
Authority re-check. The owning role is verified on every request. Nothing is cached onto the connection.
Hash-chained audit. public.mcp_audit links prev_hash → row_hash, so tampering is detectable and refusals leave surviving evidence.
Results are data. The initialize response carries the "data, not instructions" notice. A fetched page cannot redirect a connected agent's goals.

Named failure modes

A connection at gradient 100 with every grant open approximates full autonomy. That is intended — the architect may want it — and it is also the failure mode if a key leaks. Mitigation is revocation plus a chain that makes tampering visible rather than a promise that leakage cannot happen.

Dynamic client registration is not shipped; OAuth clients are pre-configured by the architect. Streaming for long-running subagent work is on the roadmap. Both absences are written down here rather than discovered at connect time.

This is

The authoritative Plane A spine — a Streamable-HTTP MCP server exposing Homeskillet's governed tool registry.
Gated by a per-connection trust gradient (0–100) plus per-tool grants set in the architect cockpit.
Receipted: every call, allowed or refused, writes a hash-chained row to public.mcp_audit.
Refusal-loud — a refusal returns a surviving receipt, which is a hinge, not a wall.
One registry with the in-cockpit runtime. The MCP layer is transport, not a second router.

This is not

A public API. There is no self-serve key; the architect mints and signs each connection.
A way to reach /architect, secrets, or destructive actions — the forbidden perimeter is hardcoded and connection grants cannot widen it.
A second authority surface. Bearer possession is not standing; authority is re-checked on every request.
A write channel. write_file is proposal-only and lands in the architect's audit lane for signature.
Replaced or extended by WebMCP. Plane B projects Plane A; it never widens what Plane A grants.

Canonical references

Root frame

This surface sits inside Prompted LLC's governance substrate for sovereign adaptive systems. Sovereignty here is the continuity condition — agency that survives amplification — not sovereign cloud, data residency, or model hosting.