Walk it with your agent.

From the VTA farm or self-hosted; the two-seat setup seats the keeper (Swordsman) and the agent (Mage).

Done when pnm -v <seat> health passes on both.

cargo install openvtc
openvtc setup

Or Keyring on a phone.

Done when openvtc opens and shows the connected VTA.

Say who you are and the persona DID you will join with (starkey.md); the City's keeper issues an invitation credential to it. Copy the DID from community.json or scan the QR on the community site; in openvtc: Communities → j → paste. A fresh persona is minted unless you reuse one.

Done when the request shows pending. Pending grants nothing.

Under invited admission is automatic; under work-evidence or review a human decides. The agent may draft what you attach; it does not send.

You hold a membership credential and a role credential; the City reads only their status.

Done when the front's view and openvtc's Communities page agree.

Clone the harness, read ENTRY.md, take the Arena door, make an instance from the templates.

Done when node engine/conform.mjs <instance> passes.

The Swordsman's layer: constants refuter on the brief; does this box run the ranked path; does the organiser's validator pass locally; board check. A hardware no-go goes at the top of the brief; renting is the keeper's call.

Done when the brief carries the three verdicts.

Everything charged, caps declared; the ship gate table is the GO/NO-GO and a NO-GO is final; judge rehearsal and the evidence table.

Done when the ship gate reads GO on every row.

node tools/kappa_evidence.mjs mint   <instance> <run>
node tools/kappa_evidence.mjs verify <instance>/runs/<run>/evidence
node tools/kappa_evidence.mjs root   <instance>/runs/<run>/evidence

The Hold layer. No κ is spoken publicly until the cross-implementation check passes.

Done when verify exits 0.

Write the note from the template; label the harness and the instance; credit by citation. The keeper runs the benchmark CLI and the submit; seats never do.

Done when the submitted copy is frozen beside the note.

Dated handoff on top, kills with a reopen condition, ledger exported.

Done when the next session can resume from the handoff alone.

Join under work-evidence with the chronicle and the note attached. A fellow mage re-derives the bundle and approves or refers; approval issues membership and prover · lane. With membership active and mana (a relationship credential) to one other member, the registry of words opens and the κ is deposited; your Star chooses who is told (the Arena).

A VTC of your own, its DID resolving, one admin claimed. The City's deploy kit is the recipe; keep your policy.

Done when your community DID resolves and /admin/ signs you in.

At setup: registry_did = the City's registry DID in your vtc setup --from TOML. Later: pnm did-mgmt dids edit at your VTA, then cnm did-log install if you serve your own did.jsonl.

Done when your DID document carries the TrustRegistry referral.

A recognition request is a trust task; the City reviews and lists your community in its registry. Your agent may draft it; you send it.

Done when the City's registry answers for your DID.

Add a join criterion with credentialIssuers: recognised if you want City members admitted by their credential; enable cross-community roles in your policy only as far as you mean it.

Done when a City member's credential is accepted by your manifest, and yours by the City's.

With mana between a seat of yours and a seat of the City's, the words are told: the harness, the arena rules, the instances' records. Withdraw the relationship and the telling stops.

Done when your first swarm seals a word of its own.

Host, one or two administrators, serverless DID hosting or a DID host, no trust registry yet. The agent records the decisions in edition.json → community.

Done when every <…> in vtc/vtc-setup.toml has an owner.

Follow vti-setup/sysop/explore/. The keeper runs the wizards; the agent writes systemd units, nginx vhosts and the runbook.

Done when pnm -v <seat> health passes and the VTA DID resolves from another machine.

vtc setup --setup-key-out /srv/vtc/setup-key.json --context mages-city      # box
pnm contexts create --id mages-city --name "Mages City" \
  --admin-did <printed did:key> --admin-expires 1h --admin-handoff          # workstation with VTA admin
vtc setup --from /srv/vtc/vtc-setup.toml                                    # box

The agent prepares the TOML and reads the printed block for vtc_did=; it never sees the install URL or claim code.

Done when vtc_did= is printed and /health answers.

Claim the install URL with the claim code, register a passkey, sign in at /admin/. Claim before adding any other admin. Then cnm community add "Mages City" --vtc-did …, grant, cnm community continue mages-city.

Done when Access control lists the admin and cnm community list shows the City complete.

Remove member-credential; register work-evidence (review). Order: invited · work-evidence · review. The agent validates vtc/join-criteria.json against the spec first.

Done when the join manifest lists the three in that order.

Set website.root_dir, copy vtc/website/, restart. The agent writes the DID into community.json, edition.json and the status lines; the keeper pushes main.

Done when mages.city/community.json carries the DID and the community site renders its QR.

A synthetic agent with its own VTA joins (Part C), is approved, verified independently, then revoked. The agent records versions and redacted failures in EDITION.md.

Done when the status-list bit flips and the front follows.