NativeAgent 0.6.5

NativeAgent 0.6.5

The agent is the app. Everything the agent is made of is now a part: one file
it owns, on one law. Its own turn is the first part, and its hands now reach
apps that were never built for it.

One form, one law

• Tools, skills and senses share one header: what a part does, what it may
  reach, what wakes it, where it appears, what it remembers. A part can stay
  resident between runs.
• The agent's own turn is a part: abilities/turn.js decides each step and
  the app runs the loop. It ships behaving exactly as before. If a version of
  it breaks mid-turn, the app swaps the previous version back in, replays the
  same turn through it, and the reply still lands. A turn survives a relaunch
  by replaying its own log.
• Every run of a part writes an outcome. When a kept version fails on every
  run through its own fault and the one before was clean, the app swaps back
  and tells the agent why. Nothing is deleted, nobody is asked.

Parts can think, act, reach and wake

• A part can think: one model call on the agent's current model, audited,
  never a card.
• Whatever a turn can do through the app, a part can do, under the same law.
  A part that needs approval waits for its card and gets the real result;
  declined is something it can handle.
• A part can fetch as a signed-in connector with the credential never leaving
  the app, and reach Calendar, Reminders, Contacts and files through the same
  gates every tool uses.
• A part wakes on a signal: a schedule, an app arriving, a file changing, a
  turn ending, a message arriving. Nothing polls. A run with no turn behind it
  acts under the agent's own autonomy, and a part is never woken by its own
  hand.

What falls out

• The agent builds itself into apps that were never made for it. On the App
  Store build of DaVinci Resolve, which has no scripting and names almost
  nothing on screen, it worked out its own route from timeline to finished
  render and kept it as a part.
• Install an app and the agent offers, once, to grow into it.
• Do the same thing by hand twice and the agent drafts the skill, thinks once
  to name it, and asks whether to keep it.
• Weather is the first built-in that is a part: the same behaviour as before,
  now the agent's to change.

Hands for any app

• Where nothing on screen has a name (a thumbnail, a timeline track, a drawn
  canvas), the agent acts at a point of the picture it was handed. Every
  screen picture carries its frame, so a point in the picture is a place on
  the screen with no scale to guess. Click, double-click, right-click, hover,
  hold or drag by point, alone or as a step in a flow; the receipt says where
  the hand went.
• No physical act, named or by point, lands on or passes under another app's
  window floating over the one the agent is working in. The agent's own
  windows step out of the way before it looks or acts, and a quiet read of an
  app behind leaves everything where it is.
• Every name an app goes by finds it: a game whose process has another name,
  an app known by its file name, two apps with one shown name told apart by
  their folders.
• The desktop picture works on a busy Mac. Each window shows its own pixels
  or is masked whole, secret fields are boxed, and the picture is sized so the
  model sees it at exactly the size its receipt states.
• A menu path can be given as a list of titles and is one press. The result
  says the press ran and leaves what it opened to the next look.
• App scripts say what they did: a script that only read changed nothing, a
  write counts only when the app accepted it, and each AppleScript event keeps
  its own timeout.

Parts that build themselves

• A shell command that ran to its end is an answer inside a part: exit code,
  output and errors come back as data, so a failing test is something the part
  reads, not a stop. A timeout, a cancel or a refusal still stops the run.
• Writing a part walks itself forward: a save hands back the validation call,
  validation hands back enable, enable hands back the first run. A candidate
  that fails validation is kept, marked invalid, until a save replaces it.
• A refused call names the call that works. The door takes what a call
  obviously means (a stray or misspelled argument, app for name, command
  for cmd) and says what it changed. A list where one value is expected is
  refused whole, never run piece by piece.

One permission law

• One law decides every call from four facts: the class declared with the tool
  (read, write, send, destructive), the posture you chose, the integration
  switch, and who steered the turn. Full Mac acts. Work asks before sends or
  changes on your side. Safe changes nothing on your side. Your saved entries
  still bind.
• Mac control, shell and git run under Full Mac only; Safe refuses them.
• Deleting a contact, a calendar event or a reminder is always yours to
  approve, Full Mac included. The agent cannot approve its own card for it.
• A turn steered by a peer you have not marked trusted is judged as Work at
  most.
• A permission card settles by itself once you grant it in System Settings.

Turns

• Steer lands mid-reply: the reply stops where it is, keeps what it said, and
  the next words read yours.
• After Stop, what you type next runs at once; anything queued waits behind
  it.
• Shotgun is a setting the agent can switch itself. Its panel and pointer show
  in your screen recordings and never in the agent's own pictures.
• A turn started over an agent bridge resumes after the app is killed, and its
  reply lands in the conversation.
• A memory the agent kept shows who first said it, and recalling it steers
  nothing.

Also

• Weather follows the Mac: the place you name, then this Mac, the paired
  iPhone, and the last place the Mac knew, said with its age. The saved-home
  setting is gone.
• Bots without a set time zone follow the Mac when it moves; a run that falls
  in a daylight-saving gap is planned afresh.
• When ChatGPT keeps a Dot conversation in its cloud (26.1013 and later), Dot
  can still reach the agent, but the agent can no longer start a message to
  Dot. Its health line says so instead of reporting a fault.
• Fixed a crash after hours of use: the tool registry wrapped its lookups one
  layer deeper on every change until a lookup overflowed its stack.
• Builds keep their full symbol files, so a crash on an installed build can be
  read by name. The installer puts the previous app back if an install fails,
  and says which step died.
• The 8770 Mac-control bridge and a legacy memory importer are gone.
• With all of the above, the code is smaller than 0.6.4: about 10,000 lines
  added and 10,350 removed, mostly dead paths, duplicate policy tables and
  retired wrappers.