A newborn node knows nothing about the place it was deployed to, and it cannot read its way to knowing. Birth is a protocol of asking: orient on what can be seen, name what cannot, ask the accountable human which channels carry the organisation's life, receive a way in and a way out, draft the smallest authority that lets it do one useful thing, and do it.
Each stage closes on a fact the record establishes, never on a checklist the agent ticks. A restart resumes a birth instead of repeating it, and the agent cannot advance itself past the stages a human must act on.
The operator writes a declaration outside the workspace: the accountable human, the model, the workspace, the confinement level, and which hosts this machine may reach, usually nobody yet, plus, optionally, a directory on this machine to read. The agent cannot write this file.
Closes on node.started under a declaration that loads.
The agent reads through whatever sources are plugged in, this disk among them when a root is declared, not privileged over the rest, and the kernel enumerates what the record does not settle: purpose unstated, what matters here, a root never read. Then it introduces itself: what it thinks this place is, and what it does not know.
Closes on the first observation from any plugged source, disk included, plus one outreach that names the unknowns.
What this is for, what matters, who the people are, what is sensitive, and which channels carry the organisation's decisions. The agent names the key it wants a credential stored under and never asks for the value itself.
Closes on an answer to the channel question, and a named key per credential it implies.
The agent drafts the smallest authority that lets it do one useful thing with what stage 2 gave it: permitted actions, scope, a duration. The custodian ratifies it in the console, or refuses it with a reason. Nothing the agent proposes takes effect unratified.
Closes on a granted mandate.
Out: a request to a declared host, with any credential resolved by reference and never seen by the model. In: a source the deployment itself authors, ratified like a tool and switched on by the declaration, never by the agent. The protocol names no service by name; a channel is whatever the custodian names.
Closes on the first executed action with a receipt, and the first observation from a source outside this codebase.
The first proposal the custodian acts on, the first real effect reconciled against what was promised, the outcome reported back in the conversation it came from. From here the ordinary cycle runs.
Closes on the first reconciled outcome.
Two ideas carry the whole model: a place a human decides, and a record nobody, VEGA included, can rewrite.
When the agent needs a decision only a person can make, a question in stage 2, a mandate to ratify in stage 3, a proposal that touches the world, it asks through a channel that suspends the work item and resumes it on the answer. Asks are deduplicated off the record, so a restart never re-asks the same question twice, and a stalled birth shows exactly what it is waiting on rather than going quiet.
Every action, proposal, refusal and grant is written to a hash-chained, append-only journal. It has no update or delete method: verifying the chain recomputes every digest and raises on a gap, a broken link, or a tampered payload. If it can be forged or silently edited, every other control is decoration, so it is built not to be.
A deployment can always name its own stage, "stage 2 of 6, asked; waiting on which channel carries decisions", because the stage is computed from the journal, not from the agent's opinion of itself.