Activation — forward-looking

Installation makes a realm’s agent available, not runnable. Adoption, which is putting the agent on duty, makes its routines runnable and pins the full-package realmDigest, Trigger Registration identities, compiled capability-grant digest and revision, worldId, contextId, access-policy revision, and one run-as principalId. The principal may be the adopting human or a service principal they are allowed to delegate to. The adoption retains its adoptionId across reapproval and records its creator and approvers for audit; those records confer no runtime authority. A signal sender is data, never authority. Cron and signal triggers run as the adoption’s principal; an on-demand call runs as its authenticated caller.

Changing Realm content, the Trigger Registration, compiled grant, run-as principal, context, or its access-policy revision increments the adoption revision and pauses new dispatches. Reapproval keeps the same adoptionId; deleting and recreating an adoption creates a new one. Disabling or removing a principal pauses every adoption that runs as it and invalidates its credentials and mutable caches. Removing an approver triggers host-policy revalidation of adoptions they approved, but does not silently revoke or inherit an independently authorized service principal’s authority. An organization may auto-approve a compatible change only under an explicit reviewed rule; the host never silently carries approval forward or expands an adoption’s authority. The host surfaces a realm’s agents in its activation UX and over MCP. Whoever adopts an agent becomes its sponsor unless the world names another. A scheduled routine uses the normal cron path; there is no second scheduler. World agents shadow realm agents on name collision.

An observing stage is a legibility aid, not a proof of future behaviour: realm code can branch on inputs or time after adoption. Security comes from the host-bound grant and method classification. Only host-vetted gateway metadata may classify a method as READ; realm, MCP, or tool-authored claims are UNKNOWN until reviewed. Observing dispatches deny both EFFECT and UNKNOWN, including nested gateway calls.