# Agent Kit r3.2.0 — The Collective Master Library v3.2.0

Kit revision **r3.2.0**; library release **v3.2.0**. They version
independently: the archive is published as
`CMPSBL-Agent-Kit-r3.2.0-Library-v3.2.0.zip`.

13 primary agent-workflow files plus 4 supporting reference documents. Hand them to a coding agent, get a branded report
back. You do not have to write the prompt — `PROMPT.md` is the prompt, and the
agent is instructed to run it unasked.

The catalog ships twice: once merged (`AGENT-HANDOFF-CATALOG.md`, ~3717 KB) and
once split into three phase files derived from it by the build. Agents whose
context window cannot hold the merged file should read `CATALOG-PHASES.md` first
and follow the phase order. Nothing is summarised away in the split — the Phase 2
rows are extracted from the Phase 3 rows, so the two cannot drift.

| File | What it is | Who reads it |
|---|---|---|
| `PROMPT.md` | The standing order: the exact instruction the agent executes, with no human prompting. Also §PART 0 of the catalog and rule 0 of `AGENTS.md` | your coding agent |
| `AGENT-HANDOFF-CATALOG.md` | Instructions + commercial terms + method + all 1162 components + a copy-paste prompt (~3717 KB) | your coding agent |
| `INTEGRATION-REPORT-TEMPLATE.html` | The report skeleton the agent must fill in | your coding agent |
| `AGENTS.md` | Standing operating rules for the agent: rule 0 (the standing order), ground rules, licence pointer, integration procedure. The Step 0 licence-conflict check lives here in `AGENTS.md` §Step 0 — including the host-licence verdict table — and is reproduced verbatim into `AGENT-HANDOFF-CATALOG.md` PART 1 §Licence rules by the build, so the two cannot drift | your coding agent |
| `LICENSE` | The GNU LicenseRef-CMPSBL-Perpetual-1.0, verbatim. The default door — free, provided your own source ships under the perpetual licence | you and your legal reviewer |
| `LICENSE` | CMPSBL(R) Perpetual Edition License 1.0 — the paid door for hosts that will not release their source | you and your legal reviewer |
| `LICENSING.md` | The two doors in one page: which one applies to you and what it costs | you |
| `CATALOG-PHASES.md` | Router for the three-phase read path: which phase file to read when, and the rules for phased reading | your coding agent |
| `CATALOG-PHASE-1-DIRECTIVES.md` | Phase 1 — standing order, assignment, pricing, licence rules, Step 0. No components | your coding agent |
| `CATALOG-PHASE-2-SHORTLIST.md` | Phase 2 — class index, capability index, and one compact row per component: id, name, mode, LOC, verification, constraints | your coding agent |
| `CATALOG-PHASE-3-COMPONENTS.md` | Phase 3 — the full component rows verbatim, including `What it does` and `API surface` | your coding agent |
| `DISCOVERY-VAULT-INDEX.md` | The separate second pool: one row per machine-synthesised discovery (6,479 rows). Screened from the index alone before purchase — the vault source ships with the delivery | your coding agent |
| `README.md` | This file | you |

The branded, printable HTML twin of the catalog is **not** in this ZIP — this kit
holds agent-readable files only. Download `AGENT-HANDOFF-CATALOG.html` separately
from https://shpbl.com if you want to read or print the catalog yourself.

## How to use it (3 steps)

1. **Attach** `PROMPT.md`, `AGENT-HANDOFF-CATALOG.md`, `AGENTS.md`,
   `DISCOVERY-VAULT-INDEX.md` and `INTEGRATION-REPORT-TEMPLATE.html` to a session
   with your coding agent, in the repo you want evaluated. If your agent's context
   window cannot hold the merged catalog, attach `CATALOG-PHASES.md` and the three
   phase files instead of `AGENT-HANDOFF-CATALOG.md`.
2. **Say nothing more than "follow the kit"** — `PROMPT.md`, §PART 0 of the
   catalog and rule 0 of `AGENTS.md` each instruct the agent to run the full
   assignment unprompted. If your tool takes a prompt separately from
   attachments, paste `PROMPT.md`, or PART 3 of the catalog
   (`# PART 3 — COPY-PASTE PROMPT`), which is the standing order plus the PART 1
   assignment body from the same source text — so attachment and prompt cannot
   disagree.
3. **Collect** `COLLECTIVE-MASTER-LIBRARY-INTEGRATION-REPORT.html` at your repo root. Open it in a browser or
   print it to PDF — it is self-contained, needs no network, and reads on a phone.

## What this kit is and is not

The kit is the **pre-purchase** surface. The catalog is the source of truth here:
it is generated from the delivery's `manifest.json` and every
`artifacts/<ID>/artifact-manifest.json`, and it carries every field the
evaluation needs. Files the catalog references — `manifest.json`, per-artifact
manifests, `VERIFICATION.md`, `polyglot/POLYGLOT.md`,
`notices/dependency-policy.json`, `adapters/`, `tests/` — ship in the full
delivery, not in this kit. Once you hold the delivery, those files are
authoritative and override the catalog.

This kit ships no `CHECKSUMS.sha256`, because it is small enough to read. The
full delivery does; see **Integrity** below for what that file proves and what it
does not.

## Using the report template

The agent copies `INTEGRATION-REPORT-TEMPLATE.html` to the host repo root as
`COLLECTIVE-MASTER-LIBRARY-INTEGRATION-REPORT.html` and replaces every double-brace placeholder. Rules the
template enforces, and that you should check on delivery:

- **No placeholder may survive.** A remaining double-brace token is a defect.
- Blocks marked `REPEAT` are duplicated once per recommendation; every
  `<section>` stays, even if the answer is "nothing here, because …".
- No external CSS, fonts, images or scripts. It must open from `file://`.
- Masthead, claim block, footer and purchase link stay intact.
- A markdown twin of the report is emitted alongside it for code review.

## What the report will tell you

REPLACE / HARDEN / SKIP for each candidate, mapped to your files; net LOC
delta; the components' own verification tokens (compile, integration, behavior,
security) carried through unchanged; and net-new components designed by
composing catalog pieces against your specific codebase.

## Verification vocabulary

`C:ok` compiles · `I:ok` imports resolve in a clean host · `B:exec` behavior
probe executed · `B:load` module loaded only · `S:tests` covered by an
adversarial suite in `tests/security/` · `S:scan` clean under the delivery scan.
Behavior against intended semantics and independent security review are
**Not claimed** — the full statement is in `VERIFICATION.md` in the delivery, and
PART 1 of the catalog reproduces the claim ceiling.

Provenance: extracted from systems the author has run in production since August
2025. Operationally exercised, not independently security-audited.

## Integrity

The full delivery ships `CHECKSUMS.sha256` and `VERIFY.sh`. Read the claim
narrowly: `sha256sum -c` proves the archive extracted completely and no delivered
file has been altered **relative to that checksum file**. It cannot prove the
checksum file itself is the one shipped, because nothing inside a tree can anchor
that tree. Anchor it out of band: `VERIFY.sh` prints the SHA-256 of
`CHECKSUMS.sha256` (the root hash), and the same value is published beside the
download at https://shpbl.com. Compare the two before you trust the tree; if a
`CHECKSUMS.sha256.minisig` ships beside it, verify that signature with the public
key published on the same page. `ROOT-OF-TRUST.md` in the delivery states this in
full.

## Modes

`direct` — plain import, zero framework coupling. This is what 1,068 of
the components are, and the mode is derived from a static scan of real import
sites.
`governed-optional` — plain import, reads shared governed state if you supply it,
works standalone if you do not. Currently **0 components** carry
this mode; it is kept in the vocabulary because the scan can produce it.
`governed-required` — needs the governed runtime slices listed on the artifact's
`runtimeRequirements.sliceIds`. Never ship one of these alone.

## Non-TypeScript host repos

The delivery ships `polyglot/bundle/cli.mjs` — it emits a governed bridge
implementation of any component in 19 languages plus 7 hardware/HDL targets, with
no install and no network. TypeScript stays canonical. Only the emitted
`typescript`, `python` and `javascript` samples are checked at build time and
pass; the other 23 targets are `Not claimed`: unverified; no claim is made. Full
claim: `polyglot/POLYGLOT.md` in the delivery.

---

License: LicenseRef-CMPSBL-Perpetual-1.0. Under the single licence the perpetual licence is the whole grant and adds no further restriction; the substance test — no component sold or published as a product in its own right — is a term of the single licence only. See `LICENSING.md`.

Buy / support: https://shpbl.com · hello@cmpsbl.com
