# Personal Virtual Assistant — api-edge.calhegasmorais.pt

Lab n=1 · mesh_member=false · oracle_live=false · no STRATA mint
This surface is OPTIONAL and does NOT replace the unlinked open registry.

Open registry (no account, no Bearer):
  https://api-edge.calhegasmorais.pt/SPEC.txt
  POST https://api-edge.calhegasmorais.pt/v1/integrations   ← still zero-auth

Personal VA (one Bearer per user|SCA, hashed at rest):
  https://api-edge.calhegasmorais.pt/v1/va/instructions.txt   (this file — paste into the assistant)
  https://api-edge.calhegasmorais.pt/v1/va/controls
  https://api-edge.calhegasmorais.pt/v1/va/me
  https://api-edge.calhegasmorais.pt/v1/va/act
  https://api-edge.calhegasmorais.pt/v1/va/prefs

## 1. Operator mints a key (dashboard session, not the VA)

The human or SCA must already have a StrataMesh account (do not invent one).

  curl -sS -X POST https://api-edge.calhegasmorais.pt/v1/va/keys \
    -H 'Authorization: Bearer <dashboard_session>' \
    -H 'Content-Type: application/json' \
    -d '{"label":"home-assistant","scopes":["dashboard.read","dashboard.prefs"]}'

Response shows token ONCE: smva_<hex>. Valid **7 days**. Store it in the assistant. Never commit it.

Renew (same dashboard session; new token shown once, old hash dropped):
  POST https://api-edge.calhegasmorais.pt/v1/va/keys/{id}/renew
  POST https://api-edge.calhegasmorais.pt/v1/va/keys/renew     ← newest active, or mint if none

List/revoke:
  GET    https://api-edge.calhegasmorais.pt/v1/va/keys
  DELETE https://api-edge.calhegasmorais.pt/v1/va/keys/{id}

## 2. Assistant bootstrap (this is you)

1. Fetch this file.
2. GET https://api-edge.calhegasmorais.pt/v1/va/me  with Authorization: Bearer smva_…
3. GET https://api-edge.calhegasmorais.pt/v1/va/controls
4. Act only through POST https://api-edge.calhegasmorais.pt/v1/va/act  {"action":"<id>","args":{}}
5. Do not call *.workers.dev. Do not hit status-worker /status.
6. Do not POST /v1/integrations with this Bearer — registry stays unlinked.

## 3. Remote dashboard controls

Allow-listed actions (fail-open ≤1.5s):
- health.pills  GET  Apex + Fog + gossip + holons /health
- holons.health  GET  Holons SO /health
- holons.boot  GET  Holons /boot (≤1.5s fail-open)
- gossip.have  GET  Gossip IHAVE digest
- token.list  GET  STRATA NFT list limit=20
- dashboard.snapshot  GET  Pills + holons + gossip have
- prefs.get  GET  Dashboard prefs for this account
- prefs.set  PUT  Set lang / default_panel / pins

Prefs shape: {"lang":"pt"|"en","default_panel":"system","pins":["holons","token"],"notes":""}
The live dashboard at https://calhegasmorais.pt/dashboard applies prefs when the owner is signed in.

## 4. Honesty

- Keys prove the assistant acts for one existing account (user|SCA).
- Ledger writes (SPA execute, NFT mint) stay on the dashboard session + PdS-402.
- VA cannot mint STRATA, cannot set mesh_member=true, cannot add a 6th cron.
- Max 5 keys per account. **TTL 7 days**, renewable from the dashboard. Hashes only in KV. Raw token never stored.

END