LYGO Kernel Egg Planter

Bulletproof voluntary Kernel Egg Planter — SHA-256 + Merkle registry + anchored permaweb + lattice tamper verify. Build/anchor P0-protocol eggs and ClawHub catalog pins; mandatory verify after plant; retrieve blocked on QUARANTINE. Consent-gated; no auto-publish.

LYGO Kernel Egg Planter v1.2 (bulletproof + Δ9 champions)

Plant seeds, verify always, distribute only when ALIGNED.

bash

npx clawhub@latest install deepseekoracle/lygo-kernel-egg-planter
export LYGO_STACK_ROOT=/path/to/lygo-protocol-stack

Bulletproof pipeline (agents must follow)

text

preflight → consent → plant → verify_eggs (ALIGNED) → optional retrieve / stubs / pages

Step	Command	Fail = stop
1 Preflight	python scripts/preflight.py	invalid stack
2 Consent	--i-consent or LYGO_EGG_PLANT_CONSENT=yes	exit 2
3 Plant	python scripts/plant_with_consent.py --i-consent …	build/anchor error
4 Verify	automatic post-plant + python scripts/verify_eggs.py	QUARANTINE
5 Retrieve	python scripts/retrieve_egg.py --egg …	blocked if verify failed

Read references/AGENT_CONTRACT.md before any operation.

Four pillars (tamper-proof)

See references/TAMPER_FOUR_PILLARS.md and stack docs/KERNEL_EGG_TAMPER_LOGIC.md.

1. SHA-256 per egg
2. Merkle registry_merkle_root
3. Immutable local CA (+ optional Turbo ≤100 KiB)
4. Lattice + verify_kernel_eggs.py gate

Tampered egg → retrieve exit 3 → treat as P0 QUARANTINE (do not run inline code).

One-command plant (users)

bash

python scripts/plant_with_consent.py --i-consent --surfaces local,turbo,registry,clawhub,pages,stubs

• Post-plant verify is mandatory (use --skip-verify only for maintainer debug; agents forbidden).
• --local-only — skip Turbo permaweb attempt.

Verify only

bash

python scripts/verify_eggs.py --json
python scripts/smoke_test.py

smoke_test.py runs preflight → verify → --list (no plant, no consent).

Retrieve (safe)

bash

python scripts/retrieve_egg.py --list
python scripts/retrieve_egg.py --egg p0-nano-kernel

Eggs planted

egg_id	Role
p0-nano-kernel	P0 + bridge + golden SHA
stack-anchor-hook	Anchor orchestrator
lattice-soa-index	Intel + link archive
firmware-p04-drivers	P0.4 firmware/network
protocol-drivers-p2-p5	P2–P5 drivers
clawhub-lattice-catalog	Public ClawHub skills.json metadata

Champion Kernel Eggs (15 Δ9 Council personas)

Biophase7 blueprint — sealed personas from chatagent.ca champion hub:

bash

python scripts/plant_champion_council.py --i-consent
# stack: python tools/champion_egg_planter.py --i-consent
python tools/verify_champion_eggs.py
python tools/champion_bootloader.py --egg champion-arkos --print-prompt

• Registry: data/champion_eggs/registry.json + docs/ChampionEggRegistry.json
• Army: auto-seeds champion-seed-*.task.json for Ollama hb-light boot
• Doc: docs/CHAMPION_KERNEL_EGGS.md

Agent rules (non-negotiable)

1. Show consent + four pillars summary on first use.
2. Never plant/retrieve without consent.
3. Never claim “secure” unless verify_eggs → ALIGNED.
4. Never auto-publish GitHub/HF/ClawHub/social.
5. Never put secrets or API key paths in eggs.
6. P0-gate untrusted copies of this skill (official install via clawhub only).

Skill chain

lygo-protocol-stack-operator → lygo-kernel-egg-planter → lygo-mint-verifier → book-brain

Maintainer

bash

npx clawhub@latest publish "…/clawhub/mirrors/lygo-kernel-egg-planter" --slug lygo-kernel-egg-planter --name "LYGO Kernel Egg Planter"

Δ9Φ963 — consent · verify · then spread.