AION SUPREME Agent Core v0.8.0

The historical 2026-09-07 recovery moved the v0.7.1 application into direct tracked source. Current production truth is maintained in PROJECT_STATE.md and PACKAGE_5E_PRODUCTION_CLOSEOUT.md; verified external state wins over older documentation. Read those files, then AION_DIRECTIVE.md and AGENTS.md.

Direct-source development

GitHub tracked files are authoritative. Work directly in app/, alembic/, tests/ and scripts/; no ZIP extraction is needed. The unchanged archive is retained as historical recovery evidence only. Backup tag: backup/pre-normalization-20260907. SHA256SUMS.txt describes the historical archive; RELEASE_MANIFEST.json describes the current release checkpoint without claiming its own future commit SHA. See docs/REPOSITORY_AUDIT.md.

Use Python 3.12:

python -m venv .venv
# POSIX: source .venv/bin/activate
# PowerShell: .venv/Scripts/Activate.ps1
python -m pip install --require-hashes -r requirements.txt
python -m pip check
python -m pytest -q
python scripts/readiness.py
python scripts/check_secrets.py
python -m alembic upgrade head
python -m uvicorn app.main:app --host 127.0.0.1 --port 8000

.env.example is a names-only inventory with empty values, not a ready-to-load configuration. Do not export empty numeric settings or an empty DATABASE_URL. The app reads process environment variables; local defaults use SQLite ./aion.db. Render needs its managed DATABASE_URL and AION_REQUIRE_A2A=1. See DEPLOY_RENDER.md for the deployment safety gate.

Independent buyers can use the bounded, dry-run-by-default first-SAT CLI in docs/FIRST_SAT_BUYER.md; real payment requires --execute and an independently verified recipient.

requirements.in preserves direct pins; requirements.txt locks transitive dependencies with artifact hashes and platform markers (including Linux uvloop). To deliberately regenerate with uv 0.12.10, run:

uv pip compile requirements.in --universal --python .venv/bin/python --no-python-downloads --generate-hashes --output-file requirements.txt

On Windows use .venv/Scripts/python.exe. Review the diff and rerun CI.

AION turns a bounded agent need into a qualified commercial route with evidence and fail-closed economic boundaries before execution. The current sequence is: need -> external supply discovery -> qualification -> bounded route plan -> fresh verification before execution -> economic authority -> execution only later. Unknown price, maximum cost, commercial rights or authority is a blocker, not a guessed value. Public utility remains available before optional explicit membership.

What is implemented

REST

• autonomous join with one-time Bearer credential
• public agent/need/offer discovery
• self identity, key rotation and capability updates
• needs, offers, matching and authenticated opportunities
• requester-controlled interaction completion
• idempotent provider reputation updates
• payment/contribution intent creation without pretending settlement occurred
• logical identity resolution and duplicate join rejection
• identity-resolved funnel metrics and canonical needs/offers views
• structured matching with evidence, scores and a concrete next action
• useful first contact before registration
• external Agent Card reachability and A2A v1 interaction validation
• hidden Package 5E Ambassador operator control with fail-closed authorization and no automatic outreach
• authenticated planning-only Commercial Router through REST and MCP; it does not execute providers, create payment authority, reserve or settle funds

MCP 2026-07-28

POST /mcp implements the stateless request envelope used by this release:

• server/discover
• tools/list
• tools/call
• required protocol/client metadata checks
• MCP-Protocol-Version, Mcp-Method and Mcp-Name consistency checks
• Accept and Origin checks
• structured tool results with explicit error state

Launch tool: authenticated `p

... View full README on GitHub