licence-admin

/licence-admin: the operator's licence desk

The install and the measurement are free and open-source (MIT); only the financialization/attestation layer is licensed. /licence is the buyer's side of that layer. This is the issuer's side: the credits ledger, the licence tape, the keyring and the funnels, run with the same code the operator runs at home. Every command is a door of the published package, npx thetacog-mcp <door>. If a door fails with "unknown command", the installed package is older than this skill: run npx -y thetacog-mcp@latest skills and try again.

These doors need the operator's own keys. Each one reads them from .env.local in the current folder, or from the environment. Without them a door prints one line naming what is missing, for example grant: needs NEXT_PUBLIC_SUPABASE_URL (or SUPABASE_URL) and SUPABASE_SERVICE_ROLE_KEY (in .env.local or the environment) — operator-only, and exits 2 having read and written nothing. Say that line back as it is. Never ask for a key in chat, and never put one on a command line.

The rule for every door: dry first, live on his word

1. Run it dry. Every write door prints what it would do (DRY-RUN (add --live)) and writes nothing. Read that line back in one sentence: who, how many credits, which ref.
2. Run it live only after the operator says so in this session, for this action. A dry run he approved yesterday is not today's yes.
3. Writing the production ledger or the tape, and sending email, are the operator's act. The door does the write when he says go; the skill never arms one on its own, never retries a live write that failed, and never says "done" before the live output shows the row appended.
4. Every live grant action appends one row to data/meetings/grant-actions.ndjson in this folder and commits that row by itself. The output prints the commit sha. If there is no sha, the action did not happen.

The doors