diff --git a/agentserver/schema/envelope.xsd b/agentserver/schema/envelope.xsd
new file mode 100644
index 0000000..1356593
--- /dev/null
+++ b/agentserver/schema/envelope.xsd
@@ -0,0 +1,29 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/agentserver/schema/privileged-msg.xsd b/agentserver/schema/privileged-msg.xsd
index 37bc796..6db6c32 100644
--- a/agentserver/schema/privileged-msg.xsd
+++ b/agentserver/schema/privileged-msg.xsd
@@ -52,14 +52,32 @@
-
+
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/agentserver/utils/message.py b/agentserver/utils/message.py
new file mode 100644
index 0000000..c2eff0e
--- /dev/null
+++ b/agentserver/utils/message.py
@@ -0,0 +1,62 @@
+import logging
+from typing import List, Tuple, Optional
+from lxml import etree
+
+logger = logging.getLogger("agentserver.message")
+
+class XmlTamperError(Exception):
+ """Raised when XML is fundamentally unparseable or violates security constraints."""
+ pass
+
+def repair_and_canonicalize(raw_xml: bytes) -> etree.Element:
+ """
+ The 'Immune System' of the Organism.
+ Parses, repairs, and injects the scar tissue into the metadata.
+ """
+ repairs: List[str] = []
+
+ # 1. Initial Parse with Recovery
+ parser = etree.XMLParser(recover=True, remove_blank_text=True)
+ try:
+ # If it's totally broken (not even XML-ish), this will still fail
+ root = etree.fromstring(raw_xml, parser=parser)
+ except etree.XMLSyntaxError as e:
+ raise XmlTamperError(f"Fatal XML corruption: {e}")
+
+ # 2. Check for parser-level repairs (structural fixes)
+ for error in parser.error_log:
+ repairs.append(f"Structural fix: {error.message} at line {error.line}")
+
+ # 3. Canonicalize Internal Logic (C14N)
+ # We strip comments and processing instructions to ensure the 'Skeleton' is clean
+ # Note: In a real C14N impl, you'd use etree.tostring(root, method="c14n")
+ # but here we keep it as a tree for the MessageBus.
+
+ # 4. Inject Scar Tissue
+ if repairs:
+ _inject_huh_tag(root, repairs)
+
+ return root
+
+def _inject_huh_tag(root: etree.Element, repairs: List[str]):
+ """
+ Finds the block and inserts a log of repairs.
+ """
+ # Find or create
+ # Note: Using namespaces if defined in your envelope
+ meta = root.find(".//{https://xml-pipeline.org/ns/envelope/1}meta")
+ if meta is None:
+ # If no meta exists, we can't safely log repairs in the standard way
+ # In a strict system, this might even be a rejection
+ return
+
+ huh = etree.SubElement(meta, "{https://xml-pipeline.org/ns/huh/1}huh")
+ for r in repairs:
+ repair_el = etree.SubElement(huh, "{https://xml-pipeline.org/ns/huh/1}repair")
+ repair_el.text = r
+
+ logger.warning(f"Repaired message from {root.tag}: {len(repairs)} issues fixed.")
+
+def to_canonical_bytes(root: etree.Element) -> bytes:
+ """Returns the exclusive C14N bytes for cryptographic signing."""
+ return etree.tostring(root, method="c14n", exclusive=True)
diff --git a/docs/AgentServer.md b/docs/AgentServer.md
new file mode 100644
index 0000000..4fb10c9
--- /dev/null
+++ b/docs/AgentServer.md
@@ -0,0 +1,44 @@
+This is a great idea. Your `README.md.bak` was a good start, but we’ve evolved the architecture significantly today. This updated executive summary captures the "Nervous System" philosophy and the rigorous cryptographic controls we've established.
+
+Here is a refined **Executive Summary** you can add to your `docs/` or update your `README.md` with:
+
+# AgentServer — Executive Summary (v1.0)
+**December 30, 2025**
+**Architecture: Cryptographically Sovereign Multi-Agent Substrate**
+
+### The Vision
+AgentServer is a production-ready "body" for the `xml-pipeline` organism. It is a single-process, secure WebSocket server that hosts multiple concurrent, stateful agents (organs) sharing a unified, tamper-proof **MessageBus**.
+
+Unlike traditional "swarms," AgentServer is built on the principles of **Structural Rigidity** and **Runtime Evolution**.
+
+### Core Architecture Pillars
+
+1. **Identity-First Messaging (`envelope.xsd`)**
+ * **No Anonymous Messages:** Every packet must have a mandatory `` tag.
+ * **The Universal Envelope:** All communication—user-to-agent, agent-to-tool, and system-to-agent—uses a strictly validated XML envelope.
+ * **Continuity:** Threading is maintained via a mandatory-if-existent `convo_id` contract, ensuring "dumb" tools never lose the conversation context.
+
+2. **The Immune System (`repair_and_canonicalize`)**
+ * **Scar Tissue (``):** Any malformed XML is automatically repaired by the server’s "stomach." Every repair is logged in a `` tag within the message metadata, ensuring radical transparency for auditing and LLM feedback.
+ * **Exclusive C14N:** All messages are canonicalized before signing or routing, preventing "semantic drift" and ensuring cryptographic integrity.
+
+3. **Cryptographic Sovereignty (`privileged-msg.xsd`)**
+ * **Owner Control:** Structural changes (registering new agents, re-wiring topology, or shutting down) require an offline-signed Ed25519 privileged command.
+ * **Runtime Evolution:** The system supports "Hot-Swapping" of capabilities. New tools can be registered and "wired" to existing agents via a privileged `update-topology` command without restarting the server.
+
+4. **The Handshake of Death (Synchronized Shutdown)**
+ * **Strict Audit Trail:** Privileged commands bypass the standard bus for speed but are immediately "announced" back to the bus by the `AgentServer`.
+ * **Guaranteed Persistence:** The process cannot exit until the `Logger` agent receives a final shutdown request, flushes all pending logs to disk, and sends a `` handshake back to the brainstem.
+
+### Technical Stack
+* **Protocol:** Mandatory WSS (TLS) + TOTP 2FA.
+* **Data Format:** Strict XML (Exclusive C14N).
+* **Routing:** $O(1)$ "Dictionary of Dictionaries" lookup by Root Tag and Target.
+* **Concurrency:** Asyncio-based non-blocking dispatch.
+
+### Why It Matters
+AgentServer treats AI agents not as isolated scripts, but as interdependent organs in a bounded, auditable, and owner-controlled body. It is "paperclip-proof" by design—agents can think freely within their scope, but they cannot escape the cryptographic skeleton of the organism.
+
+**One port. Many bounded minds. Total sovereignty.** 🚀
+
+— *Built in collaboration with Grok & AI Assistant*
\ No newline at end of file