5 · Your first conversation
Open the workspace, pick the engine you sealed in step 3, and ask it something.
A reply means the whole chain worked: you signed in as the owner, the agent authorised you, it asked the router for a model, the router authorised that too, and the answer came back encrypted.
When it does not reply
Section titled “When it does not reply”Four moving parts, and each fails with its own message. Check them in this order — the later ones cannot work if an earlier one is wrong.
1. Is the agent up?
Section titled “1. Is the agent up?”hexaeight-activate restart agent[licence] personal licence - N policy rule(s) in force[identity-agent] <name> listening on :87700 policy rule(s) means owner is missing from hexaeight-agent.json, or the baseline policy
was never written. Go back to step 2.
2. Is the router up, and did the agent find it?
Section titled “2. Is the router up, and did the agent find it?”The router must be running before the agent. If it was not, restart the agent now.
A licence error on the agent when the licence is fine almost always means one of these two things:
- the router was not running when the agent started
- the command was run from the wrong folder, so
env-filewas never read
3. Are you permitted?
Section titled “3. Are you permitted?”This prints what the enforcer actually decides, not what is written down. A rule that exists but does not match reads as protection and is not.
The two rows people miss:
| rule | without it |
|---|---|
[email protected],op:*,outbound | you sign in, and nothing else works |
*,<agent-name>,outbound | engines cannot reach the router at all |
4. Did the router allow the model?
Section titled “4. Did the router allow the model?”The router authorises twice — may this caller relay through this agent, and may this caller use this model. Both live in the router’s own policy, which the agent cannot write and which is read once at startup.
If you changed it, restart the router.
Reading the log
Section titled “Reading the log”Read the last twenty lines, or the whole file. Do not search it for the word you expect — the line that explains a failure usually sits beside the one you searched for, and filtering hides it.
tail -20 my-agent/agent.logWhat you have now
Section titled “What you have now”An agent with a cryptographic identity, reachable only by you, that can reason using a model whose credentials it does not hold.
Nothing else is configured. It has no documents, no procedures, and no callers other than you — each of those is something you add deliberately.
Where to go next
Section titled “Where to go next”| you want to | read |
|---|---|
| let it answer from your own documents | Documents |
| put an API you already run behind it | An existing API |
| make it follow the same procedure every time | A procedure it follows |
| let another system call it | Other software calling it |
| understand what you just built | Architecture |