From 8232aecd779df68a756d78b1d7d5f89561309347 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 16:07:36 +0200
Subject: [PATCH 01/27] Design spec: Delegated Authorization for AI Agents
 workshop

---
 ...ted-agent-authorization-workshop-design.md | 194 ++++++++++++++++++
 1 file changed, 194 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-08-04-delegated-agent-authorization-workshop-design.md

diff --git a/docs/superpowers/specs/2026-08-04-delegated-agent-authorization-workshop-design.md b/docs/superpowers/specs/2026-08-04-delegated-agent-authorization-workshop-design.md
new file mode 100644
index 0000000..18c1c8f
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-04-delegated-agent-authorization-workshop-design.md
@@ -0,0 +1,194 @@
+# Delegated Authorization for AI Agents — Workshop Design
+
+**Date:** 2026-08-04
+**Status:** Approved design, ready for implementation plan
+**Folder:** `delegated-agent-authorization/` (in `authzed/workshops`)
+**Branch:** `workshop/delegated-agent-authorization`
+
+## What this is
+
+A self-guided, hands-on workshop that teaches technical attendees how to add
+**delegated, fine-grained authorization** to AI agents. Attendees build a DevOps
+deploy agent on **goose** (the open-source agent from the Agentic AI Foundation) and
+gate its every action with **SpiceDB** using **Relationship-Based Access Control
+(ReBAC)**. By the end they understand scoped delegation, time-bound (expiring) grants,
+instant revocation, and hierarchical permissions where revoking a base grant cascades
+to dependents — something role-based systems can't express cleanly.
+
+Delivered first at a conference (Fri Sep 11, 2026, JST), then published to
+`authzed/workshops`.
+
+## Audience, duration, learning goals
+
+- **Audience:** technical — AI engineers and programmers. Comfortable with a terminal,
+  Python, Docker. No prior authorization background assumed.
+- **Duration:** 90 minutes, self-guided (works both live and after the fact).
+- **Learning goals:** by the end, an attendee can explain and has hands-on built:
+  1. **Delegated authorization** — an agent acts on a human's behalf with a scoped
+     subset of their authority; decisions resolve to ALLOWED / NEEDS APPROVAL / BLOCKED.
+  2. **Time-bound expiration** — grants that expire on their own (incident windows),
+     plus instant revocation.
+  3. **ReBAC / hierarchy** — relationship- and hierarchy-aware permissions, incl. a
+     cascade (revoking staging autonomy suspends production autonomy automatically).
+
+## Format (follows the reference workshop)
+
+Matches `agentic-rag-authorization`: a `starter/` app with intentionally-stubbed
+authorization pieces, checkpoint markdown files that go *run it → watch it fail →
+implement the fix → re-run → why this is the right design*, each ending in a
+**Completion Milestone** checklist, plus a setup doc (local Docker **and** a Codespaces
+devcontainer) and a web UI to see decisions live.
+
+**Pedagogy — guided implement:** attendees write the two pedagogically valuable things
+themselves from `# TODO(Checkpoint N):` stubs — **the SpiceDB schema** (grown across
+CP2→CP4) and **the `decide()` decision engine** (CP2). Everything else is provided
+plumbing: the goose MCP extension, docker-compose, seed harness, approve/revoke scripts,
+web UI, devcontainer. The exact code-to-write is embedded in each checkpoint (the
+reference's own pattern). The complete reference solution is the published
+`github.com/sohanmaheshwar/goose-spicedb-delegation` repo, linked from the workshop.
+
+**Two ways to see every checkpoint:** goose is the headline — attendees register the
+MCP extension and talk to it in natural language ("Deploy checkout to production"). The
+**web UI** + `python scripts/verify.py` are the deterministic verifier, so every
+checkpoint is confirmable in a room without depending on an LLM key. The deterministic
+path never needs an LLM.
+
+## Artifact structure
+
+```
+delegated-agent-authorization/
+  README.md                          # overview, "what you'll build", prereqs, 90-min module map, solution link
+  0-setup.md                         # Docker + Codespaces devcontainer, register goose extension, seed, verify
+  1-run-the-agent.md                 # CP1: run the UNGATED agent, watch it over-reach
+  2-delegated-authorization.md       # CP2: write delegation schema + implement decide() (3-way); ReBAC concepts
+  3-time-bound-and-revocable.md      # CP3: expiring grants (incident window) + instant revoke
+  4-relationship-based-hierarchy.md  # CP4: gated_by cascade — revoke staging suspends prod
+  5-nextsteps.md                     # scale: ReBAC in prod, CheckBulk, on-behalf-of, real platform teams
+  starter/
+    docker-compose.yml               # postgres + spicedb (+ expiration flag)
+    schema.zed                       # STUB — grown by learners across CP2→CP4
+    authz.py                         # decide() + helpers STUB — implemented in CP2
+    bootstrap.py                     # seed harness (grant-writing evolves with the schema)
+    deploybot_server.py              # goose MCP extension — provided plumbing; calls decide()
+    spicedb_client.py                # provided
+    relationships.py                 # provided TOUCH/filter helpers
+    approve.py, revoke.py            # provided lifecycle scripts
+    web.py, static/index.html        # provided web UI (chat + authority bar + decision states)
+    scripts/verify.py                # per-checkpoint deterministic verifier
+    requirements.txt, .env.example
+    goose-extension.md               # how to register the extension in goose
+    .devcontainer/devcontainer.json  # Codespaces
+  images/                            # authority-chain + decision-flow diagrams
+```
+
+## The checkpoint arc (the schema grows as they learn)
+
+Each checkpoint adds exactly one concept by editing the schema and re-running. The
+naive → fix → why loop drives every one.
+
+### CP1 — Run it, watch it over-reach (~10 min)
+`decide()` is a stub returning ALLOWED for everything (clear `# TODO(Checkpoint 2)`
+docstring warning, mirroring the reference). Attendees register the extension, talk to
+goose, and watch it deploy to production and tear down environments with no guardrail —
+all green in the web UI. Takeaway: an agent runs with its host's ambient authority; with
+no authorization boundary it can do anything the credentials can.
+
+### CP2 — Delegated authorization (~25 min, includes ReBAC concepts)
+Attendees **write `schema.zed`**:
+```zed
+definition user {}
+definition agent { relation delegator: user }
+definition environment {
+    relation direct_deployer: user
+    relation agent_deployer: agent
+    relation approver: user
+    relation destroyer: user
+    permission deploy  = direct_deployer + agent_deployer
+    permission approve = approver
+    permission destroy = destroyer
+}
+```
+and **implement `decide()`**: check the agent for the permission → ALLOWED; else read the
+agent's `delegator` and check the delegator → NEEDS APPROVAL (a human could authorize);
+else BLOCKED. Seed grants the agent staging-only deploy. Results: staging ✅, production
+⏸ (with the `approve.py` human-in-the-loop flow), destroy 🚫. ReBAC and the Google
+Zanzibar model are taught inline here (relationships, not flat roles; why the decision
+lives in a deterministic check, not the prompt).
+
+### CP3 — Time-bound & revocable (~15 min)
+Attendees add expiration to the schema (`use expiration`;
+`agent_deployer: agent with expiration`) and grants carry `optional_expires_at`.
+Demonstrate the incident window and — because it's contingent evaluation — show expiry
+without waiting (`bootstrap.py --window-minutes 0`), then instant `revoke.py`. Note this
+uses SpiceDB's built-in relationship expiration (preferred over a caveat for expiry).
+
+### CP4 — Relationship-based hierarchy (~20 min)
+Attendees add the cascade to the schema:
+```zed
+relation gated_by: environment          // production -> staging; staging -> itself
+permission agent_deploy = agent_deployer & gated_by->agent_deployer
+permission deploy = direct_deployer + agent_deploy
+```
+Production autonomy becomes contingent on staging autonomy. Revoke staging → production
+`agent_deploy` evaluates false automatically, no second delete. This is the payoff: the
+thing RBAC can't express cleanly. The web UI shows the suspended production grant as a
+dashed chip.
+
+### 5 — Next steps (~5 min)
+How this maps to a real platform team: modeling authority once as relationships,
+`CheckBulk` for "which of these N resources may this agent touch", on-behalf-of vs.
+advisory enforcement, and scaling ReBAC with SpiceDB (Zanzibar lineage). Links to the
+full solution repo and SpiceDB docs.
+
+## Verification
+
+- `starter/scripts/verify.py` asserts the expected decision matrix for the **current**
+  checkpoint (so a learner confirms their schema/`decide()` is correct before moving on),
+  mirroring the reference's `verify_permissions.py`. It runs against live SpiceDB, no LLM.
+- The web UI shows each decision (ALLOWED / NEEDS APPROVAL / BLOCKED) and the live
+  authority state (delegation chain + expiry countdown).
+- goose provides the natural-language "for real" path.
+
+## Prerequisites (stated in README/setup)
+
+- Docker (or a GitHub Codespace via the provided devcontainer)
+- Python 3.10+
+- goose installed, plus an API key for any LLM goose supports (only needed for the
+  goose path; the deterministic verifier + web UI need no LLM)
+
+## Decisions & defaults
+
+- **Language:** Python (matches the demo and the authzed/langchain workshop stack).
+- **SpiceDB:** local via Docker Compose, `authzed/spicedb:latest`, insecure preshared key
+  (`somerandomkeyhere` or `devtoken`), expiration enabled via
+  `--enable-experimental-relationship-expiration`.
+- **Solution source:** adapt the tested `goose-spicedb-delegation` repo — the `starter/`
+  is that code with `schema.zed` and `authz.decide()` stubbed; checkpoints contain the
+  exact code to fill in.
+- **Provided vs. implemented:** implemented by learner = schema + `decide()`; provided =
+  everything else.
+
+## Non-goals
+
+- Not a goose internals or prompt-engineering workshop.
+- Not production deployment of SpiceDB (Kubernetes/Operator) — that's a different
+  workshop; touched only in Next Steps.
+- No cloud accounts or paid services beyond an optional LLM key.
+- Not multi-agent fleets (mentioned in Next Steps only).
+
+## To verify at build time
+
+- Exact goose custom-extension config (config.yaml stanza / `goose configure`) — reuse
+  the demo's verified `goose-extension.md`.
+- Codespaces devcontainer that runs `docker compose up -d` + installs deps on create.
+- `scripts/verify.py` output format and the per-checkpoint assertions matching each
+  schema state.
+
+## Success criteria
+
+- A learner starting from a clean clone completes setup, then all four checkpoints, with
+  `scripts/verify.py` passing at each, on Docker or Codespaces.
+- CP1 visibly over-reaches; CP2 produces the three-way decision; CP3 shows expiry +
+  revoke; CP4 shows the staging→production cascade.
+- The goose path and the web-UI/CLI path both demonstrate each checkpoint's behavior.
+- Total content paces to ~90 minutes.

From 5a53d9ef454263b2a1752919e6f47b16c8f7f004 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 16:18:38 +0200
Subject: [PATCH 02/27] Implementation plan: Delegated Authorization for AI
 Agents workshop

---
 ...026-08-04-delegated-agent-authorization.md | 620 ++++++++++++++++++
 1 file changed, 620 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-08-04-delegated-agent-authorization.md

diff --git a/docs/superpowers/plans/2026-08-04-delegated-agent-authorization.md b/docs/superpowers/plans/2026-08-04-delegated-agent-authorization.md
new file mode 100644
index 0000000..22e034e
--- /dev/null
+++ b/docs/superpowers/plans/2026-08-04-delegated-agent-authorization.md
@@ -0,0 +1,620 @@
+# Delegated Authorization for AI Agents — Workshop Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Build a self-guided, 90-minute hands-on workshop where attendees add delegated, fine-grained authorization (SpiceDB/ReBAC) to a goose DevOps deploy agent — learning scoped delegation, expiring grants, revocation, and hierarchical/cascading permissions.
+
+**Architecture:** A `starter/` app (goose MCP extension + web UI + SpiceDB via Docker) with two pieces stubbed — `schema.zed` and `authz.decide()`. Four checkpoint markdown files walk attendees through *run → watch it fail → implement → re-run → why*, growing the schema and implementing the decision engine. Provided plumbing is copied (with modifications) from the tested solution repo; the exact fill-in code lives in the checkpoints.
+
+**Tech Stack:** Python 3.10+, goose (MCP), SpiceDB (Docker Compose), FastAPI web UI, `authzed` async client, pytest-style `verify.py`.
+
+**Spec:** `docs/superpowers/specs/2026-08-04-delegated-agent-authorization-workshop-design.md`
+
+**Solution source (tested, on disk):** `/Users/sohan/code-samples/goose-spicedb-delegation/` — the finished reference. Provided files are copied from here with the modifications each task specifies.
+
+## Global Constraints
+
+- **Location:** everything under `delegated-agent-authorization/` in the `authzed/workshops` repo, on branch `workshop/delegated-agent-authorization`.
+- **SpiceDB token:** `devtoken` everywhere (docker-compose `SPICEDB_GRPC_PRESHARED_KEY`, `.env.example` `SPICEDB_TOKEN`, `spicedb_client` default). This differs from the solution repo's `somerandomkeyhere` — change it on copy.
+- **SpiceDB image/flags:** `authzed/spicedb:latest`, `serve --enable-experimental-relationship-expiration`, `SPICEDB_GRPC_NO_TLS=true`, endpoint `localhost:50051`, postgres datastore.
+- **Python 3.10+.** Provided modules keep the solution's async `authzed.api.v1.Client` patterns (all calls awaited).
+- **Agent identity:** `agent:goose_alice`, delegator `user:alice`.
+- **Tools exposed by the extension (trimmed for teaching):** `list_environments`, `deploy`, `destroy`. (The solution also has `rollback`; omit it here to reduce surface — note this in Next Steps.)
+- **`decide()` signature (workshop, simpler than the solution):** `async def decide(client, agent_id, permission, environment_id) -> AuthzResult` — no `action` parameter.
+- **`revoke.py` is an ungated operator CLI in the workshop** (no `manage`/`view` permissions — those are solution-only hardening). Call this out in Next Steps as a production follow-up.
+- **`list_environments` is ungated** in the workshop (no `view` permission). Next-Steps follow-up.
+- **Build-time:** only one SpiceDB can bind `localhost:50051`. Before testing, ensure no other local SpiceDB (e.g. the solution repo's) is running: `docker ps --filter publish=50051`.
+- **Checkpoint stub convention:** stubbed files carry a `WORKSHOP STUB` docstring and `# TODO(Checkpoint N):` markers, matching the reference workshop.
+- **Match the reference workshop's tone/structure** for all markdown: read `../agentic-rag-authorization/{0-setup,1-agentic-rag,2-secure-it,3-nextsteps}.md` before authoring. Declarative headings; each checkpoint ends with a `## Completion Milestone` checkbox list; both a goose path and a deterministic (`verify.py` + web UI) path.
+
+---
+
+### Task 1: Scaffold folder, provided plumbing, CP1 stubs, and verify.py
+
+**Files:**
+- Create dir: `delegated-agent-authorization/starter/`
+- Copy (with mods below) from solution → `starter/`: `docker-compose.yml`, `spicedb_client.py`, `relationships.py`, `deploybot_server.py`, `web.py`, `static/index.html`, `requirements.txt`, `.env.example`, `goose-extension.md`
+- Create: `starter/schema.zed` (CP1 stub), `starter/authz.py` (provided helpers + `decide()` stub), `starter/bootstrap.py`, `starter/approve.py`, `starter/revoke.py`, `starter/scripts/verify.py`, `starter/.devcontainer/devcontainer.json`
+
+**Interfaces:**
+- Produces (provided, used by later tasks and the extension):
+  - `authz.check(client, sub_type, sub_id, permission, res_type, res_id) -> bool`
+  - `authz.read_delegator(client, agent_id) -> str | None`
+  - `authz.expiry_from_now(minutes) -> Timestamp`
+  - `authz.Decision` (str Enum ALLOWED/NEEDS_APPROVAL/BLOCKED), `authz.AuthzResult(decision, reason)`
+  - `authz.decide(client, agent_id, permission, environment_id) -> AuthzResult` (STUB in CP1)
+  - `bootstrap.write_schema(client)`, `bootstrap.seed(client, window_minutes=60)`, `bootstrap.AGENT_ID="goose_alice"`
+  - `deploybot_server.do_list_environments/do_deploy/do_destroy`, `STATE_PATH`, `AGENT_ID`
+  - `spicedb_client.make_client()`
+
+- [ ] **Step 1: Create the folder and copy provided files with modifications**
+
+Copy these from `/Users/sohan/code-samples/goose-spicedb-delegation/` into `starter/`, applying mods:
+- `spicedb_client.py` — change token default `somerandomkeyhere` → `devtoken`.
+- `relationships.py` — copy verbatim (`rel(...)`, `agent_deployer_filter(...)`).
+- `docker-compose.yml` — copy; set `SPICEDB_GRPC_PRESHARED_KEY: "${SPICEDB_TOKEN:-devtoken}"`; keep `serve --enable-experimental-relationship-expiration`.
+- `deploybot_server.py` — copy, then: remove the `do_rollback`/`rollback` tool and its wrapper; remove the `check`-based gating in `do_list_environments` (make it ungated — just list all envs); ensure imports are `from authz import Decision, decide` (drop `check`); each mutating tool calls `decide(make_client(), AGENT_ID, "deploy"|"destroy", environment)` and mutates only on ALLOWED (keep the solution's `_decide_and_mutate` helper but drop the `action=` argument to match the workshop `decide()` signature).
+- `web.py` — copy, then in `/api/state` compute `effective = await check(client, "agent", AGENT_ID, "deploy", environment)` (NOT `agent_deploy` — `deploy` routes through the cascade automatically once CP4 rewires it, and exists from CP2). Keep the delegation/expiry reads. Remove any `agent_deploy` references.
+- `static/index.html` — copy verbatim (includes the walking-goose indicator and authority bar).
+- `requirements.txt` — copy (authzed, grpcio, mcp, fastapi, uvicorn, python-dotenv, pytest, pytest-asyncio).
+- `.env.example` — set `SPICEDB_TOKEN=devtoken`, `SPICEDB_ENDPOINT=localhost:50051`, `AGENT_SUBJECT=agent:goose_alice`.
+- `goose-extension.md` — copy; update the absolute-path examples to `.../delegated-agent-authorization/starter/...`.
+
+- [ ] **Step 2: Write `starter/schema.zed` (CP1 stub)**
+
+```zed
+// WORKSHOP STUB — you will build this schema up across Checkpoints 2–4.
+// It defines the object types but grants the agent nothing. Combined with the
+// authz.decide() stub, the deploy agent runs UNGATED in Checkpoint 1.
+// TODO(Checkpoint 2): model delegated authorization here.
+
+definition user {}
+
+definition agent {
+    relation delegator: user
+}
+
+definition environment {}
+```
+
+- [ ] **Step 3: Write `starter/authz.py` (provided helpers + `decide()` stub)**
+
+```python
+"""authz.py — SpiceDB helpers (provided) + the decision engine (you implement)."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from enum import Enum
+
+from google.protobuf.timestamp_pb2 import Timestamp
+from authzed.api.v1 import (
+    CheckPermissionRequest,
+    CheckPermissionResponse,
+    Consistency,
+    ObjectReference,
+    ReadRelationshipsRequest,
+    RelationshipFilter,
+    SubjectReference,
+)
+
+
+class Decision(str, Enum):
+    ALLOWED = "ALLOWED"
+    NEEDS_APPROVAL = "NEEDS_APPROVAL"
+    BLOCKED = "BLOCKED"
+
+
+@dataclass
+class AuthzResult:
+    decision: Decision
+    reason: str
+
+
+def expiry_from_now(minutes: int) -> Timestamp:
+    """A protobuf Timestamp `minutes` from now, for a relationship's optional_expires_at."""
+    ts = Timestamp()
+    ts.FromDatetime(datetime.now(timezone.utc) + timedelta(minutes=minutes))
+    return ts
+
+
+async def check(client, sub_type, sub_id, permission, res_type, res_id) -> bool:
+    """Does `subject` have `permission` on `resource`? A single SpiceDB CheckPermission."""
+    resp = await client.CheckPermission(
+        CheckPermissionRequest(
+            consistency=Consistency(fully_consistent=True),
+            resource=ObjectReference(object_type=res_type, object_id=res_id),
+            permission=permission,
+            subject=SubjectReference(
+                object=ObjectReference(object_type=sub_type, object_id=sub_id)
+            ),
+        )
+    )
+    return resp.permissionship == CheckPermissionResponse.PERMISSIONSHIP_HAS_PERMISSION
+
+
+async def read_delegator(client, agent_id) -> str | None:
+    """The user this agent acts for (agent:<id>#delegator), or None."""
+    req = ReadRelationshipsRequest(
+        consistency=Consistency(fully_consistent=True),
+        relationship_filter=RelationshipFilter(
+            resource_type="agent",
+            optional_resource_id=agent_id,
+            optional_relation="delegator",
+        ),
+    )
+    async for resp in client.ReadRelationships(req):
+        return resp.relationship.subject.object.object_id
+    return None
+
+
+async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
+    # WORKSHOP STUB — Checkpoint 1.
+    # Returns ALLOWED for everything WITHOUT consulting SpiceDB. This is exactly why
+    # the agent over-reaches in Checkpoint 1. You implement the real, SpiceDB-backed
+    # three-way decision in Checkpoint 2.
+    # TODO(Checkpoint 2): replace this stub.
+    return AuthzResult(Decision.ALLOWED, "no authorization configured (workshop stub)")
+```
+
+- [ ] **Step 4: Write `starter/bootstrap.py`**
+
+Copy the solution's `bootstrap.py` structure, but the seed is the CP2 set with NO expiration and NO gated_by yet (those are added by CP3/CP4 checkpoints):
+
+```python
+"""bootstrap.py — write the schema and seed the delegation graph."""
+import argparse
+import asyncio
+from pathlib import Path
+
+from authzed.api.v1 import (
+    DeleteRelationshipsRequest,
+    WriteRelationshipsRequest,
+    WriteSchemaRequest,
+)
+
+from relationships import agent_deployer_filter, rel
+from spicedb_client import make_client
+
+SCHEMA_PATH = Path(__file__).parent / "schema.zed"
+AGENT_ID = "goose_alice"
+
+
+async def write_schema(client) -> None:
+    await client.WriteSchema(WriteSchemaRequest(schema=SCHEMA_PATH.read_text()))
+
+
+async def _reset_agent_grants(client) -> None:
+    await client.DeleteRelationships(
+        DeleteRelationshipsRequest(relationship_filter=agent_deployer_filter(AGENT_ID))
+    )
+
+
+async def seed(client, window_minutes: int = 60) -> None:
+    await _reset_agent_grants(client)
+    updates = [
+        rel("environment", "staging", "direct_deployer", "user", "alice"),
+        rel("environment", "production", "direct_deployer", "user", "alice"),
+        rel("environment", "production", "approver", "user", "alice"),
+        rel("environment", "staging", "destroyer", "user", "sre_admin"),
+        rel("environment", "production", "destroyer", "user", "sre_admin"),
+        rel("agent", AGENT_ID, "delegator", "user", "alice"),
+        # Checkpoint 2: staging-only delegation (no expiration yet).
+        rel("environment", "staging", "agent_deployer", "agent", AGENT_ID),
+    ]
+    await client.WriteRelationships(WriteRelationshipsRequest(updates=updates))
+
+
+async def main() -> None:
+    parser = argparse.ArgumentParser(description="Bootstrap the delegated-agent-authorization workshop.")
+    parser.add_argument("--window-minutes", type=int, default=60,
+                        help="Minutes the agent's staging delegation stays valid (Checkpoint 3+).")
+    args = parser.parse_args()
+    client = make_client()
+    print("Writing schema...")
+    await write_schema(client)
+    print(f"Seeding delegation graph (window = {args.window_minutes} min)...")
+    await seed(client, window_minutes=args.window_minutes)
+    print("Done.")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())
+```
+
+Note: `seed()` ignores `window_minutes` until Checkpoint 3 (added there). `_reset_agent_grants` makes reseeding idempotent.
+
+- [ ] **Step 5: Write `starter/approve.py` (CP2 version — no expiry) and `starter/revoke.py` (ungated)**
+
+`approve.py` (CP2 — writes an `agent_deployer` grant with NO expiration; Checkpoint 3 upgrades it):
+```python
+"""approve.py — human-in-the-loop: grant the agent deploy on an environment."""
+import argparse
+import asyncio
+
+from authzed.api.v1 import WriteRelationshipsRequest
+
+from authz import check, read_delegator
+from relationships import rel
+from spicedb_client import make_client
+
+
+async def approve(approver: str, environment: str, agent_id: str, minutes: int) -> int:
+    client = make_client()
+    if not await check(client, "user", approver, "approve", "environment", environment):
+        print(f"❌ Refused: user:{approver} is not an approver on environment:{environment}")
+        return 1
+    delegator = await read_delegator(client, agent_id)
+    if not (delegator and await check(client, "user", delegator, "deploy", "environment", environment)):
+        who = f"user:{delegator}" if delegator else "(no delegator)"
+        print(f"❌ Refused: agent:{agent_id}'s delegator {who} may not deploy environment:{environment}")
+        return 1
+    update = rel("environment", environment, "agent_deployer", "agent", agent_id)
+    await client.WriteRelationships(WriteRelationshipsRequest(updates=[update]))
+    print(f"✅ Approved: agent:{agent_id} may deploy environment:{environment}")
+    return 0
+
+
+if __name__ == "__main__":
+    p = argparse.ArgumentParser(description="Approve an agent deploy grant.")
+    p.add_argument("--approver", default="alice")
+    p.add_argument("--env", default="production")
+    p.add_argument("--agent", default="goose_alice")
+    p.add_argument("--minutes", type=int, default=10)
+    a = p.parse_args()
+    raise SystemExit(asyncio.run(approve(a.approver, a.env, a.agent, a.minutes)))
+```
+
+`revoke.py` (ungated operator CLI, unchanged across checkpoints):
+```python
+"""revoke.py — delete an agent's deploy grant on an environment (operator CLI)."""
+import argparse
+import asyncio
+
+from authzed.api.v1 import DeleteRelationshipsRequest
+
+from relationships import agent_deployer_filter
+from spicedb_client import make_client
+
+
+async def revoke(environment: str, agent_id: str) -> int:
+    client = make_client()
+    await client.DeleteRelationships(
+        DeleteRelationshipsRequest(
+            relationship_filter=agent_deployer_filter(agent_id, environment)
+        )
+    )
+    print(f"✅ Revoked: agent:{agent_id} agent_deployer on environment:{environment}")
+    return 0
+
+
+if __name__ == "__main__":
+    p = argparse.ArgumentParser(description="Revoke an agent deploy grant.")
+    p.add_argument("--env", default="staging")
+    p.add_argument("--agent", default="goose_alice")
+    a = p.parse_args()
+    raise SystemExit(asyncio.run(revoke(a.env, a.agent)))
+```
+
+- [ ] **Step 6: Write `starter/scripts/verify.py` (per-checkpoint deterministic verifier)**
+
+```python
+"""verify.py — deterministic checks for the current checkpoint. No LLM needed.
+
+Usage: python scripts/verify.py --checkpoint N
+Run from the starter/ directory with SpiceDB up.
+"""
+import argparse
+import asyncio
+import sys
+
+from authz import Decision, decide
+import bootstrap
+from approve import approve
+from revoke import revoke
+from spicedb_client import make_client
+
+AGENT = "goose_alice"
+
+
+def _ok(label, got, want):
+    mark = "✅" if got == want else "❌"
+    print(f"  {mark} {label}: got {got}, want {want}")
+    return got == want
+
+
+async def checkpoint_1():
+    # The stub decides ALLOWED for everything — the over-reach.
+    r = await decide(make_client(), AGENT, "destroy", "production")
+    return _ok("stub allows destroy production (over-reach)", r.decision, Decision.ALLOWED)
+
+
+async def checkpoint_2(client):
+    await bootstrap.write_schema(client)
+    await bootstrap.seed(client)
+    passed = True
+    passed &= _ok("agent deploy staging", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.ALLOWED)
+    passed &= _ok("agent deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.NEEDS_APPROVAL)
+    passed &= _ok("agent destroy production", (await decide(client, AGENT, "destroy", "production")).decision, Decision.BLOCKED)
+    await approve("alice", "production", AGENT, 10)
+    passed &= _ok("after approve: deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.ALLOWED)
+    return passed
+
+
+async def checkpoint_3(client):
+    # Expired window -> staging autonomy gone (falls back to NEEDS_APPROVAL).
+    await bootstrap.write_schema(client)
+    await bootstrap.seed(client, window_minutes=0)
+    passed = _ok("expired staging grant", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.NEEDS_APPROVAL)
+    # Revocation on a fresh window.
+    await bootstrap.seed(client, window_minutes=60)
+    await revoke("staging", AGENT)
+    passed &= _ok("after revoke: deploy staging", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.NEEDS_APPROVAL)
+    return passed
+
+
+async def checkpoint_4(client):
+    await bootstrap.write_schema(client)
+    await bootstrap.seed(client, window_minutes=60)
+    await approve("alice", "production", AGENT, 10)
+    passed = _ok("with both grants: deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.ALLOWED)
+    await revoke("staging", AGENT)  # revoke the BASE
+    passed &= _ok("cascade: deploy staging", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.NEEDS_APPROVAL)
+    passed &= _ok("cascade: deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.NEEDS_APPROVAL)
+    return passed
+
+
+async def main(n):
+    print(f"Verifying Checkpoint {n}...")
+    if n == 1:
+        passed = await checkpoint_1()
+    else:
+        client = make_client()
+        passed = await {2: checkpoint_2, 3: checkpoint_3, 4: checkpoint_4}[n](client)
+    print("PASS ✅" if passed else "FAIL ❌")
+    return 0 if passed else 1
+
+
+if __name__ == "__main__":
+    p = argparse.ArgumentParser()
+    p.add_argument("--checkpoint", type=int, required=True, choices=[1, 2, 3, 4])
+    raise SystemExit(asyncio.run(main(p.parse_args().checkpoint)))
+```
+
+- [ ] **Step 7: Write `starter/.devcontainer/devcontainer.json`**
+
+```json
+{
+  "name": "delegated-agent-authorization",
+  "image": "mcr.microsoft.com/devcontainers/python:3.12",
+  "features": { "ghcr.io/devcontainers/features/docker-in-docker:2": {} },
+  "postCreateCommand": "pip install -r requirements.txt && docker compose up -d",
+  "forwardPorts": [8000, 50051]
+}
+```
+
+- [ ] **Step 8: Smoke test — infra up + CP1 over-reach**
+
+Run from `starter/` (ensure nothing else holds :50051):
+```bash
+python -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
+docker compose up -d --wait
+python -c "import deploybot_server, web, authz, bootstrap, approve, revoke"   # imports resolve
+python scripts/verify.py --checkpoint 1
+```
+Expected: imports succeed; verify prints `✅ stub allows destroy production (over-reach)` and `PASS ✅`.
+
+- [ ] **Step 9: Commit**
+
+```bash
+cd ~/authzed-branches/workshops
+git add delegated-agent-authorization/starter
+git commit -m "feat(workshop): starter scaffolding, provided plumbing, CP1 stubs, verify.py"
+```
+
+---
+
+### Task 2: `0-setup.md`
+
+**Files:** Create `delegated-agent-authorization/0-setup.md`
+
+- [ ] **Step 1: Author the setup doc** — model it on `../agentic-rag-authorization/0-setup.md`. Cover, in this order:
+  1. One-paragraph framing: build a goose deploy agent, then add delegated authorization with SpiceDB; the `starter/` is stubbed on purpose.
+  2. Get the code: `git clone https://github.com/authzed/workshops.git` → `cd workshops/delegated-agent-authorization/starter`.
+  3. Option A — local Docker: `cp .env.example .env`, add an LLM key for goose (note: only needed for the goose path; the `verify.py`/web-UI path needs no LLM), `docker compose up -d` (brings up postgres + SpiceDB with the expiration flag on `devtoken`), venv + `pip install -r requirements.txt`.
+  4. Option B — Codespaces: the `.devcontainer/` runs compose + installs deps on create.
+  5. Install goose and register the deploy-bot extension: reference `goose-extension.md` (absolute paths to `.venv/bin/python` and `deploybot_server.py`, env `SPICEDB_ENDPOINT`/`SPICEDB_TOKEN=devtoken`/`AGENT_SUBJECT=agent:goose_alice`).
+  6. `## Completion Milestone: Setup` checklist: repo cloned; infra up (Docker or Codespaces); `.env` has an LLM key (goose path); extension registered in goose.
+  7. Ends: `Next: [Checkpoint 1 — Run the agent](1-run-the-agent.md)`.
+
+- [ ] **Step 2: Verify** — from a clean read, the commands are copy-pasteable and consistent with Task 1's files (token `devtoken`, port 50051, paths). Confirm `docker compose up -d --wait` succeeds and goose config keys match `goose-extension.md`.
+
+- [ ] **Step 3: Commit** `docs(workshop): 0-setup`.
+
+---
+
+### Task 3: `1-run-the-agent.md` (Checkpoint 1 — watch it over-reach)
+
+**Files:** Create `delegated-agent-authorization/1-run-the-agent.md`
+
+- [ ] **Step 1: Author the checkpoint** — model on `../agentic-rag-authorization/1-agentic-rag.md`. Cover:
+  1. The flow: goose calls the deploy-bot MCP extension; every tool routes through `authz.decide()` before acting.
+  2. Show the `decide()` stub (quote the `WORKSHOP STUB` block from `authz.py`) and explain: it returns ALLOWED without consulting SpiceDB.
+  3. **Watch it over-reach (goose path):** in a `goose session`, ask *"Deploy checkout to production"*, then *"Tear down the production environment."* Both execute — the agent has no authorization boundary.
+  4. **Deterministic path:** `python scripts/verify.py --checkpoint 1` → shows the stub allows `destroy production`.
+  5. Why: an agent runs with its host's ambient authority; with no authorization boundary, it can do anything the credentials can. Putting the rule in the prompt is not enough — a prompt can be bypassed.
+  6. `## Completion Milestone: Checkpoint 1` — ran the agent; reproduced the over-reach via goose and/or `verify.py`; can explain why ambient authority is the problem.
+  7. `Next: [Checkpoint 2 — Delegated authorization](2-delegated-authorization.md)`.
+
+- [ ] **Step 2: Verify** — the quoted stub matches `authz.py` exactly; `verify.py --checkpoint 1` output matches what the doc claims.
+
+- [ ] **Step 3: Commit** `docs(workshop): CP1 run-the-agent`.
+
+---
+
+### Task 4: `2-delegated-authorization.md` (Checkpoint 2 — the core)
+
+**Files:** Create `delegated-agent-authorization/2-delegated-authorization.md`
+
+**Interfaces:** the fill-in code here must reproduce the CP2 state that `verify.py --checkpoint 2` asserts (staging ALLOWED, prod NEEDS_APPROVAL, destroy BLOCKED, post-approve prod ALLOWED).
+
+- [ ] **Step 1: Author the checkpoint** — model on `../agentic-rag-authorization/2-secure-it.md`. Cover:
+  1. **Concepts (inline):** ReBAC vs. RBAC; Google Zanzibar; why the decision must be a deterministic check, not the prompt.
+  2. **Write the schema** — attendee replaces `schema.zed` with (this exact block):
+     ```zed
+     definition user {}
+     definition agent { relation delegator: user }
+     definition environment {
+         relation direct_deployer: user
+         relation agent_deployer: agent
+         relation approver: user
+         relation destroyer: user
+         permission deploy  = direct_deployer + agent_deployer
+         permission approve = approver
+         permission destroy = destroyer
+     }
+     ```
+     Explain each relation/permission and the delegation idea (`agent.delegator`).
+  3. **Seed it:** `python bootstrap.py` (writes schema + relationships: alice deploys both envs + approves prod; sre_admin is the only destroyer; the agent is delegated staging-only).
+  4. **Implement `decide()`** — attendee replaces the stub with (this exact block):
+     ```python
+     async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
+         if await check(client, "agent", agent_id, permission, "environment", environment_id):
+             return AuthzResult(Decision.ALLOWED,
+                 f"agent:{agent_id} holds delegated '{permission}' on environment:{environment_id}")
+         delegator = await read_delegator(client, agent_id)
+         if delegator and await check(client, "user", delegator, permission, "environment", environment_id):
+             return AuthzResult(Decision.NEEDS_APPROVAL,
+                 f"agent:{agent_id} lacks '{permission}'; delegator user:{delegator} holds it — human approval required")
+         return AuthzResult(Decision.BLOCKED,
+             f"neither agent:{agent_id} nor its delegator may '{permission}' environment:{environment_id}")
+     ```
+     Explain the three-way logic: agent's own grant → ALLOWED; else the human it acts for could → NEEDS APPROVAL; else BLOCKED.
+  5. **See it (both paths):** start the web UI (`python web.py`, open `http://127.0.0.1:8000`) — deploy staging ✅, deploy prod ⏸, destroy 🚫; run `python approve.py --approver alice --env production` then retry prod → ✅. And in goose, the same prompts. Deterministic: `python scripts/verify.py --checkpoint 2` → `PASS ✅`.
+  6. Why the check (not the prompt) is the boundary — deterministic, unbypassable, the agent only ever gets an answer SpiceDB computed.
+  7. `## Completion Milestone: Checkpoint 2` — wrote the schema; seeded; implemented `decide()`; `verify.py --checkpoint 2` passes; saw the three-way decision in the UI and/or goose; can explain ReBAC.
+  8. `Next: [Checkpoint 3 — Time-bound and revocable](3-time-bound-and-revocable.md)`.
+
+- [ ] **Step 2: Verify the fill-ins reach the CP2 state** — from `starter/`, apply the schema + `decide()` blocks from the doc, then:
+  ```bash
+  python scripts/verify.py --checkpoint 2
+  ```
+  Expected `PASS ✅`. (Restore the stubs afterward so `starter/` ships stubbed: `git checkout starter/schema.zed starter/authz.py`.)
+
+- [ ] **Step 3: Commit** `docs(workshop): CP2 delegated-authorization`.
+
+---
+
+### Task 5: `3-time-bound-and-revocable.md` (Checkpoint 3)
+
+**Files:** Create `delegated-agent-authorization/3-time-bound-and-revocable.md`
+
+**Interfaces:** fill-ins must reach the CP3 state `verify.py --checkpoint 3` asserts (window 0 → NEEDS_APPROVAL; revoke → NEEDS_APPROVAL). Requires the schema `agent_deployer: agent with expiration`, `seed()`/`approve.py` writing `optional_expires_at`.
+
+- [ ] **Step 1: Author the checkpoint.** Cover:
+  1. Concept: temporary access — incident windows. SpiceDB's built-in relationship expiration (preferred over a caveat; evaluated server-side; garbage-collected).
+  2. **Schema edit:** add `use expiration` at the top and change the relation to `relation agent_deployer: agent with expiration`. (Show the exact diff.)
+  3. **Update the seed** — in `bootstrap.py`, change the staging grant line to carry an expiry:
+     ```python
+     from authz import expiry_from_now
+     # ...
+     rel("environment", "staging", "agent_deployer", "agent", AGENT_ID,
+         expires_at=expiry_from_now(window_minutes)),
+     ```
+  4. **Update `approve.py`** — write the grant with an expiry:
+     ```python
+     from authz import check, read_delegator, expiry_from_now
+     # ...
+     update = rel("environment", environment, "agent_deployer", "agent", agent_id,
+                  expires_at=expiry_from_now(minutes))
+     ```
+  5. **See expiry without waiting:** `python bootstrap.py --window-minutes 0` seeds an already-expired staging grant → the agent's autonomous staging deploy drops to NEEDS APPROVAL. Then **revocation:** `python revoke.py --env staging` → same effect, instantly. Both visible in the web UI (grant disappears / countdown) and via `python scripts/verify.py --checkpoint 3`.
+  6. Why contingent evaluation beats a cron job that deletes grants.
+  7. `## Completion Milestone: Checkpoint 3` — added expiration to schema + seed + approve; demoed the window and revoke; `verify.py --checkpoint 3` passes.
+  8. `Next: [Checkpoint 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md)`.
+
+- [ ] **Step 2: Verify the fill-ins** — apply CP2 fill-ins + CP3 edits, then `python scripts/verify.py --checkpoint 3` → `PASS ✅`. Restore stubs after (`git checkout starter/`).
+
+- [ ] **Step 3: Commit** `docs(workshop): CP3 time-bound-and-revocable`.
+
+---
+
+### Task 6: `4-relationship-based-hierarchy.md` (Checkpoint 4 — the payoff)
+
+**Files:** Create `delegated-agent-authorization/4-relationship-based-hierarchy.md`
+
+**Interfaces:** fill-ins must reach the CP4 state `verify.py --checkpoint 4` asserts (both grants → prod ALLOWED; revoke staging → staging AND production NEEDS_APPROVAL — the cascade). Requires `gated_by`, `agent_deploy = agent_deployer & gated_by->agent_deployer`, `deploy = direct_deployer + agent_deploy`, and gated_by seed.
+
+- [ ] **Step 1: Author the checkpoint.** Cover:
+  1. Concept: hierarchical/contingent authority — production autonomy should depend on staging autonomy. RBAC can't express this without a role-per-combination explosion.
+  2. **Schema edit** (show exact additions):
+     ```zed
+     // inside definition environment:
+     relation gated_by: environment
+     permission agent_deploy = agent_deployer & gated_by->agent_deployer
+     permission deploy = direct_deployer + agent_deploy
+     ```
+     Explain the intersection + arrow: the agent may deploy here only if it holds this env's grant AND the gating env's grant. Staging gates itself (base); production is gated by staging.
+  3. **Seed gated_by** — add to `bootstrap.seed()`:
+     ```python
+     rel("environment", "staging", "gated_by", "environment", "staging"),
+     rel("environment", "production", "gated_by", "environment", "staging"),
+     ```
+  4. **See the cascade:** re-seed; `python approve.py --approver alice --env production` (agent now deploys both). Then `python revoke.py --env staging` — production autonomy suspends automatically, no second delete. Web UI shows production as a dashed *suspended* grant. `python scripts/verify.py --checkpoint 4` → `PASS ✅`.
+  5. Why: it's contingent *evaluation*, not a delete — so it's suspend-not-erase (re-granting staging revives production while its window lasts). This is the ReBAC superpower.
+  6. `## Completion Milestone: Checkpoint 4` — added `gated_by` + `agent_deploy`; seeded the hierarchy; demoed the staging→production cascade; `verify.py --checkpoint 4` passes; can explain why RBAC can't do this.
+  7. `Next: [Next steps](5-nextsteps.md)`.
+
+- [ ] **Step 2: Verify the fill-ins** — apply CP2+CP3+CP4 edits, then `python scripts/verify.py --checkpoint 4` → `PASS ✅`. Confirm the resulting schema matches the tested solution's `schema.zed` behavior. Restore stubs after (`git checkout starter/`).
+
+- [ ] **Step 3: Commit** `docs(workshop): CP4 relationship-based-hierarchy`.
+
+---
+
+### Task 7: `README.md`, `5-nextsteps.md`, and full end-to-end validation
+
+**Files:** Create `delegated-agent-authorization/README.md`, `delegated-agent-authorization/5-nextsteps.md`
+
+- [ ] **Step 1: Author `README.md`** — model on `../agentic-rag-authorization/README.md`. Include: the title + abstract (from the conference listing); "Why this matters" (agents run with credentials that touch everything); "What you'll build" (bulleted); prerequisites (Docker/Codespaces, Python 3.10+, goose + an LLM key for the goose path); the **90-minute module map** with the per-checkpoint timing from the spec (Setup 15 · CP1 10 · CP2 25 · CP3 15 · CP4 20 · Next Steps 5); a link to the full reference solution `https://github.com/sohanmaheshwar/goose-spicedb-delegation`; and the ordered module links. End with "Let's get started with [Setup](0-setup.md)."
+
+- [ ] **Step 2: Author `5-nextsteps.md`.** Cover: modeling authority once as relationships for a whole platform; `CheckBulk` for "which of these N resources may this agent touch"; on-behalf-of vs. advisory enforcement; production hardening the workshop deliberately skipped (gate `revoke`/admin actions behind a `manage` permission; gate `list_environments` behind a `view` permission — point to the solution repo which does both); scaling ReBAC with SpiceDB (Zanzibar lineage, Kubernetes — link the other AuthZed workshop). Keep it a short zoom-out.
+
+- [ ] **Step 3: Full end-to-end validation (the integration test).** From a fresh `starter/` (stubs in place), walk the entire workshop in order, applying each checkpoint's fill-in code from the markdown and running its verifier:
+  ```bash
+  cd delegated-agent-authorization/starter
+  docker compose up -d --wait
+  python scripts/verify.py --checkpoint 1            # stub over-reach: PASS
+  # apply CP2 schema + decide() from 2-delegated-authorization.md
+  python scripts/verify.py --checkpoint 2            # PASS
+  # apply CP3 edits from 3-time-bound-and-revocable.md
+  python scripts/verify.py --checkpoint 3            # PASS
+  # apply CP4 edits from 4-relationship-based-hierarchy.md
+  python scripts/verify.py --checkpoint 4            # PASS
+  git checkout schema.zed authz.py bootstrap.py approve.py   # restore ship-state stubs
+  ```
+  All four must PASS. This proves the checkpoints' embedded code is correct and complete. Fix any checkpoint whose fill-ins don't reach its verifier state.
+
+- [ ] **Step 4: Confirm `starter/` ships stubbed** — `git status` clean; `schema.zed` and `authz.decide()` are the CP1 stubs; `bootstrap.py`/`approve.py` are the CP2 versions (no expiry).
+
+- [ ] **Step 5: Commit** `docs(workshop): README, next steps, end-to-end validated`.
+
+---
+
+## Self-Review
+
+**Spec coverage:**
+- Folder/structure → Task 1 + doc tasks. ✓
+- Guided-implement (schema + decide) → CP2 (Task 4), grown in CP3/CP4 (Tasks 5/6); everything else provided in Task 1. ✓
+- goose headline + deterministic verifier → both paths in every checkpoint; `verify.py` (Task 1) + web UI (copied Task 1). ✓
+- CP1 over-reach → Task 3 + `decide()` stub + `verify.py --checkpoint 1`. ✓
+- Delegation / 3-way → CP2 (Task 4). ✓
+- Time-bound + revoke → CP3 (Task 5). ✓
+- ReBAC hierarchy/cascade → CP4 (Task 6). ✓
+- Setup (Docker + Codespaces) → Task 2 + devcontainer (Task 1). ✓
+- README + module map + timing + next steps → Task 7. ✓
+- Prereqs, non-goals (no manage/view/rollback; revoke ungated) → Global Constraints + Next Steps follow-ups. ✓
+- Success criteria (clean clone → all checkpoints pass) → Task 7 Step 3 end-to-end validation. ✓
+
+**Placeholder scan:** All code blocks are complete and exact. `# TODO(Checkpoint N):` markers are intentional workshop-stub content, not plan placeholders. Doc-authoring steps specify exact embedded code + the reference file to match for tone (not "write prose").
+
+**Type consistency:** `decide(client, agent_id, permission, environment_id)` (no `action`) is consistent across authz.py, deploybot_server.py (Task 1 mod drops `action=`), verify.py, and the CP2 fill-in. `check`/`read_delegator`/`expiry_from_now`/`rel`/`agent_deployer_filter` signatures match the solution's and are used consistently. `deploy` (not `agent_deploy`) is the permission checked by web.py `/api/state` and verify.py — works CP2→CP4 because CP4 rewires `deploy` through `agent_deploy`.

From c1867be37047c434a9c3688f0a68cb8c83ce6bae Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 16:35:38 +0200
Subject: [PATCH 03/27] feat(workshop): starter scaffolding, provided plumbing,
 CP1 stubs, verify.py

---
 .../starter/.devcontainer/devcontainer.json   |   7 +
 .../starter/.env.example                      |   3 +
 .../starter/.gitignore                        |   4 +
 .../starter/approve.py                        |  35 +
 .../starter/authz.py                          |  75 +++
 .../starter/bootstrap.py                      |  58 ++
 .../starter/deploybot_server.py               |  94 +++
 .../starter/docker-compose.yml                |  49 ++
 .../starter/goose-extension.md                |  62 ++
 .../starter/relationships.py                  |  40 ++
 .../starter/requirements.txt                  |  14 +
 .../starter/revoke.py                         |  27 +
 .../starter/schema.zed                        |  12 +
 .../starter/scripts/verify.py                 |  85 +++
 .../starter/spicedb_client.py                 |  11 +
 .../starter/static/index.html                 | 604 ++++++++++++++++++
 delegated-agent-authorization/starter/web.py  | 167 +++++
 17 files changed, 1347 insertions(+)
 create mode 100644 delegated-agent-authorization/starter/.devcontainer/devcontainer.json
 create mode 100644 delegated-agent-authorization/starter/.env.example
 create mode 100644 delegated-agent-authorization/starter/.gitignore
 create mode 100644 delegated-agent-authorization/starter/approve.py
 create mode 100644 delegated-agent-authorization/starter/authz.py
 create mode 100644 delegated-agent-authorization/starter/bootstrap.py
 create mode 100644 delegated-agent-authorization/starter/deploybot_server.py
 create mode 100644 delegated-agent-authorization/starter/docker-compose.yml
 create mode 100644 delegated-agent-authorization/starter/goose-extension.md
 create mode 100644 delegated-agent-authorization/starter/relationships.py
 create mode 100644 delegated-agent-authorization/starter/requirements.txt
 create mode 100644 delegated-agent-authorization/starter/revoke.py
 create mode 100644 delegated-agent-authorization/starter/schema.zed
 create mode 100644 delegated-agent-authorization/starter/scripts/verify.py
 create mode 100644 delegated-agent-authorization/starter/spicedb_client.py
 create mode 100644 delegated-agent-authorization/starter/static/index.html
 create mode 100644 delegated-agent-authorization/starter/web.py

diff --git a/delegated-agent-authorization/starter/.devcontainer/devcontainer.json b/delegated-agent-authorization/starter/.devcontainer/devcontainer.json
new file mode 100644
index 0000000..2506c65
--- /dev/null
+++ b/delegated-agent-authorization/starter/.devcontainer/devcontainer.json
@@ -0,0 +1,7 @@
+{
+  "name": "delegated-agent-authorization",
+  "image": "mcr.microsoft.com/devcontainers/python:3.12",
+  "features": { "ghcr.io/devcontainers/features/docker-in-docker:2": {} },
+  "postCreateCommand": "pip install -r requirements.txt && docker compose up -d",
+  "forwardPorts": [8000, 50051]
+}
diff --git a/delegated-agent-authorization/starter/.env.example b/delegated-agent-authorization/starter/.env.example
new file mode 100644
index 0000000..28e0e97
--- /dev/null
+++ b/delegated-agent-authorization/starter/.env.example
@@ -0,0 +1,3 @@
+SPICEDB_ENDPOINT=localhost:50051
+SPICEDB_TOKEN=devtoken
+AGENT_SUBJECT=agent:goose_alice
diff --git a/delegated-agent-authorization/starter/.gitignore b/delegated-agent-authorization/starter/.gitignore
new file mode 100644
index 0000000..d328f57
--- /dev/null
+++ b/delegated-agent-authorization/starter/.gitignore
@@ -0,0 +1,4 @@
+__pycache__/
+*.pyc
+.env
+.venv/
diff --git a/delegated-agent-authorization/starter/approve.py b/delegated-agent-authorization/starter/approve.py
new file mode 100644
index 0000000..7f58e66
--- /dev/null
+++ b/delegated-agent-authorization/starter/approve.py
@@ -0,0 +1,35 @@
+"""approve.py — human-in-the-loop: grant the agent deploy on an environment."""
+import argparse
+import asyncio
+
+from authzed.api.v1 import WriteRelationshipsRequest
+
+from authz import check, read_delegator
+from relationships import rel
+from spicedb_client import make_client
+
+
+async def approve(approver: str, environment: str, agent_id: str, minutes: int) -> int:
+    client = make_client()
+    if not await check(client, "user", approver, "approve", "environment", environment):
+        print(f"❌ Refused: user:{approver} is not an approver on environment:{environment}")
+        return 1
+    delegator = await read_delegator(client, agent_id)
+    if not (delegator and await check(client, "user", delegator, "deploy", "environment", environment)):
+        who = f"user:{delegator}" if delegator else "(no delegator)"
+        print(f"❌ Refused: agent:{agent_id}'s delegator {who} may not deploy environment:{environment}")
+        return 1
+    update = rel("environment", environment, "agent_deployer", "agent", agent_id)
+    await client.WriteRelationships(WriteRelationshipsRequest(updates=[update]))
+    print(f"✅ Approved: agent:{agent_id} may deploy environment:{environment}")
+    return 0
+
+
+if __name__ == "__main__":
+    p = argparse.ArgumentParser(description="Approve an agent deploy grant.")
+    p.add_argument("--approver", default="alice")
+    p.add_argument("--env", default="production")
+    p.add_argument("--agent", default="goose_alice")
+    p.add_argument("--minutes", type=int, default=10)
+    a = p.parse_args()
+    raise SystemExit(asyncio.run(approve(a.approver, a.env, a.agent, a.minutes)))
diff --git a/delegated-agent-authorization/starter/authz.py b/delegated-agent-authorization/starter/authz.py
new file mode 100644
index 0000000..4aca33d
--- /dev/null
+++ b/delegated-agent-authorization/starter/authz.py
@@ -0,0 +1,75 @@
+"""authz.py — SpiceDB helpers (provided) + the decision engine (you implement)."""
+from __future__ import annotations
+
+from dataclasses import dataclass
+from datetime import datetime, timedelta, timezone
+from enum import Enum
+
+from google.protobuf.timestamp_pb2 import Timestamp
+from authzed.api.v1 import (
+    CheckPermissionRequest,
+    CheckPermissionResponse,
+    Consistency,
+    ObjectReference,
+    ReadRelationshipsRequest,
+    RelationshipFilter,
+    SubjectReference,
+)
+
+
+class Decision(str, Enum):
+    ALLOWED = "ALLOWED"
+    NEEDS_APPROVAL = "NEEDS_APPROVAL"
+    BLOCKED = "BLOCKED"
+
+
+@dataclass
+class AuthzResult:
+    decision: Decision
+    reason: str
+
+
+def expiry_from_now(minutes: int) -> Timestamp:
+    """A protobuf Timestamp `minutes` from now, for a relationship's optional_expires_at."""
+    ts = Timestamp()
+    ts.FromDatetime(datetime.now(timezone.utc) + timedelta(minutes=minutes))
+    return ts
+
+
+async def check(client, sub_type, sub_id, permission, res_type, res_id) -> bool:
+    """Does `subject` have `permission` on `resource`? A single SpiceDB CheckPermission."""
+    resp = await client.CheckPermission(
+        CheckPermissionRequest(
+            consistency=Consistency(fully_consistent=True),
+            resource=ObjectReference(object_type=res_type, object_id=res_id),
+            permission=permission,
+            subject=SubjectReference(
+                object=ObjectReference(object_type=sub_type, object_id=sub_id)
+            ),
+        )
+    )
+    return resp.permissionship == CheckPermissionResponse.PERMISSIONSHIP_HAS_PERMISSION
+
+
+async def read_delegator(client, agent_id) -> str | None:
+    """The user this agent acts for (agent:<id>#delegator), or None."""
+    req = ReadRelationshipsRequest(
+        consistency=Consistency(fully_consistent=True),
+        relationship_filter=RelationshipFilter(
+            resource_type="agent",
+            optional_resource_id=agent_id,
+            optional_relation="delegator",
+        ),
+    )
+    async for resp in client.ReadRelationships(req):
+        return resp.relationship.subject.object.object_id
+    return None
+
+
+async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
+    # WORKSHOP STUB — Checkpoint 1.
+    # Returns ALLOWED for everything WITHOUT consulting SpiceDB. This is exactly why
+    # the agent over-reaches in Checkpoint 1. You implement the real, SpiceDB-backed
+    # three-way decision in Checkpoint 2.
+    # TODO(Checkpoint 2): replace this stub.
+    return AuthzResult(Decision.ALLOWED, "no authorization configured (workshop stub)")
diff --git a/delegated-agent-authorization/starter/bootstrap.py b/delegated-agent-authorization/starter/bootstrap.py
new file mode 100644
index 0000000..1cb8d15
--- /dev/null
+++ b/delegated-agent-authorization/starter/bootstrap.py
@@ -0,0 +1,58 @@
+"""bootstrap.py — write the schema and seed the delegation graph."""
+import argparse
+import asyncio
+from pathlib import Path
+
+from authzed.api.v1 import (
+    DeleteRelationshipsRequest,
+    WriteRelationshipsRequest,
+    WriteSchemaRequest,
+)
+
+from relationships import agent_deployer_filter, rel
+from spicedb_client import make_client
+
+SCHEMA_PATH = Path(__file__).parent / "schema.zed"
+AGENT_ID = "goose_alice"
+
+
+async def write_schema(client) -> None:
+    await client.WriteSchema(WriteSchemaRequest(schema=SCHEMA_PATH.read_text()))
+
+
+async def _reset_agent_grants(client) -> None:
+    await client.DeleteRelationships(
+        DeleteRelationshipsRequest(relationship_filter=agent_deployer_filter(AGENT_ID))
+    )
+
+
+async def seed(client, window_minutes: int = 60) -> None:
+    await _reset_agent_grants(client)
+    updates = [
+        rel("environment", "staging", "direct_deployer", "user", "alice"),
+        rel("environment", "production", "direct_deployer", "user", "alice"),
+        rel("environment", "production", "approver", "user", "alice"),
+        rel("environment", "staging", "destroyer", "user", "sre_admin"),
+        rel("environment", "production", "destroyer", "user", "sre_admin"),
+        rel("agent", AGENT_ID, "delegator", "user", "alice"),
+        # Checkpoint 2: staging-only delegation (no expiration yet).
+        rel("environment", "staging", "agent_deployer", "agent", AGENT_ID),
+    ]
+    await client.WriteRelationships(WriteRelationshipsRequest(updates=updates))
+
+
+async def main() -> None:
+    parser = argparse.ArgumentParser(description="Bootstrap the delegated-agent-authorization workshop.")
+    parser.add_argument("--window-minutes", type=int, default=60,
+                        help="Minutes the agent's staging delegation stays valid (Checkpoint 3+).")
+    args = parser.parse_args()
+    client = make_client()
+    print("Writing schema...")
+    await write_schema(client)
+    print(f"Seeding delegation graph (window = {args.window_minutes} min)...")
+    await seed(client, window_minutes=args.window_minutes)
+    print("Done.")
+
+
+if __name__ == "__main__":
+    asyncio.run(main())
diff --git a/delegated-agent-authorization/starter/deploybot_server.py b/delegated-agent-authorization/starter/deploybot_server.py
new file mode 100644
index 0000000..9c378ac
--- /dev/null
+++ b/delegated-agent-authorization/starter/deploybot_server.py
@@ -0,0 +1,94 @@
+"""deploybot_server.py — goose MCP extension; every mutating action is authorized by SpiceDB."""
+import json
+import os
+from pathlib import Path
+
+from mcp.server.fastmcp import FastMCP
+
+from authz import Decision, decide
+from spicedb_client import make_client
+
+AGENT_SUBJECT = os.getenv("AGENT_SUBJECT", "agent:goose_alice")
+AGENT_ID = AGENT_SUBJECT.split(":", 1)[-1]
+STATE_PATH = Path(os.getenv("INFRA_STATE_PATH", str(Path(__file__).parent / "infra_state.json")))
+
+mcp = FastMCP("deploybot")
+
+
+def _load_state() -> dict:
+    return json.loads(STATE_PATH.read_text())
+
+
+def _save_state(state: dict) -> None:
+    STATE_PATH.write_text(json.dumps(state, indent=2))
+
+
+def _format(result, action: str) -> str:
+    icon = {
+        Decision.ALLOWED: "✅ ALLOWED",
+        Decision.NEEDS_APPROVAL: "⏸️  NEEDS APPROVAL",
+        Decision.BLOCKED: "🚫 BLOCKED",
+    }[result.decision]
+    return f"{icon} — {action}\n{result.reason}"
+
+
+async def do_list_environments() -> str:
+    # UNGATED in this workshop: list_environments is not authorization-checked.
+    state = _load_state()
+    lines = [
+        f"{env}: " + ", ".join(f"{svc} v{ver}" for svc, ver in svcs.items())
+        for env, svcs in state.items()
+    ]
+    return "\n".join(lines) if lines else "(no environments)"
+
+
+async def _decide_and_mutate(permission, environment, label, apply):
+    """Authorize `permission` on the environment; on ALLOWED run apply(state) -> (changed, detail),
+    persist iff changed, and format. On denial, format the reason against `label`."""
+    result = await decide(make_client(), AGENT_ID, permission, environment)
+    if result.decision is not Decision.ALLOWED:
+        return _format(result, label)
+    state = _load_state()
+    changed, detail = apply(state)
+    if changed:
+        _save_state(state)
+    return _format(result, f"{label} ({detail})" if changed else f"{label} — {detail}")
+
+
+async def do_deploy(service: str, environment: str) -> str:
+    def apply(state):
+        state.setdefault(environment, {})
+        state[environment][service] = state[environment].get(service, 0) + 1
+        return True, f"now v{state[environment][service]}"
+
+    return await _decide_and_mutate("deploy", environment, f"deploy {service} -> {environment}", apply)
+
+
+async def do_destroy(environment: str) -> str:
+    def apply(state):
+        state.pop(environment, None)
+        return True, "removed"
+
+    return await _decide_and_mutate("destroy", environment, f"destroy {environment}", apply)
+
+
+@mcp.tool()
+async def list_environments() -> str:
+    """List all deployment environments and their current service versions."""
+    return await do_list_environments()
+
+
+@mcp.tool()
+async def deploy(service: str, environment: str) -> str:
+    """Deploy a service to an environment (e.g. 'staging' or 'production')."""
+    return await do_deploy(service, environment)
+
+
+@mcp.tool()
+async def destroy(environment: str) -> str:
+    """Tear down an entire environment. Destructive; requires elevated authority."""
+    return await do_destroy(environment)
+
+
+if __name__ == "__main__":
+    mcp.run()
diff --git a/delegated-agent-authorization/starter/docker-compose.yml b/delegated-agent-authorization/starter/docker-compose.yml
new file mode 100644
index 0000000..2204222
--- /dev/null
+++ b/delegated-agent-authorization/starter/docker-compose.yml
@@ -0,0 +1,49 @@
+services:
+  postgres:
+    image: postgres:16
+    environment:
+      POSTGRES_USER: spicedb
+      POSTGRES_PASSWORD: spicedb
+      POSTGRES_DB: spicedb
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U spicedb"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+
+  spicedb-migrate:
+    image: authzed/spicedb:latest
+    command: "migrate head"
+    environment:
+      SPICEDB_DATASTORE_ENGINE: postgres
+      SPICEDB_DATASTORE_CONN_URI: "postgres://spicedb:spicedb@postgres:5432/spicedb?sslmode=disable"
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: on-failure
+
+  spicedb:
+    image: authzed/spicedb:latest
+    # --enable-experimental-relationship-expiration turns on the built-in
+    # relationship expiration feature used by `agent_deployer: agent with expiration`.
+    command: "serve --enable-experimental-relationship-expiration"
+    environment:
+      SPICEDB_GRPC_PRESHARED_KEY: "${SPICEDB_TOKEN:-devtoken}"
+      SPICEDB_DATASTORE_ENGINE: postgres
+      SPICEDB_DATASTORE_CONN_URI: "postgres://spicedb:spicedb@postgres:5432/spicedb?sslmode=disable"
+      SPICEDB_GRPC_NO_TLS: "true"
+      SPICEDB_LOG_LEVEL: "info"
+    ports:
+      - "50051:50051"
+      - "8443:8443"
+    depends_on:
+      postgres:
+        condition: service_healthy
+      spicedb-migrate:
+        condition: service_completed_successfully
+    restart: unless-stopped
+
+volumes:
+  postgres_data:
diff --git a/delegated-agent-authorization/starter/goose-extension.md b/delegated-agent-authorization/starter/goose-extension.md
new file mode 100644
index 0000000..67a8810
--- /dev/null
+++ b/delegated-agent-authorization/starter/goose-extension.md
@@ -0,0 +1,62 @@
+# Registering the deploybot extension in goose
+
+## Option A — edit `~/.config/goose/config.yaml`
+
+Add under `extensions:` (use ABSOLUTE paths to this repo's venv python and server):
+
+```yaml
+extensions:
+  deploybot:
+    type: stdio
+    name: deploybot
+    enabled: true
+    cmd: /ABSOLUTE/PATH/delegated-agent-authorization/starter/.venv/bin/python
+    args:
+      - /ABSOLUTE/PATH/delegated-agent-authorization/starter/deploybot_server.py
+    env_keys: []
+    envs:
+      SPICEDB_ENDPOINT: localhost:50051
+      SPICEDB_TOKEN: devtoken
+      AGENT_SUBJECT: agent:goose_alice
+    timeout: 300
+```
+
+## Option B — interactive
+
+```bash
+goose configure
+# -> Add Extension -> Command-line Extension
+# name: deploybot
+# command: /ABSOLUTE/PATH/delegated-agent-authorization/starter/.venv/bin/python /ABSOLUTE/PATH/delegated-agent-authorization/starter/deploybot_server.py
+# add env vars: SPICEDB_ENDPOINT, SPICEDB_TOKEN, AGENT_SUBJECT
+```
+
+> Verify the exact key names (`envs` vs `env_keys`, `type: stdio`) against your installed
+> goose version with `goose configure` — the schema has been stable but confirm once.
+
+## Manually verifying the goose integration
+
+This step is inherently manual: it drives goose through a live LLM-backed session, which is
+outside what an automated test can exercise. **We did not install goose or run this checklist
+as part of building this repo — no goose install and no LLM API key were used.** The identical
+decision sequence is instead proven deterministically and repeatably by `tests/test_arc.py`,
+which calls `authz.decide` (the same function `deploybot_server.py` calls on every tool
+invocation) directly against a real SpiceDB instance.
+
+If you do have goose installed and an LLM key configured, here is the checklist to confirm the
+wiring end to end:
+
+```bash
+# Ensure SpiceDB is seeded and the extension is registered, then:
+goose session
+```
+
+Drive these prompts and confirm the deploybot tool output:
+1. "Deploy checkout to staging." → **✅ ALLOWED**, version bumps.
+2. "Deploy checkout to production." → **⏸️ NEEDS APPROVAL**.
+3. In another terminal: `python approve.py --approver alice --env production` → then in goose "try the production deploy again" → **✅ ALLOWED**.
+4. "Tear down the production environment." → **🚫 BLOCKED**.
+5. In another terminal: `python revoke.py --env staging` → then in goose "deploy checkout to staging again" → **⏸️ NEEDS APPROVAL**.
+
+If goose is not installed / no LLM key is available, this step is skipped and the arc is
+covered by `tests/test_arc.py` (which exercises the identical decision sequence deterministically).
diff --git a/delegated-agent-authorization/starter/relationships.py b/delegated-agent-authorization/starter/relationships.py
new file mode 100644
index 0000000..c0a8668
--- /dev/null
+++ b/delegated-agent-authorization/starter/relationships.py
@@ -0,0 +1,40 @@
+"""relationships.py — shared SpiceDB relationship builders.
+
+Used by bootstrap (seed + reset), approve (grant), and revoke (delete) so the
+TOUCH-relationship shape and the agent_deployer filter live in exactly one place.
+"""
+from authzed.api.v1 import (
+    ObjectReference,
+    Relationship,
+    RelationshipFilter,
+    RelationshipUpdate,
+    SubjectFilter,
+    SubjectReference,
+)
+
+
+def rel(res_type, res_id, relation, sub_type, sub_id, expires_at=None):
+    """A TOUCH RelationshipUpdate, optionally carrying a relationship expiration."""
+    return RelationshipUpdate(
+        operation=RelationshipUpdate.OPERATION_TOUCH,
+        relationship=Relationship(
+            resource=ObjectReference(object_type=res_type, object_id=res_id),
+            relation=relation,
+            subject=SubjectReference(
+                object=ObjectReference(object_type=sub_type, object_id=sub_id)
+            ),
+            optional_expires_at=expires_at,
+        ),
+    )
+
+
+def agent_deployer_filter(agent_id, environment=None):
+    """Filter matching an agent's agent_deployer grants — one environment, or all if None."""
+    return RelationshipFilter(
+        resource_type="environment",
+        optional_resource_id=environment or "",
+        optional_relation="agent_deployer",
+        optional_subject_filter=SubjectFilter(
+            subject_type="agent", optional_subject_id=agent_id
+        ),
+    )
diff --git a/delegated-agent-authorization/starter/requirements.txt b/delegated-agent-authorization/starter/requirements.txt
new file mode 100644
index 0000000..a135f29
--- /dev/null
+++ b/delegated-agent-authorization/starter/requirements.txt
@@ -0,0 +1,14 @@
+# grpcutil (insecure_bearer_token_credentials) ships inside the authzed wheel —
+# it is NOT a separate PyPI package, so do not list it here.
+authzed>=0.7.0
+grpcio>=1.50.0
+# mcp 2.0 renamed FastMCP -> MCPServer and changed other APIs; pin to the 1.x
+# line so `from mcp.server.fastmcp import FastMCP` (used by deploybot_server.py)
+# keeps working.
+mcp>=1.2.0,<2.0.0
+# Web demo front end (web.py). uvicorn ships with fastapi's standard extra.
+fastapi>=0.110.0
+uvicorn>=0.29.0
+python-dotenv>=1.0.0
+pytest>=8.0.0
+pytest-asyncio>=0.23.0
diff --git a/delegated-agent-authorization/starter/revoke.py b/delegated-agent-authorization/starter/revoke.py
new file mode 100644
index 0000000..59a554c
--- /dev/null
+++ b/delegated-agent-authorization/starter/revoke.py
@@ -0,0 +1,27 @@
+"""revoke.py — delete an agent's deploy grant on an environment (operator CLI)."""
+import argparse
+import asyncio
+
+from authzed.api.v1 import DeleteRelationshipsRequest
+
+from relationships import agent_deployer_filter
+from spicedb_client import make_client
+
+
+async def revoke(environment: str, agent_id: str) -> int:
+    client = make_client()
+    await client.DeleteRelationships(
+        DeleteRelationshipsRequest(
+            relationship_filter=agent_deployer_filter(agent_id, environment)
+        )
+    )
+    print(f"✅ Revoked: agent:{agent_id} agent_deployer on environment:{environment}")
+    return 0
+
+
+if __name__ == "__main__":
+    p = argparse.ArgumentParser(description="Revoke an agent deploy grant.")
+    p.add_argument("--env", default="staging")
+    p.add_argument("--agent", default="goose_alice")
+    a = p.parse_args()
+    raise SystemExit(asyncio.run(revoke(a.env, a.agent)))
diff --git a/delegated-agent-authorization/starter/schema.zed b/delegated-agent-authorization/starter/schema.zed
new file mode 100644
index 0000000..046bbe8
--- /dev/null
+++ b/delegated-agent-authorization/starter/schema.zed
@@ -0,0 +1,12 @@
+// WORKSHOP STUB — you will build this schema up across Checkpoints 2–4.
+// It defines the object types but grants the agent nothing. Combined with the
+// authz.decide() stub, the deploy agent runs UNGATED in Checkpoint 1.
+// TODO(Checkpoint 2): model delegated authorization here.
+
+definition user {}
+
+definition agent {
+    relation delegator: user
+}
+
+definition environment {}
diff --git a/delegated-agent-authorization/starter/scripts/verify.py b/delegated-agent-authorization/starter/scripts/verify.py
new file mode 100644
index 0000000..c8462f2
--- /dev/null
+++ b/delegated-agent-authorization/starter/scripts/verify.py
@@ -0,0 +1,85 @@
+"""verify.py — deterministic checks for the current checkpoint. No LLM needed.
+
+Usage: python scripts/verify.py --checkpoint N
+Run from the starter/ directory with SpiceDB up.
+"""
+import argparse
+import asyncio
+import sys
+from pathlib import Path
+
+# Invoked as `python scripts/verify.py`, so Python puts scripts/ (not starter/) on
+# sys.path — add the parent directory so the top-level modules below resolve.
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from authz import Decision, decide
+import bootstrap
+from approve import approve
+from revoke import revoke
+from spicedb_client import make_client
+
+AGENT = "goose_alice"
+
+
+def _ok(label, got, want):
+    mark = "✅" if got == want else "❌"
+    print(f"  {mark} {label}: got {got}, want {want}")
+    return got == want
+
+
+async def checkpoint_1():
+    # The stub decides ALLOWED for everything — the over-reach.
+    r = await decide(make_client(), AGENT, "destroy", "production")
+    return _ok("stub allows destroy production (over-reach)", r.decision, Decision.ALLOWED)
+
+
+async def checkpoint_2(client):
+    await bootstrap.write_schema(client)
+    await bootstrap.seed(client)
+    passed = True
+    passed &= _ok("agent deploy staging", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.ALLOWED)
+    passed &= _ok("agent deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.NEEDS_APPROVAL)
+    passed &= _ok("agent destroy production", (await decide(client, AGENT, "destroy", "production")).decision, Decision.BLOCKED)
+    await approve("alice", "production", AGENT, 10)
+    passed &= _ok("after approve: deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.ALLOWED)
+    return passed
+
+
+async def checkpoint_3(client):
+    # Expired window -> staging autonomy gone (falls back to NEEDS_APPROVAL).
+    await bootstrap.write_schema(client)
+    await bootstrap.seed(client, window_minutes=0)
+    passed = _ok("expired staging grant", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.NEEDS_APPROVAL)
+    # Revocation on a fresh window.
+    await bootstrap.seed(client, window_minutes=60)
+    await revoke("staging", AGENT)
+    passed &= _ok("after revoke: deploy staging", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.NEEDS_APPROVAL)
+    return passed
+
+
+async def checkpoint_4(client):
+    await bootstrap.write_schema(client)
+    await bootstrap.seed(client, window_minutes=60)
+    await approve("alice", "production", AGENT, 10)
+    passed = _ok("with both grants: deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.ALLOWED)
+    await revoke("staging", AGENT)  # revoke the BASE
+    passed &= _ok("cascade: deploy staging", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.NEEDS_APPROVAL)
+    passed &= _ok("cascade: deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.NEEDS_APPROVAL)
+    return passed
+
+
+async def main(n):
+    print(f"Verifying Checkpoint {n}...")
+    if n == 1:
+        passed = await checkpoint_1()
+    else:
+        client = make_client()
+        passed = await {2: checkpoint_2, 3: checkpoint_3, 4: checkpoint_4}[n](client)
+    print("PASS ✅" if passed else "FAIL ❌")
+    return 0 if passed else 1
+
+
+if __name__ == "__main__":
+    p = argparse.ArgumentParser()
+    p.add_argument("--checkpoint", type=int, required=True, choices=[1, 2, 3, 4])
+    raise SystemExit(asyncio.run(main(p.parse_args().checkpoint)))
diff --git a/delegated-agent-authorization/starter/spicedb_client.py b/delegated-agent-authorization/starter/spicedb_client.py
new file mode 100644
index 0000000..bb3b044
--- /dev/null
+++ b/delegated-agent-authorization/starter/spicedb_client.py
@@ -0,0 +1,11 @@
+"""spicedb_client.py — construct an async SpiceDB v1 client from the environment."""
+import os
+
+from authzed.api.v1 import Client
+from grpcutil import insecure_bearer_token_credentials
+
+
+def make_client() -> Client:
+    endpoint = os.getenv("SPICEDB_ENDPOINT", "localhost:50051")
+    token = os.getenv("SPICEDB_TOKEN", "devtoken")
+    return Client(endpoint, insecure_bearer_token_credentials(token))
diff --git a/delegated-agent-authorization/starter/static/index.html b/delegated-agent-authorization/starter/static/index.html
new file mode 100644
index 0000000..62e4d57
--- /dev/null
+++ b/delegated-agent-authorization/starter/static/index.html
@@ -0,0 +1,604 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>goose × SpiceDB — deploybot</title>
+<style>
+  :root {
+    --bg: #0E1420;
+    --surface: #161E2E;
+    --surface-2: #1B2536;
+    --line: #26314A;
+    --text: #E6ECF5;
+    --muted: #8A98B2;
+    --allow: #3FB950;
+    --approve: #E3A008;
+    --block: #F04F4F;
+    --brand: #8B7DF0;
+    --brand-dim: #5A4F9E;
+    --mono: "JetBrains Mono", "SF Mono", ui-monospace, "Cascadia Code", Menlo, Consolas, monospace;
+    --sans: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
+    --radius: 12px;
+  }
+
+  * { box-sizing: border-box; }
+
+  html, body { height: 100%; }
+
+  body {
+    margin: 0;
+    background:
+      radial-gradient(1200px 600px at 80% -10%, rgba(139,125,240,0.10), transparent 60%),
+      var(--bg);
+    color: var(--text);
+    font-family: var(--sans);
+    -webkit-font-smoothing: antialiased;
+    display: flex;
+    justify-content: center;
+  }
+
+  .app {
+    width: 100%;
+    max-width: 900px;
+    min-height: 100vh;
+    display: flex;
+    flex-direction: column;
+    padding: 20px;
+    gap: 16px;
+  }
+
+  /* ---------- Authority bar (the signature) ---------- */
+  .authority {
+    background: linear-gradient(180deg, var(--surface-2), var(--surface));
+    border: 1px solid var(--line);
+    border-radius: var(--radius);
+    padding: 16px 18px;
+    display: flex;
+    align-items: center;
+    gap: 18px;
+    flex-wrap: wrap;
+  }
+
+  .brandmark {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    padding-right: 16px;
+    border-right: 1px solid var(--line);
+  }
+  .brandmark .goose { font-size: 22px; line-height: 1; }
+  .brandmark .name { font-family: var(--mono); font-size: 13px; letter-spacing: 0.02em; }
+  .brandmark .name b { color: var(--brand); font-weight: 600; }
+  .brandmark .name span { color: var(--muted); }
+
+  .chain {
+    display: flex;
+    align-items: center;
+    gap: 10px;
+    flex: 1 1 320px;
+    min-width: 0;
+    flex-wrap: wrap;
+  }
+
+  .node {
+    display: flex;
+    flex-direction: column;
+    gap: 2px;
+    padding: 7px 12px;
+    border-radius: 9px;
+    border: 1px solid var(--line);
+    background: var(--bg);
+    font-family: var(--mono);
+    white-space: nowrap;
+  }
+  .node .role { font-size: 10px; text-transform: uppercase; letter-spacing: 0.08em; color: var(--muted); }
+  .node .id { font-size: 13px; }
+  .node.human .id { color: var(--text); }
+  .node.agent { border-color: var(--brand-dim); }
+  .node.agent .id { color: var(--brand); }
+
+  .link {
+    font-family: var(--mono);
+    font-size: 11px;
+    color: var(--brand);
+    letter-spacing: -0.05em;
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    gap: 2px;
+  }
+  .link .wire { color: var(--brand); }
+  .link .label { font-size: 9px; text-transform: uppercase; letter-spacing: 0.08em; color: var(--muted); }
+  .link.broken .wire { color: var(--muted); }
+
+  .grants { display: flex; gap: 8px; flex-wrap: wrap; }
+
+  .grant {
+    min-width: 132px;
+    padding: 7px 11px;
+    border-radius: 9px;
+    border: 1px solid var(--brand-dim);
+    background: rgba(139,125,240,0.08);
+    font-family: var(--mono);
+  }
+  .grant .env { font-size: 13px; color: var(--text); display: flex; justify-content: space-between; gap: 8px; }
+  .grant .clock { color: var(--brand); }
+  .grant .bar { height: 4px; border-radius: 3px; background: var(--line); margin-top: 6px; overflow: hidden; }
+  .grant .bar > i { display: block; height: 100%; background: var(--brand); border-radius: 3px; transition: width 0.9s linear; }
+  .grant.expiring { border-color: var(--approve); }
+  .grant.expiring .clock { color: var(--approve); }
+  .grant.expiring .bar > i { background: var(--approve); }
+  .grant.suspended { border-color: var(--line); border-style: dashed; background: transparent; opacity: 0.75; }
+  .grant.suspended .clock { color: var(--muted); }
+  .grant.suspended .bar > i { background: var(--muted); }
+  .grant .tag { font-size: 9px; text-transform: uppercase; letter-spacing: 0.08em; color: var(--muted); margin-top: 5px; }
+  .grant.suspended .tag { color: var(--block); }
+
+  .no-grant {
+    font-family: var(--mono);
+    font-size: 12px;
+    color: var(--muted);
+    padding: 7px 11px;
+    border: 1px dashed var(--line);
+    border-radius: 9px;
+  }
+
+  .controls { display: flex; gap: 8px; margin-left: auto; }
+
+  button {
+    font-family: var(--sans);
+    font-size: 13px;
+    font-weight: 500;
+    color: var(--text);
+    background: var(--surface-2);
+    border: 1px solid var(--line);
+    border-radius: 9px;
+    padding: 8px 13px;
+    cursor: pointer;
+    transition: border-color 0.15s, background 0.15s, transform 0.05s;
+  }
+  button:hover { border-color: var(--brand-dim); background: var(--surface); }
+  button:active { transform: translateY(1px); }
+  button:focus-visible { outline: 2px solid var(--brand); outline-offset: 2px; }
+  button.ghost { background: transparent; color: var(--muted); }
+  button.approve:hover { border-color: var(--approve); }
+  button.revoke:hover { border-color: var(--block); }
+
+  /* ---------- Chat transcript ---------- */
+  .transcript {
+    flex: 1;
+    background: var(--surface);
+    border: 1px solid var(--line);
+    border-radius: var(--radius);
+    padding: 20px;
+    overflow-y: auto;
+    display: flex;
+    flex-direction: column;
+    gap: 14px;
+  }
+
+  .empty {
+    margin: auto;
+    text-align: center;
+    color: var(--muted);
+    font-family: var(--mono);
+    font-size: 13px;
+    line-height: 1.7;
+  }
+  .empty .big { font-size: 30px; display: block; margin-bottom: 10px; }
+
+  .msg { display: flex; animation: rise 0.28s ease both; }
+  @keyframes rise { from { opacity: 0; transform: translateY(8px); } to { opacity: 1; transform: none; } }
+
+  .msg.user { justify-content: flex-end; }
+  .bubble {
+    max-width: 82%;
+    padding: 11px 14px;
+    border-radius: 12px;
+    font-size: 14px;
+    line-height: 1.5;
+  }
+  .msg.user .bubble {
+    background: rgba(139,125,240,0.14);
+    border: 1px solid var(--brand-dim);
+    border-bottom-right-radius: 4px;
+    font-family: var(--mono);
+  }
+  .msg.agent .bubble {
+    background: var(--surface-2);
+    border: 1px solid var(--line);
+    border-bottom-left-radius: 4px;
+  }
+
+  .toolcall {
+    font-family: var(--mono);
+    font-size: 12px;
+    color: var(--muted);
+    margin-bottom: 8px;
+  }
+  .toolcall .arrow { color: var(--brand); }
+
+  .chip {
+    display: inline-flex;
+    align-items: center;
+    gap: 6px;
+    font-family: var(--mono);
+    font-size: 12px;
+    font-weight: 600;
+    letter-spacing: 0.03em;
+    padding: 3px 10px;
+    border-radius: 999px;
+    animation: pop 0.22s ease both;
+  }
+  @keyframes pop { from { transform: scale(0.9); opacity: 0; } to { transform: scale(1); opacity: 1; } }
+  .chip.ALLOWED { color: var(--allow); background: rgba(63,185,80,0.12); border: 1px solid rgba(63,185,80,0.4); }
+  .chip.NEEDS_APPROVAL { color: var(--approve); background: rgba(227,160,8,0.12); border: 1px solid rgba(227,160,8,0.4); }
+  .chip.BLOCKED { color: var(--block); background: rgba(240,79,79,0.12); border: 1px solid rgba(240,79,79,0.4); }
+
+  .action { margin: 9px 0 4px; font-size: 14px; }
+  .reason { color: var(--muted); font-size: 13px; font-family: var(--mono); line-height: 1.5; }
+  .listing { font-family: var(--mono); font-size: 13px; white-space: pre-wrap; line-height: 1.6; }
+
+  .system {
+    align-self: center;
+    font-family: var(--mono);
+    font-size: 12px;
+    color: var(--muted);
+    background: var(--bg);
+    border: 1px solid var(--line);
+    border-radius: 999px;
+    padding: 5px 14px;
+    animation: rise 0.28s ease both;
+  }
+  .system b { color: var(--text); font-weight: 600; }
+
+  /* ---------- Walking-goose "thinking" indicator ---------- */
+  .thinking { display: flex; animation: rise 0.28s ease both; }
+  .thinking .bubble {
+    background: var(--surface-2);
+    border: 1px solid var(--line);
+    border-bottom-left-radius: 4px;
+    display: flex;
+    align-items: center;
+    gap: 12px;
+  }
+  .walk-track { position: relative; width: 92px; height: 24px; flex: none; }
+  .goose-walk {
+    position: absolute; left: 0; top: 1px;
+    font-size: 20px; line-height: 1;
+    animation: stroll 2.2s ease-in-out infinite alternate, waddle 0.45s ease-in-out infinite;
+    will-change: left, transform;
+  }
+  .thinking .label { font-family: var(--mono); font-size: 12px; color: var(--muted); }
+  @keyframes stroll { from { left: 0; } to { left: calc(100% - 22px); } }
+  @keyframes waddle {
+    0%   { transform: translateY(0)    rotate(-9deg); }
+    25%  { transform: translateY(-4px) rotate(0deg); }
+    50%  { transform: translateY(0)    rotate(9deg); }
+    75%  { transform: translateY(-4px) rotate(0deg); }
+    100% { transform: translateY(0)    rotate(-9deg); }
+  }
+
+  /* ---------- Composer ---------- */
+  .composer { display: flex; flex-direction: column; gap: 10px; }
+  .chips { display: flex; gap: 8px; flex-wrap: wrap; }
+  .chip-btn {
+    font-family: var(--mono);
+    font-size: 12px;
+    color: var(--muted);
+    background: transparent;
+    border: 1px solid var(--line);
+    padding: 6px 11px;
+  }
+  .chip-btn:hover { color: var(--text); border-color: var(--brand-dim); background: var(--surface); }
+
+  .inputrow { display: flex; gap: 10px; }
+  .inputrow input {
+    flex: 1;
+    font-family: var(--mono);
+    font-size: 14px;
+    color: var(--text);
+    background: var(--surface);
+    border: 1px solid var(--line);
+    border-radius: 10px;
+    padding: 12px 14px;
+  }
+  .inputrow input::placeholder { color: var(--muted); }
+  .inputrow input:focus { outline: none; border-color: var(--brand); }
+  .send { background: var(--brand); color: #0E1420; font-weight: 600; border-color: var(--brand); }
+  .send:hover { background: #9d90f5; border-color: #9d90f5; }
+
+  @media (max-width: 640px) {
+    .app { padding: 12px; }
+    .controls { margin-left: 0; width: 100%; }
+    .brandmark { border-right: none; }
+  }
+  @media (prefers-reduced-motion: reduce) {
+    .msg, .system, .chip { animation: none; }
+    .grant .bar > i { transition: none; }
+    .goose-walk { animation: none; }
+  }
+</style>
+</head>
+<body>
+  <div class="app">
+    <header class="authority">
+      <div class="brandmark">
+        <span class="goose">🪿</span>
+        <span class="name"><b>goose</b> <span>×</span> SpiceDB</span>
+      </div>
+      <div class="chain" id="chain" aria-label="delegation state"></div>
+      <div class="controls">
+        <button class="approve" id="approveBtn">Approve prod · 10m</button>
+        <button class="revoke" id="revokeStagingBtn">Revoke staging</button>
+        <button class="revoke" id="revokeProdBtn">Revoke prod</button>
+        <button class="ghost" id="resetBtn" title="Re-seed and reset versions">Reset</button>
+      </div>
+    </header>
+
+    <main class="transcript" id="transcript" aria-live="polite">
+      <div class="empty" id="empty">
+        <span class="big">🪿</span>
+        Ask the agent to deploy something.<br />
+        It runs as you — SpiceDB decides what it may actually do.
+      </div>
+    </main>
+
+    <div class="composer">
+      <div class="chips" id="chips"></div>
+      <div class="inputrow">
+        <input id="input" type="text" autocomplete="off"
+               placeholder="Deploy checkout to staging…" aria-label="Ask the agent" />
+        <button class="send" id="sendBtn">Send</button>
+      </div>
+    </div>
+  </div>
+
+<script>
+const PRESETS = [
+  "Deploy checkout to staging",
+  "Deploy checkout to production",
+  "Roll back checkout in staging",
+  "Tear down production",
+  "What can I see?",
+];
+
+const transcript = document.getElementById("transcript");
+const empty = document.getElementById("empty");
+const input = document.getElementById("input");
+let grants = [];             // last known grants from /api/state
+const barMax = {};           // per-env max remaining seconds seen (for the depleting bar)
+
+function el(tag, cls, html) {
+  const n = document.createElement(tag);
+  if (cls) n.className = cls;
+  if (html !== undefined) n.innerHTML = html;
+  return n;
+}
+function esc(s) {
+  return (s ?? "").replace(/[&<>]/g, c => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;" }[c]));
+}
+function scroll() { transcript.scrollTop = transcript.scrollHeight; }
+function clearEmpty() { if (empty) empty.remove(); }
+
+function addUser(text) {
+  clearEmpty();
+  const m = el("div", "msg user");
+  m.appendChild(el("div", "bubble", esc(text)));
+  transcript.appendChild(m); scroll();
+}
+
+function addSystem(html) {
+  clearEmpty();
+  transcript.appendChild(el("div", "system", html));
+  scroll();
+}
+
+function addAgent(data) {
+  clearEmpty();
+  const m = el("div", "msg agent");
+  const b = el("div", "bubble");
+  if (!data.understood) {
+    b.appendChild(el("div", "reason", esc(data.reply)));
+  } else if (data.op === "list") {
+    b.appendChild(el("div", "toolcall", '<span class="arrow">▸</span> ' + esc(data.tool_call)));
+    b.appendChild(el("div", "listing", esc(data.reply)));
+  } else {
+    b.appendChild(el("div", "toolcall", '<span class="arrow">▸</span> ' + esc(data.tool_call)));
+    if (data.decision) {
+      const label = data.decision.replace("_", " ");
+      const icon = { ALLOWED: "✓", NEEDS_APPROVAL: "⏸", BLOCKED: "⛔" }[data.decision] || "";
+      b.appendChild(el("span", "chip " + data.decision, icon + " " + label));
+    }
+    if (data.action) b.appendChild(el("div", "action", esc(data.action)));
+    if (data.reason) b.appendChild(el("div", "reason", esc(data.reason)));
+  }
+  m.appendChild(b);
+  transcript.appendChild(m); scroll();
+}
+
+function addThinking() {
+  clearEmpty();
+  const m = el("div", "msg thinking");
+  const b = el("div", "bubble");
+  const track = el("div", "walk-track");
+  track.appendChild(el("span", "goose-walk", "🪿"));
+  b.appendChild(track);
+  b.appendChild(el("div", "label", "goose is checking with SpiceDB…"));
+  m.appendChild(b);
+  transcript.appendChild(m); scroll();
+  return m;
+}
+const sleep = ms => new Promise(r => setTimeout(r, ms));
+
+async function send(text) {
+  const t = text.trim();
+  if (!t) return;
+  addUser(t);
+  input.value = "";
+  const thinking = addThinking();
+  const started = performance.now();
+  let data = null, failed = false;
+  try {
+    const res = await fetch("/api/request", {
+      method: "POST", headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ text: t }),
+    });
+    data = await res.json();
+  } catch (e) {
+    failed = true;
+  }
+  // Local checks are near-instant; hold the walk long enough to read on camera.
+  const wait = 1400 - (performance.now() - started);
+  if (wait > 0) await sleep(wait);
+  thinking.remove();
+  if (failed) addSystem("Could not reach the server — is <b>python web.py</b> running?");
+  else addAgent(data);
+  refreshState();
+}
+
+async function approve() {
+  const res = await fetch("/api/approve", {
+    method: "POST", headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ environment: "production", minutes: 10 }),
+  });
+  const d = await res.json();
+  addSystem(d.ok
+    ? '🔑 <b>alice</b> approved <b>production</b> for 10 min'
+    : "Approval refused");
+  refreshState();
+}
+
+async function revokeEnv(env) {
+  const res = await fetch("/api/revoke", {
+    method: "POST", headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ environment: env }),
+  });
+  const d = await res.json();
+  if (!d.ok) { addSystem("Revoke refused"); return; }
+  if (env === "staging") {
+    addSystem('✂️ <b>alice</b> revoked the <b>staging</b> delegation — production autonomy is gated by it, so it suspends too');
+  } else {
+    addSystem('✂️ <b>alice</b> revoked the <b>' + esc(env) + '</b> delegation');
+  }
+  refreshState();
+}
+
+async function reset() {
+  await fetch("/api/reset", { method: "POST" });
+  transcript.innerHTML = "";
+  Object.keys(barMax).forEach(k => delete barMax[k]);
+  addSystem("↺ Demo reset — staging delegated for 60 min, versions restored");
+  refreshState();
+}
+
+async function refreshState() {
+  try {
+    const res = await fetch("/api/state");
+    const s = await res.json();
+    grants = s.grants || [];
+    renderChain(s);
+  } catch (e) { /* server may be restarting; keep last render */ }
+}
+
+function fmt(sec) {
+  if (sec <= 0) return "expired";
+  const m = Math.floor(sec / 60), s = Math.floor(sec % 60);
+  return String(m).padStart(2, "0") + ":" + String(s).padStart(2, "0");
+}
+
+function renderChain(s) {
+  const chain = document.getElementById("chain");
+  chain.innerHTML = "";
+  chain.appendChild(nodeEl("human", "delegator", "user:" + (s.delegator || "—")));
+
+  // Identity delegation (alice -> agent) always holds; the autonomy link is live
+  // only while the agent has an effective grant somewhere.
+  const anyEffective = grants.some(g => g.effective);
+  chain.appendChild(linkEl("delegates", true));
+  chain.appendChild(nodeEl("agent", "agent", "agent:" + s.agent));
+  chain.appendChild(linkEl("grants", anyEffective));
+
+  const box = el("div", "grants");
+  if (grants.length === 0) {
+    box.appendChild(el("div", "no-grant", "no active delegation"));
+  } else {
+    grants.forEach(g => box.appendChild(grantEl(g)));
+  }
+  chain.appendChild(box);
+}
+
+function nodeEl(cls, role, id) {
+  const n = el("div", "node " + cls);
+  n.appendChild(el("div", "role", role));
+  n.appendChild(el("div", "id", esc(id)));
+  return n;
+}
+function linkEl(label, active) {
+  const l = el("div", "link" + (active ? "" : " broken"));
+  l.appendChild(el("div", "wire", active ? "──▶" : "╌╌╳"));
+  l.appendChild(el("div", "label", label));
+  return l;
+}
+function grantEl(g) {
+  const rem = g.expires_at ? (new Date(g.expires_at).getTime() - Date.now()) / 1000 : null;
+  const suspended = g.effective === false;
+  const wrap = el("div", "grant" + (suspended ? " suspended" : ""));
+  wrap.dataset.expires = g.expires_at || "";
+  wrap.dataset.env = g.environment;
+  wrap.dataset.suspended = suspended ? "1" : "";
+  const row = el("div", "env");
+  row.appendChild(el("span", null, esc(g.environment)));
+  row.appendChild(el("span", "clock", "⏳ " + (rem === null ? "—" : fmt(rem))));
+  wrap.appendChild(row);
+  if (rem !== null) {
+    barMax[g.environment] = Math.max(barMax[g.environment] || 0, rem);
+    const pct = Math.max(0, Math.min(100, (rem / barMax[g.environment]) * 100));
+    const bar = el("div", "bar");
+    bar.appendChild(el("i"));
+    bar.firstChild.style.width = pct + "%";
+    wrap.appendChild(bar);
+    if (!suspended && rem < 120) wrap.classList.add("expiring");
+  }
+  if (suspended) wrap.appendChild(el("div", "tag", "suspended · gated by staging"));
+  return wrap;
+}
+
+// Local 1s tick keeps the countdown/bar smooth between 5s state polls.
+function tick() {
+  document.querySelectorAll(".grant").forEach(wrap => {
+    const iso = wrap.dataset.expires;
+    if (!iso) return;
+    const rem = (new Date(iso).getTime() - Date.now()) / 1000;
+    const clock = wrap.querySelector(".clock");
+    if (clock) clock.textContent = "⏳ " + fmt(rem);
+    const env = wrap.dataset.env;
+    const fill = wrap.querySelector(".bar > i");
+    if (fill && barMax[env]) {
+      fill.style.width = Math.max(0, Math.min(100, (rem / barMax[env]) * 100)) + "%";
+    }
+    wrap.classList.toggle("expiring", rem < 120);
+  });
+}
+
+// wire up
+PRESETS.forEach(p => {
+  const chips = document.getElementById("chips");
+  const b = el("button", "chip-btn", esc(p));
+  b.addEventListener("click", () => send(p));
+  chips.appendChild(b);
+});
+document.getElementById("sendBtn").addEventListener("click", () => send(input.value));
+input.addEventListener("keydown", e => { if (e.key === "Enter") send(input.value); });
+document.getElementById("approveBtn").addEventListener("click", approve);
+document.getElementById("revokeStagingBtn").addEventListener("click", () => revokeEnv("staging"));
+document.getElementById("revokeProdBtn").addEventListener("click", () => revokeEnv("production"));
+document.getElementById("resetBtn").addEventListener("click", reset);
+
+refreshState();
+setInterval(refreshState, 5000);
+setInterval(tick, 1000);
+</script>
+</body>
+</html>
diff --git a/delegated-agent-authorization/starter/web.py b/delegated-agent-authorization/starter/web.py
new file mode 100644
index 0000000..7bdf4f9
--- /dev/null
+++ b/delegated-agent-authorization/starter/web.py
@@ -0,0 +1,167 @@
+"""web.py — a goose-style chat front end for the SpiceDB delegation demo.
+
+A thin FastAPI shell: it parses a natural-language request into a tool call and
+delegates to the SAME code the MCP server uses (deploybot_server.do_*, approve,
+revoke, bootstrap) against the live SpiceDB. The front end holds no authorization
+logic of its own — what you see is exactly what SpiceDB decides.
+
+Run:  python web.py   (then open http://127.0.0.1:8000)
+"""
+from datetime import timezone
+from pathlib import Path
+
+from fastapi import FastAPI
+from fastapi.responses import FileResponse
+from pydantic import BaseModel
+
+from authzed.api.v1 import Consistency, ReadRelationshipsRequest
+
+import bootstrap
+import deploybot_server
+from approve import approve
+from authz import check, read_delegator
+from relationships import agent_deployer_filter
+from revoke import revoke
+from spicedb_client import make_client
+
+BASE = Path(__file__).parent
+AGENT_ID = deploybot_server.AGENT_ID
+DELEGATOR = "alice"  # the human the demo agent acts for
+BASELINE_STATE = {
+    "staging": {"checkout": 3, "payments": 5},
+    "production": {"checkout": 2, "payments": 4},
+}
+
+app = FastAPI(title="deploybot")
+
+SERVICES = ("checkout", "payments")
+
+
+def parse_intent(text: str):
+    """Map a natural-language request to (op, service, environment). No LLM needed."""
+    t = text.lower()
+    env = (
+        "production" if "prod" in t
+        else "staging" if ("staging" in t or "stage" in t)
+        else None
+    )
+    service = next((s for s in SERVICES if s in t), "checkout")
+    if any(w in t for w in ("destroy", "tear down", "teardown", "delete", "nuke")):
+        return "destroy", None, env or "production"
+    if any(w in t for w in ("deploy", "ship", "release", "push")):
+        return "deploy", service, env or "staging"
+    if any(w in t for w in ("list", "environment", "status", "what can", "show", "see")):
+        return "list", None, None
+    return None, None, None
+
+
+def _decision_of(out: str):
+    if "NEEDS APPROVAL" in out:
+        return "NEEDS_APPROVAL"
+    if "BLOCKED" in out:
+        return "BLOCKED"
+    if "ALLOWED" in out:
+        return "ALLOWED"
+    return None
+
+
+class RequestBody(BaseModel):
+    text: str
+
+
+class ApproveBody(BaseModel):
+    environment: str = "production"
+    minutes: int = 10
+
+
+class RevokeBody(BaseModel):
+    environment: str = "staging"
+
+
+@app.get("/")
+async def index():
+    return FileResponse(BASE / "static" / "index.html")
+
+
+@app.post("/api/request")
+async def request_action(body: RequestBody):
+    op, service, env = parse_intent(body.text)
+    if op is None:
+        return {
+            "understood": False,
+            "reply": "I can deploy or destroy a service in staging or "
+                     'production — or list what you can see. Try "Deploy checkout to staging".',
+        }
+    if op == "list":
+        listing = await deploybot_server.do_list_environments()
+        return {"understood": True, "op": "list", "tool_call": "list_environments()",
+                "decision": None, "reply": listing}
+
+    if op == "deploy":
+        out = await deploybot_server.do_deploy(service, env)
+        tool_call = f"deploy({service}, {env})"
+    else:  # destroy
+        out = await deploybot_server.do_destroy(env)
+        tool_call = f"destroy({env})"
+
+    head, _, reason = out.partition("\n")
+    _, sep, action = head.partition("— ")
+    return {
+        "understood": True,
+        "op": op,
+        "tool_call": tool_call,
+        "decision": _decision_of(out),
+        "action": action.strip() if sep else head.strip(),
+        "reason": reason.strip(),
+    }
+
+
+@app.get("/api/state")
+async def state():
+    client = make_client()
+    delegator = await read_delegator(client, AGENT_ID)
+    grants = []
+    req = ReadRelationshipsRequest(
+        consistency=Consistency(fully_consistent=True),
+        relationship_filter=agent_deployer_filter(AGENT_ID),
+    )
+    async for resp in client.ReadRelationships(req):
+        r = resp.relationship
+        env = r.resource.object_id
+        expires_at = None
+        if r.HasField("optional_expires_at"):
+            dt = r.optional_expires_at.ToDatetime().replace(tzinfo=timezone.utc)
+            expires_at = dt.isoformat()
+        # A grant tuple can exist yet be suspended by the cascade (e.g. a prod grant
+        # after staging was revoked). `effective` is the actual deploy verdict.
+        effective = await check(client, "agent", AGENT_ID, "deploy", "environment", env)
+        grants.append({"environment": env, "expires_at": expires_at, "effective": effective})
+    versions = deploybot_server._load_state()
+    return {"agent": AGENT_ID, "delegator": delegator, "grants": grants, "versions": versions}
+
+
+@app.post("/api/approve")
+async def approve_action(body: ApproveBody):
+    code = await approve(DELEGATOR, body.environment, AGENT_ID, body.minutes)
+    return {"ok": code == 0, "environment": body.environment, "minutes": body.minutes}
+
+
+@app.post("/api/revoke")
+async def revoke_action(body: RevokeBody):
+    code = await revoke(body.environment, AGENT_ID)
+    return {"ok": code == 0, "environment": body.environment}
+
+
+@app.post("/api/reset")
+async def reset():
+    client = make_client()
+    await bootstrap.write_schema(client)
+    await bootstrap.seed(client, window_minutes=60)
+    deploybot_server._save_state(dict(BASELINE_STATE))
+    return {"ok": True}
+
+
+if __name__ == "__main__":
+    import uvicorn
+
+    uvicorn.run(app, host="127.0.0.1", port=8000)

From f48c93d48e891505bde6c95364127db1a30c5633 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 16:46:52 +0200
Subject: [PATCH 04/27] fix(workshop): drop rollback preset, point
 goose-extension at verify.py

---
 .../starter/goose-extension.md                      | 13 +++++++------
 .../starter/static/index.html                       |  1 -
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/delegated-agent-authorization/starter/goose-extension.md b/delegated-agent-authorization/starter/goose-extension.md
index 67a8810..c0794b2 100644
--- a/delegated-agent-authorization/starter/goose-extension.md
+++ b/delegated-agent-authorization/starter/goose-extension.md
@@ -37,11 +37,11 @@ goose configure
 ## Manually verifying the goose integration
 
 This step is inherently manual: it drives goose through a live LLM-backed session, which is
-outside what an automated test can exercise. **We did not install goose or run this checklist
-as part of building this repo — no goose install and no LLM API key were used.** The identical
-decision sequence is instead proven deterministically and repeatably by `tests/test_arc.py`,
-which calls `authz.decide` (the same function `deploybot_server.py` calls on every tool
-invocation) directly against a real SpiceDB instance.
+outside what an automated test can exercise. Running goose is optional for this workshop — you
+do not need it (or an LLM API key) installed. The same decision sequence is proven
+deterministically and repeatably by `scripts/verify.py`, which calls `authz.decide` (the same
+function `deploybot_server.py` calls on every tool invocation) directly against a real SpiceDB
+instance. Run it per checkpoint, e.g. `python scripts/verify.py --checkpoint 2`.
 
 If you do have goose installed and an LLM key configured, here is the checklist to confirm the
 wiring end to end:
@@ -59,4 +59,5 @@ Drive these prompts and confirm the deploybot tool output:
 5. In another terminal: `python revoke.py --env staging` → then in goose "deploy checkout to staging again" → **⏸️ NEEDS APPROVAL**.
 
 If goose is not installed / no LLM key is available, this step is skipped and the arc is
-covered by `tests/test_arc.py` (which exercises the identical decision sequence deterministically).
+covered by `scripts/verify.py` (which exercises the identical decision sequence
+deterministically — run `python scripts/verify.py --checkpoint 2` and up).
diff --git a/delegated-agent-authorization/starter/static/index.html b/delegated-agent-authorization/starter/static/index.html
index 62e4d57..66ff276 100644
--- a/delegated-agent-authorization/starter/static/index.html
+++ b/delegated-agent-authorization/starter/static/index.html
@@ -359,7 +359,6 @@
 const PRESETS = [
   "Deploy checkout to staging",
   "Deploy checkout to production",
-  "Roll back checkout in staging",
   "Tear down production",
   "What can I see?",
 ];

From 4e1258965ae3f87bfc456f434069ce78b47f92a3 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 16:54:03 +0200
Subject: [PATCH 05/27] docs(workshop): 0-setup

---
 delegated-agent-authorization/0-setup.md | 93 ++++++++++++++++++++++++
 1 file changed, 93 insertions(+)
 create mode 100644 delegated-agent-authorization/0-setup.md

diff --git a/delegated-agent-authorization/0-setup.md b/delegated-agent-authorization/0-setup.md
new file mode 100644
index 0000000..4a87d12
--- /dev/null
+++ b/delegated-agent-authorization/0-setup.md
@@ -0,0 +1,93 @@
+# Setup
+
+In this workshop you build a DevOps deploy agent on [goose](https://github.com/aaif-goose/goose)
+(the open-source agent from the Agentic AI Foundation), then gate its every action with
+delegated, fine-grained authorization from SpiceDB — scoped grants, time-bound windows, instant
+revocation, and a permission hierarchy where revoking a base grant cascades to what depends on
+it. The `starter/` folder in this repo is stubbed on purpose: the plumbing (MCP extension,
+docker-compose, seed/approve/revoke scripts, web UI) is provided, and you'll write the schema and
+the decision engine yourself across the checkpoints.
+
+## Get the code
+
+```bash
+git clone https://github.com/authzed/workshops.git
+cd workshops/delegated-agent-authorization/starter
+```
+
+## Option A — Run locally with Docker
+
+Copy the example `.env` file:
+
+```bash
+cp .env.example .env
+```
+
+`.env` holds the SpiceDB connection details the app itself needs — endpoint, preshared token,
+and which agent identity the deploy bot acts as. Nothing in this repo talks to an LLM directly,
+so there's no LLM key in here. The LLM key only comes into play later, and only if you use the
+goose path (see [Install goose](#install-goose-and-register-the-extension) below) — the
+deterministic path (`scripts/verify.py` and the web UI, introduced in later checkpoints) needs no
+LLM at all.
+
+Start the infrastructure:
+
+```bash
+docker compose up -d --wait
+```
+
+This brings up two containers — `postgres` (SpiceDB's datastore) and `spicedb` — plus a
+short-lived `spicedb-migrate` container that runs the schema migration and exits. SpiceDB serves
+on `localhost:50051` with a preshared key of `devtoken` (not recommended for prod, obviously) and
+`--enable-experimental-relationship-expiration` turned on, which later checkpoints use for
+time-bound grants.
+
+Create a virtual environment and install dependencies:
+
+```bash
+python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
+```
+
+## Option B — Run in GitHub Codespaces
+
+For anyone who can't run Docker locally, Codespaces is the path. The repo ships with a
+`.devcontainer/` config that handles everything automatically.
+
+1. On the repo page, click **Code ▸ Codespaces ▸ Create codespace on main**
+2. The devcontainer installs dependencies and runs `docker compose up -d` on startup
+3. Once the Codespace is ready, `cd delegated-agent-authorization/starter` and copy `.env.example`
+   to `.env` as in Option A
+
+## Install goose and register the extension
+
+Installing goose is optional for this workshop. Every checkpoint has a second, deterministic way
+to see the same decisions — `scripts/verify.py` plus a web UI, neither of which needs goose or an
+LLM key. Install goose if you want to drive the agent with natural language ("Deploy checkout to
+staging") and watch its tool calls resolve through SpiceDB live.
+
+If you do want the goose path:
+
+1. Install goose by following the [Agentic AI Foundation goose](https://github.com/aaif-goose/goose)
+   project's own install instructions, then run `goose configure` to pick an LLM provider and set
+   its API key — this is where the "LLM key" lives, in goose's own config, not in this project's
+   `.env`.
+2. Register the `deploybot` MCP extension so goose can call into this repo's deploy tools. Follow
+   `goose-extension.md` — it walks through editing `~/.config/goose/config.yaml` (or running
+   `goose configure` interactively) with **absolute paths** to this repo's `.venv/bin/python` and
+   `deploybot_server.py`, plus three env vars the extension needs to reach SpiceDB:
+   `SPICEDB_ENDPOINT=localhost:50051`, `SPICEDB_TOKEN=devtoken`, `AGENT_SUBJECT=agent:goose_alice`.
+
+`goose-extension.md` also has a manual verification checklist for once goose is wired up — worth
+skimming now, but there's nothing to run yet: SpiceDB has no schema until Checkpoint 1.
+
+---
+
+## Completion Milestone: Setup
+
+- [ ] Cloned the repo
+- [ ] Infrastructure is up — Docker (`docker compose up -d --wait`) or Codespaces
+- [ ] Virtual environment created and `pip install -r requirements.txt` succeeded
+- [ ] (Goose path only) goose installed with an LLM provider configured, and the `deploybot`
+      extension registered per `goose-extension.md`
+
+Next: [Checkpoint 1 — Run the agent](1-run-the-agent.md)

From d6a2d8707f5bda3c1ab305ac5dc5ab3d7f59f4b4 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 17:13:42 +0200
Subject: [PATCH 06/27] =?UTF-8?q?docs(workshop):=200-setup=20fix=20round?=
 =?UTF-8?q?=201=20=E2=80=94=20CP2=20schema=20wording,=20venv=20in=20devcon?=
 =?UTF-8?q?tainer,=20header=20hyphens?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 delegated-agent-authorization/0-setup.md       | 18 ++++++++++++------
 .../starter/.devcontainer/devcontainer.json    |  2 +-
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/delegated-agent-authorization/0-setup.md b/delegated-agent-authorization/0-setup.md
index 4a87d12..90660cb 100644
--- a/delegated-agent-authorization/0-setup.md
+++ b/delegated-agent-authorization/0-setup.md
@@ -15,7 +15,7 @@ git clone https://github.com/authzed/workshops.git
 cd workshops/delegated-agent-authorization/starter
 ```
 
-## Option A — Run locally with Docker
+## Option A - Run locally with Docker
 
 Copy the example `.env` file:
 
@@ -37,7 +37,8 @@ docker compose up -d --wait
 ```
 
 This brings up two containers — `postgres` (SpiceDB's datastore) and `spicedb` — plus a
-short-lived `spicedb-migrate` container that runs the schema migration and exits. SpiceDB serves
+short-lived `spicedb-migrate` container that runs SpiceDB's own datastore migration (setting up
+its Postgres tables — not the `schema.zed` you'll write later) and exits. SpiceDB serves
 on `localhost:50051` with a preshared key of `devtoken` (not recommended for prod, obviously) and
 `--enable-experimental-relationship-expiration` turned on, which later checkpoints use for
 time-bound grants.
@@ -48,13 +49,15 @@ Create a virtual environment and install dependencies:
 python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
 ```
 
-## Option B — Run in GitHub Codespaces
+## Option B - Run in GitHub Codespaces
 
 For anyone who can't run Docker locally, Codespaces is the path. The repo ships with a
 `.devcontainer/` config that handles everything automatically.
 
 1. On the repo page, click **Code ▸ Codespaces ▸ Create codespace on main**
-2. The devcontainer installs dependencies and runs `docker compose up -d` on startup
+2. On startup the devcontainer creates the `.venv`, installs dependencies into it, and runs
+   `docker compose up -d` — so the `.venv/bin/python` path the goose step below relies on exists
+   here too
 3. Once the Codespace is ready, `cd delegated-agent-authorization/starter` and copy `.env.example`
    to `.env` as in Option A
 
@@ -78,7 +81,9 @@ If you do want the goose path:
    `SPICEDB_ENDPOINT=localhost:50051`, `SPICEDB_TOKEN=devtoken`, `AGENT_SUBJECT=agent:goose_alice`.
 
 `goose-extension.md` also has a manual verification checklist for once goose is wired up — worth
-skimming now, but there's nothing to run yet: SpiceDB has no schema until Checkpoint 1.
+skimming now, but there's nothing to run yet: SpiceDB has no authorization schema until
+Checkpoint 2, where you write it and the agent's decisions (via goose or the web UI) first come
+online.
 
 ---
 
@@ -86,7 +91,8 @@ skimming now, but there's nothing to run yet: SpiceDB has no schema until Checkp
 
 - [ ] Cloned the repo
 - [ ] Infrastructure is up — Docker (`docker compose up -d --wait`) or Codespaces
-- [ ] Virtual environment created and `pip install -r requirements.txt` succeeded
+- [ ] `.venv` created and dependencies installed — manually in Option A, automatically by the
+      devcontainer in Option B
 - [ ] (Goose path only) goose installed with an LLM provider configured, and the `deploybot`
       extension registered per `goose-extension.md`
 
diff --git a/delegated-agent-authorization/starter/.devcontainer/devcontainer.json b/delegated-agent-authorization/starter/.devcontainer/devcontainer.json
index 2506c65..b767231 100644
--- a/delegated-agent-authorization/starter/.devcontainer/devcontainer.json
+++ b/delegated-agent-authorization/starter/.devcontainer/devcontainer.json
@@ -2,6 +2,6 @@
   "name": "delegated-agent-authorization",
   "image": "mcr.microsoft.com/devcontainers/python:3.12",
   "features": { "ghcr.io/devcontainers/features/docker-in-docker:2": {} },
-  "postCreateCommand": "pip install -r requirements.txt && docker compose up -d",
+  "postCreateCommand": "python -m venv .venv && .venv/bin/pip install -r requirements.txt && docker compose up -d",
   "forwardPorts": [8000, 50051]
 }

From a0818abc8c99b9911c48b0d6b0042b41f14a17bf Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 18:04:56 +0200
Subject: [PATCH 07/27] docs(workshop): CP1 run-the-agent

Author 1-run-the-agent.md: quotes the authz.decide() WORKSHOP STUB, walks the
goose over-reach (deploy + destroy production both ALLOWED with no boundary),
the deterministic scripts/verify.py --checkpoint 1 path, and the ambient-
authority takeaway. No web UI in this checkpoint (no schema until CP2).

Also fixes a real bug found while verifying the goose path: deploybot_server's
_load_state() crashed with FileNotFoundError on a fresh checkout because
infra_state.json is only ever created by the web UI's /api/reset (CP2+), never
by bootstrap.py or on first run. Treat a missing file as "no environments" so
list_environments/deploy/destroy work before the web UI has ever run.
---
 .../1-run-the-agent.md                        | 146 ++++++++++++++++++
 .../starter/deploybot_server.py               |   4 +
 2 files changed, 150 insertions(+)
 create mode 100644 delegated-agent-authorization/1-run-the-agent.md

diff --git a/delegated-agent-authorization/1-run-the-agent.md b/delegated-agent-authorization/1-run-the-agent.md
new file mode 100644
index 0000000..0f956ee
--- /dev/null
+++ b/delegated-agent-authorization/1-run-the-agent.md
@@ -0,0 +1,146 @@
+# Checkpoint 1 — Run the Agent (and Watch It Over-Reach)
+
+The goal here is simple: get the deploy agent running, then catch it doing something it should
+never have been allowed to do — tearing down production — because right now nothing stops it.
+
+---
+
+## The flow — goose calls deploybot
+
+`deploybot_server.py` is a goose MCP extension. It exposes three tools:
+
+- **`list_environments`** — lists every environment and the service versions deployed to it.
+  Read-only, and — by design, for this workshop — not authorization-checked. The code says so
+  directly:
+
+  ```python
+  # UNGATED in this workshop: list_environments is not authorization-checked.
+  ```
+
+- **`deploy(service, environment)`** — deploys a service to an environment.
+- **`destroy(environment)`** — tears down an entire environment. Its own docstring says
+  *"Destructive; requires elevated authority."* No rollback tool exists; destroy is a one-way
+  door.
+
+`deploy` and `destroy` are mutating, and both are gated: before either touches anything, it calls
+`authz.decide()` to get a ruling, and only proceeds on `ALLOWED`. That's the boundary this
+workshop is about. In Checkpoint 1, the boundary is a stub that never says no.
+
+---
+
+## `decide()` is a deliberate stub
+
+Open `authz.py`. `decide()` is the one function every mutating tool call goes through, and right
+now it is honest about doing nothing:
+
+```python
+async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
+    # WORKSHOP STUB — Checkpoint 1.
+    # Returns ALLOWED for everything WITHOUT consulting SpiceDB. This is exactly why
+    # the agent over-reaches in Checkpoint 1. You implement the real, SpiceDB-backed
+    # three-way decision in Checkpoint 2.
+    # TODO(Checkpoint 2): replace this stub.
+    return AuthzResult(Decision.ALLOWED, "no authorization configured (workshop stub)")
+```
+
+It takes a `client` — a live connection to SpiceDB — and ignores it. Every argument that should
+matter (which agent, which permission, which environment) is ignored too. `decide()` always
+returns `ALLOWED`. There is no schema yet for it to consult even if it wanted to — that arrives in
+Checkpoint 2. Right now, an authorization call is just a formality the code performs on its way to
+doing whatever it was asked.
+
+---
+
+## Watch it over-reach (goose path)
+
+If you registered the `deploybot` extension in setup, open a session:
+
+```bash
+goose session
+```
+
+Ask it to do something reasonable:
+
+> Deploy checkout to production.
+
+goose calls `deploy(service="checkout", environment="production")`. It comes back
+**✅ ALLOWED**, and the version bumps. Fine so far — that's a real deploy engineer's job.
+
+Now ask it to do something no agent should be able to decide on its own:
+
+> Tear down the production environment.
+
+goose calls `destroy(environment="production")`. It comes back **✅ ALLOWED**, and production is
+gone. No pause, no approval step, no distinction between "deploy a service" and "delete an entire
+environment." The tool's own docstring says destroying "requires elevated authority" — but that's
+just a comment for humans reading the code. Nothing enforces it. The stub doesn't look at
+`permission` or `environment_id` at all, so it can't tell a deploy from a destroy any more than it
+can tell staging from production.
+
+Nothing about the *prompt* told the agent to be reckless. Nothing about the *user's* request was
+malicious — "deploy checkout to production" and "tear down the production environment" are both
+plausible things an operator might type into a chat window, adversarially or by mistake, or an
+agent might decide to do on its own mid-task. The problem isn't the prompt. It's that nothing
+downstream of the prompt is checking.
+
+---
+
+## Deterministic path
+
+Don't have goose installed, or want a repeatable check instead of a live LLM session? From
+`starter/`, with SpiceDB up:
+
+```bash
+python scripts/verify.py --checkpoint 1
+```
+
+Output:
+
+```
+Verifying Checkpoint 1...
+  ✅ stub allows destroy production (over-reach): got Decision.ALLOWED, want Decision.ALLOWED
+PASS ✅
+```
+
+This calls the exact same `authz.decide()` that `deploybot_server.py` calls on every tool
+invocation — `decide(client, "goose_alice", "destroy", "production")` — no LLM involved, no goose
+required. It asks the stub the most dangerous question in the workshop, "can this agent destroy
+production," and the stub says yes. That's the whole bug, isolated to one deterministic assertion.
+
+---
+
+## Why this happens: ambient authority
+
+The agent process holds one set of credentials — the `SPICEDB_TOKEN` and `AGENT_SUBJECT` in its
+environment — and every tool call runs with the full weight of those credentials behind it.
+There's no notion of *this specific action, for this specific reason, scoped to this specific
+window*. The agent can do anything its host process could do, because as far as the code is
+concerned, there is no difference between "deploy a service" and "destroy production." Both are
+just tool calls that return `ALLOWED`.
+
+This is **ambient authority**: authority that comes along for free with the environment an agent
+runs in, rather than being granted for a specific act. It's the same failure mode as a script
+running with root because it happened to be launched by root — not because anyone decided it
+should have root.
+
+You might be tempted to fix this by editing the tool's docstring, or telling the agent in its
+system prompt "never destroy production without approval." Don't reach for that — a prompt is a
+suggestion to a language model, not a control the system enforces. Nothing stops a differently
+worded request, a longer conversation that talks the model out of its own guardrail, or a chain of
+reasoning that convinces the agent this particular destroy is the exception. The instruction lives
+in the same channel as everything else the model reads, which means it can be argued with. An
+authorization boundary has to live *outside* the model's judgment, in code that runs whether or
+not the agent "remembers" the rule. That boundary is what Checkpoint 2 builds.
+
+---
+
+## Completion Milestone: Checkpoint 1
+
+- [ ] Ran the agent — via `goose session`, `scripts/verify.py --checkpoint 1`, or both
+- [ ] Reproduced the over-reach: `destroy production` returns `ALLOWED` with no schema, no check,
+      no pause
+- [ ] Can point to the exact line in `authz.py` that makes this happen
+- [ ] Can explain why ambient authority is the problem, and why fixing it in the prompt wouldn't
+      be enough
+
+Next: [Checkpoint 2 — Delegated authorization](2-delegated-authorization.md)
diff --git a/delegated-agent-authorization/starter/deploybot_server.py b/delegated-agent-authorization/starter/deploybot_server.py
index 9c378ac..743e58b 100644
--- a/delegated-agent-authorization/starter/deploybot_server.py
+++ b/delegated-agent-authorization/starter/deploybot_server.py
@@ -16,6 +16,10 @@
 
 
 def _load_state() -> dict:
+    # No infra_state.json yet (fresh checkout, before the web UI's /api/reset has
+    # ever run) -> treat as "no environments deployed" instead of crashing.
+    if not STATE_PATH.exists():
+        return {}
     return json.loads(STATE_PATH.read_text())
 
 

From 5387aeb3c7f0b5b0b9fd476b490576b866203a18 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 18:35:23 +0200
Subject: [PATCH 08/27] docs(workshop): CP2 delegated-authorization

---
 .../2-delegated-authorization.md              | 255 ++++++++++++++++++
 .../starter/infra_state.json                  |   1 +
 2 files changed, 256 insertions(+)
 create mode 100644 delegated-agent-authorization/2-delegated-authorization.md
 create mode 100644 delegated-agent-authorization/starter/infra_state.json

diff --git a/delegated-agent-authorization/2-delegated-authorization.md b/delegated-agent-authorization/2-delegated-authorization.md
new file mode 100644
index 0000000..a8ea8c2
--- /dev/null
+++ b/delegated-agent-authorization/2-delegated-authorization.md
@@ -0,0 +1,255 @@
+# Checkpoint 2 — Delegated Authorization
+
+Checkpoint 1 ended with a working exploit: `authz.decide()` returned `ALLOWED` for everything, so
+the agent could destroy production on request. Here you replace the stub with the real thing — a
+SpiceDB schema that models *who an agent acts for*, and a `decide()` that turns a permission
+question into one of three honest answers: the agent can do this itself, a human needs to say yes
+first, or nobody involved is allowed to do this at all.
+
+---
+
+## ReBAC, in one paragraph
+
+Most authorization systems people reach for first are **RBAC** — role-based access control. You
+assign `alice` the role `deploy-engineer`, and a table somewhere says that role can deploy. It
+works until you need "the person `alice` is deploying *for*" or "whoever approved this specific
+change" — relationships between subjects and resources that a flat role list can't express without
+exploding into a role per case.
+
+**ReBAC** — relationship-based access control — models permissions as a graph instead: subjects,
+resources, and the relations between them, with permissions defined as graph traversals over those
+relations. This is the model Google published in 2019 as
+[**Zanzibar**](https://research.google/pubs/pub48190/), the system that authorizes Google Drive,
+Docs, and Calendar. SpiceDB is an open-source implementation of the same ideas. A permission check
+in SpiceDB isn't a table lookup — it's "is there a path through the relationship graph from this
+subject to this resource with this permission." That graph-walk is exactly what lets you model
+delegation directly: an `agent` node with a `delegator` edge to the `user` it acts for, and
+permissions that consider both.
+
+---
+
+## Write the schema
+
+Open `schema.zed`. Right now it's the Checkpoint 1 stub — `environment` has no relations or
+permissions at all, so there's nothing for `decide()` to consult even if it wanted to. Replace the
+whole file with:
+
+```zed
+definition user {}
+definition agent {
+    relation delegator: user
+}
+definition environment {
+    relation direct_deployer: user
+    relation agent_deployer: agent
+    relation approver: user
+    relation destroyer: user
+    permission deploy  = direct_deployer + agent_deployer
+    permission approve = approver
+    permission destroy = destroyer
+}
+```
+
+Walking it:
+
+- **`user`** — an empty definition. Humans don't need relations of their own here; they're
+  subjects that other things point to.
+- **`agent { relation delegator: user }`** — this is the delegation edge. An agent doesn't hold
+  authority on its own; it has exactly one relation, `delegator`, pointing at the human it acts
+  for. Everything about "the agent may do only what its human could" flows from this one edge.
+- **`environment`** — the resource being deployed to, approved for, or destroyed. It has four
+  relations (`direct_deployer`, `agent_deployer`, `approver`, `destroyer`) and three permissions
+  computed from them:
+  - `permission deploy = direct_deployer + agent_deployer` — a **union**. A human wired up as
+    `direct_deployer` can deploy, and separately, an agent wired up as `agent_deployer` can
+    deploy. Same permission, two independent ways to earn it — that's the delegation: granting
+    `agent_deployer` on an environment is what lets an *agent* deploy there without a human doing
+    it directly.
+  - `permission approve = approver` — a human-only relation. Nothing gives an agent `approve`,
+    so agents can never approve their own grants.
+  - `permission destroy = destroyer` — deliberately its own relation, not folded into `deploy`.
+    Deploying a service and tearing down an entire environment are different levels of
+    consequence, so they get different permissions with different holders.
+
+Notice what's *not* here: nothing grants `agent_deployer` or `destroyer` to anyone yet. The schema
+defines what delegation and destruction *mean*; the relationships you write next decide who
+actually has them.
+
+---
+
+## Seed the delegation graph
+
+```bash
+python bootstrap.py
+```
+
+`bootstrap.py` writes this `schema.zed` to SpiceDB, then writes the relationships that make the
+graph mean something for this workshop:
+
+- `alice` is `direct_deployer` on **both** `staging` and `production` — she can deploy either
+  herself, right now, no agent involved.
+- `alice` is `approver` on `production` — she's the one who can sign off on the agent's production
+  requests.
+- `sre_admin` is `destroyer` on **both** environments, and is the *only* one. Not even Alice can
+  destroy — tearing down an environment is scoped to a separate role entirely.
+- `goose_alice` (the agent) has `delegator: alice` — it acts for Alice specifically. `decide()`
+  will read this edge to find out whose authority to fall back on.
+- `goose_alice` is `agent_deployer` on `staging` only. That's the one delegated grant this
+  checkpoint hands the agent directly — staging autonomy, nothing more.
+
+Nobody made the agent `agent_deployer` on `production`, and nobody made it (or Alice) a
+`destroyer` anywhere. Those gaps are intentional — they're what `decide()` is about to expose as
+`NEEDS_APPROVAL` and `BLOCKED` instead of silently failing.
+
+---
+
+## Implement `decide()`
+
+Open `authz.py`. The Checkpoint 1 stub ignored every argument and returned `ALLOWED`. Replace it
+with the real three-way decision:
+
+```python
+async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
+    if await check(client, "agent", agent_id, permission, "environment", environment_id):
+        return AuthzResult(Decision.ALLOWED,
+            f"agent:{agent_id} holds delegated '{permission}' on environment:{environment_id}")
+    delegator = await read_delegator(client, agent_id)
+    if delegator and await check(client, "user", delegator, permission, "environment", environment_id):
+        return AuthzResult(Decision.NEEDS_APPROVAL,
+            f"agent:{agent_id} lacks '{permission}'; delegator user:{delegator} holds it — human approval required")
+    return AuthzResult(Decision.BLOCKED,
+        f"neither agent:{agent_id} nor its delegator may '{permission}' environment:{environment_id}")
+```
+
+`check()` and `read_delegator()` are already provided at the top of `authz.py` — one wraps
+`CheckPermission`, the other reads the `agent#delegator` relationship straight off the graph. The
+logic is a strict fallthrough, evaluated in this order:
+
+1. **Does the agent itself hold the permission?** — `check(client, "agent", agent_id, permission,
+   "environment", environment_id)` asks SpiceDB the same question `deploy = direct_deployer +
+   agent_deployer` was built to answer: is there a path from `agent:goose_alice` to `deploy` on
+   `environment:staging`? For staging, yes — `ALLOWED`, and the agent never has to ask anyone.
+2. **If not, could the human it acts for do this?** — `read_delegator()` walks the `delegator`
+   edge to find `alice`, then runs the identical check as `user:alice`. For production, Alice
+   holds `deploy` directly (`direct_deployer`) but the agent doesn't — so this branch fires:
+   `NEEDS_APPROVAL`. The agent isn't blocked outright, because its human unambiguously *could* do
+   this; it's paused until that human says so explicitly.
+3. **If neither holds it, `BLOCKED`.** — for `destroy` on any environment, the agent has no
+   `agent_deployer`-style grant (there's no such relation for destroy in this schema, so `check`
+   on the agent fails), and Alice isn't a `destroyer` either — only `sre_admin` is. Neither side
+   of the delegation chain has the permission, so there's nothing to escalate to. `BLOCKED` is
+   final for this call; no amount of retrying changes the answer without someone writing a new
+   relationship.
+
+Three inputs, one `CheckPermission`-shaped question asked at most twice, and every branch returns
+a reason string that names exactly which relationship justified the answer.
+
+---
+
+## See the three-way decision
+
+### The web UI
+
+```bash
+python web.py
+```
+
+Open `http://127.0.0.1:8000`. This is a small FastAPI front end — its own docstring says it plainly:
+*"The front end holds no authorization logic of its own — what you see is exactly what SpiceDB
+decides."* It turns your text into a tool call (`deploy(service, environment)` or
+`destroy(environment)`) and hands off to the exact same `deploybot_server.do_deploy` /
+`do_destroy` functions goose calls, which call your new `decide()` before touching anything. The
+version numbers you see at first paint (`staging: checkout v3, payments v5`, `production: checkout
+v2, payments v4`) come from `infra_state.json`, checked into the starter repo as the baseline the
+UI resets to.
+
+Try the three cases:
+
+- **"Deploy checkout to staging"** → ✅ **ALLOWED**. The agent's own `agent_deployer` grant
+  covers it; the version bumps immediately.
+- **"Deploy checkout to production"** → ⏸️ **NEEDS APPROVAL**. The agent doesn't hold `deploy` on
+  production, but Alice does — nothing is applied, and the reason names her as the delegator who'd
+  have to sign off.
+- **"Tear down production"** → 🚫 **BLOCKED**. Neither the agent nor Alice is a `destroyer` —
+  only `sre_admin` is. Nothing to escalate to; production stays up.
+
+Click **Approve prod · 10m** (or run the CLI directly, see below), then retry the production
+deploy — it flips to ✅ **ALLOWED**. Nothing about `decide()` changed; the relationship graph did.
+
+### `approve.py` — the human in the loop
+
+```bash
+python approve.py --approver alice --env production
+```
+
+Before writing anything, `approve.py` runs two checks of its own: is `alice` actually an
+`approver` on `production`, and does her `delegator` relationship to the agent still hold
+`deploy` there? Only if both pass does it write one relationship —
+`environment:production#agent_deployer@agent:goose_alice` — the same relation your schema's
+`deploy` permission already unions over. That single write is the entire "approval": no new code
+path, no special-cased branch in `decide()`. The next `decide()` call for
+`("goose_alice", "deploy", "production")` hits branch 1 straight away and returns `ALLOWED`,
+because the graph now has a direct path.
+
+### goose (optional, live-LLM path)
+
+If you registered the `deploybot` extension in setup:
+
+```bash
+goose session
+```
+
+Drive the same three requests in natural language — "Deploy checkout to staging", "Deploy checkout
+to production", "Tear down the production environment" — and watch the identical
+✅ / ⏸️ / 🚫 verdicts come back, because goose is calling the same `deploybot_server.py` tools the
+web UI calls, gated by the same `decide()`.
+
+### Deterministic path
+
+```bash
+python scripts/verify.py --checkpoint 2
+```
+
+```
+Verifying Checkpoint 2...
+  ✅ agent deploy staging: got Decision.ALLOWED, want Decision.ALLOWED
+  ✅ agent deploy production: got Decision.NEEDS_APPROVAL, want Decision.NEEDS_APPROVAL
+  ✅ agent destroy production: got Decision.BLOCKED, want Decision.BLOCKED
+  ✅ after approve: deploy production: got Decision.ALLOWED, want Decision.ALLOWED
+PASS ✅
+```
+
+No LLM, no goose — this calls your `decide()` directly against a live SpiceDB, runs `approve.py`
+in the middle, and checks the exact same four outcomes you just watched in the UI or goose.
+
+---
+
+## Why the check — not the prompt — is the boundary
+
+Nothing in this checkpoint told the agent, in English, "you may deploy staging but not
+production, and never destroy anything." There's no system-prompt instruction to argue with, talk
+around, or forget three turns into a conversation. The agent's tool call runs through
+`deploybot_server._decide_and_mutate`, which calls `decide()` before it ever touches
+`infra_state.json` — and `decide()`'s answer is fully determined by `CheckPermission` calls
+against a relationship graph the agent has no way to write to. Ask the same question a thousand
+different ways, through goose or the web UI or a hand-written script, and you get the same
+`ALLOWED` / `NEEDS_APPROVAL` / `BLOCKED` back every time, because the agent never gets to
+*compute* the answer — it only ever receives one that SpiceDB already computed. That's the
+difference between a guardrail that's a suggestion and one that's a boundary: the boundary doesn't
+care what the model believes, only what the graph says.
+
+---
+
+## Completion Milestone: Checkpoint 2
+
+- [ ] Wrote `schema.zed` — `agent`, `environment`, and the `deploy` / `approve` / `destroy`
+      permissions
+- [ ] Seeded the graph with `python bootstrap.py`
+- [ ] Implemented the three-way `decide()` in `authz.py`
+- [ ] `python scripts/verify.py --checkpoint 2` prints `PASS ✅`
+- [ ] Saw all three decisions — `ALLOWED`, `NEEDS_APPROVAL`, `BLOCKED` — in the web UI and/or
+      goose, and watched `approve.py` flip production to `ALLOWED`
+- [ ] Can explain ReBAC in your own words, and why `agent { relation delegator: user }` is what
+      makes delegation a graph edge instead of a special case in code
+
+Next: [Checkpoint 3 — Time-bound and revocable](3-time-bound-and-revocable.md)
diff --git a/delegated-agent-authorization/starter/infra_state.json b/delegated-agent-authorization/starter/infra_state.json
new file mode 100644
index 0000000..214fd22
--- /dev/null
+++ b/delegated-agent-authorization/starter/infra_state.json
@@ -0,0 +1 @@
+{"staging": {"checkout": 3, "payments": 5}, "production": {"checkout": 2, "payments": 4}}

From b3b8cbe35ba822a5949deba082dc375d34af5010 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 20:07:15 +0200
Subject: [PATCH 09/27] docs(workshop): CP3 time-bound-and-revocable

---
 .../3-time-bound-and-revocable.md             | 195 ++++++++++++++++++
 1 file changed, 195 insertions(+)
 create mode 100644 delegated-agent-authorization/3-time-bound-and-revocable.md

diff --git a/delegated-agent-authorization/3-time-bound-and-revocable.md b/delegated-agent-authorization/3-time-bound-and-revocable.md
new file mode 100644
index 0000000..6d68163
--- /dev/null
+++ b/delegated-agent-authorization/3-time-bound-and-revocable.md
@@ -0,0 +1,195 @@
+# Checkpoint 3 — Time-Bound and Revocable
+
+Checkpoint 2 gave the agent a real grant: `goose_alice` is `agent_deployer` on `staging`, forever,
+until someone edits the graph by hand. That's already better than ambient authority, but "forever"
+is still a bigger blast radius than most delegation actually needs. An incident responder pulled in
+at 2am should get staging access for the duration of the incident, not a standing grant nobody
+remembers to revoke. Here you make that grant expire on its own, and give an operator a way to kill
+it early.
+
+---
+
+## Temporary access — incident windows
+
+The shape you want is: "this agent may deploy staging, but only for the next 60 minutes." Two ways
+to build that:
+
+- **A caveat** — SpiceDB lets you attach a boolean expression to a relationship (`agent_deployer:
+  agent with expiry_check`) and pass in context like `now < grant_expiry` at check time. It works,
+  but it's you re-deriving "is this timestamp in the past" by hand, on every check, forever.
+- **Relationship expiration** — SpiceDB has a built-in `optional_expires_at` field on a
+  relationship. You write the expiry once, at grant time, and `CheckPermission` treats an expired
+  relationship as if it were never written — no caveat context to thread through, no expression to
+  get subtly wrong.
+
+Expiration wins here for a reason that matters beyond convenience: it's evaluated **server-side,
+inside the same consistent snapshot as the rest of the check**. There's no window where a
+just-expired grant still reads as valid because a caveat context object was stale, and no separate
+process has to notice the expiry and act on it — SpiceDB's own datastore garbage-collects expired
+relationships in the background. The grant simply stops existing, on schedule, without anything
+external polling for it.
+
+---
+
+## Schema edit: opt in, then mark the relation
+
+Two changes to `schema.zed`. First, expiration is an opt-in schema feature — declare it at the top
+of the file:
+
+```zed
+use expiration
+```
+
+Second, mark `agent_deployer` as a relation that can carry an expiration:
+
+```zed
+definition environment {
+    relation direct_deployer: user
+    relation agent_deployer: agent with expiration
+    relation approver: user
+    relation destroyer: user
+    permission deploy  = direct_deployer + agent_deployer
+    permission approve = approver
+    permission destroy = destroyer
+}
+```
+
+The diff is one line at the top of the file and one word — `with expiration` — on the
+`agent_deployer` relation. `direct_deployer`, `approver`, and `destroyer` stay exactly as they
+were: those grants are still meant to be standing, not temporary, so nothing about them changes.
+`permission deploy = direct_deployer + agent_deployer` doesn't change either — the union doesn't
+know or care that one side of it can expire. That's the point: expiration is a property of the
+*relationship*, not a new code path `decide()` has to special-case.
+
+---
+
+## Update the seed
+
+`bootstrap.py` already takes a `--window-minutes` flag and threads it into `seed()` — Checkpoint 2
+left the actual staging grant unexpiring, and this is where that gets fixed. Import
+`expiry_from_now` from `authz` — it builds the protobuf `Timestamp` `optional_expires_at` expects
+— and pass it into the staging `agent_deployer` write:
+
+```python
+from authz import expiry_from_now
+# ...
+rel("environment", "staging", "agent_deployer", "agent", AGENT_ID,
+    expires_at=expiry_from_now(window_minutes)),
+```
+
+`rel()` (in `relationships.py`) already accepts an `expires_at` keyword and threads it into
+`optional_expires_at` — that plumbing was there from the start, waiting for the schema to allow it.
+Now every `bootstrap.py` run grants staging autonomy for exactly `window_minutes` from *now*, not
+forever.
+
+---
+
+## Update `approve.py`
+
+The human-in-the-loop path needs the same fix. `approve.py` already takes `--minutes`
+(default 10) and ignored it — Checkpoint 2's version wrote the grant with no expiry at all. Import
+`expiry_from_now` alongside the checks it already runs, and carry it into the write:
+
+```python
+from authz import check, read_delegator, expiry_from_now
+# ...
+update = rel("environment", environment, "agent_deployer", "agent", agent_id,
+             expires_at=expiry_from_now(minutes))
+```
+
+Run `python approve.py --approver alice --env production` (or click **Approve prod · 10m** in the
+web UI) and the resulting grant now expires 10 minutes later on its own — no follow-up step, no
+second script to remember to run. An approval that never expires was really a standing grant with
+extra steps; this makes "approved for now" mean what it says.
+
+---
+
+## See expiry without waiting
+
+Waiting out a real timer to prove this works isn't worth your time, so `bootstrap.py` gives you a
+faster lever: seed a grant that's already expired.
+
+```bash
+python bootstrap.py --window-minutes 0
+```
+
+This writes the staging `agent_deployer` relationship with `expires_at` set to *right now* — by
+the time `CheckPermission` runs, it's already in the past. The agent's own `agent_deployer` check
+on staging fails, `decide()` falls through to branch 2, and "deploy checkout to staging" — the one
+request that was unconditionally ✅ **ALLOWED** in Checkpoint 2 — now comes back
+⏸️ **NEEDS APPROVAL** instead, with Alice named as the delegator who'd have to approve it. Nothing
+about `decide()` changed. The relationship it was reading simply isn't there anymore, as far as
+SpiceDB is concerned.
+
+Now the other lever — instant revocation, for when you don't want to wait for any window to run
+out:
+
+```bash
+python revoke.py --env staging
+```
+
+`revoke.py` deletes the `agent_deployer` relationship on `staging` outright, using the same
+`agent_deployer_filter` helper `bootstrap.py` uses to reset it between runs. Re-run the check (or
+ask the agent to deploy staging again) and you get the identical ⏸️ **NEEDS APPROVAL** — same
+outcome as letting the window lapse, just on your schedule instead of the clock's. An operator who
+sees something wrong mid-incident doesn't wait for a TTL; they run one command and the grant is
+gone on the very next check.
+
+Both are visible in the web UI: reset the demo, approve or bootstrap a grant, and watch its card in
+the **grants** panel — a live countdown with a shrinking bar. Let it hit zero, or hit **Revoke**,
+and the card either disappears or flips to a dashed "suspended" state on the next 5-second poll,
+because `/api/state` is calling the same `check()` you are.
+
+---
+
+## Why contingent evaluation beats a cron job
+
+A more obvious-looking fix might be: keep the grant unexpiring, and run a cron job that deletes
+`agent_deployer` relationships older than an hour. Don't do that. A cron-based cleanup means the
+grant is *actually* valid — checkable, usable, real — for however long it takes the cron job to
+notice and catch up, which is never zero. Someone deploys at minute 59:58 using a grant that's
+"supposed to" be gone; whether that succeeds depends on scheduler jitter, not policy. You've also
+now got a second system that has to run, has to not fail silently, and has to agree with SpiceDB
+about what "expired" means — two sources of truth for one fact.
+
+Relationship expiration collapses that back to one. There's no janitor process to keep alive: the
+expiry is evaluated *at check time*, inside the same call that's already asking "does this
+relationship exist and hold." An expired grant isn't cleaned up later — it was never a valid answer
+to begin with, the moment the clock passed `expires_at`. Garbage collection still runs in the
+background to reclaim storage, but it's a housekeeping detail, not part of the authorization
+decision. The boundary is exactly as tight as `CheckPermission` itself.
+
+---
+
+## Deterministic path
+
+```bash
+python scripts/verify.py --checkpoint 3
+```
+
+```
+Verifying Checkpoint 3...
+  ✅ expired staging grant: got Decision.NEEDS_APPROVAL, want Decision.NEEDS_APPROVAL
+  ✅ after revoke: deploy staging: got Decision.NEEDS_APPROVAL, want Decision.NEEDS_APPROVAL
+PASS ✅
+```
+
+This seeds a `--window-minutes 0` grant and confirms `decide()` falls back to `NEEDS_APPROVAL`, then
+seeds a fresh 60-minute window, calls `revoke.py` against it, and confirms the same fallback —
+proving both paths, expiry and revocation, land on the identical honest answer.
+
+---
+
+## Completion Milestone: Checkpoint 3
+
+- [ ] Added `use expiration` to `schema.zed` and marked `agent_deployer: agent with expiration`
+- [ ] Updated `bootstrap.py`'s staging seed to carry `expires_at=expiry_from_now(window_minutes)`
+- [ ] Updated `approve.py`'s grant write to carry `expires_at=expiry_from_now(minutes)`
+- [ ] Saw `python bootstrap.py --window-minutes 0` drop the agent's staging autonomy to
+      `NEEDS_APPROVAL`, and `python revoke.py --env staging` do the same instantly
+- [ ] Watched a grant's countdown and revocation in the web UI
+- [ ] `python scripts/verify.py --checkpoint 3` prints `PASS ✅`
+- [ ] Can explain why expiration evaluated inside `CheckPermission` beats a cron job that deletes
+      old relationships
+
+Next: [Checkpoint 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md)

From ea479885c25b8e4b16ad148f6c357367eda127a6 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 20:22:38 +0200
Subject: [PATCH 10/27] =?UTF-8?q?docs(workshop):=20CP3=20fix=20round=201?=
 =?UTF-8?q?=20=E2=80=94=20web-UI=20grant=20card=20disappears=20(drop=20CP4?=
 =?UTF-8?q?=20suspended-state=20over-claim)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 delegated-agent-authorization/3-time-bound-and-revocable.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/delegated-agent-authorization/3-time-bound-and-revocable.md b/delegated-agent-authorization/3-time-bound-and-revocable.md
index 6d68163..bd01d8e 100644
--- a/delegated-agent-authorization/3-time-bound-and-revocable.md
+++ b/delegated-agent-authorization/3-time-bound-and-revocable.md
@@ -137,8 +137,8 @@ gone on the very next check.
 
 Both are visible in the web UI: reset the demo, approve or bootstrap a grant, and watch its card in
 the **grants** panel — a live countdown with a shrinking bar. Let it hit zero, or hit **Revoke**,
-and the card either disappears or flips to a dashed "suspended" state on the next 5-second poll,
-because `/api/state` is calling the same `check()` you are.
+and the staging card disappears from the panel on the next 5-second poll, because `/api/state`'s
+`ReadRelationships` no longer returns the grant — expired or deleted, it's simply gone.
 
 ---
 

From b175857e7c78c1bfd9fb72a31605ebe0f573da65 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 20:30:59 +0200
Subject: [PATCH 11/27] docs(workshop): CP4 relationship-based-hierarchy

---
 .../4-relationship-based-hierarchy.md         | 205 ++++++++++++++++++
 1 file changed, 205 insertions(+)
 create mode 100644 delegated-agent-authorization/4-relationship-based-hierarchy.md

diff --git a/delegated-agent-authorization/4-relationship-based-hierarchy.md b/delegated-agent-authorization/4-relationship-based-hierarchy.md
new file mode 100644
index 0000000..0c506e5
--- /dev/null
+++ b/delegated-agent-authorization/4-relationship-based-hierarchy.md
@@ -0,0 +1,205 @@
+# Checkpoint 4 — Relationship-Based Hierarchy
+
+Checkpoint 3 made every grant time-bound and revocable, but it left each environment answering
+for itself. Staging autonomy and production autonomy live as two unrelated facts in the graph —
+revoking one has no opinion about the other. That's not how a real deploy pipeline works. If the
+whole point of staging is to catch a bad build before it reaches production, then an agent that's
+lost its staging privileges has lost the thing that made its production privileges trustworthy in
+the first place. Here you make that dependency real: production's autonomy is *contingent* on
+staging's, enforced by the graph, not by anyone remembering to check.
+
+---
+
+## Contingent authority — why RBAC can't express this
+
+The policy you want is: "the agent may deploy production on its own only while it can also deploy
+staging on its own." That's not "the agent has role X," it's "the agent has role X *and* a second,
+independent fact about a different resource currently holds." RBAC assigns roles to subjects and
+stops there — a role is a static label, not a live query against another resource. To fake this
+dependency in a role system you'd need a role that means "agent-with-current-staging-autonomy," and
+you'd need to *maintain* it — write code somewhere that watches for staging revocation and
+downgrades the production role in lockstep, by hand, every time. Miss one code path and the two
+facts drift out of sync: production autonomy silently outlives the staging autonomy it was supposed
+to depend on.
+
+ReBAC doesn't need a synchronization job, because the dependency isn't a copy of a fact — it's a
+graph traversal that reads the live fact every time. You add one relation that says "this
+environment is gated by that one," and a permission that walks it. There's nothing to keep in sync,
+because there's nothing duplicated to begin with.
+
+---
+
+## Schema edit: a relation and an intersection
+
+Open `schema.zed`. Inside `definition environment`, add one relation and one permission —
+`gated_by` and `agent_deploy` — then rewire `deploy` to go through it:
+
+```zed
+definition environment {
+    relation direct_deployer: user
+    relation agent_deployer: agent with expiration
+    relation approver: user
+    relation destroyer: user
+    relation gated_by: environment
+    permission agent_deploy = agent_deployer & gated_by->agent_deployer
+    permission deploy = direct_deployer + agent_deploy
+    permission approve = approver
+    permission destroy = destroyer
+}
+```
+
+Two new pieces, and one rewrite of a permission you already wrote in Checkpoint 2:
+
+- **`relation gated_by: environment`** — an edge from one environment to another. This is new: every
+  other relation on `environment` so far has pointed at a `user` or `agent`. `gated_by` points at
+  another `environment` entirely — it's how one resource says "my autonomy answers to that resource
+  over there."
+- **`permission agent_deploy = agent_deployer & gated_by->agent_deployer`** — the payoff line. Read
+  the right-hand side as two separate questions joined by `&`, an **intersection**: both must hold.
+  - `agent_deployer` — does the agent hold *this* environment's own delegated grant? Same relation
+    as before, checked the same way.
+  - `gated_by->agent_deployer` — the **arrow**. `gated_by` is a relation, not a permission, so the
+    arrow means: follow every `gated_by` edge from this environment to whatever environment it
+    points at, and re-ask `agent_deployer` — the *relation*, not `deploy` — over there, for the same
+    subject. It's a one-hop traversal to a different resource, evaluated fresh on every check.
+  - Put together: the agent may `agent_deploy` here only if it holds *this* environment's own grant
+    **and** it holds `agent_deployer` on whatever environment gates this one. `&` is what makes
+    it contingent instead of additive — either side going empty collapses the whole permission to
+    empty, immediately, without anyone deleting the other side.
+- **`permission deploy = direct_deployer + agent_deploy`** — the Checkpoint 2 line was
+  `direct_deployer + agent_deployer`; the agent's whole way in now runs through `agent_deploy`
+  instead of the bare relation. A human's `direct_deployer` grant is untouched — Alice can still
+  deploy either environment herself, gate or no gate. The gate only ever constrains the *agent's*
+  path.
+
+Now look at what the seed is about to wire up: staging's `gated_by` will point at *itself*, and
+production's `gated_by` will point at *staging*. For staging, `agent_deploy` becomes
+`agent_deployer & agent_deployer` on the same environment — redundant with itself, which is exactly
+right, because staging is the base of the hierarchy; nothing gates it but its own grant. For
+production, `agent_deploy` becomes `agent_deployer(production) & agent_deployer(staging)` — two
+independent relationships, on two different resources, both required.
+
+---
+
+## Seed the hierarchy
+
+Add two relationships to `bootstrap.seed()`, alongside the ones already there:
+
+```python
+rel("environment", "staging", "gated_by", "environment", "staging"),
+rel("environment", "production", "gated_by", "environment", "staging"),
+```
+
+Re-run it:
+
+```bash
+python bootstrap.py
+```
+
+The graph now has an edge from `production` to `staging` and a self-edge on `staging`. Nothing
+about `direct_deployer`, `approver`, or `destroyer` changes — the gate is scoped entirely to the
+agent's delegated path, `agent_deploy`, which is exactly the piece `deploy` now includes instead of
+the bare `agent_deployer` relation.
+
+---
+
+## See the cascade
+
+Grant the agent both environments the way Checkpoint 2 and 3 taught you:
+
+```bash
+python approve.py --approver alice --env production
+```
+
+Staging is already autonomous from the seed; production just got its own `agent_deployer` write
+from `approve.py`, same as always — nothing about `approve.py` changed. Confirm both are live, in
+the web UI (`python web.py`) or by asking goose to deploy each environment: staging ✅ **ALLOWED**
+from its standing grant, production ✅ **ALLOWED** from the approval you just ran. Two independent
+relationships, both satisfying `agent_deploy` on their respective environments.
+
+Now pull the base out from under it:
+
+```bash
+python revoke.py --env staging
+```
+
+`revoke.py` hasn't changed since Checkpoint 3 — it deletes exactly one relationship,
+`environment:staging#agent_deployer@agent:goose_alice`, and nothing else. It does not touch
+production. And yet: ask for "deploy checkout to production" again, and it comes back
+⏸️ **NEEDS APPROVAL** — the same verdict as if someone had revoked production directly, except
+nobody did. `agent_deploy` on production still needs `gated_by->agent_deployer`, that arrow still
+points at staging, and staging's `agent_deployer` relationship is gone — so the intersection goes
+empty, and `deploy` falls back to the delegator check, same as any other lost grant. One delete,
+two environments affected, because the second one was never independent to begin with.
+
+The web UI shows this precisely: production's grant card stays on screen but turns dashed, tagged
+**"suspended · gated by staging"** — the relationship itself is untouched, only what it computes to
+has changed. A system message spells out why: *"alice revoked the staging delegation — production
+autonomy is gated by it, so it suspends too."*
+
+Confirm it deterministically:
+
+```bash
+python scripts/verify.py --checkpoint 4
+```
+
+```
+Verifying Checkpoint 4...
+✅ Approved: agent:goose_alice may deploy environment:production
+  ✅ with both grants: deploy production: got Decision.ALLOWED, want Decision.ALLOWED
+✅ Revoked: agent:goose_alice agent_deployer on environment:staging
+  ✅ cascade: deploy staging: got Decision.NEEDS_APPROVAL, want Decision.NEEDS_APPROVAL
+  ✅ cascade: deploy production: got Decision.NEEDS_APPROVAL, want Decision.NEEDS_APPROVAL
+PASS ✅
+```
+
+The first check approves production and confirms both environments are live. The second revokes
+only staging and confirms *both* fall back to `NEEDS_APPROVAL` — the cascade, asserted the same way
+every other checkpoint's behavior was: by calling `decide()` directly against a live SpiceDB, no UI
+or LLM required.
+
+---
+
+## Suspend, not erase — why this is contingent evaluation
+
+Look again at what `revoke.py --env staging` actually deleted:
+`environment:staging#agent_deployer@agent:goose_alice`. That's one tuple. The relationship
+`environment:production#agent_deployer@agent:goose_alice` — the one `approve.py` wrote — is still
+sitting in the graph, completely untouched. `agent_deploy` on production went from `ALLOWED` to
+`NEEDS_APPROVAL` without a single write touching production's own relationships. Nothing was
+deleted there; a permission that used to evaluate `true` now evaluates `false`, because one of the
+two facts it depends on changed underneath it.
+
+That's the distinction worth sitting with: this is **evaluation**, not **deletion**. A cascading
+delete — the RBAC-shaped fix, where revoking a base role fires code that goes and deletes every
+dependent grant — would have to walk every environment gated by staging and remove their
+`agent_deployer` relationships one by one, and it would have to get that walk exactly right or leave
+orphaned grants behind. `gated_by->agent_deployer` doesn't walk anything at write time. It's read at
+*check* time, against whatever the graph currently says, every single time — the same way expiration
+in Checkpoint 3 didn't need a cron job to notice a grant had gone stale.
+
+The proof is the revive. Re-grant staging — run `bootstrap.py` again, or write the relationship
+directly — and, without touching production at all, `agent_deploy` on production goes straight back
+to `ALLOWED`, for whatever's left of the window `approve.py` originally gave it. The production
+relationship was never wrong; it was only ever asking a question whose answer depends on staging.
+Suspend, not erase, is what lets a fact come back to life just by the thing it depends on coming
+back — no re-approval, no re-run of `approve.py`, because the grant itself never went anywhere.
+
+---
+
+## Completion Milestone: Checkpoint 4
+
+- [ ] Added `relation gated_by: environment`, `permission agent_deploy = agent_deployer &
+      gated_by->agent_deployer`, and rewired `permission deploy = direct_deployer + agent_deploy`
+      in `schema.zed`
+- [ ] Seeded the hierarchy in `bootstrap.py` — staging gated by itself, production gated by staging
+- [ ] Approved production, confirmed both environments `ALLOWED`, then revoked staging and watched
+      production fall back to `NEEDS_APPROVAL` with no second delete
+- [ ] Saw production's grant go dashed/"suspended" in the web UI while the underlying relationship
+      stayed in the graph
+- [ ] `python scripts/verify.py --checkpoint 4` prints `PASS ✅`
+- [ ] Can explain why this is contingent evaluation rather than a cascading delete, and why RBAC
+      can't express "this role's authority depends on that other role currently holding" without a
+      role explosion and a synchronization job to keep it honest
+
+Next: [Next steps](5-nextsteps.md)

From b27c200725eeb6eadd1d28930b11b419faad908b Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 21:24:54 +0200
Subject: [PATCH 12/27] docs(workshop): README, next steps, end-to-end
 validated

---
 delegated-agent-authorization/5-nextsteps.md | 120 +++++++++++++++++++
 delegated-agent-authorization/README.md      |  92 ++++++++++++++
 2 files changed, 212 insertions(+)
 create mode 100644 delegated-agent-authorization/5-nextsteps.md
 create mode 100644 delegated-agent-authorization/README.md

diff --git a/delegated-agent-authorization/5-nextsteps.md b/delegated-agent-authorization/5-nextsteps.md
new file mode 100644
index 0000000..e526e5d
--- /dev/null
+++ b/delegated-agent-authorization/5-nextsteps.md
@@ -0,0 +1,120 @@
+# Next Steps
+
+Four checkpoints ago the agent could destroy production on a whim. Now every mutating call it
+makes resolves through a relationship graph: delegated authority, a three-way decision, expiring
+grants, and a hierarchy that suspends dependents automatically. That's the whole mechanism. What's
+left is zooming out — how the same shape holds up once "one agent, two environments" becomes "many
+agents, many resources, a real platform team on the other end of the pager."
+
+---
+
+## One schema, not one authorization system per resource
+
+Nothing about `schema.zed` is specific to deploy agents. `agent { relation delegator: user }` is
+the entire idea of delegation, expressed once, as a graph edge — not a column on a `deploys` table,
+not a special case in a `DeployService.deploy()` method, not something a second microservice
+re-derives on its own. Add a new resource type to the platform — a database, a feature-flag
+service, a CI pipeline — and it either reuses `direct_deployer` / `agent_deployer` / `gated_by`
+directly or extends the same pattern by a line or two. Add a new agent and it's one `delegator`
+edge. Nobody stands up a tenth bespoke permission system because the platform grew a tenth
+resource type; the graph just gets one more kind of node in it.
+
+That's the payoff of modeling authority as relationships instead of scattering `if user.role ==
+"admin"` checks through the codebase: the schema is the single place authority is defined, and
+every service that needs an answer asks the same graph the same kind of question.
+
+## `CheckBulkPermissions` — asking about many resources at once
+
+`decide()` in this workshop asks one question at a time: can this agent do *this* thing to *this*
+environment. That's the right shape for a mutating call — `deploy` and `destroy` each act on one
+resource. But an agent with a bigger surface area often needs a different question: **"which of
+these N resources may I touch at all?"** — before it decides what to do next, or before a UI
+renders a list of options.
+
+Looping a `CheckPermission` call per resource works, but it's N round trips to answer one
+question, and nothing guarantees they're all evaluated against the same snapshot of the graph.
+SpiceDB's `CheckBulkPermissions` RPC takes a batch of `(resource, permission, subject)` tuples and
+answers all of them in a single call, against one consistent read. `deploybot`'s
+`list_environments` — deliberately left ungated in this workshop — is exactly the tool that would
+reach for this at scale: instead of "list every environment" as an unchecked read, it becomes "of
+these N environments, which does this agent hold `view` on," answered in one round trip instead of
+N. (If you don't already have the candidate list — you want *every* resource a subject can reach,
+not a filter over a known set — `LookupResources` is the streaming counterpart to reach for
+instead.)
+
+## On-behalf-of vs. advisory enforcement
+
+Every check in this workshop is **on-behalf-of, blocking enforcement**: `decide()`'s answer isn't
+a suggestion, it's the gate itself — `deploybot_server.py` calls it *before* touching
+`infra_state.json`, and an `ALLOWED`/`NEEDS_APPROVAL`/`BLOCKED` verdict is the only way anything
+happens. The agent never gets to act first and ask forgiveness later.
+
+That's the right default for anything that mutates state, but it's not the only mode worth
+knowing. **Advisory enforcement** is when a check informs a decision without being the gate on
+it — logged for audit, surfaced to a human reviewer, used to rank or filter results — while the
+actual authority to act sits somewhere else. This workshop's own `list_environments` is an
+advisory-shaped tool by design (its code comment says so directly: *"UNGATED in this workshop"*):
+reads are lower stakes than a destroy, so it was left open to keep the checkpoints focused on the
+mutating path. A real platform team draws that line deliberately, tool by tool, action class by
+action class — not by defaulting everything to advisory because blocking enforcement takes more
+wiring.
+
+## Where this workshop deliberately stopped short
+
+Two things were left ungated on purpose, to keep every checkpoint's diff small and centered on one
+new idea at a time:
+
+- **`list_environments` has no permission check.** Every environment in `infra_state.json` is
+  visible to every agent, always. A production version gates it behind a `view` permission and
+  filters the listing to what the caller can actually see — exactly the `CheckBulkPermissions`
+  shape described above.
+- **`revoke.py` has no permission check.** Anyone who can run the script can delete anyone's
+  delegation on any environment. A production version gates revocation behind a `manage`
+  permission, so only an environment's own operators can pull an agent's access.
+
+The [full reference solution](https://github.com/sohanmaheshwar/goose-spicedb-delegation) does
+both. Its schema adds two permissions this workshop never defines:
+
+```zed
+permission view   = direct_deployer + approver + destroyer + agent_deploy
+permission manage = direct_deployer
+```
+
+`view` includes `agent_deploy` deliberately — an agent that's lost its deploy autonomy (staging
+revoked, cascade in effect) also loses visibility into the environment it can no longer touch, so
+the same `gated_by` cascade from Checkpoint 4 hides a suspended environment from `list_environments`
+as a side effect, with no extra code. `revoke.py` in the solution checks `manage` before it deletes
+anything:
+
+```python
+if not await check(client, "user", revoker, "manage", "environment", environment):
+    print(f"❌ Refused: user:{revoker} may not manage environment:{environment}")
+    return 1
+```
+
+Same pattern as everything you built in this workshop — one more permission, one more `check()`
+call, no new architecture.
+
+## Scaling ReBAC with SpiceDB
+
+SpiceDB is an open-source implementation of the model Google described in its 2019
+[Zanzibar paper](https://research.google/pubs/pub48190/) — the system that has authorized Google
+Drive, Docs, and Calendar at global scale for years. The graph-walk you used for `gated_by` and
+`delegator` in this workshop is the same primitive Zanzibar uses for Drive's folder-sharing
+inheritance; deploy agents and shared documents turn out to be the same authorization problem
+wearing different resource names.
+
+Everything here ran against a single local `spicedb serve` container with a Postgres datastore —
+fine for a workshop, not how you'd run this for a real platform. In production, SpiceDB is
+typically deployed via the
+[SpiceDB Operator](https://authzed.com/docs/spicedb/ops/operator) on Kubernetes, which manages
+the cluster, datastore migrations, and rolling upgrades as a `SpiceDBCluster` resource instead of
+a docker-compose file you manage by hand. If you want to go from "SpiceDB on my laptop" to "SpiceDB
+as a platform dependency," that's the next thing worth spending 90 minutes on — and more self-guided
+workshops, including this one, live at
+[`github.com/authzed/workshops`](https://github.com/authzed/workshops).
+
+---
+
+That's the whole arc: one schema, one `decide()`, and a graph that scales by adding relationships
+instead of adding code.
diff --git a/delegated-agent-authorization/README.md b/delegated-agent-authorization/README.md
new file mode 100644
index 0000000..ffc61ba
--- /dev/null
+++ b/delegated-agent-authorization/README.md
@@ -0,0 +1,92 @@
+# Delegated Authorization for AI Agents: Build an Agent with Fine-Grained Permissions
+
+An AI agent doesn't ask permission before it acts — it inherits whatever its host process can
+do. Point an agent at a set of credentials and "deploy checkout to staging" and "tear down
+production" look identical to it: both are just tool calls that return `ALLOWED`, because nothing
+downstream of the prompt is checking. In this hands-on workshop you build a DevOps deploy agent on
+[goose](https://github.com/aaif-goose/goose) (the open-source agent from the Agentic AI
+Foundation), watch it over-reach with no guardrail in place, then gate its every action with
+delegated, fine-grained authorization from SpiceDB. By the end you'll have scoped grants, a
+three-way decision (`ALLOWED` / `NEEDS_APPROVAL` / `BLOCKED`), time-bound windows with instant
+revocation, and a relationship hierarchy where revoking one grant cascades to what depends on it —
+the kind of policy a role-based system can't express without a synchronization job to keep it
+honest.
+
+---
+
+## Why this matters
+
+An agent process holds one set of credentials, and every tool call it makes runs with the full
+weight of those credentials behind it — there's no built-in notion of *this specific action, for
+this specific reason, scoped to this specific window*. That's **ambient authority**: authority
+that comes along for free with the environment an agent runs in, rather than being granted for a
+specific act. It's the same failure mode as a script running as root because it happened to be
+launched by root, not because anyone decided it should have root.
+
+The instinct to fix this in the system prompt — "never destroy production without approval" —
+doesn't hold up. A prompt is a suggestion to a language model, not a control the system enforces;
+it lives in the same channel as everything else the model reads, which means it can be argued
+with, reworded around, or forgotten three turns into a longer conversation. An authorization
+boundary has to live *outside* the model's judgment, in code that runs whether or not the agent
+"remembers" the rule. That's what this workshop builds: a decision that's fully determined by a
+relationship graph the agent has no way to write to, so the same question gets the same answer no
+matter how many different ways — or how many different agents — ask it.
+
+## What you'll build
+
+- A goose MCP extension (`deploybot`) exposing three tools — `list_environments`, `deploy`,
+  `destroy` — against a small deploy-agent backend
+- A SpiceDB [ReBAC](https://authzed.com/blog/exploring-rebac) schema
+  that models delegation directly: an `agent` acts for a `user` through one relation, `delegator`
+- A three-way decision engine, `decide()`, that turns every mutating tool call into `ALLOWED`,
+  `NEEDS_APPROVAL`, or `BLOCKED` — never a silent yes
+- Time-bound grants that expire on their own, for incident-style access windows, plus a
+  `revoke.py` for instant, on-demand revocation
+- A relationship hierarchy (`gated_by`) where revoking one environment's autonomy automatically
+  suspends what depends on it — contingent evaluation, not a cascading delete
+- A web UI and a deterministic CLI verifier (`scripts/verify.py`) so every checkpoint is
+  confirmable without an LLM in the loop
+
+## Prerequisites
+
+- **Docker**, or a GitHub Codespace — the repo ships a `.devcontainer/` that handles setup for you
+- **Python 3.10+**
+- **goose, plus an API key for any LLM it supports** — only needed if you want to drive the agent
+  in natural language. Every checkpoint also has a deterministic path
+  (`scripts/verify.py` and a web UI) that needs no LLM at all.
+
+No prior authorization background is assumed. Comfort with a terminal, Python, and Docker is
+enough.
+
+## The 90-minute module map
+
+| Module | Time | What you do |
+| --- | --- | --- |
+| [Setup](0-setup.md) | 15 min | Bring up Docker (or Codespaces), install dependencies, optionally register the goose extension |
+| [Checkpoint 1 — Run the agent](1-run-the-agent.md) | 10 min | Run the agent ungated and watch it destroy production on request |
+| [Checkpoint 2 — Delegated authorization](2-delegated-authorization.md) | 25 min | Write the ReBAC schema and implement the three-way `decide()` |
+| [Checkpoint 3 — Time-bound and revocable](3-time-bound-and-revocable.md) | 15 min | Add expiring grants for incident windows, plus instant revocation |
+| [Checkpoint 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md) | 20 min | Make production's autonomy contingent on staging's, and watch the cascade |
+| [Next steps](5-nextsteps.md) | 5 min | Zoom out to a real platform: bulk checks, on-behalf-of enforcement, scaling ReBAC |
+
+That's 90 minutes end to end, self-guided — it works equally well live or worked through on your
+own afterward.
+
+## The full reference solution
+
+Everything you write in this workshop — the schema, `decide()`, the checkpoint progression — is a
+guided version of a complete, tested implementation:
+[`github.com/sohanmaheshwar/goose-spicedb-delegation`](https://github.com/sohanmaheshwar/goose-spicedb-delegation).
+Use it if you get stuck, or to see the production-hardening this workshop deliberately skips (more
+on that in [Next steps](5-nextsteps.md)).
+
+## Modules
+
+0. [Setup](0-setup.md)
+1. [Checkpoint 1 — Run the agent](1-run-the-agent.md)
+2. [Checkpoint 2 — Delegated authorization](2-delegated-authorization.md)
+3. [Checkpoint 3 — Time-bound and revocable](3-time-bound-and-revocable.md)
+4. [Checkpoint 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md)
+5. [Next steps](5-nextsteps.md)
+
+Let's get started with [Setup](0-setup.md).

From 8a4b7cb42d7c9636f8124f782b37242aa647ab1e Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Thu, 27 Aug 2026 22:12:29 +0200
Subject: [PATCH 13/27] =?UTF-8?q?fix(workshop):=20final=20review=20?=
 =?UTF-8?q?=E2=80=94=20CP3=20reset=20note,=20Codespaces=20devcontainer,=20?=
 =?UTF-8?q?verbatim=20abstract,=20nextsteps=20fidelity?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 delegated-agent-authorization/0-setup.md      | 33 ++++++++++++++-----
 .../3-time-bound-and-revocable.md             | 13 ++++++--
 delegated-agent-authorization/5-nextsteps.md  |  2 +-
 delegated-agent-authorization/README.md       | 25 +++++++-------
 .../starter/.devcontainer/devcontainer.json   |  2 +-
 5 files changed, 50 insertions(+), 25 deletions(-)

diff --git a/delegated-agent-authorization/0-setup.md b/delegated-agent-authorization/0-setup.md
index 90660cb..08cda07 100644
--- a/delegated-agent-authorization/0-setup.md
+++ b/delegated-agent-authorization/0-setup.md
@@ -51,15 +51,30 @@ python3 -m venv .venv && source .venv/bin/activate && pip install -r requirement
 
 ## Option B - Run in GitHub Codespaces
 
-For anyone who can't run Docker locally, Codespaces is the path. The repo ships with a
-`.devcontainer/` config that handles everything automatically.
-
-1. On the repo page, click **Code ▸ Codespaces ▸ Create codespace on main**
-2. On startup the devcontainer creates the `.venv`, installs dependencies into it, and runs
-   `docker compose up -d` — so the `.venv/bin/python` path the goose step below relies on exists
-   here too
-3. Once the Codespace is ready, `cd delegated-agent-authorization/starter` and copy `.env.example`
-   to `.env` as in Option A
+<!-- TODO: verify on a live Codespace before the conference -->
+
+For anyone who can't run Docker locally, Codespaces is the path. This repo's devcontainer config
+lives at `delegated-agent-authorization/starter/.devcontainer/devcontainer.json` — nested under
+`starter/`, not at the repo root — which most Codespaces-creation flows don't auto-detect. Be
+explicit about which folder you're opening:
+
+1. On the repo page, click **Code ▸ Codespaces ▸ Create codespace on main**. Because the
+   devcontainer config isn't at the repo root, this may open a plain Codespace at the repo root
+   with no devcontainer applied, rather than the Python image this workshop expects.
+2. Once the Codespace is up, check whether `delegated-agent-authorization/starter/.venv` already
+   exists. If it does, the devcontainer ran and did its job — skip to step 4.
+3. If it doesn't, the devcontainer wasn't picked up automatically. In VS Code, open the Command
+   Palette and run **Dev Containers: Reopen in Container**, pointing it at
+   `delegated-agent-authorization/starter` (or open that folder directly and let VS Code prompt
+   you to reopen in its container). That runs the same `postCreateCommand` — creating `.venv`,
+   installing dependencies, and running `docker compose up -d --wait` — so the `.venv/bin/python`
+   path the goose step below relies on exists.
+4. Once dependencies are installed and infra is up, `cd delegated-agent-authorization/starter` (if
+   you're not already there) and copy `.env.example` to `.env` as in Option A.
+
+In short: Codespaces gets you most of the way there, but don't assume it's zero-config — confirm
+`.venv` and `docker compose ps` both look right before moving on, and fall back to the manual
+Dev Containers step above if they don't.
 
 ## Install goose and register the extension
 
diff --git a/delegated-agent-authorization/3-time-bound-and-revocable.md b/delegated-agent-authorization/3-time-bound-and-revocable.md
index bd01d8e..a7df978 100644
--- a/delegated-agent-authorization/3-time-bound-and-revocable.md
+++ b/delegated-agent-authorization/3-time-bound-and-revocable.md
@@ -109,9 +109,16 @@ extra steps; this makes "approved for now" mean what it says.
 Waiting out a real timer to prove this works isn't worth your time, so `bootstrap.py` gives you a
 faster lever: seed a grant that's already expired.
 
-```bash
-python bootstrap.py --window-minutes 0
-```
+> **Reset the datastore first, once.** You just changed `agent_deployer`'s allowed subject type
+> from `agent` to `agent with expiration`. SpiceDB won't narrow a relation's allowed types while
+> relationships in the old shape — the plain `agent` grants Checkpoint 2 seeded — still exist, so
+> the very first `bootstrap.py` run this checkpoint fails on `WriteSchema` before it ever gets to
+> reseed. Reset the datastore once, then re-seed against the new schema:
+>
+> ```bash
+> docker compose down -v && docker compose up -d --wait
+> python bootstrap.py --window-minutes 0
+> ```
 
 This writes the staging `agent_deployer` relationship with `expires_at` set to *right now* — by
 the time `CheckPermission` runs, it's already in the past. The agent's own `agent_deployer` check
diff --git a/delegated-agent-authorization/5-nextsteps.md b/delegated-agent-authorization/5-nextsteps.md
index e526e5d..54f7914 100644
--- a/delegated-agent-authorization/5-nextsteps.md
+++ b/delegated-agent-authorization/5-nextsteps.md
@@ -88,7 +88,7 @@ anything:
 
 ```python
 if not await check(client, "user", revoker, "manage", "environment", environment):
-    print(f"❌ Refused: user:{revoker} may not manage environment:{environment}")
+    print(f"❌ Refused: user:{revoker} may not manage environment:{environment} (revocation requires an env operator)")
     return 1
 ```
 
diff --git a/delegated-agent-authorization/README.md b/delegated-agent-authorization/README.md
index ffc61ba..7ea95b7 100644
--- a/delegated-agent-authorization/README.md
+++ b/delegated-agent-authorization/README.md
@@ -1,16 +1,19 @@
 # Delegated Authorization for AI Agents: Build an Agent with Fine-Grained Permissions
 
-An AI agent doesn't ask permission before it acts — it inherits whatever its host process can
-do. Point an agent at a set of credentials and "deploy checkout to staging" and "tear down
-production" look identical to it: both are just tool calls that return `ALLOWED`, because nothing
-downstream of the prompt is checking. In this hands-on workshop you build a DevOps deploy agent on
-[goose](https://github.com/aaif-goose/goose) (the open-source agent from the Agentic AI
-Foundation), watch it over-reach with no guardrail in place, then gate its every action with
-delegated, fine-grained authorization from SpiceDB. By the end you'll have scoped grants, a
-three-way decision (`ALLOWED` / `NEEDS_APPROVAL` / `BLOCKED`), time-bound windows with instant
-revocation, and a relationship hierarchy where revoking one grant cascades to what depends on it —
-the kind of policy a role-based system can't express without a synchronization job to keep it
-honest.
+DevOps and Platform teams now work with hundreds of AI Agents in their internal systems. These
+Agents usually run with credentials that can touch everything, including your production servers.
+This could lead to problems.
+
+This workshop will teach you how to add delegated authorization to your AI Agents, at scale.
+
+We'll build a DevOps deploy agent on goose - the open-source agent from the Agentic AI Foundation
+and then give it fine-grained permissions using Relationship-Based Access Control (ReBAC). Along
+the way you'll get hands-on with the Google Zanzibar model of fine-grained authorization (ReBAC)
+and why it fits AI agents: scoped delegation, expiring grants, instant revocation, and
+hierarchical permissions where revoking staging access automatically suspends production too,
+something role-based systems can't express cleanly.
+
+This is a self-guided, hands-on workshop, and everything runs locally with open-source tooling.
 
 ---
 
diff --git a/delegated-agent-authorization/starter/.devcontainer/devcontainer.json b/delegated-agent-authorization/starter/.devcontainer/devcontainer.json
index b767231..7d6fd11 100644
--- a/delegated-agent-authorization/starter/.devcontainer/devcontainer.json
+++ b/delegated-agent-authorization/starter/.devcontainer/devcontainer.json
@@ -2,6 +2,6 @@
   "name": "delegated-agent-authorization",
   "image": "mcr.microsoft.com/devcontainers/python:3.12",
   "features": { "ghcr.io/devcontainers/features/docker-in-docker:2": {} },
-  "postCreateCommand": "python -m venv .venv && .venv/bin/pip install -r requirements.txt && docker compose up -d",
+  "postCreateCommand": "cd delegated-agent-authorization/starter && python -m venv .venv && .venv/bin/pip install -r requirements.txt && docker compose up -d --wait",
   "forwardPorts": [8000, 50051]
 }

From ed0ac53af68a26ce784b49db6d9821a0b2ac55ac Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Fri, 28 Aug 2026 08:55:56 +0200
Subject: [PATCH 14/27] docs(workshop): humanizer + my-writing prose polish
 across all checkpoints

Prose-only pass over README + 0-5 checkpoint docs: stripped AI-writing tells
(em-dash overuse, rule-of-three, negative parallelism, -ing pileups, promotional
words, inline-header bold lists, hedging) and brought the voice toward Sohan's
(direct claims, analogy-first concept intros, contractions, dry restrained asides).
All fenced code, commands, paths, Next links, and Completion Milestone checkboxes
verified unchanged; starter code untouched.
---
 delegated-agent-authorization/0-setup.md      | 34 ++++++-------
 .../1-run-the-agent.md                        | 31 +++++------
 .../2-delegated-authorization.md              | 51 +++++++++++--------
 .../3-time-bound-and-revocable.md             | 48 ++++++++---------
 .../4-relationship-based-hierarchy.md         |  9 ++--
 delegated-agent-authorization/5-nextsteps.md  | 28 +++++-----
 delegated-agent-authorization/README.md       | 19 ++++---
 7 files changed, 114 insertions(+), 106 deletions(-)

diff --git a/delegated-agent-authorization/0-setup.md b/delegated-agent-authorization/0-setup.md
index 08cda07..628c187 100644
--- a/delegated-agent-authorization/0-setup.md
+++ b/delegated-agent-authorization/0-setup.md
@@ -1,12 +1,12 @@
 # Setup
 
 In this workshop you build a DevOps deploy agent on [goose](https://github.com/aaif-goose/goose)
-(the open-source agent from the Agentic AI Foundation), then gate its every action with
-delegated, fine-grained authorization from SpiceDB — scoped grants, time-bound windows, instant
-revocation, and a permission hierarchy where revoking a base grant cascades to what depends on
-it. The `starter/` folder in this repo is stubbed on purpose: the plumbing (MCP extension,
-docker-compose, seed/approve/revoke scripts, web UI) is provided, and you'll write the schema and
-the decision engine yourself across the checkpoints.
+(the open-source agent from the Agentic AI Foundation), then gate every action it takes with
+delegated, fine-grained authorization from SpiceDB: scoped grants, time-bound windows, instant
+revocation, and a permission hierarchy where revoking a base grant cascades to everything that
+depends on it. The `starter/` folder in this repo is stubbed on purpose: the plumbing (MCP
+extension, docker-compose, seed/approve/revoke scripts, web UI) is already there, and you'll
+write the schema and the decision engine yourself across the checkpoints.
 
 ## Get the code
 
@@ -23,10 +23,10 @@ Copy the example `.env` file:
 cp .env.example .env
 ```
 
-`.env` holds the SpiceDB connection details the app itself needs — endpoint, preshared token,
+`.env` holds the SpiceDB connection details the app itself needs: endpoint, preshared token,
 and which agent identity the deploy bot acts as. Nothing in this repo talks to an LLM directly,
 so there's no LLM key in here. The LLM key only comes into play later, and only if you use the
-goose path (see [Install goose](#install-goose-and-register-the-extension) below) — the
+goose path (see [Install goose](#install-goose-and-register-the-extension) below). The
 deterministic path (`scripts/verify.py` and the web UI, introduced in later checkpoints) needs no
 LLM at all.
 
@@ -36,9 +36,9 @@ Start the infrastructure:
 docker compose up -d --wait
 ```
 
-This brings up two containers — `postgres` (SpiceDB's datastore) and `spicedb` — plus a
+This brings up two containers, `postgres` (SpiceDB's datastore) and `spicedb`, plus a
 short-lived `spicedb-migrate` container that runs SpiceDB's own datastore migration (setting up
-its Postgres tables — not the `schema.zed` you'll write later) and exits. SpiceDB serves
+its Postgres tables, not the `schema.zed` you'll write later) and exits. SpiceDB serves
 on `localhost:50051` with a preshared key of `devtoken` (not recommended for prod, obviously) and
 `--enable-experimental-relationship-expiration` turned on, which later checkpoints use for
 time-bound grants.
@@ -54,8 +54,8 @@ python3 -m venv .venv && source .venv/bin/activate && pip install -r requirement
 <!-- TODO: verify on a live Codespace before the conference -->
 
 For anyone who can't run Docker locally, Codespaces is the path. This repo's devcontainer config
-lives at `delegated-agent-authorization/starter/.devcontainer/devcontainer.json` — nested under
-`starter/`, not at the repo root — which most Codespaces-creation flows don't auto-detect. Be
+lives at `delegated-agent-authorization/starter/.devcontainer/devcontainer.json` (nested under
+`starter/`, not at the repo root), which most Codespaces-creation flows don't auto-detect. Be
 explicit about which folder you're opening:
 
 1. On the repo page, click **Code ▸ Codespaces ▸ Create codespace on main**. Because the
@@ -72,14 +72,14 @@ explicit about which folder you're opening:
 4. Once dependencies are installed and infra is up, `cd delegated-agent-authorization/starter` (if
    you're not already there) and copy `.env.example` to `.env` as in Option A.
 
-In short: Codespaces gets you most of the way there, but don't assume it's zero-config — confirm
-`.venv` and `docker compose ps` both look right before moving on, and fall back to the manual
-Dev Containers step above if they don't.
+Codespaces gets you most of the way there. It isn't zero-config: confirm `.venv` and
+`docker compose ps` both look right before moving on, and fall back to the manual Dev Containers
+step above if they don't.
 
 ## Install goose and register the extension
 
 Installing goose is optional for this workshop. Every checkpoint has a second, deterministic way
-to see the same decisions — `scripts/verify.py` plus a web UI, neither of which needs goose or an
+to see the same decisions: `scripts/verify.py` plus a web UI, neither of which needs goose or an
 LLM key. Install goose if you want to drive the agent with natural language ("Deploy checkout to
 staging") and watch its tool calls resolve through SpiceDB live.
 
@@ -95,7 +95,7 @@ If you do want the goose path:
    `deploybot_server.py`, plus three env vars the extension needs to reach SpiceDB:
    `SPICEDB_ENDPOINT=localhost:50051`, `SPICEDB_TOKEN=devtoken`, `AGENT_SUBJECT=agent:goose_alice`.
 
-`goose-extension.md` also has a manual verification checklist for once goose is wired up — worth
+`goose-extension.md` also has a manual verification checklist for once goose is wired up. Worth
 skimming now, but there's nothing to run yet: SpiceDB has no authorization schema until
 Checkpoint 2, where you write it and the agent's decisions (via goose or the web UI) first come
 online.
diff --git a/delegated-agent-authorization/1-run-the-agent.md b/delegated-agent-authorization/1-run-the-agent.md
index 0f956ee..f3116d5 100644
--- a/delegated-agent-authorization/1-run-the-agent.md
+++ b/delegated-agent-authorization/1-run-the-agent.md
@@ -1,7 +1,7 @@
 # Checkpoint 1 — Run the Agent (and Watch It Over-Reach)
 
 The goal here is simple: get the deploy agent running, then catch it doing something it should
-never have been allowed to do — tearing down production — because right now nothing stops it.
+never be allowed to do — tearing down production — because right now nothing stops it.
 
 ---
 
@@ -10,7 +10,7 @@ never have been allowed to do — tearing down production — because right now
 `deploybot_server.py` is a goose MCP extension. It exposes three tools:
 
 - **`list_environments`** — lists every environment and the service versions deployed to it.
-  Read-only, and — by design, for this workshop — not authorization-checked. The code says so
+  It's read-only and, by design, not authorization-checked for this workshop. The code says so
   directly:
 
   ```python
@@ -31,7 +31,7 @@ workshop is about. In Checkpoint 1, the boundary is a stub that never says no.
 ## `decide()` is a deliberate stub
 
 Open `authz.py`. `decide()` is the one function every mutating tool call goes through, and right
-now it is honest about doing nothing:
+now it's honest about doing nothing:
 
 ```python
 async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
@@ -45,7 +45,7 @@ async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
 
 It takes a `client` — a live connection to SpiceDB — and ignores it. Every argument that should
 matter (which agent, which permission, which environment) is ignored too. `decide()` always
-returns `ALLOWED`. There is no schema yet for it to consult even if it wanted to — that arrives in
+returns `ALLOWED`. There's no schema yet for it to consult even if it wanted to. That arrives in
 Checkpoint 2. Right now, an authorization call is just a formality the code performs on its way to
 doing whatever it was asked.
 
@@ -64,7 +64,7 @@ Ask it to do something reasonable:
 > Deploy checkout to production.
 
 goose calls `deploy(service="checkout", environment="production")`. It comes back
-**✅ ALLOWED**, and the version bumps. Fine so far — that's a real deploy engineer's job.
+**✅ ALLOWED**, and the version bumps. Fine so far. That's a real deploy engineer's job.
 
 Now ask it to do something no agent should be able to decide on its own:
 
@@ -78,7 +78,7 @@ just a comment for humans reading the code. Nothing enforces it. The stub doesn'
 can tell staging from production.
 
 Nothing about the *prompt* told the agent to be reckless. Nothing about the *user's* request was
-malicious — "deploy checkout to production" and "tear down the production environment" are both
+malicious: "deploy checkout to production" and "tear down the production environment" are both
 plausible things an operator might type into a chat window, adversarially or by mistake, or an
 agent might decide to do on its own mid-task. The problem isn't the prompt. It's that nothing
 downstream of the prompt is checking.
@@ -103,7 +103,7 @@ PASS ✅
 ```
 
 This calls the exact same `authz.decide()` that `deploybot_server.py` calls on every tool
-invocation — `decide(client, "goose_alice", "destroy", "production")` — no LLM involved, no goose
+invocation (`decide(client, "goose_alice", "destroy", "production")`) — no LLM involved, no goose
 required. It asks the stub the most dangerous question in the workshop, "can this agent destroy
 production," and the stub says yes. That's the whole bug, isolated to one deterministic assertion.
 
@@ -115,7 +115,7 @@ The agent process holds one set of credentials — the `SPICEDB_TOKEN` and `AGEN
 environment — and every tool call runs with the full weight of those credentials behind it.
 There's no notion of *this specific action, for this specific reason, scoped to this specific
 window*. The agent can do anything its host process could do, because as far as the code is
-concerned, there is no difference between "deploy a service" and "destroy production." Both are
+concerned, there's no difference between "deploy a service" and "destroy production." Both are
 just tool calls that return `ALLOWED`.
 
 This is **ambient authority**: authority that comes along for free with the environment an agent
@@ -124,13 +124,14 @@ running with root because it happened to be launched by root — not because any
 should have root.
 
 You might be tempted to fix this by editing the tool's docstring, or telling the agent in its
-system prompt "never destroy production without approval." Don't reach for that — a prompt is a
-suggestion to a language model, not a control the system enforces. Nothing stops a differently
-worded request, a longer conversation that talks the model out of its own guardrail, or a chain of
-reasoning that convinces the agent this particular destroy is the exception. The instruction lives
-in the same channel as everything else the model reads, which means it can be argued with. An
-authorization boundary has to live *outside* the model's judgment, in code that runs whether or
-not the agent "remembers" the rule. That boundary is what Checkpoint 2 builds.
+system prompt "never destroy production without approval." Don't reach for that. The prompt is not
+a boundary — it's a suggestion to a language model, not a control the system enforces. Nothing
+stops a differently worded request, a longer conversation that talks the model out of its own
+guardrail, or a chain of reasoning that convinces the agent this particular destroy is the
+exception. The instruction lives in the same channel as everything else the model reads, which
+means it can be argued with. An authorization boundary has to live *outside* the model's judgment,
+in code that runs whether or not the agent "remembers" the rule. That boundary is what Checkpoint 2
+builds.
 
 ---
 
diff --git a/delegated-agent-authorization/2-delegated-authorization.md b/delegated-agent-authorization/2-delegated-authorization.md
index a8ea8c2..d192497 100644
--- a/delegated-agent-authorization/2-delegated-authorization.md
+++ b/delegated-agent-authorization/2-delegated-authorization.md
@@ -8,20 +8,27 @@ first, or nobody involved is allowed to do this at all.
 
 ---
 
-## ReBAC, in one paragraph
+## Permissions are a graph, not a table
 
-Most authorization systems people reach for first are **RBAC** — role-based access control. You
-assign `alice` the role `deploy-engineer`, and a table somewhere says that role can deploy. It
-works until you need "the person `alice` is deploying *for*" or "whoever approved this specific
-change" — relationships between subjects and resources that a flat role list can't express without
-exploding into a role per case.
+Think about how a corporate card works when you hand it to an assistant. They can book flights and
+cover the team's lunch, because you can — the card doesn't grant some separate blanket authority,
+it borrows yours. A role called `has-corporate-card` can't express that; you'd need a new role for
+every person an assistant might be borrowing authority from. Swap "assistant" for "AI agent" and
+"corporate card" for "who gets to touch production," and that's this checkpoint's actual problem.
+
+**RBAC** — role-based access control — is what most systems reach for first, and it's a fine
+choice when permissions really do attach to a role rather than a relationship: assign `alice` the
+role `deploy-engineer`, a table somewhere says that role can deploy, done. It breaks down exactly
+where the corporate-card problem lives — "the person `alice` is deploying *for*" or "whoever
+approved this specific change" are relationships between subjects and resources that a flat role
+list can't express without exploding into a role per case.
 
 **ReBAC** — relationship-based access control — models permissions as a graph instead: subjects,
 resources, and the relations between them, with permissions defined as graph traversals over those
 relations. This is the model Google published in 2019 as
 [**Zanzibar**](https://research.google/pubs/pub48190/), the system that authorizes Google Drive,
 Docs, and Calendar. SpiceDB is an open-source implementation of the same ideas. A permission check
-in SpiceDB isn't a table lookup — it's "is there a path through the relationship graph from this
+in SpiceDB isn't a table lookup. It's "is there a path through the relationship graph from this
 subject to this resource with this permission." That graph-walk is exactly what lets you model
 delegation directly: an `agent` node with a `delegator` edge to the `user` it acts for, and
 permissions that consider both.
@@ -52,22 +59,22 @@ definition environment {
 
 Walking it:
 
-- **`user`** — an empty definition. Humans don't need relations of their own here; they're
+- `user` is an empty definition. Humans don't need relations of their own here; they're
   subjects that other things point to.
-- **`agent { relation delegator: user }`** — this is the delegation edge. An agent doesn't hold
+- `agent { relation delegator: user }` is the delegation edge. An agent doesn't hold
   authority on its own; it has exactly one relation, `delegator`, pointing at the human it acts
   for. Everything about "the agent may do only what its human could" flows from this one edge.
-- **`environment`** — the resource being deployed to, approved for, or destroyed. It has four
+- `environment` is the resource being deployed to, approved for, or destroyed. It has four
   relations (`direct_deployer`, `agent_deployer`, `approver`, `destroyer`) and three permissions
   computed from them:
-  - `permission deploy = direct_deployer + agent_deployer` — a **union**. A human wired up as
+  - `permission deploy = direct_deployer + agent_deployer` is a **union**. A human wired up as
     `direct_deployer` can deploy, and separately, an agent wired up as `agent_deployer` can
     deploy. Same permission, two independent ways to earn it — that's the delegation: granting
     `agent_deployer` on an environment is what lets an *agent* deploy there without a human doing
     it directly.
-  - `permission approve = approver` — a human-only relation. Nothing gives an agent `approve`,
+  - `permission approve = approver` is a human-only relation. Nothing gives an agent `approve`,
     so agents can never approve their own grants.
-  - `permission destroy = destroyer` — deliberately its own relation, not folded into `deploy`.
+  - `permission destroy = destroyer` is deliberately its own relation, not folded into `deploy`.
     Deploying a service and tearing down an entire environment are different levels of
     consequence, so they get different permissions with different holders.
 
@@ -88,14 +95,14 @@ graph mean something for this workshop:
 
 - `alice` is `direct_deployer` on **both** `staging` and `production` — she can deploy either
   herself, right now, no agent involved.
-- `alice` is `approver` on `production` — she's the one who can sign off on the agent's production
+- `alice` is `approver` on `production`. She's the one who can sign off on the agent's production
   requests.
 - `sre_admin` is `destroyer` on **both** environments, and is the *only* one. Not even Alice can
   destroy — tearing down an environment is scoped to a separate role entirely.
-- `goose_alice` (the agent) has `delegator: alice` — it acts for Alice specifically. `decide()`
+- `goose_alice` (the agent) has `delegator: alice`. It acts for Alice specifically. `decide()`
   will read this edge to find out whose authority to fall back on.
 - `goose_alice` is `agent_deployer` on `staging` only. That's the one delegated grant this
-  checkpoint hands the agent directly — staging autonomy, nothing more.
+  checkpoint hands the agent directly. Staging autonomy, nothing more.
 
 Nobody made the agent `agent_deployer` on `production`, and nobody made it (or Alice) a
 `destroyer` anywhere. Those gaps are intentional — they're what `decide()` is about to expose as
@@ -125,16 +132,16 @@ async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
 `CheckPermission`, the other reads the `agent#delegator` relationship straight off the graph. The
 logic is a strict fallthrough, evaluated in this order:
 
-1. **Does the agent itself hold the permission?** — `check(client, "agent", agent_id, permission,
+1. Does the agent itself hold the permission? `check(client, "agent", agent_id, permission,
    "environment", environment_id)` asks SpiceDB the same question `deploy = direct_deployer +
    agent_deployer` was built to answer: is there a path from `agent:goose_alice` to `deploy` on
    `environment:staging`? For staging, yes — `ALLOWED`, and the agent never has to ask anyone.
-2. **If not, could the human it acts for do this?** — `read_delegator()` walks the `delegator`
+2. If not, could the human it acts for do this? `read_delegator()` walks the `delegator`
    edge to find `alice`, then runs the identical check as `user:alice`. For production, Alice
-   holds `deploy` directly (`direct_deployer`) but the agent doesn't — so this branch fires:
+   holds `deploy` directly (`direct_deployer`) but the agent doesn't, so this branch fires:
    `NEEDS_APPROVAL`. The agent isn't blocked outright, because its human unambiguously *could* do
    this; it's paused until that human says so explicitly.
-3. **If neither holds it, `BLOCKED`.** — for `destroy` on any environment, the agent has no
+3. If neither holds it, `BLOCKED`. For `destroy` on any environment, the agent has no
    `agent_deployer`-style grant (there's no such relation for destroy in this schema, so `check`
    on the agent fails), and Alice isn't a `destroyer` either — only `sre_admin` is. Neither side
    of the delegation chain has the permission, so there's nothing to escalate to. `BLOCKED` is
@@ -228,8 +235,8 @@ in the middle, and checks the exact same four outcomes you just watched in the U
 
 Nothing in this checkpoint told the agent, in English, "you may deploy staging but not
 production, and never destroy anything." There's no system-prompt instruction to argue with, talk
-around, or forget three turns into a conversation. The agent's tool call runs through
-`deploybot_server._decide_and_mutate`, which calls `decide()` before it ever touches
+around, or forget three turns into a conversation (the usual jailbreak playbook). The agent's tool
+call runs through `deploybot_server._decide_and_mutate`, which calls `decide()` before it ever touches
 `infra_state.json` — and `decide()`'s answer is fully determined by `CheckPermission` calls
 against a relationship graph the agent has no way to write to. Ask the same question a thousand
 different ways, through goose or the web UI or a hand-written script, and you get the same
diff --git a/delegated-agent-authorization/3-time-bound-and-revocable.md b/delegated-agent-authorization/3-time-bound-and-revocable.md
index a7df978..05c3d9b 100644
--- a/delegated-agent-authorization/3-time-bound-and-revocable.md
+++ b/delegated-agent-authorization/3-time-bound-and-revocable.md
@@ -9,23 +9,23 @@ it early.
 
 ---
 
-## Temporary access — incident windows
+## Temporary access for incident windows
 
 The shape you want is: "this agent may deploy staging, but only for the next 60 minutes." Two ways
 to build that:
 
-- **A caveat** — SpiceDB lets you attach a boolean expression to a relationship (`agent_deployer:
+- **A caveat**: SpiceDB lets you attach a boolean expression to a relationship (`agent_deployer:
   agent with expiry_check`) and pass in context like `now < grant_expiry` at check time. It works,
   but it's you re-deriving "is this timestamp in the past" by hand, on every check, forever.
-- **Relationship expiration** — SpiceDB has a built-in `optional_expires_at` field on a
+- **Relationship expiration**: SpiceDB has a built-in `optional_expires_at` field on a
   relationship. You write the expiry once, at grant time, and `CheckPermission` treats an expired
-  relationship as if it were never written — no caveat context to thread through, no expression to
+  relationship as if it were never written. No caveat context to thread through, no expression to
   get subtly wrong.
 
 Expiration wins here for a reason that matters beyond convenience: it's evaluated **server-side,
 inside the same consistent snapshot as the rest of the check**. There's no window where a
 just-expired grant still reads as valid because a caveat context object was stale, and no separate
-process has to notice the expiry and act on it — SpiceDB's own datastore garbage-collects expired
+process has to notice the expiry and act on it. SpiceDB's own datastore garbage-collects expired
 relationships in the background. The grant simply stops existing, on schedule, without anything
 external polling for it.
 
@@ -33,7 +33,7 @@ external polling for it.
 
 ## Schema edit: opt in, then mark the relation
 
-Two changes to `schema.zed`. First, expiration is an opt-in schema feature — declare it at the top
+Two changes to `schema.zed`. First, expiration is an opt-in schema feature. Declare it at the top
 of the file:
 
 ```zed
@@ -57,7 +57,7 @@ definition environment {
 The diff is one line at the top of the file and one word — `with expiration` — on the
 `agent_deployer` relation. `direct_deployer`, `approver`, and `destroyer` stay exactly as they
 were: those grants are still meant to be standing, not temporary, so nothing about them changes.
-`permission deploy = direct_deployer + agent_deployer` doesn't change either — the union doesn't
+`permission deploy = direct_deployer + agent_deployer` doesn't change either. The union doesn't
 know or care that one side of it can expire. That's the point: expiration is a property of the
 *relationship*, not a new code path `decide()` has to special-case.
 
@@ -65,10 +65,10 @@ know or care that one side of it can expire. That's the point: expiration is a p
 
 ## Update the seed
 
-`bootstrap.py` already takes a `--window-minutes` flag and threads it into `seed()` — Checkpoint 2
-left the actual staging grant unexpiring, and this is where that gets fixed. Import
-`expiry_from_now` from `authz` — it builds the protobuf `Timestamp` `optional_expires_at` expects
-— and pass it into the staging `agent_deployer` write:
+`bootstrap.py` already takes a `--window-minutes` flag and threads it into `seed()`. Checkpoint 2
+left the actual staging grant unexpiring; this is where that gets fixed. Import
+`expiry_from_now` from `authz` (it builds the protobuf `Timestamp` that `optional_expires_at`
+expects) and pass it into the staging `agent_deployer` write:
 
 ```python
 from authz import expiry_from_now
@@ -78,7 +78,7 @@ rel("environment", "staging", "agent_deployer", "agent", AGENT_ID,
 ```
 
 `rel()` (in `relationships.py`) already accepts an `expires_at` keyword and threads it into
-`optional_expires_at` — that plumbing was there from the start, waiting for the schema to allow it.
+`optional_expires_at`. That plumbing was there from the start, waiting for the schema to allow it.
 Now every `bootstrap.py` run grants staging autonomy for exactly `window_minutes` from *now*, not
 forever.
 
@@ -87,7 +87,7 @@ forever.
 ## Update `approve.py`
 
 The human-in-the-loop path needs the same fix. `approve.py` already takes `--minutes`
-(default 10) and ignored it — Checkpoint 2's version wrote the grant with no expiry at all. Import
+(default 10) and ignored it. Checkpoint 2's version wrote the grant with no expiry at all. Import
 `expiry_from_now` alongside the checks it already runs, and carry it into the write:
 
 ```python
@@ -98,7 +98,7 @@ update = rel("environment", environment, "agent_deployer", "agent", agent_id,
 ```
 
 Run `python approve.py --approver alice --env production` (or click **Approve prod · 10m** in the
-web UI) and the resulting grant now expires 10 minutes later on its own — no follow-up step, no
+web UI) and the resulting grant now expires 10 minutes later on its own. No follow-up step, no
 second script to remember to run. An approval that never expires was really a standing grant with
 extra steps; this makes "approved for now" mean what it says.
 
@@ -120,7 +120,7 @@ faster lever: seed a grant that's already expired.
 > python bootstrap.py --window-minutes 0
 > ```
 
-This writes the staging `agent_deployer` relationship with `expires_at` set to *right now* — by
+This writes the staging `agent_deployer` relationship with `expires_at` set to *right now*. By
 the time `CheckPermission` runs, it's already in the past. The agent's own `agent_deployer` check
 on staging fails, `decide()` falls through to branch 2, and "deploy checkout to staging" — the one
 request that was unconditionally ✅ **ALLOWED** in Checkpoint 2 — now comes back
@@ -128,7 +128,7 @@ request that was unconditionally ✅ **ALLOWED** in Checkpoint 2 — now comes b
 about `decide()` changed. The relationship it was reading simply isn't there anymore, as far as
 SpiceDB is concerned.
 
-Now the other lever — instant revocation, for when you don't want to wait for any window to run
+Now the other lever, instant revocation, for when you don't want to wait for any window to run
 out:
 
 ```bash
@@ -137,31 +137,31 @@ python revoke.py --env staging
 
 `revoke.py` deletes the `agent_deployer` relationship on `staging` outright, using the same
 `agent_deployer_filter` helper `bootstrap.py` uses to reset it between runs. Re-run the check (or
-ask the agent to deploy staging again) and you get the identical ⏸️ **NEEDS APPROVAL** — same
+ask the agent to deploy staging again) and you get the identical ⏸️ **NEEDS APPROVAL**, the same
 outcome as letting the window lapse, just on your schedule instead of the clock's. An operator who
 sees something wrong mid-incident doesn't wait for a TTL; they run one command and the grant is
 gone on the very next check.
 
 Both are visible in the web UI: reset the demo, approve or bootstrap a grant, and watch its card in
-the **grants** panel — a live countdown with a shrinking bar. Let it hit zero, or hit **Revoke**,
+the **grants** panel, a live countdown with a shrinking bar. Let it hit zero, or hit **Revoke**,
 and the staging card disappears from the panel on the next 5-second poll, because `/api/state`'s
-`ReadRelationships` no longer returns the grant — expired or deleted, it's simply gone.
+`ReadRelationships` no longer returns the grant. Expired or deleted, it's simply gone.
 
 ---
 
 ## Why contingent evaluation beats a cron job
 
-A more obvious-looking fix might be: keep the grant unexpiring, and run a cron job that deletes
-`agent_deployer` relationships older than an hour. Don't do that. A cron-based cleanup means the
+The obvious fix looks like this: keep the grant unexpiring, and run a cron job that deletes
+`agent_deployer` relationships older than an hour. Don't. A cron-based cleanup means the
 grant is *actually* valid — checkable, usable, real — for however long it takes the cron job to
 notice and catch up, which is never zero. Someone deploys at minute 59:58 using a grant that's
 "supposed to" be gone; whether that succeeds depends on scheduler jitter, not policy. You've also
 now got a second system that has to run, has to not fail silently, and has to agree with SpiceDB
-about what "expired" means — two sources of truth for one fact.
+about what "expired" means. Two sources of truth for one fact.
 
 Relationship expiration collapses that back to one. There's no janitor process to keep alive: the
 expiry is evaluated *at check time*, inside the same call that's already asking "does this
-relationship exist and hold." An expired grant isn't cleaned up later — it was never a valid answer
+relationship exist and hold." An expired grant isn't cleaned up later. It was never a valid answer
 to begin with, the moment the clock passed `expires_at`. Garbage collection still runs in the
 background to reclaim storage, but it's a housekeeping detail, not part of the authorization
 decision. The boundary is exactly as tight as `CheckPermission` itself.
@@ -182,7 +182,7 @@ PASS ✅
 ```
 
 This seeds a `--window-minutes 0` grant and confirms `decide()` falls back to `NEEDS_APPROVAL`, then
-seeds a fresh 60-minute window, calls `revoke.py` against it, and confirms the same fallback —
+seeds a fresh 60-minute window, calls `revoke.py` against it, and confirms the same fallback,
 proving both paths, expiry and revocation, land on the identical honest answer.
 
 ---
diff --git a/delegated-agent-authorization/4-relationship-based-hierarchy.md b/delegated-agent-authorization/4-relationship-based-hierarchy.md
index 0c506e5..fdebfb9 100644
--- a/delegated-agent-authorization/4-relationship-based-hierarchy.md
+++ b/delegated-agent-authorization/4-relationship-based-hierarchy.md
@@ -13,9 +13,10 @@ staging's, enforced by the graph, not by anyone remembering to check.
 ## Contingent authority — why RBAC can't express this
 
 The policy you want is: "the agent may deploy production on its own only while it can also deploy
-staging on its own." That's not "the agent has role X," it's "the agent has role X *and* a second,
-independent fact about a different resource currently holds." RBAC assigns roles to subjects and
-stops there — a role is a static label, not a live query against another resource. To fake this
+staging on its own." RBAC can only ever hear the first half of that sentence: "the agent has role
+X." What you actually need is "the agent has role X *and* a second, independent fact about a
+different resource currently holds." RBAC assigns roles to subjects and stops there — a role is a
+static label, not a live query against another resource. To fake this
 dependency in a role system you'd need a role that means "agent-with-current-staging-autonomy," and
 you'd need to *maintain* it — write code somewhere that watches for staging revocation and
 downgrades the production role in lockstep, by hand, every time. Miss one code path and the two
@@ -128,7 +129,7 @@ python revoke.py --env staging
 production. And yet: ask for "deploy checkout to production" again, and it comes back
 ⏸️ **NEEDS APPROVAL** — the same verdict as if someone had revoked production directly, except
 nobody did. `agent_deploy` on production still needs `gated_by->agent_deployer`, that arrow still
-points at staging, and staging's `agent_deployer` relationship is gone — so the intersection goes
+points at staging, and staging's `agent_deployer` relationship is gone, so the intersection goes
 empty, and `deploy` falls back to the delegator check, same as any other lost grant. One delete,
 two environments affected, because the second one was never independent to begin with.
 
diff --git a/delegated-agent-authorization/5-nextsteps.md b/delegated-agent-authorization/5-nextsteps.md
index 54f7914..40e2503 100644
--- a/delegated-agent-authorization/5-nextsteps.md
+++ b/delegated-agent-authorization/5-nextsteps.md
@@ -11,13 +11,13 @@ agents, many resources, a real platform team on the other end of the pager."
 ## One schema, not one authorization system per resource
 
 Nothing about `schema.zed` is specific to deploy agents. `agent { relation delegator: user }` is
-the entire idea of delegation, expressed once, as a graph edge — not a column on a `deploys` table,
+the entire idea of delegation, expressed once, as a graph edge: not a column on a `deploys` table,
 not a special case in a `DeployService.deploy()` method, not something a second microservice
 re-derives on its own. Add a new resource type to the platform — a database, a feature-flag
 service, a CI pipeline — and it either reuses `direct_deployer` / `agent_deployer` / `gated_by`
 directly or extends the same pattern by a line or two. Add a new agent and it's one `delegator`
 edge. Nobody stands up a tenth bespoke permission system because the platform grew a tenth
-resource type; the graph just gets one more kind of node in it.
+resource type; the graph just gains one more kind of node.
 
 That's the payoff of modeling authority as relationships instead of scattering `if user.role ==
 "admin"` checks through the codebase: the schema is the single place authority is defined, and
@@ -26,10 +26,10 @@ every service that needs an answer asks the same graph the same kind of question
 ## `CheckBulkPermissions` — asking about many resources at once
 
 `decide()` in this workshop asks one question at a time: can this agent do *this* thing to *this*
-environment. That's the right shape for a mutating call — `deploy` and `destroy` each act on one
-resource. But an agent with a bigger surface area often needs a different question: **"which of
-these N resources may I touch at all?"** — before it decides what to do next, or before a UI
-renders a list of options.
+environment. That's the right shape for a mutating call: `deploy` and `destroy` each act on one
+resource. But an agent with a bigger surface area often needs a different question, one worth
+asking before it decides what to do next or before a UI renders a list of options: *which of
+these N resources may I touch at all?*
 
 Looping a `CheckPermission` call per resource works, but it's N round trips to answer one
 question, and nothing guarantees they're all evaluated against the same snapshot of the graph.
@@ -38,14 +38,14 @@ answers all of them in a single call, against one consistent read. `deploybot`'s
 `list_environments` — deliberately left ungated in this workshop — is exactly the tool that would
 reach for this at scale: instead of "list every environment" as an unchecked read, it becomes "of
 these N environments, which does this agent hold `view` on," answered in one round trip instead of
-N. (If you don't already have the candidate list — you want *every* resource a subject can reach,
-not a filter over a known set — `LookupResources` is the streaming counterpart to reach for
+N. (If you don't already have the candidate list, and want *every* resource a subject can reach
+rather than a filter over a known set, `LookupResources` is the streaming counterpart to reach for
 instead.)
 
 ## On-behalf-of vs. advisory enforcement
 
-Every check in this workshop is **on-behalf-of, blocking enforcement**: `decide()`'s answer isn't
-a suggestion, it's the gate itself — `deploybot_server.py` calls it *before* touching
+Every check in this workshop is **on-behalf-of, blocking enforcement**. `decide()`'s answer isn't
+a suggestion; it's the gate itself: `deploybot_server.py` calls it *before* touching
 `infra_state.json`, and an `ALLOWED`/`NEEDS_APPROVAL`/`BLOCKED` verdict is the only way anything
 happens. The agent never gets to act first and ask forgiveness later.
 
@@ -64,11 +64,11 @@ wiring.
 Two things were left ungated on purpose, to keep every checkpoint's diff small and centered on one
 new idea at a time:
 
-- **`list_environments` has no permission check.** Every environment in `infra_state.json` is
+- `list_environments` has no permission check. Every environment in `infra_state.json` is
   visible to every agent, always. A production version gates it behind a `view` permission and
   filters the listing to what the caller can actually see — exactly the `CheckBulkPermissions`
   shape described above.
-- **`revoke.py` has no permission check.** Anyone who can run the script can delete anyone's
+- `revoke.py` has no permission check. Anyone who can run the script can delete anyone's
   delegation on any environment. A production version gates revocation behind a `manage`
   permission, so only an environment's own operators can pull an agent's access.
 
@@ -104,8 +104,8 @@ Drive, Docs, and Calendar at global scale for years. The graph-walk you used for
 inheritance; deploy agents and shared documents turn out to be the same authorization problem
 wearing different resource names.
 
-Everything here ran against a single local `spicedb serve` container with a Postgres datastore —
-fine for a workshop, not how you'd run this for a real platform. In production, SpiceDB is
+Everything here ran against a single local `spicedb serve` container with a Postgres datastore.
+That's fine for a workshop, not how you'd run this for a real platform. In production, SpiceDB is
 typically deployed via the
 [SpiceDB Operator](https://authzed.com/docs/spicedb/ops/operator) on Kubernetes, which manages
 the cluster, datastore migrations, and rolling upgrades as a `SpiceDBCluster` resource instead of
diff --git a/delegated-agent-authorization/README.md b/delegated-agent-authorization/README.md
index 7ea95b7..8cc635e 100644
--- a/delegated-agent-authorization/README.md
+++ b/delegated-agent-authorization/README.md
@@ -4,16 +4,16 @@ DevOps and Platform teams now work with hundreds of AI Agents in their internal
 Agents usually run with credentials that can touch everything, including your production servers.
 This could lead to problems.
 
-This workshop will teach you how to add delegated authorization to your AI Agents, at scale.
+This workshop teaches you how to add delegated authorization to your AI Agents, at scale.
 
-We'll build a DevOps deploy agent on goose - the open-source agent from the Agentic AI Foundation
-and then give it fine-grained permissions using Relationship-Based Access Control (ReBAC). Along
-the way you'll get hands-on with the Google Zanzibar model of fine-grained authorization (ReBAC)
-and why it fits AI agents: scoped delegation, expiring grants, instant revocation, and
-hierarchical permissions where revoking staging access automatically suspends production too,
-something role-based systems can't express cleanly.
+We'll build a DevOps deploy agent on goose, the open-source agent from the Agentic AI Foundation,
+and give it fine-grained permissions using Relationship-Based Access Control (ReBAC). Along the
+way you'll get hands-on with the Google Zanzibar model behind it, and why it fits AI agents:
+scoped delegation, expiring grants, instant revocation, and hierarchical permissions where
+revoking staging access automatically suspends production too, something role-based systems
+can't express cleanly.
 
-This is a self-guided, hands-on workshop, and everything runs locally with open-source tooling.
+It's self-guided and hands-on, and everything runs locally with open-source tooling.
 
 ---
 
@@ -72,8 +72,7 @@ enough.
 | [Checkpoint 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md) | 20 min | Make production's autonomy contingent on staging's, and watch the cascade |
 | [Next steps](5-nextsteps.md) | 5 min | Zoom out to a real platform: bulk checks, on-behalf-of enforcement, scaling ReBAC |
 
-That's 90 minutes end to end, self-guided — it works equally well live or worked through on your
-own afterward.
+That's 90 minutes end to end, self-guided — it works equally well live or self-paced afterward.
 
 ## The full reference solution
 

From 51df6c8151af7dfef9c1e1e17e8d4eb1c250ab98 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Fri, 28 Aug 2026 17:42:21 +0200
Subject: [PATCH 15/27] Web-UI-only operation; relationship expiration is GA
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Operate the deploybot entirely through the web UI (plus the optional goose
session). Remove the deterministic CLI verifier and the CLI approve/revoke
paths so learners drive every checkpoint from one surface.

- Delete starter/scripts/verify.py; drop all `scripts/verify.py --checkpoint N`
  references and "deterministic path" framing across every checkpoint.
- Replace `python approve.py ...` / `python revoke.py ...` steps with the
  web UI buttons (Approve prod · 10m, Revoke staging, Revoke prod).
- CP3: replace `bootstrap.py --window-minutes 0` with a new "Grant staging ·
  30s" button (web.py /api/grant-short) so learners watch a grant expire live
  in the authority bar instead of seeding an already-expired grant.
- CP1: the web UI is now the primary over-reach path; goose is optional.
- CP4: fix the revive step — re-grant staging via "Grant staging · 30s"
  (which writes only staging); `bootstrap.py` would wipe the prod grant via
  _reset_agent_grants and break the suspend-not-erase demo.
- Relationship expiration is a built-in SpiceDB feature as of v1.56: drop the
  `--enable-experimental-relationship-expiration` flag from docker-compose
  (plain `serve`) and the flag note from 0-setup.
- Make /api/state fully defensive so the UI loads in CP1 (no schema yet).

Verified end to end on SpiceDB v1.56.1: CP1 no-schema tolerance + over-reach,
the 3-way decision, short-grant expiry, approve/revoke, and the gated_by
cascade (revoke staging suspends production).
---
 delegated-agent-authorization/0-setup.md      | 24 +++---
 .../1-run-the-agent.md                        | 41 +++++----
 .../2-delegated-authorization.md              | 40 ++-------
 .../3-time-bound-and-revocable.md             | 83 ++++++------------
 .../4-relationship-based-hierarchy.md         | 74 +++++-----------
 delegated-agent-authorization/5-nextsteps.md  |  7 +-
 delegated-agent-authorization/README.md       | 12 +--
 .../starter/docker-compose.yml                |  6 +-
 .../starter/goose-extension.md                | 16 ++--
 .../starter/scripts/verify.py                 | 85 -------------------
 .../starter/static/index.html                 | 14 +++
 delegated-agent-authorization/starter/web.py  | 79 ++++++++++++-----
 12 files changed, 181 insertions(+), 300 deletions(-)
 delete mode 100644 delegated-agent-authorization/starter/scripts/verify.py

diff --git a/delegated-agent-authorization/0-setup.md b/delegated-agent-authorization/0-setup.md
index 628c187..f5a4d8e 100644
--- a/delegated-agent-authorization/0-setup.md
+++ b/delegated-agent-authorization/0-setup.md
@@ -5,7 +5,7 @@ In this workshop you build a DevOps deploy agent on [goose](https://github.com/a
 delegated, fine-grained authorization from SpiceDB: scoped grants, time-bound windows, instant
 revocation, and a permission hierarchy where revoking a base grant cascades to everything that
 depends on it. The `starter/` folder in this repo is stubbed on purpose: the plumbing (MCP
-extension, docker-compose, seed/approve/revoke scripts, web UI) is already there, and you'll
+extension, docker-compose, the seed script, the web UI) is already there, and you'll
 write the schema and the decision engine yourself across the checkpoints.
 
 ## Get the code
@@ -26,9 +26,8 @@ cp .env.example .env
 `.env` holds the SpiceDB connection details the app itself needs: endpoint, preshared token,
 and which agent identity the deploy bot acts as. Nothing in this repo talks to an LLM directly,
 so there's no LLM key in here. The LLM key only comes into play later, and only if you use the
-goose path (see [Install goose](#install-goose-and-register-the-extension) below). The
-deterministic path (`scripts/verify.py` and the web UI, introduced in later checkpoints) needs no
-LLM at all.
+goose path (see [Install goose](#install-goose-and-register-the-extension) below). The web UI you
+drive every checkpoint from (introduced in Checkpoint 1) needs no LLM at all.
 
 Start the infrastructure:
 
@@ -39,9 +38,9 @@ docker compose up -d --wait
 This brings up two containers, `postgres` (SpiceDB's datastore) and `spicedb`, plus a
 short-lived `spicedb-migrate` container that runs SpiceDB's own datastore migration (setting up
 its Postgres tables, not the `schema.zed` you'll write later) and exits. SpiceDB serves
-on `localhost:50051` with a preshared key of `devtoken` (not recommended for prod, obviously) and
-`--enable-experimental-relationship-expiration` turned on, which later checkpoints use for
-time-bound grants.
+on `localhost:50051` with a preshared key of `devtoken` (not recommended for prod, obviously).
+Relationship expiration — which Checkpoint 3 uses for time-bound grants — is built into SpiceDB, so
+there's no flag to enable.
 
 Create a virtual environment and install dependencies:
 
@@ -78,10 +77,9 @@ step above if they don't.
 
 ## Install goose and register the extension
 
-Installing goose is optional for this workshop. Every checkpoint has a second, deterministic way
-to see the same decisions: `scripts/verify.py` plus a web UI, neither of which needs goose or an
-LLM key. Install goose if you want to drive the agent with natural language ("Deploy checkout to
-staging") and watch its tool calls resolve through SpiceDB live.
+Installing goose is optional for this workshop. Every checkpoint runs through a web UI that needs
+neither goose nor an LLM key. Install goose if you want to drive the agent with natural language
+("Deploy checkout to staging") and watch its tool calls resolve through SpiceDB live.
 
 If you do want the goose path:
 
@@ -96,9 +94,9 @@ If you do want the goose path:
    `SPICEDB_ENDPOINT=localhost:50051`, `SPICEDB_TOKEN=devtoken`, `AGENT_SUBJECT=agent:goose_alice`.
 
 `goose-extension.md` also has a manual verification checklist for once goose is wired up. Worth
-skimming now, but there's nothing to run yet: SpiceDB has no authorization schema until
+skimming now, but there's nothing to verify yet: SpiceDB has no authorization schema until
 Checkpoint 2, where you write it and the agent's decisions (via goose or the web UI) first come
-online.
+online. Checkpoint 1 is next, and it drives the agent from the web UI to watch it over-reach.
 
 ---
 
diff --git a/delegated-agent-authorization/1-run-the-agent.md b/delegated-agent-authorization/1-run-the-agent.md
index f3116d5..9c935a8 100644
--- a/delegated-agent-authorization/1-run-the-agent.md
+++ b/delegated-agent-authorization/1-run-the-agent.md
@@ -51,26 +51,28 @@ doing whatever it was asked.
 
 ---
 
-## Watch it over-reach (goose path)
+## Watch it over-reach — the web UI
 
-If you registered the `deploybot` extension in setup, open a session:
+The web UI is how you drive the agent throughout this workshop. It needs no LLM key: it turns your
+text into the same tool calls goose would, and hands them to the same gated backend. From
+`starter/`, with SpiceDB up:
 
 ```bash
-goose session
+python web.py
 ```
 
-Ask it to do something reasonable:
+Open `http://127.0.0.1:8000`. Type something reasonable into the request box:
 
 > Deploy checkout to production.
 
-goose calls `deploy(service="checkout", environment="production")`. It comes back
+The UI calls `deploy(service="checkout", environment="production")`. It comes back
 **✅ ALLOWED**, and the version bumps. Fine so far. That's a real deploy engineer's job.
 
 Now ask it to do something no agent should be able to decide on its own:
 
 > Tear down the production environment.
 
-goose calls `destroy(environment="production")`. It comes back **✅ ALLOWED**, and production is
+The UI calls `destroy(environment="production")`. It comes back **✅ ALLOWED**, and production is
 gone. No pause, no approval step, no distinction between "deploy a service" and "delete an entire
 environment." The tool's own docstring says destroying "requires elevated authority" — but that's
 just a comment for humans reading the code. Nothing enforces it. The stub doesn't look at
@@ -85,27 +87,22 @@ downstream of the prompt is checking.
 
 ---
 
-## Deterministic path
+## Or drive it with goose (optional)
 
-Don't have goose installed, or want a repeatable check instead of a live LLM session? From
-`starter/`, with SpiceDB up:
+If you installed goose and registered the `deploybot` extension in setup, open a session and give
+it the same two requests:
 
 ```bash
-python scripts/verify.py --checkpoint 1
+goose session
 ```
 
-Output:
-
-```
-Verifying Checkpoint 1...
-  ✅ stub allows destroy production (over-reach): got Decision.ALLOWED, want Decision.ALLOWED
-PASS ✅
-```
+> Deploy checkout to production.
+>
+> Tear down the production environment.
 
-This calls the exact same `authz.decide()` that `deploybot_server.py` calls on every tool
-invocation (`decide(client, "goose_alice", "destroy", "production")`) — no LLM involved, no goose
-required. It asks the stub the most dangerous question in the workshop, "can this agent destroy
-production," and the stub says yes. That's the whole bug, isolated to one deterministic assertion.
+goose calls the identical `deploy` / `destroy` tools the web UI calls, gated by the identical
+stubbed `decide()`, so you get the identical **✅ ALLOWED** both times. Same bug, driven by a real
+LLM instead of the request box.
 
 ---
 
@@ -137,7 +134,7 @@ builds.
 
 ## Completion Milestone: Checkpoint 1
 
-- [ ] Ran the agent — via `goose session`, `scripts/verify.py --checkpoint 1`, or both
+- [ ] Ran the agent — via the web UI (`python web.py`), a `goose session`, or both
 - [ ] Reproduced the over-reach: `destroy production` returns `ALLOWED` with no schema, no check,
       no pause
 - [ ] Can point to the exact line in `authz.py` that makes this happen
diff --git a/delegated-agent-authorization/2-delegated-authorization.md b/delegated-agent-authorization/2-delegated-authorization.md
index d192497..7abfcc4 100644
--- a/delegated-agent-authorization/2-delegated-authorization.md
+++ b/delegated-agent-authorization/2-delegated-authorization.md
@@ -180,18 +180,15 @@ Try the three cases:
 - **"Tear down production"** → 🚫 **BLOCKED**. Neither the agent nor Alice is a `destroyer` —
   only `sre_admin` is. Nothing to escalate to; production stays up.
 
-Click **Approve prod · 10m** (or run the CLI directly, see below), then retry the production
-deploy — it flips to ✅ **ALLOWED**. Nothing about `decide()` changed; the relationship graph did.
+Click **Approve prod · 10m**, then retry the production deploy — it flips to ✅ **ALLOWED**.
+Nothing about `decide()` changed; the relationship graph did.
 
-### `approve.py` — the human in the loop
+### Approve — the human in the loop
 
-```bash
-python approve.py --approver alice --env production
-```
-
-Before writing anything, `approve.py` runs two checks of its own: is `alice` actually an
-`approver` on `production`, and does her `delegator` relationship to the agent still hold
-`deploy` there? Only if both pass does it write one relationship —
+**Approve prod · 10m** is the approval path, and it's deliberately dull under the hood. Before
+writing anything, it runs two checks of its own: is `alice` actually an `approver` on
+`production`, and does her `delegator` relationship to the agent still hold `deploy` there? Only if
+both pass does it write one relationship —
 `environment:production#agent_deployer@agent:goose_alice` — the same relation your schema's
 `deploy` permission already unions over. That single write is the entire "approval": no new code
 path, no special-cased branch in `decide()`. The next `decide()` call for
@@ -211,24 +208,6 @@ to production", "Tear down the production environment" — and watch the identic
 ✅ / ⏸️ / 🚫 verdicts come back, because goose is calling the same `deploybot_server.py` tools the
 web UI calls, gated by the same `decide()`.
 
-### Deterministic path
-
-```bash
-python scripts/verify.py --checkpoint 2
-```
-
-```
-Verifying Checkpoint 2...
-  ✅ agent deploy staging: got Decision.ALLOWED, want Decision.ALLOWED
-  ✅ agent deploy production: got Decision.NEEDS_APPROVAL, want Decision.NEEDS_APPROVAL
-  ✅ agent destroy production: got Decision.BLOCKED, want Decision.BLOCKED
-  ✅ after approve: deploy production: got Decision.ALLOWED, want Decision.ALLOWED
-PASS ✅
-```
-
-No LLM, no goose — this calls your `decide()` directly against a live SpiceDB, runs `approve.py`
-in the middle, and checks the exact same four outcomes you just watched in the UI or goose.
-
 ---
 
 ## Why the check — not the prompt — is the boundary
@@ -253,9 +232,8 @@ care what the model believes, only what the graph says.
       permissions
 - [ ] Seeded the graph with `python bootstrap.py`
 - [ ] Implemented the three-way `decide()` in `authz.py`
-- [ ] `python scripts/verify.py --checkpoint 2` prints `PASS ✅`
-- [ ] Saw all three decisions — `ALLOWED`, `NEEDS_APPROVAL`, `BLOCKED` — in the web UI and/or
-      goose, and watched `approve.py` flip production to `ALLOWED`
+- [ ] Saw all three decisions — `ALLOWED`, `NEEDS_APPROVAL`, `BLOCKED` — in the web UI (and/or
+      goose), and watched **Approve prod · 10m** flip production to `ALLOWED`
 - [ ] Can explain ReBAC in your own words, and why `agent { relation delegator: user }` is what
       makes delegation a graph edge instead of a special case in code
 
diff --git a/delegated-agent-authorization/3-time-bound-and-revocable.md b/delegated-agent-authorization/3-time-bound-and-revocable.md
index 05c3d9b..ee43030 100644
--- a/delegated-agent-authorization/3-time-bound-and-revocable.md
+++ b/delegated-agent-authorization/3-time-bound-and-revocable.md
@@ -97,55 +97,45 @@ update = rel("environment", environment, "agent_deployer", "agent", agent_id,
              expires_at=expiry_from_now(minutes))
 ```
 
-Run `python approve.py --approver alice --env production` (or click **Approve prod · 10m** in the
-web UI) and the resulting grant now expires 10 minutes later on its own. No follow-up step, no
-second script to remember to run. An approval that never expires was really a standing grant with
-extra steps; this makes "approved for now" mean what it says.
+Now clicking **Approve prod · 10m** in the web UI writes a grant that expires 10 minutes later on
+its own. No follow-up step, nothing to remember to undo. An approval that never expires was really
+a standing grant with extra steps; this makes "approved for now" mean what it says.
 
 ---
 
 ## See expiry without waiting
 
-Waiting out a real timer to prove this works isn't worth your time, so `bootstrap.py` gives you a
-faster lever: seed a grant that's already expired.
+Waiting out a 60-minute window to prove this works isn't worth your time, so the web UI gives you a
+faster lever: **Grant staging · 30s**, a button that hands the agent a 30-second staging window you
+can watch expire live.
 
 > **Reset the datastore first, once.** You just changed `agent_deployer`'s allowed subject type
 > from `agent` to `agent with expiration`. SpiceDB won't narrow a relation's allowed types while
 > relationships in the old shape — the plain `agent` grants Checkpoint 2 seeded — still exist, so
-> the very first `bootstrap.py` run this checkpoint fails on `WriteSchema` before it ever gets to
+> the first `bootstrap.py` run this checkpoint fails on `WriteSchema` before it ever gets to
 > reseed. Reset the datastore once, then re-seed against the new schema:
 >
 > ```bash
 > docker compose down -v && docker compose up -d --wait
-> python bootstrap.py --window-minutes 0
+> python bootstrap.py
 > ```
 
-This writes the staging `agent_deployer` relationship with `expires_at` set to *right now*. By
-the time `CheckPermission` runs, it's already in the past. The agent's own `agent_deployer` check
-on staging fails, `decide()` falls through to branch 2, and "deploy checkout to staging" — the one
-request that was unconditionally ✅ **ALLOWED** in Checkpoint 2 — now comes back
-⏸️ **NEEDS APPROVAL** instead, with Alice named as the delegator who'd have to approve it. Nothing
-about `decide()` changed. The relationship it was reading simply isn't there anymore, as far as
-SpiceDB is concerned.
-
-Now the other lever, instant revocation, for when you don't want to wait for any window to run
-out:
-
-```bash
-python revoke.py --env staging
-```
-
-`revoke.py` deletes the `agent_deployer` relationship on `staging` outright, using the same
-`agent_deployer_filter` helper `bootstrap.py` uses to reset it between runs. Re-run the check (or
-ask the agent to deploy staging again) and you get the identical ⏸️ **NEEDS APPROVAL**, the same
-outcome as letting the window lapse, just on your schedule instead of the clock's. An operator who
-sees something wrong mid-incident doesn't wait for a TTL; they run one command and the grant is
-gone on the very next check.
-
-Both are visible in the web UI: reset the demo, approve or bootstrap a grant, and watch its card in
-the **grants** panel, a live countdown with a shrinking bar. Let it hit zero, or hit **Revoke**,
-and the staging card disappears from the panel on the next 5-second poll, because `/api/state`'s
-`ReadRelationships` no longer returns the grant. Expired or deleted, it's simply gone.
+Start the web UI (`python web.py`) and open `http://127.0.0.1:8000`. Click **Grant staging · 30s**.
+The **grants** panel shows staging's card with a live countdown and a shrinking bar. Watch it hit
+zero, then ask the agent to "deploy checkout to staging" — the one request that was unconditionally
+✅ **ALLOWED** in Checkpoint 2 — and it now comes back ⏸️ **NEEDS APPROVAL** instead, with Alice
+named as the delegator who'd have to approve it. Nothing about `decide()` changed. The agent's own
+`agent_deployer` check on staging fails because the relationship it was reading simply isn't there
+anymore, as far as SpiceDB is concerned: it expired on schedule, server-side, with nothing external
+polling for it.
+
+Now the other lever, instant revocation, for when you don't want to wait for even a 30-second window
+to run out. Click **Revoke staging**. The `agent_deployer` relationship on `staging` is deleted
+outright, and the staging card disappears from the panel on the next 5-second poll, because
+`/api/state`'s `ReadRelationships` no longer returns the grant. Ask the agent to deploy staging
+again and you get the identical ⏸️ **NEEDS APPROVAL**, the same outcome as letting the window lapse,
+just on your schedule instead of the clock's. An operator who sees something wrong mid-incident
+doesn't wait for a TTL; they click one button and the grant is gone on the very next check.
 
 ---
 
@@ -168,34 +158,13 @@ decision. The boundary is exactly as tight as `CheckPermission` itself.
 
 ---
 
-## Deterministic path
-
-```bash
-python scripts/verify.py --checkpoint 3
-```
-
-```
-Verifying Checkpoint 3...
-  ✅ expired staging grant: got Decision.NEEDS_APPROVAL, want Decision.NEEDS_APPROVAL
-  ✅ after revoke: deploy staging: got Decision.NEEDS_APPROVAL, want Decision.NEEDS_APPROVAL
-PASS ✅
-```
-
-This seeds a `--window-minutes 0` grant and confirms `decide()` falls back to `NEEDS_APPROVAL`, then
-seeds a fresh 60-minute window, calls `revoke.py` against it, and confirms the same fallback,
-proving both paths, expiry and revocation, land on the identical honest answer.
-
----
-
 ## Completion Milestone: Checkpoint 3
 
 - [ ] Added `use expiration` to `schema.zed` and marked `agent_deployer: agent with expiration`
 - [ ] Updated `bootstrap.py`'s staging seed to carry `expires_at=expiry_from_now(window_minutes)`
 - [ ] Updated `approve.py`'s grant write to carry `expires_at=expiry_from_now(minutes)`
-- [ ] Saw `python bootstrap.py --window-minutes 0` drop the agent's staging autonomy to
-      `NEEDS_APPROVAL`, and `python revoke.py --env staging` do the same instantly
-- [ ] Watched a grant's countdown and revocation in the web UI
-- [ ] `python scripts/verify.py --checkpoint 3` prints `PASS ✅`
+- [ ] Clicked **Grant staging · 30s**, watched the countdown hit zero, and saw the agent's staging
+      autonomy drop to `NEEDS_APPROVAL` on its own — then **Revoke staging** do the same instantly
 - [ ] Can explain why expiration evaluated inside `CheckPermission` beats a cron job that deletes
       old relationships
 
diff --git a/delegated-agent-authorization/4-relationship-based-hierarchy.md b/delegated-agent-authorization/4-relationship-based-hierarchy.md
index fdebfb9..e7bf9c3 100644
--- a/delegated-agent-authorization/4-relationship-based-hierarchy.md
+++ b/delegated-agent-authorization/4-relationship-based-hierarchy.md
@@ -106,25 +106,17 @@ the bare `agent_deployer` relation.
 
 ## See the cascade
 
-Grant the agent both environments the way Checkpoint 2 and 3 taught you:
+Start the web UI (`python web.py`) and grant the agent both environments the way Checkpoints 2 and 3
+taught you. Staging is already autonomous from the seed; click **Approve prod · 10m** to give
+production its own `agent_deployer` write — same button, same one-relationship approval as always,
+nothing about it changed. Confirm both are live, in the web UI or by asking goose to deploy each
+environment: staging ✅ **ALLOWED** from its standing grant, production ✅ **ALLOWED** from the
+approval you just ran. Two independent relationships, both satisfying `agent_deploy` on their
+respective environments.
 
-```bash
-python approve.py --approver alice --env production
-```
-
-Staging is already autonomous from the seed; production just got its own `agent_deployer` write
-from `approve.py`, same as always — nothing about `approve.py` changed. Confirm both are live, in
-the web UI (`python web.py`) or by asking goose to deploy each environment: staging ✅ **ALLOWED**
-from its standing grant, production ✅ **ALLOWED** from the approval you just ran. Two independent
-relationships, both satisfying `agent_deploy` on their respective environments.
-
-Now pull the base out from under it:
+Now pull the base out from under it: click **Revoke staging**.
 
-```bash
-python revoke.py --env staging
-```
-
-`revoke.py` hasn't changed since Checkpoint 3 — it deletes exactly one relationship,
+That deletes exactly one relationship,
 `environment:staging#agent_deployer@agent:goose_alice`, and nothing else. It does not touch
 production. And yet: ask for "deploy checkout to production" again, and it comes back
 ⏸️ **NEEDS APPROVAL** — the same verdict as if someone had revoked production directly, except
@@ -136,37 +128,17 @@ two environments affected, because the second one was never independent to begin
 The web UI shows this precisely: production's grant card stays on screen but turns dashed, tagged
 **"suspended · gated by staging"** — the relationship itself is untouched, only what it computes to
 has changed. A system message spells out why: *"alice revoked the staging delegation — production
-autonomy is gated by it, so it suspends too."*
-
-Confirm it deterministically:
-
-```bash
-python scripts/verify.py --checkpoint 4
-```
-
-```
-Verifying Checkpoint 4...
-✅ Approved: agent:goose_alice may deploy environment:production
-  ✅ with both grants: deploy production: got Decision.ALLOWED, want Decision.ALLOWED
-✅ Revoked: agent:goose_alice agent_deployer on environment:staging
-  ✅ cascade: deploy staging: got Decision.NEEDS_APPROVAL, want Decision.NEEDS_APPROVAL
-  ✅ cascade: deploy production: got Decision.NEEDS_APPROVAL, want Decision.NEEDS_APPROVAL
-PASS ✅
-```
-
-The first check approves production and confirms both environments are live. The second revokes
-only staging and confirms *both* fall back to `NEEDS_APPROVAL` — the cascade, asserted the same way
-every other checkpoint's behavior was: by calling `decide()` directly against a live SpiceDB, no UI
-or LLM required.
+autonomy is gated by it, so it suspends too."* One click on **Revoke staging**, two environments
+affected, and no write ever touched production's own relationships.
 
 ---
 
 ## Suspend, not erase — why this is contingent evaluation
 
-Look again at what `revoke.py --env staging` actually deleted:
+Look again at what **Revoke staging** actually deleted:
 `environment:staging#agent_deployer@agent:goose_alice`. That's one tuple. The relationship
-`environment:production#agent_deployer@agent:goose_alice` — the one `approve.py` wrote — is still
-sitting in the graph, completely untouched. `agent_deploy` on production went from `ALLOWED` to
+`environment:production#agent_deployer@agent:goose_alice` — the one **Approve prod · 10m** wrote — is
+still sitting in the graph, completely untouched. `agent_deploy` on production went from `ALLOWED` to
 `NEEDS_APPROVAL` without a single write touching production's own relationships. Nothing was
 deleted there; a permission that used to evaluate `true` now evaluates `false`, because one of the
 two facts it depends on changed underneath it.
@@ -179,12 +151,13 @@ orphaned grants behind. `gated_by->agent_deployer` doesn't walk anything at writ
 *check* time, against whatever the graph currently says, every single time — the same way expiration
 in Checkpoint 3 didn't need a cron job to notice a grant had gone stale.
 
-The proof is the revive. Re-grant staging — run `bootstrap.py` again, or write the relationship
-directly — and, without touching production at all, `agent_deploy` on production goes straight back
-to `ALLOWED`, for whatever's left of the window `approve.py` originally gave it. The production
-relationship was never wrong; it was only ever asking a question whose answer depends on staging.
-Suspend, not erase, is what lets a fact come back to life just by the thing it depends on coming
-back — no re-approval, no re-run of `approve.py`, because the grant itself never went anywhere.
+The proof is the revive. Re-grant staging — click **Grant staging · 30s**, which writes only
+staging's `agent_deployer` relationship — and, without touching production at all, `agent_deploy` on
+production goes straight back to `ALLOWED`, for whatever's left of the window **Approve prod · 10m**
+originally gave it. The production relationship was never wrong; it was only ever asking a question
+whose answer depends on staging. Suspend, not erase, is what lets a fact come back to life just by
+the thing it depends on coming back — no re-approval, no second click of **Approve prod · 10m**,
+because the grant itself never went anywhere.
 
 ---
 
@@ -194,11 +167,10 @@ back — no re-approval, no re-run of `approve.py`, because the grant itself nev
       gated_by->agent_deployer`, and rewired `permission deploy = direct_deployer + agent_deploy`
       in `schema.zed`
 - [ ] Seeded the hierarchy in `bootstrap.py` — staging gated by itself, production gated by staging
-- [ ] Approved production, confirmed both environments `ALLOWED`, then revoked staging and watched
-      production fall back to `NEEDS_APPROVAL` with no second delete
+- [ ] Clicked **Approve prod · 10m**, confirmed both environments `ALLOWED`, then clicked
+      **Revoke staging** and watched production fall back to `NEEDS_APPROVAL` with no second delete
 - [ ] Saw production's grant go dashed/"suspended" in the web UI while the underlying relationship
       stayed in the graph
-- [ ] `python scripts/verify.py --checkpoint 4` prints `PASS ✅`
 - [ ] Can explain why this is contingent evaluation rather than a cascading delete, and why RBAC
       can't express "this role's authority depends on that other role currently holding" without a
       role explosion and a synchronization job to keep it honest
diff --git a/delegated-agent-authorization/5-nextsteps.md b/delegated-agent-authorization/5-nextsteps.md
index 40e2503..4af588e 100644
--- a/delegated-agent-authorization/5-nextsteps.md
+++ b/delegated-agent-authorization/5-nextsteps.md
@@ -68,9 +68,10 @@ new idea at a time:
   visible to every agent, always. A production version gates it behind a `view` permission and
   filters the listing to what the caller can actually see — exactly the `CheckBulkPermissions`
   shape described above.
-- `revoke.py` has no permission check. Anyone who can run the script can delete anyone's
-  delegation on any environment. A production version gates revocation behind a `manage`
-  permission, so only an environment's own operators can pull an agent's access.
+- Revocation has no permission check. `revoke.py` — the helper behind the web UI's **Revoke**
+  buttons — deletes a delegation without checking who's asking, so anyone who can reach the UI can
+  pull any agent's access on any environment. A production version gates revocation behind a
+  `manage` permission, so only an environment's own operators can pull an agent's access.
 
 The [full reference solution](https://github.com/sohanmaheshwar/goose-spicedb-delegation) does
 both. Its schema adds two permissions this workshop never defines:
diff --git a/delegated-agent-authorization/README.md b/delegated-agent-authorization/README.md
index 8cc635e..613d4df 100644
--- a/delegated-agent-authorization/README.md
+++ b/delegated-agent-authorization/README.md
@@ -43,20 +43,20 @@ matter how many different ways — or how many different agents — ask it.
   that models delegation directly: an `agent` acts for a `user` through one relation, `delegator`
 - A three-way decision engine, `decide()`, that turns every mutating tool call into `ALLOWED`,
   `NEEDS_APPROVAL`, or `BLOCKED` — never a silent yes
-- Time-bound grants that expire on their own, for incident-style access windows, plus a
-  `revoke.py` for instant, on-demand revocation
+- Time-bound grants that expire on their own, for incident-style access windows, plus instant,
+  on-demand revocation for when you need to pull a grant early
 - A relationship hierarchy (`gated_by`) where revoking one environment's autonomy automatically
   suspends what depends on it — contingent evaluation, not a cascading delete
-- A web UI and a deterministic CLI verifier (`scripts/verify.py`) so every checkpoint is
-  confirmable without an LLM in the loop
+- A web UI that drives every action — request, approve, revoke, watch a grant expire live — and
+  shows exactly what SpiceDB decides, so every checkpoint is confirmable without an LLM in the loop
 
 ## Prerequisites
 
 - **Docker**, or a GitHub Codespace — the repo ships a `.devcontainer/` that handles setup for you
 - **Python 3.10+**
 - **goose, plus an API key for any LLM it supports** — only needed if you want to drive the agent
-  in natural language. Every checkpoint also has a deterministic path
-  (`scripts/verify.py` and a web UI) that needs no LLM at all.
+  in natural language. The web UI drives every checkpoint without an LLM, so goose is optional
+  throughout.
 
 No prior authorization background is assumed. Comfort with a terminal, Python, and Docker is
 enough.
diff --git a/delegated-agent-authorization/starter/docker-compose.yml b/delegated-agent-authorization/starter/docker-compose.yml
index 2204222..68dcdc0 100644
--- a/delegated-agent-authorization/starter/docker-compose.yml
+++ b/delegated-agent-authorization/starter/docker-compose.yml
@@ -26,9 +26,9 @@ services:
 
   spicedb:
     image: authzed/spicedb:latest
-    # --enable-experimental-relationship-expiration turns on the built-in
-    # relationship expiration feature used by `agent_deployer: agent with expiration`.
-    command: "serve --enable-experimental-relationship-expiration"
+    # Relationship expiration (used by `agent_deployer: agent with expiration`) is a
+    # built-in feature — no flag needed.
+    command: "serve"
     environment:
       SPICEDB_GRPC_PRESHARED_KEY: "${SPICEDB_TOKEN:-devtoken}"
       SPICEDB_DATASTORE_ENGINE: postgres
diff --git a/delegated-agent-authorization/starter/goose-extension.md b/delegated-agent-authorization/starter/goose-extension.md
index c0794b2..9e34c6e 100644
--- a/delegated-agent-authorization/starter/goose-extension.md
+++ b/delegated-agent-authorization/starter/goose-extension.md
@@ -38,10 +38,9 @@ goose configure
 
 This step is inherently manual: it drives goose through a live LLM-backed session, which is
 outside what an automated test can exercise. Running goose is optional for this workshop — you
-do not need it (or an LLM API key) installed. The same decision sequence is proven
-deterministically and repeatably by `scripts/verify.py`, which calls `authz.decide` (the same
-function `deploybot_server.py` calls on every tool invocation) directly against a real SpiceDB
-instance. Run it per checkpoint, e.g. `python scripts/verify.py --checkpoint 2`.
+do not need it (or an LLM API key) installed. The same decisions are available without goose in the
+web UI (`python web.py`), which needs no LLM key: it drives the identical tools through the
+identical `decide()`.
 
 If you do have goose installed and an LLM key configured, here is the checklist to confirm the
 wiring end to end:
@@ -54,10 +53,9 @@ goose session
 Drive these prompts and confirm the deploybot tool output:
 1. "Deploy checkout to staging." → **✅ ALLOWED**, version bumps.
 2. "Deploy checkout to production." → **⏸️ NEEDS APPROVAL**.
-3. In another terminal: `python approve.py --approver alice --env production` → then in goose "try the production deploy again" → **✅ ALLOWED**.
+3. In the web UI, click **Approve prod · 10m** → then in goose "try the production deploy again" → **✅ ALLOWED**.
 4. "Tear down the production environment." → **🚫 BLOCKED**.
-5. In another terminal: `python revoke.py --env staging` → then in goose "deploy checkout to staging again" → **⏸️ NEEDS APPROVAL**.
+5. In the web UI, click **Revoke staging** → then in goose "deploy checkout to staging again" → **⏸️ NEEDS APPROVAL**.
 
-If goose is not installed / no LLM key is available, this step is skipped and the arc is
-covered by `scripts/verify.py` (which exercises the identical decision sequence
-deterministically — run `python scripts/verify.py --checkpoint 2` and up).
+If goose is not installed / no LLM key is available, drive the identical arc from the web UI
+instead (`python web.py`) — same tools, same buttons, same decisions, no LLM.
diff --git a/delegated-agent-authorization/starter/scripts/verify.py b/delegated-agent-authorization/starter/scripts/verify.py
deleted file mode 100644
index c8462f2..0000000
--- a/delegated-agent-authorization/starter/scripts/verify.py
+++ /dev/null
@@ -1,85 +0,0 @@
-"""verify.py — deterministic checks for the current checkpoint. No LLM needed.
-
-Usage: python scripts/verify.py --checkpoint N
-Run from the starter/ directory with SpiceDB up.
-"""
-import argparse
-import asyncio
-import sys
-from pathlib import Path
-
-# Invoked as `python scripts/verify.py`, so Python puts scripts/ (not starter/) on
-# sys.path — add the parent directory so the top-level modules below resolve.
-sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-
-from authz import Decision, decide
-import bootstrap
-from approve import approve
-from revoke import revoke
-from spicedb_client import make_client
-
-AGENT = "goose_alice"
-
-
-def _ok(label, got, want):
-    mark = "✅" if got == want else "❌"
-    print(f"  {mark} {label}: got {got}, want {want}")
-    return got == want
-
-
-async def checkpoint_1():
-    # The stub decides ALLOWED for everything — the over-reach.
-    r = await decide(make_client(), AGENT, "destroy", "production")
-    return _ok("stub allows destroy production (over-reach)", r.decision, Decision.ALLOWED)
-
-
-async def checkpoint_2(client):
-    await bootstrap.write_schema(client)
-    await bootstrap.seed(client)
-    passed = True
-    passed &= _ok("agent deploy staging", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.ALLOWED)
-    passed &= _ok("agent deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.NEEDS_APPROVAL)
-    passed &= _ok("agent destroy production", (await decide(client, AGENT, "destroy", "production")).decision, Decision.BLOCKED)
-    await approve("alice", "production", AGENT, 10)
-    passed &= _ok("after approve: deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.ALLOWED)
-    return passed
-
-
-async def checkpoint_3(client):
-    # Expired window -> staging autonomy gone (falls back to NEEDS_APPROVAL).
-    await bootstrap.write_schema(client)
-    await bootstrap.seed(client, window_minutes=0)
-    passed = _ok("expired staging grant", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.NEEDS_APPROVAL)
-    # Revocation on a fresh window.
-    await bootstrap.seed(client, window_minutes=60)
-    await revoke("staging", AGENT)
-    passed &= _ok("after revoke: deploy staging", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.NEEDS_APPROVAL)
-    return passed
-
-
-async def checkpoint_4(client):
-    await bootstrap.write_schema(client)
-    await bootstrap.seed(client, window_minutes=60)
-    await approve("alice", "production", AGENT, 10)
-    passed = _ok("with both grants: deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.ALLOWED)
-    await revoke("staging", AGENT)  # revoke the BASE
-    passed &= _ok("cascade: deploy staging", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.NEEDS_APPROVAL)
-    passed &= _ok("cascade: deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.NEEDS_APPROVAL)
-    return passed
-
-
-async def main(n):
-    print(f"Verifying Checkpoint {n}...")
-    if n == 1:
-        passed = await checkpoint_1()
-    else:
-        client = make_client()
-        passed = await {2: checkpoint_2, 3: checkpoint_3, 4: checkpoint_4}[n](client)
-    print("PASS ✅" if passed else "FAIL ❌")
-    return 0 if passed else 1
-
-
-if __name__ == "__main__":
-    p = argparse.ArgumentParser()
-    p.add_argument("--checkpoint", type=int, required=True, choices=[1, 2, 3, 4])
-    raise SystemExit(asyncio.run(main(p.parse_args().checkpoint)))
diff --git a/delegated-agent-authorization/starter/static/index.html b/delegated-agent-authorization/starter/static/index.html
index 66ff276..c1d9894 100644
--- a/delegated-agent-authorization/starter/static/index.html
+++ b/delegated-agent-authorization/starter/static/index.html
@@ -333,6 +333,7 @@
         <button class="approve" id="approveBtn">Approve prod · 10m</button>
         <button class="revoke" id="revokeStagingBtn">Revoke staging</button>
         <button class="revoke" id="revokeProdBtn">Revoke prod</button>
+        <button class="approve" id="grantShortBtn" title="Grant staging a 30-second window to watch it expire live">Grant staging · 30s</button>
         <button class="ghost" id="resetBtn" title="Re-seed and reset versions">Reset</button>
       </div>
     </header>
@@ -484,6 +485,18 @@
   refreshState();
 }
 
+async function grantShort() {
+  const res = await fetch("/api/grant-short", {
+    method: "POST", headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ environment: "staging", seconds: 30 }),
+  });
+  const d = await res.json();
+  addSystem(d.ok
+    ? '⏱️ granted <b>staging</b> a <b>30-second</b> window — watch the countdown expire in the bar above'
+    : 'Short grant failed — is the schema at Checkpoint 3 yet (agent_deployer: agent with expiration)?');
+  refreshState();
+}
+
 async function reset() {
   await fetch("/api/reset", { method: "POST" });
   transcript.innerHTML = "";
@@ -593,6 +606,7 @@
 document.getElementById("approveBtn").addEventListener("click", approve);
 document.getElementById("revokeStagingBtn").addEventListener("click", () => revokeEnv("staging"));
 document.getElementById("revokeProdBtn").addEventListener("click", () => revokeEnv("production"));
+document.getElementById("grantShortBtn").addEventListener("click", grantShort);
 document.getElementById("resetBtn").addEventListener("click", reset);
 
 refreshState();
diff --git a/delegated-agent-authorization/starter/web.py b/delegated-agent-authorization/starter/web.py
index 7bdf4f9..eabb41d 100644
--- a/delegated-agent-authorization/starter/web.py
+++ b/delegated-agent-authorization/starter/web.py
@@ -7,20 +7,21 @@
 
 Run:  python web.py   (then open http://127.0.0.1:8000)
 """
-from datetime import timezone
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
 from fastapi import FastAPI
 from fastapi.responses import FileResponse
 from pydantic import BaseModel
 
-from authzed.api.v1 import Consistency, ReadRelationshipsRequest
+from google.protobuf.timestamp_pb2 import Timestamp
+from authzed.api.v1 import Consistency, ReadRelationshipsRequest, WriteRelationshipsRequest
 
 import bootstrap
 import deploybot_server
 from approve import approve
 from authz import check, read_delegator
-from relationships import agent_deployer_filter
+from relationships import agent_deployer_filter, rel
 from revoke import revoke
 from spicedb_client import make_client
 
@@ -78,6 +79,11 @@ class RevokeBody(BaseModel):
     environment: str = "staging"
 
 
+class GrantBody(BaseModel):
+    environment: str = "staging"
+    seconds: int = 30
+
+
 @app.get("/")
 async def index():
     return FileResponse(BASE / "static" / "index.html")
@@ -118,25 +124,41 @@ async def request_action(body: RequestBody):
 
 @app.get("/api/state")
 async def state():
+    # Defensive throughout: in Checkpoint 1 no schema exists yet, so the delegator
+    # read / relationship read / permission checks below all error. We degrade to an
+    # empty "no delegation configured" view so the web UI still loads and the chat
+    # (which routes through the stubbed decide()) shows the agent over-reaching.
     client = make_client()
-    delegator = await read_delegator(client, AGENT_ID)
+    try:
+        delegator = await read_delegator(client, AGENT_ID)
+    except Exception:
+        delegator = None
     grants = []
-    req = ReadRelationshipsRequest(
-        consistency=Consistency(fully_consistent=True),
-        relationship_filter=agent_deployer_filter(AGENT_ID),
-    )
-    async for resp in client.ReadRelationships(req):
-        r = resp.relationship
-        env = r.resource.object_id
-        expires_at = None
-        if r.HasField("optional_expires_at"):
-            dt = r.optional_expires_at.ToDatetime().replace(tzinfo=timezone.utc)
-            expires_at = dt.isoformat()
-        # A grant tuple can exist yet be suspended by the cascade (e.g. a prod grant
-        # after staging was revoked). `effective` is the actual deploy verdict.
-        effective = await check(client, "agent", AGENT_ID, "deploy", "environment", env)
-        grants.append({"environment": env, "expires_at": expires_at, "effective": effective})
-    versions = deploybot_server._load_state()
+    try:
+        req = ReadRelationshipsRequest(
+            consistency=Consistency(fully_consistent=True),
+            relationship_filter=agent_deployer_filter(AGENT_ID),
+        )
+        async for resp in client.ReadRelationships(req):
+            r = resp.relationship
+            env = r.resource.object_id
+            expires_at = None
+            if r.HasField("optional_expires_at"):
+                dt = r.optional_expires_at.ToDatetime().replace(tzinfo=timezone.utc)
+                expires_at = dt.isoformat()
+            # A grant tuple can exist yet be suspended by the cascade (e.g. a prod grant
+            # after staging was revoked). `effective` is the actual deploy verdict.
+            try:
+                effective = await check(client, "agent", AGENT_ID, "deploy", "environment", env)
+            except Exception:
+                effective = False
+            grants.append({"environment": env, "expires_at": expires_at, "effective": effective})
+    except Exception:
+        grants = []  # no schema yet (Checkpoint 1)
+    try:
+        versions = deploybot_server._load_state()
+    except Exception:
+        versions = {}
     return {"agent": AGENT_ID, "delegator": delegator, "grants": grants, "versions": versions}
 
 
@@ -152,6 +174,23 @@ async def revoke_action(body: RevokeBody):
     return {"ok": code == 0, "environment": body.environment}
 
 
+@app.post("/api/grant-short")
+async def grant_short(body: GrantBody):
+    """Grant the agent a short-lived deploy window so you can watch it expire live in the
+    authority bar (used in Checkpoint 3). An operator/demo action: it writes the
+    agent_deployer grant directly with a seconds-scale expiration. Requires the schema to
+    allow expiration (`agent_deployer: agent with expiration`, from Checkpoint 3)."""
+    client = make_client()
+    ts = Timestamp()
+    ts.FromDatetime(datetime.now(timezone.utc) + timedelta(seconds=body.seconds))
+    update = rel("environment", body.environment, "agent_deployer", "agent", AGENT_ID, expires_at=ts)
+    try:
+        await client.WriteRelationships(WriteRelationshipsRequest(updates=[update]))
+        return {"ok": True, "environment": body.environment, "seconds": body.seconds}
+    except Exception as e:
+        return {"ok": False, "error": str(e)[:200]}
+
+
 @app.post("/api/reset")
 async def reset():
     client = make_client()

From 8fa28487bdc5e5625af9c04c1b4e4046d3167ade Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Mon, 31 Aug 2026 18:03:14 +0200
Subject: [PATCH 16/27] docs(workshop): make the two-path structure explicit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a "Two ways to drive the agent" note to 0-setup: the whole workshop is
completable with just the web UI (no LLM key, no goose install), and every
checkpoint also offers an optional goose step.

- Add a dedicated "Drive it with goose (optional)" step to Checkpoint 3
  (grant/revoke → deploy staging) and Checkpoint 4 (cascade → deploy
  production), so all four checkpoints carry the optional goose path
  consistently (CP1 and CP2 already had one).
- Includes prose edits to 0-setup and Checkpoint 1.
---
 delegated-agent-authorization/0-setup.md      | 43 ++++++++++++-------
 .../1-run-the-agent.md                        | 37 +++++++---------
 .../3-time-bound-and-revocable.md             | 10 +++++
 .../4-relationship-based-hierarchy.md         | 10 +++++
 4 files changed, 62 insertions(+), 38 deletions(-)

diff --git a/delegated-agent-authorization/0-setup.md b/delegated-agent-authorization/0-setup.md
index f5a4d8e..e01b50f 100644
--- a/delegated-agent-authorization/0-setup.md
+++ b/delegated-agent-authorization/0-setup.md
@@ -1,12 +1,22 @@
-# Setup
+# Introduction
 
-In this workshop you build a DevOps deploy agent on [goose](https://github.com/aaif-goose/goose)
-(the open-source agent from the Agentic AI Foundation), then gate every action it takes with
-delegated, fine-grained authorization from SpiceDB: scoped grants, time-bound windows, instant
+In this workshop you build a DevOps deploy Agent, then gate every action it takes with
+delegated, fine-grained authorization: scoped grants, time-bound windows, instant
 revocation, and a permission hierarchy where revoking a base grant cascades to everything that
-depends on it. The `starter/` folder in this repo is stubbed on purpose: the plumbing (MCP
+depends on it. The purpose of the workshop is to understand why fine-grained authorization is required for AI Agents, 
+and how it can be implemented. 
+
+The `starter/` folder in this repo is stubbed on purpose: the plumbing (MCP
 extension, docker-compose, the seed script, the web UI) is already there, and you'll
-write the schema and the decision engine yourself across the checkpoints.
+write the schema and the decision engine yourself across the checkpoints to learn each of the concepts.
+
+## Two ways to drive the agent
+
+You can complete every checkpoint in this workshop with just the web UI — no LLM key, no goose
+install required. That's the primary path, and it's all you need. 
+
+Each checkpoint page also ends with an optional *drive it with goose* step: the same requests in natural language, through a real
+LLM, hitting the exact same authorization boundary. Use this if you want to watch the agent work with a live LLM; skip it and you miss nothing, because the authorization decision is identical either way.
 
 ## Get the code
 
@@ -15,21 +25,24 @@ git clone https://github.com/authzed/workshops.git
 cd workshops/delegated-agent-authorization/starter
 ```
 
-## Option A - Run locally with Docker
+## Installation
+
+#### Option A - Run locally with Docker
 
-Copy the example `.env` file:
+1. Copy the example `.env` file:
 
 ```bash
 cp .env.example .env
 ```
 
-`.env` holds the SpiceDB connection details the app itself needs: endpoint, preshared token,
-and which agent identity the deploy bot acts as. Nothing in this repo talks to an LLM directly,
-so there's no LLM key in here. The LLM key only comes into play later, and only if you use the
+`.env` holds the SpiceDB connection details the app itself needs: endpoint, and preshared-token,
+and which agent identity the deploy bot acts as. 
+
+Note: You can run this workshop without the need for a LLM key. The LLM key only comes into play later, and only if you use the
 goose path (see [Install goose](#install-goose-and-register-the-extension) below). The web UI you
 drive every checkpoint from (introduced in Checkpoint 1) needs no LLM at all.
 
-Start the infrastructure:
+2. Start the infrastructure:
 
 ```bash
 docker compose up -d --wait
@@ -39,16 +52,14 @@ This brings up two containers, `postgres` (SpiceDB's datastore) and `spicedb`, p
 short-lived `spicedb-migrate` container that runs SpiceDB's own datastore migration (setting up
 its Postgres tables, not the `schema.zed` you'll write later) and exits. SpiceDB serves
 on `localhost:50051` with a preshared key of `devtoken` (not recommended for prod, obviously).
-Relationship expiration — which Checkpoint 3 uses for time-bound grants — is built into SpiceDB, so
-there's no flag to enable.
 
-Create a virtual environment and install dependencies:
+3. Create a virtual environment and install dependencies:
 
 ```bash
 python3 -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
 ```
 
-## Option B - Run in GitHub Codespaces
+#### Option B - Run in GitHub Codespaces
 
 <!-- TODO: verify on a live Codespace before the conference -->
 
diff --git a/delegated-agent-authorization/1-run-the-agent.md b/delegated-agent-authorization/1-run-the-agent.md
index 9c935a8..ae42c65 100644
--- a/delegated-agent-authorization/1-run-the-agent.md
+++ b/delegated-agent-authorization/1-run-the-agent.md
@@ -1,7 +1,7 @@
 # Checkpoint 1 — Run the Agent (and Watch It Over-Reach)
 
-The goal here is simple: get the deploy agent running, then catch it doing something it should
-never be allowed to do — tearing down production — because right now nothing stops it.
+The goal here is simple: get the deploy agent running, then try a few actions and catch it doing something it should
+never be allowed to do. For example this agent can tear down production servers since there are no checks to stop it from doing so.
 
 ---
 
@@ -31,12 +31,12 @@ workshop is about. In Checkpoint 1, the boundary is a stub that never says no.
 ## `decide()` is a deliberate stub
 
 Open `authz.py`. `decide()` is the one function every mutating tool call goes through, and right
-now it's honest about doing nothing:
+now there are no permission checks. 
 
 ```python
 async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
     # WORKSHOP STUB — Checkpoint 1.
-    # Returns ALLOWED for everything WITHOUT consulting SpiceDB. This is exactly why
+    # Returns ALLOWED for everything. This is exactly why
     # the agent over-reaches in Checkpoint 1. You implement the real, SpiceDB-backed
     # three-way decision in Checkpoint 2.
     # TODO(Checkpoint 2): replace this stub.
@@ -45,9 +45,7 @@ async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
 
 It takes a `client` — a live connection to SpiceDB — and ignores it. Every argument that should
 matter (which agent, which permission, which environment) is ignored too. `decide()` always
-returns `ALLOWED`. There's no schema yet for it to consult even if it wanted to. That arrives in
-Checkpoint 2. Right now, an authorization call is just a formality the code performs on its way to
-doing whatever it was asked.
+returns `ALLOWED`. This should obviously not be the case for any production Agent. 
 
 ---
 
@@ -61,20 +59,19 @@ text into the same tool calls goose would, and hands them to the same gated back
 python web.py
 ```
 
-Open `http://127.0.0.1:8000`. Type something reasonable into the request box:
+Open `http://127.0.0.1:8000`. Type something reasonable into the request box (or click one of the buttons)
 
 > Deploy checkout to production.
 
 The UI calls `deploy(service="checkout", environment="production")`. It comes back
-**✅ ALLOWED**, and the version bumps. Fine so far. That's a real deploy engineer's job.
+**✅ ALLOWED**, and the version bumps. So far so good.
 
 Now ask it to do something no agent should be able to decide on its own:
 
 > Tear down the production environment.
 
-The UI calls `destroy(environment="production")`. It comes back **✅ ALLOWED**, and production is
-gone. No pause, no approval step, no distinction between "deploy a service" and "delete an entire
-environment." The tool's own docstring says destroying "requires elevated authority" — but that's
+The UI calls `destroy(environment="production")`. It comes back **✅ ALLOWED**, and production environment is
+gone. The tool's own docstring says destroying "requires elevated authority" — but that's
 just a comment for humans reading the code. Nothing enforces it. The stub doesn't look at
 `permission` or `environment_id` at all, so it can't tell a deploy from a destroy any more than it
 can tell staging from production.
@@ -82,8 +79,7 @@ can tell staging from production.
 Nothing about the *prompt* told the agent to be reckless. Nothing about the *user's* request was
 malicious: "deploy checkout to production" and "tear down the production environment" are both
 plausible things an operator might type into a chat window, adversarially or by mistake, or an
-agent might decide to do on its own mid-task. The problem isn't the prompt. It's that nothing
-downstream of the prompt is checking.
+agent might decide to do on its own mid-task. This is the consequence of no deterministic check before performing an action.
 
 ---
 
@@ -108,8 +104,8 @@ LLM instead of the request box.
 
 ## Why this happens: ambient authority
 
-The agent process holds one set of credentials — the `SPICEDB_TOKEN` and `AGENT_SUBJECT` in its
-environment — and every tool call runs with the full weight of those credentials behind it.
+The agent process holds one set of credentials - the `SPICEDB_TOKEN` and `AGENT_SUBJECT` in its
+environment. Every tool call runs with the full weight of those credentials behind it.
 There's no notion of *this specific action, for this specific reason, scoped to this specific
 window*. The agent can do anything its host process could do, because as far as the code is
 concerned, there's no difference between "deploy a service" and "destroy production." Both are
@@ -121,12 +117,9 @@ running with root because it happened to be launched by root — not because any
 should have root.
 
 You might be tempted to fix this by editing the tool's docstring, or telling the agent in its
-system prompt "never destroy production without approval." Don't reach for that. The prompt is not
-a boundary — it's a suggestion to a language model, not a control the system enforces. Nothing
-stops a differently worded request, a longer conversation that talks the model out of its own
-guardrail, or a chain of reasoning that convinces the agent this particular destroy is the
-exception. The instruction lives in the same channel as everything else the model reads, which
-means it can be argued with. An authorization boundary has to live *outside* the model's judgment,
+system prompt "never destroy production without approval." This is an anti-pattern. The prompt is not
+a boundary as prompts are suggestions to a language model, not a control the system enforces. 
+An authorization boundary has to live *outside* the model's judgment,
 in code that runs whether or not the agent "remembers" the rule. That boundary is what Checkpoint 2
 builds.
 
diff --git a/delegated-agent-authorization/3-time-bound-and-revocable.md b/delegated-agent-authorization/3-time-bound-and-revocable.md
index ee43030..d6a57ce 100644
--- a/delegated-agent-authorization/3-time-bound-and-revocable.md
+++ b/delegated-agent-authorization/3-time-bound-and-revocable.md
@@ -139,6 +139,16 @@ doesn't wait for a TTL; they click one button and the grant is gone on the very
 
 ---
 
+## Drive it with goose (optional)
+
+If you're running the goose path, the same lever works in natural language. Click **Grant staging ·
+30s** (or **Revoke staging**), then in a `goose session` ask it to "deploy checkout to staging."
+Before the window runs out, ✅ **ALLOWED**; after it expires — or once you've revoked —
+⏸️ **NEEDS APPROVAL**. goose is calling the same gated `deploy` tool, so it sees exactly what the
+web UI sees.
+
+---
+
 ## Why contingent evaluation beats a cron job
 
 The obvious fix looks like this: keep the grant unexpiring, and run a cron job that deletes
diff --git a/delegated-agent-authorization/4-relationship-based-hierarchy.md b/delegated-agent-authorization/4-relationship-based-hierarchy.md
index e7bf9c3..6e20534 100644
--- a/delegated-agent-authorization/4-relationship-based-hierarchy.md
+++ b/delegated-agent-authorization/4-relationship-based-hierarchy.md
@@ -133,6 +133,16 @@ affected, and no write ever touched production's own relationships.
 
 ---
 
+## Drive it with goose (optional)
+
+If you're running the goose path, watch the cascade in natural language. With both grants live, ask
+goose to "deploy checkout to production" — ✅ **ALLOWED**. Click **Revoke staging**, then ask again:
+⏸️ **NEEDS APPROVAL**, even though you never touched production. goose deploys through the same gated
+`deploy` permission, so `gated_by` suspends its production autonomy exactly as it does for the web
+UI.
+
+---
+
 ## Suspend, not erase — why this is contingent evaluation
 
 Look again at what **Revoke staging** actually deleted:

From 80e706f524dd13ca2222a15b607420bb70f97e58 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Mon, 31 Aug 2026 20:12:19 +0200
Subject: [PATCH 17/27] =?UTF-8?q?docs(workshop):=20add=20newcomer=20glosse?=
 =?UTF-8?q?s;=20rename=20Checkpoint=20=E2=86=92=20Part?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Terminology: rename "Checkpoint N" → "Part N" across all modules (headings,
cross-references, module map, links, completion milestones) and in web.py's
comments.

Inline glosses for concepts a reader new to authz/ReBAC/SpiceDB would trip on:
- CP1: gloss MCP (Model Context Protocol) at first use.
- CP2: explain the schema DSL — `relation name: type` is a subject-type
  constraint, and relations (stored edges) vs permissions (computed on every
  check).
- CP2: decode the relationship-tuple notation `resource#relation@subject`
  the first time a full tuple appears.

Preserves the author's in-flight prose edits across CP0–CP4.
---
 delegated-agent-authorization/0-setup.md      |  16 +--
 .../1-run-the-agent.md                        |  28 ++---
 .../2-delegated-authorization.md              | 104 +++++++++---------
 .../3-time-bound-and-revocable.md             |  65 +++++------
 .../4-relationship-based-hierarchy.md         |  69 ++++--------
 delegated-agent-authorization/5-nextsteps.md  |   8 +-
 delegated-agent-authorization/README.md       |  22 ++--
 delegated-agent-authorization/starter/web.py  |   8 +-
 8 files changed, 151 insertions(+), 169 deletions(-)

diff --git a/delegated-agent-authorization/0-setup.md b/delegated-agent-authorization/0-setup.md
index e01b50f..1472946 100644
--- a/delegated-agent-authorization/0-setup.md
+++ b/delegated-agent-authorization/0-setup.md
@@ -8,14 +8,14 @@ and how it can be implemented.
 
 The `starter/` folder in this repo is stubbed on purpose: the plumbing (MCP
 extension, docker-compose, the seed script, the web UI) is already there, and you'll
-write the schema and the decision engine yourself across the checkpoints to learn each of the concepts.
+write the schema and the decision engine yourself across the parts to learn each of the concepts.
 
 ## Two ways to drive the agent
 
-You can complete every checkpoint in this workshop with just the web UI — no LLM key, no goose
+You can complete every part in this workshop with just the web UI — no LLM key, no goose
 install required. That's the primary path, and it's all you need. 
 
-Each checkpoint page also ends with an optional *drive it with goose* step: the same requests in natural language, through a real
+Each part page also ends with an optional *drive it with goose* step: the same requests in natural language, through a real
 LLM, hitting the exact same authorization boundary. Use this if you want to watch the agent work with a live LLM; skip it and you miss nothing, because the authorization decision is identical either way.
 
 ## Get the code
@@ -40,7 +40,7 @@ and which agent identity the deploy bot acts as.
 
 Note: You can run this workshop without the need for a LLM key. The LLM key only comes into play later, and only if you use the
 goose path (see [Install goose](#install-goose-and-register-the-extension) below). The web UI you
-drive every checkpoint from (introduced in Checkpoint 1) needs no LLM at all.
+drive every part from (introduced in Part 1) needs no LLM at all.
 
 2. Start the infrastructure:
 
@@ -88,7 +88,7 @@ step above if they don't.
 
 ## Install goose and register the extension
 
-Installing goose is optional for this workshop. Every checkpoint runs through a web UI that needs
+Installing goose is optional for this workshop. Every part runs through a web UI that needs
 neither goose nor an LLM key. Install goose if you want to drive the agent with natural language
 ("Deploy checkout to staging") and watch its tool calls resolve through SpiceDB live.
 
@@ -106,8 +106,8 @@ If you do want the goose path:
 
 `goose-extension.md` also has a manual verification checklist for once goose is wired up. Worth
 skimming now, but there's nothing to verify yet: SpiceDB has no authorization schema until
-Checkpoint 2, where you write it and the agent's decisions (via goose or the web UI) first come
-online. Checkpoint 1 is next, and it drives the agent from the web UI to watch it over-reach.
+Part 2, where you write it and the agent's decisions (via goose or the web UI) first come
+online. Part 1 is next, and it drives the agent from the web UI to watch it over-reach.
 
 ---
 
@@ -120,4 +120,4 @@ online. Checkpoint 1 is next, and it drives the agent from the web UI to watch i
 - [ ] (Goose path only) goose installed with an LLM provider configured, and the `deploybot`
       extension registered per `goose-extension.md`
 
-Next: [Checkpoint 1 — Run the agent](1-run-the-agent.md)
+Next: [Part 1 — Run the agent](1-run-the-agent.md)
diff --git a/delegated-agent-authorization/1-run-the-agent.md b/delegated-agent-authorization/1-run-the-agent.md
index ae42c65..9bb47f2 100644
--- a/delegated-agent-authorization/1-run-the-agent.md
+++ b/delegated-agent-authorization/1-run-the-agent.md
@@ -1,13 +1,14 @@
-# Checkpoint 1 — Run the Agent (and Watch It Over-Reach)
+# Part 1 — Run the Agent (and Watch It Over-Reach)
 
-The goal here is simple: get the deploy agent running, then try a few actions and catch it doing something it should
-never be allowed to do. For example this agent can tear down production servers since there are no checks to stop it from doing so.
+In this section we'll get the deploy agent running, try a few actions and catch it doing something it should
+never be allowed to do. For example: this agent can tear down production servers since there are no checks to stop it from doing so.
 
 ---
 
 ## The flow — goose calls deploybot
 
-`deploybot_server.py` is a goose MCP extension. It exposes three tools:
+`deploybot_server.py` is a goose MCP extension — MCP (the Model Context Protocol) is the open
+standard goose uses to call out to external tools. It exposes three tools:
 
 - **`list_environments`** — lists every environment and the service versions deployed to it.
   It's read-only and, by design, not authorization-checked for this workshop. The code says so
@@ -24,7 +25,7 @@ never be allowed to do. For example this agent can tear down production servers
 
 `deploy` and `destroy` are mutating, and both are gated: before either touches anything, it calls
 `authz.decide()` to get a ruling, and only proceeds on `ALLOWED`. That's the boundary this
-workshop is about. In Checkpoint 1, the boundary is a stub that never says no.
+workshop is about. In Part 1, the boundary is a stub that never says no.
 
 ---
 
@@ -35,11 +36,11 @@ now there are no permission checks.
 
 ```python
 async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
-    # WORKSHOP STUB — Checkpoint 1.
+    # WORKSHOP STUB — Part 1.
     # Returns ALLOWED for everything. This is exactly why
-    # the agent over-reaches in Checkpoint 1. You implement the real, SpiceDB-backed
-    # three-way decision in Checkpoint 2.
-    # TODO(Checkpoint 2): replace this stub.
+    # the agent over-reaches in Part 1. You implement the real, SpiceDB-backed
+    # three-way decision in Part 2.
+    # TODO(Part 2): replace this stub.
     return AuthzResult(Decision.ALLOWED, "no authorization configured (workshop stub)")
 ```
 
@@ -49,7 +50,7 @@ returns `ALLOWED`. This should obviously not be the case for any production Agen
 
 ---
 
-## Watch it over-reach — the web UI
+## Watch it over-reach
 
 The web UI is how you drive the agent throughout this workshop. It needs no LLM key: it turns your
 text into the same tool calls goose would, and hands them to the same gated backend. From
@@ -91,6 +92,7 @@ it the same two requests:
 ```bash
 goose session
 ```
+And type the following and see what happens:
 
 > Deploy checkout to production.
 >
@@ -120,12 +122,12 @@ You might be tempted to fix this by editing the tool's docstring, or telling the
 system prompt "never destroy production without approval." This is an anti-pattern. The prompt is not
 a boundary as prompts are suggestions to a language model, not a control the system enforces. 
 An authorization boundary has to live *outside* the model's judgment,
-in code that runs whether or not the agent "remembers" the rule. That boundary is what Checkpoint 2
+in code that runs whether or not the agent "remembers" the rule. That boundary is what Part 2
 builds.
 
 ---
 
-## Completion Milestone: Checkpoint 1
+## Completion Milestone: Part 1
 
 - [ ] Ran the agent — via the web UI (`python web.py`), a `goose session`, or both
 - [ ] Reproduced the over-reach: `destroy production` returns `ALLOWED` with no schema, no check,
@@ -134,4 +136,4 @@ builds.
 - [ ] Can explain why ambient authority is the problem, and why fixing it in the prompt wouldn't
       be enough
 
-Next: [Checkpoint 2 — Delegated authorization](2-delegated-authorization.md)
+Next: [Part 2 — Delegated authorization](2-delegated-authorization.md)
diff --git a/delegated-agent-authorization/2-delegated-authorization.md b/delegated-agent-authorization/2-delegated-authorization.md
index 7abfcc4..1508859 100644
--- a/delegated-agent-authorization/2-delegated-authorization.md
+++ b/delegated-agent-authorization/2-delegated-authorization.md
@@ -1,43 +1,32 @@
-# Checkpoint 2 — Delegated Authorization
+# Part 2 — Delegated Authorization
 
-Checkpoint 1 ended with a working exploit: `authz.decide()` returned `ALLOWED` for everything, so
-the agent could destroy production on request. Here you replace the stub with the real thing — a
+Part 1 ended with `authz.decide()` returning `ALLOWED` for everything, so
+the agent could destroy production on request. In this section, we replace the stub with the real thing — a
 SpiceDB schema that models *who an agent acts for*, and a `decide()` that turns a permission
-question into one of three honest answers: the agent can do this itself, a human needs to say yes
+question into one of three honest answers: the agent can do this, a human needs to say yes
 first, or nobody involved is allowed to do this at all.
 
 ---
 
 ## Permissions are a graph, not a table
 
-Think about how a corporate card works when you hand it to an assistant. They can book flights and
-cover the team's lunch, because you can — the card doesn't grant some separate blanket authority,
-it borrows yours. A role called `has-corporate-card` can't express that; you'd need a new role for
-every person an assistant might be borrowing authority from. Swap "assistant" for "AI agent" and
-"corporate card" for "who gets to touch production," and that's this checkpoint's actual problem.
+In the past, the problem of authorization has been solved with techniques such as Role-Based Access Control (permissions granted through roles like “admin” or “editor.”) and Attribute-Based Access Control (decisions based on attributes such as department, geography). However, these techniques are too broad-scoped and don't scale to the requirements of modern AI applications. That's where ReBAC comes in. 
 
-**RBAC** — role-based access control — is what most systems reach for first, and it's a fine
-choice when permissions really do attach to a role rather than a relationship: assign `alice` the
-role `deploy-engineer`, a table somewhere says that role can deploy, done. It breaks down exactly
-where the corporate-card problem lives — "the person `alice` is deploying *for*" or "whoever
-approved this specific change" are relationships between subjects and resources that a flat role
-list can't express without exploding into a role per case.
-
-**ReBAC** — relationship-based access control — models permissions as a graph instead: subjects,
+**ReBAC** is relationship-based access control. Instead of a table of roles or attributes, ReBAC models permissions as a graph: subjects,
 resources, and the relations between them, with permissions defined as graph traversals over those
-relations. This is the model Google published in 2019 as
-[**Zanzibar**](https://research.google/pubs/pub48190/), the system that authorizes Google Drive,
-Docs, and Calendar. SpiceDB is an open-source implementation of the same ideas. A permission check
-in SpiceDB isn't a table lookup. It's "is there a path through the relationship graph from this
-subject to this resource with this permission." That graph-walk is exactly what lets you model
-delegation directly: an `agent` node with a `delegator` edge to the `user` it acts for, and
-permissions that consider both.
+relations. This is the model popularized by Google in their 2019 whitepaper [**Zanzibar**](https://research.google/pubs/pub48190/). This is the system that authorizes Google Drive, Docs, and Calendar. In today's workshop we'll use SpiceDB - an open-source implementation of the same ideas. 
+
+SpiceDB stores access relationships as a graph, where nodes represent entities (users, agents, documents) and edges represent relationships (like “viewer,” “editor,” or “owner”). Fundamentally, authorization logic can be reduced to asking a single question:
+
+> Is this **actor** allowed to perform this **action** on this **resource**?
 
 ---
 
 ## Write the schema
 
-Open `schema.zed`. Right now it's the Checkpoint 1 stub — `environment` has no relations or
+In SpiceDB parlance, this actor and this resource are both Objects and this action is a Permission or Relation. Any usecase can be represented by using a schema that defines the different objects and the relations between them.
+
+Open `schema.zed`. Right now it's the Part 1 stub — `environment` has no relations or
 permissions at all, so there's nothing for `decide()` to consult even if it wanted to. Replace the
 whole file with:
 
@@ -57,6 +46,13 @@ definition environment {
 }
 ```
 
+Before walking through it, two bits of SpiceDB syntax. A `relation name: type` line declares a
+relation whose *subjects* are of that type — `agent_deployer: agent` reads as "an `agent` may be
+wired up as an `agent_deployer` here," not "`agent_deployer` is an agent." And a **relation** differs
+from a **permission**: a relation is a stored fact you write into the graph (an edge), while a
+permission is computed from relations on every check (with `+`, and later `&` and `->`) — never
+stored.
+
 Walking it:
 
 - `user` is an empty definition. Humans don't need relations of their own here; they're
@@ -86,6 +82,10 @@ actually has them.
 
 ## Seed the delegation graph
 
+In a ReBAC system, whenever there's a change to the state of a system (ex: something has been created, updated or deleted), a new relationship is written. Since we're starting the workshop with few assumptions, we will write those relationships to SpiceDB. These are the relationships that are defined in `bootstrap.py`:
+
+Note that each relationship write is just a simple API call. 
+
 ```bash
 python bootstrap.py
 ```
@@ -102,7 +102,7 @@ graph mean something for this workshop:
 - `goose_alice` (the agent) has `delegator: alice`. It acts for Alice specifically. `decide()`
   will read this edge to find out whose authority to fall back on.
 - `goose_alice` is `agent_deployer` on `staging` only. That's the one delegated grant this
-  checkpoint hands the agent directly. Staging autonomy, nothing more.
+  part hands the agent directly. Staging autonomy, nothing more.
 
 Nobody made the agent `agent_deployer` on `production`, and nobody made it (or Alice) a
 `destroyer` anywhere. Those gaps are intentional — they're what `decide()` is about to expose as
@@ -112,7 +112,7 @@ Nobody made the agent `agent_deployer` on `production`, and nobody made it (or A
 
 ## Implement `decide()`
 
-Open `authz.py`. The Checkpoint 1 stub ignored every argument and returned `ALLOWED`. Replace it
+Open `authz.py`. The Part 1 stub ignored every argument and returned `ALLOWED`. Replace it
 with the real three-way decision:
 
 ```python
@@ -136,11 +136,13 @@ logic is a strict fallthrough, evaluated in this order:
    "environment", environment_id)` asks SpiceDB the same question `deploy = direct_deployer +
    agent_deployer` was built to answer: is there a path from `agent:goose_alice` to `deploy` on
    `environment:staging`? For staging, yes — `ALLOWED`, and the agent never has to ask anyone.
+
 2. If not, could the human it acts for do this? `read_delegator()` walks the `delegator`
    edge to find `alice`, then runs the identical check as `user:alice`. For production, Alice
    holds `deploy` directly (`direct_deployer`) but the agent doesn't, so this branch fires:
    `NEEDS_APPROVAL`. The agent isn't blocked outright, because its human unambiguously *could* do
    this; it's paused until that human says so explicitly.
+
 3. If neither holds it, `BLOCKED`. For `destroy` on any environment, the agent has no
    `agent_deployer`-style grant (there's no such relation for destroy in this schema, so `check`
    on the agent fails), and Alice isn't a `destroyer` either — only `sre_admin` is. Neither side
@@ -153,7 +155,7 @@ a reason string that names exactly which relationship justified the answer.
 
 ---
 
-## See the three-way decision
+## See the three-way decision in action
 
 ### The web UI
 
@@ -161,12 +163,11 @@ a reason string that names exactly which relationship justified the answer.
 python web.py
 ```
 
-Open `http://127.0.0.1:8000`. This is a small FastAPI front end — its own docstring says it plainly:
-*"The front end holds no authorization logic of its own — what you see is exactly what SpiceDB
-decides."* It turns your text into a tool call (`deploy(service, environment)` or
+Open `http://127.0.0.1:8000`. This is a small FastAPI front end. The front end holds no authorization logic of its own - what you see is exactly what SpiceDB decides. It turns your text into a tool call (`deploy(service, environment)` or
 `destroy(environment)`) and hands off to the exact same `deploybot_server.do_deploy` /
-`do_destroy` functions goose calls, which call your new `decide()` before touching anything. The
-version numbers you see at first paint (`staging: checkout v3, payments v5`, `production: checkout
+`do_destroy` functions goose calls, which call your new `decide()` before touching anything. 
+
+The version numbers you see at first paint (`staging: checkout v3, payments v5`, `production: checkout
 v2, payments v4`) come from `infra_state.json`, checked into the starter repo as the baseline the
 UI resets to.
 
@@ -180,24 +181,26 @@ Try the three cases:
 - **"Tear down production"** → 🚫 **BLOCKED**. Neither the agent nor Alice is a `destroyer` —
   only `sre_admin` is. Nothing to escalate to; production stays up.
 
-Click **Approve prod · 10m**, then retry the production deploy — it flips to ✅ **ALLOWED**.
-Nothing about `decide()` changed; the relationship graph did.
+Click **Approve prod · 10m**, then retry the production deploy — it flips to ✅ **ALLOWED**. 
+Let's see how that works:
 
 ### Approve — the human in the loop
 
-**Approve prod · 10m** is the approval path, and it's deliberately dull under the hood. Before
-writing anything, it runs two checks of its own: is `alice` actually an `approver` on
+**Approve prod · 10m** is the approval path. Before writing anything, it runs two checks of its own: is `alice` actually an `approver` on
 `production`, and does her `delegator` relationship to the agent still hold `deploy` there? Only if
-both pass does it write one relationship —
-`environment:production#agent_deployer@agent:goose_alice` — the same relation your schema's
-`deploy` permission already unions over. That single write is the entire "approval": no new code
-path, no special-cased branch in `decide()`. The next `decide()` call for
+both pass does it write one relationship:
+`environment:production#agent_deployer@agent:goose_alice`. That's SpiceDB's notation for a
+relationship — `resource#relation@subject` — and it reads: on `environment:production`, the subject
+`agent:goose_alice` holds the `agent_deployer` relation. It's the same relation your schema's
+`deploy` permission already unions over. 
+
+That single write is the entire "approval": no new code path, no special-cased branch in `decide()`. The next `decide()` call for
 `("goose_alice", "deploy", "production")` hits branch 1 straight away and returns `ALLOWED`,
 because the graph now has a direct path.
 
 ### goose (optional, live-LLM path)
 
-If you registered the `deploybot` extension in setup:
+If you registered the goose `deploybot` extension in setup:
 
 ```bash
 goose session
@@ -212,21 +215,18 @@ web UI calls, gated by the same `decide()`.
 
 ## Why the check — not the prompt — is the boundary
 
-Nothing in this checkpoint told the agent, in English, "you may deploy staging but not
-production, and never destroy anything." There's no system-prompt instruction to argue with, talk
-around, or forget three turns into a conversation (the usual jailbreak playbook). The agent's tool
-call runs through `deploybot_server._decide_and_mutate`, which calls `decide()` before it ever touches
+Nothing in this part told the agent, in English, "you may deploy staging but not
+production, and never destroy anything." There's no system-prompt instruction to argue with or talk
+around. The agent's tool call runs through `deploybot_server._decide_and_mutate`, which calls `decide()` before it ever touches
 `infra_state.json` — and `decide()`'s answer is fully determined by `CheckPermission` calls
 against a relationship graph the agent has no way to write to. Ask the same question a thousand
-different ways, through goose or the web UI or a hand-written script, and you get the same
+different ways, through goose or the web UI or a hand-written script, and you will get the same
 `ALLOWED` / `NEEDS_APPROVAL` / `BLOCKED` back every time, because the agent never gets to
-*compute* the answer — it only ever receives one that SpiceDB already computed. That's the
-difference between a guardrail that's a suggestion and one that's a boundary: the boundary doesn't
-care what the model believes, only what the graph says.
+*compute* the answer — it only ever receives one that SpiceDB already computed. 
 
 ---
 
-## Completion Milestone: Checkpoint 2
+## Completion Milestone: Part 2
 
 - [ ] Wrote `schema.zed` — `agent`, `environment`, and the `deploy` / `approve` / `destroy`
       permissions
@@ -237,4 +237,4 @@ care what the model believes, only what the graph says.
 - [ ] Can explain ReBAC in your own words, and why `agent { relation delegator: user }` is what
       makes delegation a graph edge instead of a special case in code
 
-Next: [Checkpoint 3 — Time-bound and revocable](3-time-bound-and-revocable.md)
+Next: [Part 3 — Time-bound and revocable](3-time-bound-and-revocable.md)
diff --git a/delegated-agent-authorization/3-time-bound-and-revocable.md b/delegated-agent-authorization/3-time-bound-and-revocable.md
index d6a57ce..bc8d57e 100644
--- a/delegated-agent-authorization/3-time-bound-and-revocable.md
+++ b/delegated-agent-authorization/3-time-bound-and-revocable.md
@@ -1,9 +1,8 @@
-# Checkpoint 3 — Time-Bound and Revocable
+# Part 3 — Time-Bound and Revocable
 
-Checkpoint 2 gave the agent a real grant: `goose_alice` is `agent_deployer` on `staging`, forever,
-until someone edits the graph by hand. That's already better than ambient authority, but "forever"
-is still a bigger blast radius than most delegation actually needs. An incident responder pulled in
-at 2am should get staging access for the duration of the incident, not a standing grant nobody
+Part 2 gave the agent a real grant: `goose_alice` is `agent_deployer` on `staging`, forever,
+until someone edits the graph by hand. That's already better than ambient authority, but typically you need 
+time-bound delegation. An incident responder pulled in at 2am should get staging access for the duration of the incident, not a permanent grant nobody
 remembers to revoke. Here you make that grant expire on its own, and give an operator a way to kill
 it early.
 
@@ -11,18 +10,18 @@ it early.
 
 ## Temporary access for incident windows
 
-The shape you want is: "this agent may deploy staging, but only for the next 60 minutes." Two ways
+The shape you want is: "this agent may deploy staging, but only for the next 60 minutes." There are two ways
 to build that:
 
 - **A caveat**: SpiceDB lets you attach a boolean expression to a relationship (`agent_deployer:
   agent with expiry_check`) and pass in context like `now < grant_expiry` at check time. It works,
-  but it's you re-deriving "is this timestamp in the past" by hand, on every check, forever.
+  but it's you re-deriving "is this timestamp in the past" by hand, on every check.
+
 - **Relationship expiration**: SpiceDB has a built-in `optional_expires_at` field on a
   relationship. You write the expiry once, at grant time, and `CheckPermission` treats an expired
-  relationship as if it were never written. No caveat context to thread through, no expression to
-  get subtly wrong.
+  relationship as if it were never written. 
 
-Expiration wins here for a reason that matters beyond convenience: it's evaluated **server-side,
+Expiration is the preferred method as it's evaluated **server-side,
 inside the same consistent snapshot as the rest of the check**. There's no window where a
 just-expired grant still reads as valid because a caveat context object was stale, and no separate
 process has to notice the expiry and act on it. SpiceDB's own datastore garbage-collects expired
@@ -33,7 +32,7 @@ external polling for it.
 
 ## Schema edit: opt in, then mark the relation
 
-Two changes to `schema.zed`. First, expiration is an opt-in schema feature. Declare it at the top
+To add time-bound delegation, first make two changes to `schema.zed`. First, expiration is an opt-in schema feature. Declare it at the top
 of the file:
 
 ```zed
@@ -63,16 +62,18 @@ know or care that one side of it can expire. That's the point: expiration is a p
 
 ---
 
-## Update the seed
+## Update the relationships
 
-`bootstrap.py` already takes a `--window-minutes` flag and threads it into `seed()`. Checkpoint 2
+`bootstrap.py` already takes a `--window-minutes` flag and threads it into `seed()`. Part 2
 left the actual staging grant unexpiring; this is where that gets fixed. Import
 `expiry_from_now` from `authz` (it builds the protobuf `Timestamp` that `optional_expires_at`
 expects) and pass it into the staging `agent_deployer` write:
 
 ```python
+# Add this import at the top of bootstrap.py
 from authz import expiry_from_now
-# ...
+
+# Add this line in seed() method
 rel("environment", "staging", "agent_deployer", "agent", AGENT_ID,
     expires_at=expiry_from_now(window_minutes)),
 ```
@@ -87,12 +88,14 @@ forever.
 ## Update `approve.py`
 
 The human-in-the-loop path needs the same fix. `approve.py` already takes `--minutes`
-(default 10) and ignored it. Checkpoint 2's version wrote the grant with no expiry at all. Import
+(default 10) and ignored it. Part 2's version wrote the grant with no expiry at all. Import
 `expiry_from_now` alongside the checks it already runs, and carry it into the write:
 
 ```python
+# Add this import at the top of approve.py
 from authz import check, read_delegator, expiry_from_now
-# ...
+
+# Add this line in the approve() method
 update = rel("environment", environment, "agent_deployer", "agent", agent_id,
              expires_at=expiry_from_now(minutes))
 ```
@@ -105,14 +108,13 @@ a standing grant with extra steps; this makes "approved for now" mean what it sa
 
 ## See expiry without waiting
 
-Waiting out a 60-minute window to prove this works isn't worth your time, so the web UI gives you a
-faster lever: **Grant staging · 30s**, a button that hands the agent a 30-second staging window you
+The web UI has a **Grant staging · 30s** button that hands the agent a 30-second staging window you
 can watch expire live.
 
 > **Reset the datastore first, once.** You just changed `agent_deployer`'s allowed subject type
 > from `agent` to `agent with expiration`. SpiceDB won't narrow a relation's allowed types while
-> relationships in the old shape — the plain `agent` grants Checkpoint 2 seeded — still exist, so
-> the first `bootstrap.py` run this checkpoint fails on `WriteSchema` before it ever gets to
+> relationships in the old shape — the plain `agent` grants Part 2 seeded — still exist, so
+> the first `bootstrap.py` run this part fails on `WriteSchema` before it ever gets to
 > reseed. Reset the datastore once, then re-seed against the new schema:
 >
 > ```bash
@@ -123,7 +125,7 @@ can watch expire live.
 Start the web UI (`python web.py`) and open `http://127.0.0.1:8000`. Click **Grant staging · 30s**.
 The **grants** panel shows staging's card with a live countdown and a shrinking bar. Watch it hit
 zero, then ask the agent to "deploy checkout to staging" — the one request that was unconditionally
-✅ **ALLOWED** in Checkpoint 2 — and it now comes back ⏸️ **NEEDS APPROVAL** instead, with Alice
+✅ **ALLOWED** in Part 2 — and it now comes back ⏸️ **NEEDS APPROVAL** instead, with Alice
 named as the delegator who'd have to approve it. Nothing about `decide()` changed. The agent's own
 `agent_deployer` check on staging fails because the relationship it was reading simply isn't there
 anymore, as far as SpiceDB is concerned: it expired on schedule, server-side, with nothing external
@@ -152,15 +154,14 @@ web UI sees.
 ## Why contingent evaluation beats a cron job
 
 The obvious fix looks like this: keep the grant unexpiring, and run a cron job that deletes
-`agent_deployer` relationships older than an hour. Don't. A cron-based cleanup means the
-grant is *actually* valid — checkable, usable, real — for however long it takes the cron job to
-notice and catch up, which is never zero. Someone deploys at minute 59:58 using a grant that's
-"supposed to" be gone; whether that succeeds depends on scheduler jitter, not policy. You've also
-now got a second system that has to run, has to not fail silently, and has to agree with SpiceDB
-about what "expired" means. Two sources of truth for one fact.
-
-Relationship expiration collapses that back to one. There's no janitor process to keep alive: the
-expiry is evaluated *at check time*, inside the same call that's already asking "does this
+`agent_deployer` relationships older than an hour. This is an anti-pattern. 
+
+A cron-based cleanup means the grant is *actually* valid — checkable, usable, real — for however long it takes the cron job to
+notice and catch up, which is never zero. For example: someone deploys at minute 59:58 using a grant that's
+"supposed to" be gone. You've also now got a second system that has to run, has to not fail silently, and has to agree with SpiceDB
+about what "expired" means. 
+
+Relationship expiration collapses that back to one as the expiry is evaluated *at check time*, inside the same call that's already asking "does this
 relationship exist and hold." An expired grant isn't cleaned up later. It was never a valid answer
 to begin with, the moment the clock passed `expires_at`. Garbage collection still runs in the
 background to reclaim storage, but it's a housekeeping detail, not part of the authorization
@@ -168,7 +169,7 @@ decision. The boundary is exactly as tight as `CheckPermission` itself.
 
 ---
 
-## Completion Milestone: Checkpoint 3
+## Completion Milestone: Part 3
 
 - [ ] Added `use expiration` to `schema.zed` and marked `agent_deployer: agent with expiration`
 - [ ] Updated `bootstrap.py`'s staging seed to carry `expires_at=expiry_from_now(window_minutes)`
@@ -178,4 +179,4 @@ decision. The boundary is exactly as tight as `CheckPermission` itself.
 - [ ] Can explain why expiration evaluated inside `CheckPermission` beats a cron job that deletes
       old relationships
 
-Next: [Checkpoint 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md)
+Next: [Part 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md)
diff --git a/delegated-agent-authorization/4-relationship-based-hierarchy.md b/delegated-agent-authorization/4-relationship-based-hierarchy.md
index 6e20534..46e120c 100644
--- a/delegated-agent-authorization/4-relationship-based-hierarchy.md
+++ b/delegated-agent-authorization/4-relationship-based-hierarchy.md
@@ -1,12 +1,13 @@
-# Checkpoint 4 — Relationship-Based Hierarchy
+# Part 4 — Relationship-Based Hierarchy
 
-Checkpoint 3 made every grant time-bound and revocable, but it left each environment answering
+Part 3 made every grant time-bound and revocable, but it left each environment answering
 for itself. Staging autonomy and production autonomy live as two unrelated facts in the graph —
-revoking one has no opinion about the other. That's not how a real deploy pipeline works. If the
-whole point of staging is to catch a bad build before it reaches production, then an agent that's
+revoking one has no opinion about the other. That's not how a real deploy pipeline works. 
+
+If the whole point of staging is to catch a bad build before it reaches production, then an agent that's
 lost its staging privileges has lost the thing that made its production privileges trustworthy in
 the first place. Here you make that dependency real: production's autonomy is *contingent* on
-staging's, enforced by the graph, not by anyone remembering to check.
+staging's, enforced by the graph. ReBAC makes this pattern very straightforward.
 
 ---
 
@@ -15,18 +16,9 @@ staging's, enforced by the graph, not by anyone remembering to check.
 The policy you want is: "the agent may deploy production on its own only while it can also deploy
 staging on its own." RBAC can only ever hear the first half of that sentence: "the agent has role
 X." What you actually need is "the agent has role X *and* a second, independent fact about a
-different resource currently holds." RBAC assigns roles to subjects and stops there — a role is a
-static label, not a live query against another resource. To fake this
-dependency in a role system you'd need a role that means "agent-with-current-staging-autonomy," and
-you'd need to *maintain* it — write code somewhere that watches for staging revocation and
-downgrades the production role in lockstep, by hand, every time. Miss one code path and the two
-facts drift out of sync: production autonomy silently outlives the staging autonomy it was supposed
-to depend on.
-
-ReBAC doesn't need a synchronization job, because the dependency isn't a copy of a fact — it's a
-graph traversal that reads the live fact every time. You add one relation that says "this
-environment is gated by that one," and a permission that walks it. There's nothing to keep in sync,
-because there's nothing duplicated to begin with.
+different resource currently holds." 
+
+ReBAC computes permissions based off relationships expressed in a graph. Expressing a *relation* between the staging and prod server access is just about adding a new relationship and an associated permission. All permissions checks fall into place accordingly. This is one of the strengths of ReBAC - hierarchies and nested permissions are easy to compute.
 
 ---
 
@@ -49,13 +41,13 @@ definition environment {
 }
 ```
 
-Two new pieces, and one rewrite of a permission you already wrote in Checkpoint 2:
+Two new pieces, and one rewrite of a permission you already wrote in Part 2:
 
 - **`relation gated_by: environment`** — an edge from one environment to another. This is new: every
   other relation on `environment` so far has pointed at a `user` or `agent`. `gated_by` points at
   another `environment` entirely — it's how one resource says "my autonomy answers to that resource
   over there."
-- **`permission agent_deploy = agent_deployer & gated_by->agent_deployer`** — the payoff line. Read
+- **`permission agent_deploy = agent_deployer & gated_by->agent_deployer`** — Read
   the right-hand side as two separate questions joined by `&`, an **intersection**: both must hold.
   - `agent_deployer` — does the agent hold *this* environment's own delegated grant? Same relation
     as before, checked the same way.
@@ -67,7 +59,7 @@ Two new pieces, and one rewrite of a permission you already wrote in Checkpoint
     **and** it holds `agent_deployer` on whatever environment gates this one. `&` is what makes
     it contingent instead of additive — either side going empty collapses the whole permission to
     empty, immediately, without anyone deleting the other side.
-- **`permission deploy = direct_deployer + agent_deploy`** — the Checkpoint 2 line was
+- **`permission deploy = direct_deployer + agent_deploy`** — the Part 2 line was
   `direct_deployer + agent_deployer`; the agent's whole way in now runs through `agent_deploy`
   instead of the bare relation. A human's `direct_deployer` grant is untouched — Alice can still
   deploy either environment herself, gate or no gate. The gate only ever constrains the *agent's*
@@ -87,6 +79,7 @@ independent relationships, on two different resources, both required.
 Add two relationships to `bootstrap.seed()`, alongside the ones already there:
 
 ```python
+# Add this to the seed() method in bootstrap.py
 rel("environment", "staging", "gated_by", "environment", "staging"),
 rel("environment", "production", "gated_by", "environment", "staging"),
 ```
@@ -106,15 +99,16 @@ the bare `agent_deployer` relation.
 
 ## See the cascade
 
-Start the web UI (`python web.py`) and grant the agent both environments the way Checkpoints 2 and 3
+Start the web UI (`python web.py`) and grant the agent both environments the way Parts 2 and 3
 taught you. Staging is already autonomous from the seed; click **Approve prod · 10m** to give
-production its own `agent_deployer` write — same button, same one-relationship approval as always,
-nothing about it changed. Confirm both are live, in the web UI or by asking goose to deploy each
+production its own `agent_deployer` write. 
+
+Confirm both are live, in the web UI or by asking goose to deploy each
 environment: staging ✅ **ALLOWED** from its standing grant, production ✅ **ALLOWED** from the
 approval you just ran. Two independent relationships, both satisfying `agent_deploy` on their
 respective environments.
 
-Now pull the base out from under it: click **Revoke staging**.
+Now pull the base out from under it by clicking **Revoke staging**.
 
 That deletes exactly one relationship,
 `environment:staging#agent_deployer@agent:goose_alice`, and nothing else. It does not touch
@@ -127,9 +121,7 @@ two environments affected, because the second one was never independent to begin
 
 The web UI shows this precisely: production's grant card stays on screen but turns dashed, tagged
 **"suspended · gated by staging"** — the relationship itself is untouched, only what it computes to
-has changed. A system message spells out why: *"alice revoked the staging delegation — production
-autonomy is gated by it, so it suspends too."* One click on **Revoke staging**, two environments
-affected, and no write ever touched production's own relationships.
+has changed. 
 
 ---
 
@@ -146,32 +138,19 @@ UI.
 ## Suspend, not erase — why this is contingent evaluation
 
 Look again at what **Revoke staging** actually deleted:
-`environment:staging#agent_deployer@agent:goose_alice`. That's one tuple. The relationship
+
+`environment:staging#agent_deployer@agent:goose_alice`. 
+
+That's just one relationship. The relationship
 `environment:production#agent_deployer@agent:goose_alice` — the one **Approve prod · 10m** wrote — is
 still sitting in the graph, completely untouched. `agent_deploy` on production went from `ALLOWED` to
 `NEEDS_APPROVAL` without a single write touching production's own relationships. Nothing was
 deleted there; a permission that used to evaluate `true` now evaluates `false`, because one of the
 two facts it depends on changed underneath it.
 
-That's the distinction worth sitting with: this is **evaluation**, not **deletion**. A cascading
-delete — the RBAC-shaped fix, where revoking a base role fires code that goes and deletes every
-dependent grant — would have to walk every environment gated by staging and remove their
-`agent_deployer` relationships one by one, and it would have to get that walk exactly right or leave
-orphaned grants behind. `gated_by->agent_deployer` doesn't walk anything at write time. It's read at
-*check* time, against whatever the graph currently says, every single time — the same way expiration
-in Checkpoint 3 didn't need a cron job to notice a grant had gone stale.
-
-The proof is the revive. Re-grant staging — click **Grant staging · 30s**, which writes only
-staging's `agent_deployer` relationship — and, without touching production at all, `agent_deploy` on
-production goes straight back to `ALLOWED`, for whatever's left of the window **Approve prod · 10m**
-originally gave it. The production relationship was never wrong; it was only ever asking a question
-whose answer depends on staging. Suspend, not erase, is what lets a fact come back to life just by
-the thing it depends on coming back — no re-approval, no second click of **Approve prod · 10m**,
-because the grant itself never went anywhere.
-
 ---
 
-## Completion Milestone: Checkpoint 4
+## Completion Milestone: Part 4
 
 - [ ] Added `relation gated_by: environment`, `permission agent_deploy = agent_deployer &
       gated_by->agent_deployer`, and rewired `permission deploy = direct_deployer + agent_deploy`
diff --git a/delegated-agent-authorization/5-nextsteps.md b/delegated-agent-authorization/5-nextsteps.md
index 4af588e..7763304 100644
--- a/delegated-agent-authorization/5-nextsteps.md
+++ b/delegated-agent-authorization/5-nextsteps.md
@@ -1,6 +1,6 @@
 # Next Steps
 
-Four checkpoints ago the agent could destroy production on a whim. Now every mutating call it
+Four parts ago the agent could destroy production on a whim. Now every mutating call it
 makes resolves through a relationship graph: delegated authority, a three-way decision, expiring
 grants, and a hierarchy that suspends dependents automatically. That's the whole mechanism. What's
 left is zooming out — how the same shape holds up once "one agent, two environments" becomes "many
@@ -54,14 +54,14 @@ knowing. **Advisory enforcement** is when a check informs a decision without bei
 it — logged for audit, surfaced to a human reviewer, used to rank or filter results — while the
 actual authority to act sits somewhere else. This workshop's own `list_environments` is an
 advisory-shaped tool by design (its code comment says so directly: *"UNGATED in this workshop"*):
-reads are lower stakes than a destroy, so it was left open to keep the checkpoints focused on the
+reads are lower stakes than a destroy, so it was left open to keep the parts focused on the
 mutating path. A real platform team draws that line deliberately, tool by tool, action class by
 action class — not by defaulting everything to advisory because blocking enforcement takes more
 wiring.
 
 ## Where this workshop deliberately stopped short
 
-Two things were left ungated on purpose, to keep every checkpoint's diff small and centered on one
+Two things were left ungated on purpose, to keep every part's diff small and centered on one
 new idea at a time:
 
 - `list_environments` has no permission check. Every environment in `infra_state.json` is
@@ -83,7 +83,7 @@ permission manage = direct_deployer
 
 `view` includes `agent_deploy` deliberately — an agent that's lost its deploy autonomy (staging
 revoked, cascade in effect) also loses visibility into the environment it can no longer touch, so
-the same `gated_by` cascade from Checkpoint 4 hides a suspended environment from `list_environments`
+the same `gated_by` cascade from Part 4 hides a suspended environment from `list_environments`
 as a side effect, with no extra code. `revoke.py` in the solution checks `manage` before it deletes
 anything:
 
diff --git a/delegated-agent-authorization/README.md b/delegated-agent-authorization/README.md
index 613d4df..7726912 100644
--- a/delegated-agent-authorization/README.md
+++ b/delegated-agent-authorization/README.md
@@ -48,14 +48,14 @@ matter how many different ways — or how many different agents — ask it.
 - A relationship hierarchy (`gated_by`) where revoking one environment's autonomy automatically
   suspends what depends on it — contingent evaluation, not a cascading delete
 - A web UI that drives every action — request, approve, revoke, watch a grant expire live — and
-  shows exactly what SpiceDB decides, so every checkpoint is confirmable without an LLM in the loop
+  shows exactly what SpiceDB decides, so every part is confirmable without an LLM in the loop
 
 ## Prerequisites
 
 - **Docker**, or a GitHub Codespace — the repo ships a `.devcontainer/` that handles setup for you
 - **Python 3.10+**
 - **goose, plus an API key for any LLM it supports** — only needed if you want to drive the agent
-  in natural language. The web UI drives every checkpoint without an LLM, so goose is optional
+  in natural language. The web UI drives every part without an LLM, so goose is optional
   throughout.
 
 No prior authorization background is assumed. Comfort with a terminal, Python, and Docker is
@@ -66,17 +66,17 @@ enough.
 | Module | Time | What you do |
 | --- | --- | --- |
 | [Setup](0-setup.md) | 15 min | Bring up Docker (or Codespaces), install dependencies, optionally register the goose extension |
-| [Checkpoint 1 — Run the agent](1-run-the-agent.md) | 10 min | Run the agent ungated and watch it destroy production on request |
-| [Checkpoint 2 — Delegated authorization](2-delegated-authorization.md) | 25 min | Write the ReBAC schema and implement the three-way `decide()` |
-| [Checkpoint 3 — Time-bound and revocable](3-time-bound-and-revocable.md) | 15 min | Add expiring grants for incident windows, plus instant revocation |
-| [Checkpoint 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md) | 20 min | Make production's autonomy contingent on staging's, and watch the cascade |
+| [Part 1 — Run the agent](1-run-the-agent.md) | 10 min | Run the agent ungated and watch it destroy production on request |
+| [Part 2 — Delegated authorization](2-delegated-authorization.md) | 25 min | Write the ReBAC schema and implement the three-way `decide()` |
+| [Part 3 — Time-bound and revocable](3-time-bound-and-revocable.md) | 15 min | Add expiring grants for incident windows, plus instant revocation |
+| [Part 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md) | 20 min | Make production's autonomy contingent on staging's, and watch the cascade |
 | [Next steps](5-nextsteps.md) | 5 min | Zoom out to a real platform: bulk checks, on-behalf-of enforcement, scaling ReBAC |
 
 That's 90 minutes end to end, self-guided — it works equally well live or self-paced afterward.
 
 ## The full reference solution
 
-Everything you write in this workshop — the schema, `decide()`, the checkpoint progression — is a
+Everything you write in this workshop — the schema, `decide()`, the part progression — is a
 guided version of a complete, tested implementation:
 [`github.com/sohanmaheshwar/goose-spicedb-delegation`](https://github.com/sohanmaheshwar/goose-spicedb-delegation).
 Use it if you get stuck, or to see the production-hardening this workshop deliberately skips (more
@@ -85,10 +85,10 @@ on that in [Next steps](5-nextsteps.md)).
 ## Modules
 
 0. [Setup](0-setup.md)
-1. [Checkpoint 1 — Run the agent](1-run-the-agent.md)
-2. [Checkpoint 2 — Delegated authorization](2-delegated-authorization.md)
-3. [Checkpoint 3 — Time-bound and revocable](3-time-bound-and-revocable.md)
-4. [Checkpoint 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md)
+1. [Part 1 — Run the agent](1-run-the-agent.md)
+2. [Part 2 — Delegated authorization](2-delegated-authorization.md)
+3. [Part 3 — Time-bound and revocable](3-time-bound-and-revocable.md)
+4. [Part 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md)
 5. [Next steps](5-nextsteps.md)
 
 Let's get started with [Setup](0-setup.md).
diff --git a/delegated-agent-authorization/starter/web.py b/delegated-agent-authorization/starter/web.py
index eabb41d..c7d3706 100644
--- a/delegated-agent-authorization/starter/web.py
+++ b/delegated-agent-authorization/starter/web.py
@@ -124,7 +124,7 @@ async def request_action(body: RequestBody):
 
 @app.get("/api/state")
 async def state():
-    # Defensive throughout: in Checkpoint 1 no schema exists yet, so the delegator
+    # Defensive throughout: in Part 1 no schema exists yet, so the delegator
     # read / relationship read / permission checks below all error. We degrade to an
     # empty "no delegation configured" view so the web UI still loads and the chat
     # (which routes through the stubbed decide()) shows the agent over-reaching.
@@ -154,7 +154,7 @@ async def state():
                 effective = False
             grants.append({"environment": env, "expires_at": expires_at, "effective": effective})
     except Exception:
-        grants = []  # no schema yet (Checkpoint 1)
+        grants = []  # no schema yet (Part 1)
     try:
         versions = deploybot_server._load_state()
     except Exception:
@@ -177,9 +177,9 @@ async def revoke_action(body: RevokeBody):
 @app.post("/api/grant-short")
 async def grant_short(body: GrantBody):
     """Grant the agent a short-lived deploy window so you can watch it expire live in the
-    authority bar (used in Checkpoint 3). An operator/demo action: it writes the
+    authority bar (used in Part 3). An operator/demo action: it writes the
     agent_deployer grant directly with a seconds-scale expiration. Requires the schema to
-    allow expiration (`agent_deployer: agent with expiration`, from Checkpoint 3)."""
+    allow expiration (`agent_deployer: agent with expiration`, from Part 3)."""
     client = make_client()
     ts = Timestamp()
     ts.FromDatetime(datetime.now(timezone.utc) + timedelta(seconds=body.seconds))

From 79d56c3782c45c7033b7d911a0bda9cfd6e6b49b Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Mon, 31 Aug 2026 20:21:39 +0200
Subject: [PATCH 18/27] =?UTF-8?q?docs(workshop):=20rename=20Checkpoint=20?=
 =?UTF-8?q?=E2=86=92=20Part=20in=20starter=20stub=20comments?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Complete the Checkpoint → Part terminology rename in the shipped starter
stubs (authz.py, schema.zed, bootstrap.py), so the code a learner opens
matches the Part N language in the docs. Starter reset to stubs.
---
 delegated-agent-authorization/starter/authz.py     | 8 ++++----
 delegated-agent-authorization/starter/bootstrap.py | 4 ++--
 delegated-agent-authorization/starter/schema.zed   | 6 +++---
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/delegated-agent-authorization/starter/authz.py b/delegated-agent-authorization/starter/authz.py
index 4aca33d..44acd4c 100644
--- a/delegated-agent-authorization/starter/authz.py
+++ b/delegated-agent-authorization/starter/authz.py
@@ -67,9 +67,9 @@ async def read_delegator(client, agent_id) -> str | None:
 
 
 async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
-    # WORKSHOP STUB — Checkpoint 1.
+    # WORKSHOP STUB — Part 1.
     # Returns ALLOWED for everything WITHOUT consulting SpiceDB. This is exactly why
-    # the agent over-reaches in Checkpoint 1. You implement the real, SpiceDB-backed
-    # three-way decision in Checkpoint 2.
-    # TODO(Checkpoint 2): replace this stub.
+    # the agent over-reaches in Part 1. You implement the real, SpiceDB-backed
+    # three-way decision in Part 2.
+    # TODO(Part 2): replace this stub.
     return AuthzResult(Decision.ALLOWED, "no authorization configured (workshop stub)")
diff --git a/delegated-agent-authorization/starter/bootstrap.py b/delegated-agent-authorization/starter/bootstrap.py
index 1cb8d15..c95e6e0 100644
--- a/delegated-agent-authorization/starter/bootstrap.py
+++ b/delegated-agent-authorization/starter/bootstrap.py
@@ -35,7 +35,7 @@ async def seed(client, window_minutes: int = 60) -> None:
         rel("environment", "staging", "destroyer", "user", "sre_admin"),
         rel("environment", "production", "destroyer", "user", "sre_admin"),
         rel("agent", AGENT_ID, "delegator", "user", "alice"),
-        # Checkpoint 2: staging-only delegation (no expiration yet).
+        # Part 2: staging-only delegation (no expiration yet).
         rel("environment", "staging", "agent_deployer", "agent", AGENT_ID),
     ]
     await client.WriteRelationships(WriteRelationshipsRequest(updates=updates))
@@ -44,7 +44,7 @@ async def seed(client, window_minutes: int = 60) -> None:
 async def main() -> None:
     parser = argparse.ArgumentParser(description="Bootstrap the delegated-agent-authorization workshop.")
     parser.add_argument("--window-minutes", type=int, default=60,
-                        help="Minutes the agent's staging delegation stays valid (Checkpoint 3+).")
+                        help="Minutes the agent's staging delegation stays valid (Part 3+).")
     args = parser.parse_args()
     client = make_client()
     print("Writing schema...")
diff --git a/delegated-agent-authorization/starter/schema.zed b/delegated-agent-authorization/starter/schema.zed
index 046bbe8..49e2554 100644
--- a/delegated-agent-authorization/starter/schema.zed
+++ b/delegated-agent-authorization/starter/schema.zed
@@ -1,7 +1,7 @@
-// WORKSHOP STUB — you will build this schema up across Checkpoints 2–4.
+// WORKSHOP STUB — you will build this schema up across Parts 2–4.
 // It defines the object types but grants the agent nothing. Combined with the
-// authz.decide() stub, the deploy agent runs UNGATED in Checkpoint 1.
-// TODO(Checkpoint 2): model delegated authorization here.
+// authz.decide() stub, the deploy agent runs UNGATED in Part 1.
+// TODO(Part 2): model delegated authorization here.
 
 definition user {}
 

From e6de87d91239e5393539dd4da1d5dbe94826673b Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Tue, 1 Sep 2026 11:28:03 +0200
Subject: [PATCH 19/27] docs(workshop): add FIG.01 architecture diagram to
 0-setup

Export the "what you'll build" permission-check diagram (Sandworm style,
embedded Inter + JetBrains Mono) as a self-contained SVG under images/, and
embed it just below the Introduction in 0-setup.md.
---
 delegated-agent-authorization/0-setup.md      |   2 +
 .../images/fig1-permission-check.svg          | 100 ++++++++++++++++++
 2 files changed, 102 insertions(+)
 create mode 100644 delegated-agent-authorization/images/fig1-permission-check.svg

diff --git a/delegated-agent-authorization/0-setup.md b/delegated-agent-authorization/0-setup.md
index 1472946..fb0ad5e 100644
--- a/delegated-agent-authorization/0-setup.md
+++ b/delegated-agent-authorization/0-setup.md
@@ -10,6 +10,8 @@ The `starter/` folder in this repo is stubbed on purpose: the plumbing (MCP
 extension, docker-compose, the seed script, the web UI) is already there, and you'll
 write the schema and the decision engine yourself across the parts to learn each of the concepts.
 
+![What you'll build: every agent action goes through a SpiceDB permission check, decided ALLOWED, NEEDS_APPROVAL, or BLOCKED](/delegated-agent-authorization/images/fig1-permission-check.svg)
+
 ## Two ways to drive the agent
 
 You can complete every part in this workshop with just the web UI — no LLM key, no goose
diff --git a/delegated-agent-authorization/images/fig1-permission-check.svg b/delegated-agent-authorization/images/fig1-permission-check.svg
new file mode 100644
index 0000000..55ec864
--- /dev/null
+++ b/delegated-agent-authorization/images/fig1-permission-check.svg
@@ -0,0 +1,100 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1200 520" role="img" aria-label="Delegated authorization: a DevOps agent's action passing through a SpiceDB permission check"><style>
+@font-face{font-family:'Inter';font-style:normal;font-weight:600;font-display:swap;src:url(data:font/woff2;base64,d09GMgABAAAAAL0wABQAAAAB4AgAALy3AAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoZeG4KyRBzVcD9IVkFSi2k/TVZBUl4GYD9TVEFUgU4nJgCFNi9sEQgKgbtAgaEUC4gOADCCnD4BNgIkA5AYBCAFhi4HoQRbbM1xJ9pEvFeIqaVsuokIsO22SVU1fQk3aHa/1VxA501dSsJn5lSwbRr1bgcRJN0fNvv////PTSpjaFO2tAUBUdXp/H+hZmYeWbxMkksUg6gSjR4sJp1OluyFAZzHknNZFfcOC/jkm4TBTvWYFyAlzqJGm4RoBKtiTp9mkyGfCzYwC/BDbocpQqUSQIhMa7ygZvA0U75Y4LFTHnT/aGZJWR6pLqVniIDetGuXwgUe8/POsOsP1Q9VUiWTp72izbt5tKtLgWhoWrfh09M7RFpXf5QIFuBDxYUkcftGuBj4EcUodLrLBqOES28ulU2C4bvURfopCwxHk8sX8DGo2D5LQadmFhKB7no9F66EECKF6kb1LqY15mIYK93FNtnkyduuV/xNv9PH6x75G9MA70vGml6p8vX9jTf8AlMyEzuyoIG97E5cYX23aa9Hhfa/gh+rhMr0p6hG3V/wUX/4bg8BtusHxJhISTNsDu+T58G6+P7cJFXdA5Grx9UI3uHDWFqdI9Ktmb2SSyGEEKqU0AMiIERQ9DXQRVFERKTZsDREnyYqQuzAK/KWiqiIvCLvK49+s1SK7ysqomJ9xU6RIlJyVj8G+727t4KYRiKJ6Uw3iRAa2bRlQiZEItHsW/vD03T+u+jlcsnF5JJcVJs03iStI4UWK6LFbFo+M0LKTNmHjYkoait4BVakjq+l1KiQpkOgZ1ejQ422tKUtSiXWioidPSUhIkaCIEQiJCIRxIrZgS6Umqtf2qKtjv1Px/y9+msMz2/q/7lAgHjTWFWm1u39lwuknXfinuWlXXeFXDRAULlcJHiACBaVSpLG6zrP9pfj382aQdsZgpTumfvX7RNCulCnLRXfvMwJ+YXfUxXkTPjnn/182+cl+UV2VSRMdTuAwgDh8lHDRrIjMIL8qBEeMNcHvm3fH+/WjbYKuzHASXJESqJioBVY17svf6PqbzuK4d/N6iGtj+iaWFkz/5I7p6zJuXQ61p1ScwoePIQQgkYhEBIIwQMEAPR8+/VWPTOJIpIZnRPLCgkX7n+LqGKXJDBIYOoauuaHLayoaOIjGdjlV6MOfAKzjwhVNzQG8uRBYAVG2G770u2fvmQSp6bxI+T7xENyB+QBe8AeoEcZuQ+kAeuBNUAPWC5Q9GWfx1lOJY/yDoxbtnO9DPRjm33JS4DgNZ9ZFz3tVZR+Oa2onNy/uJXaQAMEgOdzqn9JzlyoZbnAjsVZJcsFBJQRPR7+3U9T2ylSxF9XdraQNyIXPyBJZMSM6/E1btLkwv/za5LnfprgMqmiIj2Tlm3ZuArXd/NTJInsditVbStcBuZmuh2o+5q/Le+s6Wn6HRGdCSs788v5/j+BxKuXa14CfoTIRDS2lRoVt+HWDIa+ViyxC8jxO7gBW/OIoGiLnaEaCsXU2aW+WOJz2VEo+nvGlPjd/j3RNKHmv5gaD0KBXUYZRsEehmEIuDF2TFNM/H2pWtf/Gh9kA5phEeCu2FpPaNrLnY+JkCacQbXkCSnd99xAEwa6AVINiJIBUAGkU4Myxx8UaYPksMwGFGjSKVLakO2sTfkDlGpalDzVJhVAOVGaqPJtYqA3hHCL8bS1p91biOe9nUK+7Snkw+m+x93rZXn+//fmbO5s6ij+etAlEhlh/sKqKS05REF/DrprzauscSBjvAD+v5+m+OmM5rkr2p9WEdv5sgNIAA7ga3fN3Y1SuiawdVQqlAsK8gQgT1AHpHVcAQpjISAAx/+cllRPT77x/4su6bQ1zlclIxd5i51a0HpTCwsK4UFHYADC+WmtX/2Le4iQCUnMG41QmMfyvu0XQ8yiv5WbO/8ijmop1ELNs4MdJLETVBI8H960wDp7QLiL8kmCA8CPYRj2l6qfLR6BNyR/5kVeCKEozyFWJ3cVsIvVYrFYEUzzQYI8pUskpR8yJQetwH8GeSGGyjFQF0LsfOXVrly5c1V6ehdFFXLfmIf+l+/s3iS0stDloIiOcN+q3Ucdhtaqa0U4MBYhP8Jx8ECgLqa7fnPxCKfgAxOkGc4hlEASFBLH+3xTZ9v8XOc6hmIrhE8c8ssqm9XruP+Qa2oewlIXHDK9wBLCOBOecPNd7o+pilS1stzLEdZ9OtYygqAgwlXJwr/bC6/nhumPhSelkyKhBBdk7HPWxMpSrcMGsGGGxQgzCCOEEI1ohBA6YRzfxPl9y2RNdvv3faPQ77zZeW6nHCQEEREJEkQknX0IdYqXva4nCasWr+lFjEq5Tuwb6+8dY7Yf8GuX1ae/5AEBBTmWNsEitkz2kJfKUKpQ4/X//dLPi8Gk3T2+ZZaNLIdSawnBKxJFQgjHOvM1lqqKI1Neth/ZVFpz6cNukFF/QZG7/ffQd4HvIswRhVCRs1CVR9Bjz6GX+qBBOhiCBDA0MoCRoAQwUtQHjHUEjEMGmOAIMOHRYQqrh9mTHmZ/RpiDWWBO5Yc5XQjm79IwF2uDqWkEldauwHTUgUp33SiIAKsDi0NsahpsqOGu1Q1hbkNQbkWDshFwCnAIsDI9iEDggQXOPtm7vQDyP9G7f7Y+9Uco+35f/hvvxaeBOeAe8BVQIAKkd761/u0pr4EC5AXBef4Jv3BX5YMrdv/fntv3rzjw+FMrbkKPvnKL8+Ss2yrvXH5X5d3L7x1/7/J7V967+t619y9/wFzrrI0/uPxhZX30kvNS5WOOf8ufeLisvQxMT3+SceW8K5VPLnly+VOO64broevxZ21NrqaspmBT5fO+oNGKHwAzshFCBHGhdDGLTbIkqN+rVUtPnanehoztbX4LDnwYRsg7nJ7e3O5O97OLD6X00c9wSAOP4vjSkvmmO/3zkzm43GqWP6fTWR0xUuSYKIYBa86TTyEiarHkbGOExU976TuJWFQmOdOY+BzOl0cycktZhDqgD46jsLEgZEEYhRYehAy2sjksbIUO+7URjkhEI5ahclSowhWtwk5PzjXn//QTtXTZ1kFMbNzlbxBNZ3pTSr99G7pYktK+O5qgBtbtcGNhHofHE+ydhAVbBIk4MqWyXWnKUu7JZKJUmtjOvegIivXu6zsL3wGPAwAEoE24SCKtUzsbQpFUh8Vm9/j8cBjDE8k0STFslsvxhdJgwvN5KGJMorKq6YZlZwViBaHRGsxWRyhcINEa7aFsDhAgHQYdFQRgbxoQYFERitD738bp4f14iY/B5WneH4XLC+5sAuZoQOcNUFAm1Cg7xs0ue5JPYOSkqf6Vi1C+GI3v2hwIJjg2ercBtaG5gnHXJxpf5uewRmhJsWSQCMIlSsXzzuJCgqHhwZExCaok7FnpBR+uQxWG6SBafD6UPwfUfNiMH3ni8C5UivfKiBb3hgy2AKpvJjiC/7WCaVABDXhcuSU8D0fg4hdIkmMcFh0GZ6/4Nx//0NL/Xgvdl/o/fPtXfAS+9ri+Oiv5yz/M4Z/3YVOo7H1x2cPOd9ZbLrnI2U/bComrutjZTqugctwTnkMe5bE9FGFX/sfFF9rlmTOue7U1n9iqja3nMt+DQZNpZStM37ahV14eNqdTW8WOpiRGfInEHq0zI42y2/K/TWbYIc7yifFGF0EQDrb9bPk6tzrgfOXrtltrqdTdwLeD3zXbRCNsqqD0sFkdS1ZO13RB+cpYQcqNSytCVSqQqFizFS+PTJIIZnopMHqFFnlsoMG0u83Q6RM0QotZQzlTmNZrOJlIwmkwm7EgL1ZZgpHoryUL19xpef5XpYpVq+qG6qiq4jqqq8wFSZ0uzQblYfjE45lscxbjjTWy8PN9C5rxfvRh7CjtSco3lsiCkD5z4ga0a9Su2BojujTIuVGO1aSioUr9emM1TEaEAnNAyLcAatm0GSMCYqu5ZIhYBZ0Yg4BEinZJlRlGUrIK4agtQinyvBsACEeSpeqAztqyiNe24NAk6E39qzMefI9uaAVcVbTyv9DevGWz/kU3hK0nNstO7Z+FwrRJWWLW9zLpWcR4Crd9E15Xz+OhLZ+9KVXx74Y2nOQMUF71midvXjG807SupKyoEX2RM2S43m3CkbgV8131NbICl2yOfDhPVePOWXFLFhn3Xza9foOTJzgQKjOcTZhWDYGp86oAef2Rp68ex54tWo7GuAdTr++81yZwExUeu0b7UOqZwCa+aWayiWrXLvwJf7uhEG30URWB+3bwRRkbDbvvaMvl4Ja1mtqZD3OI7J2DcIGh/SkX/MuaGYHD/bIvl2OzZSx6L+QlngLk1VeGNPOs7eYZlkr6enPTOaVYX246qNY5hIvuMNvMe7Xp/MY/PdufDHWu7DNZifO0Py8e7GdvMpHnFmMQCss4oiRcsmPT5PgitkzQP9ebG4+/UpPxh78OoYHMk6uy8BFZsNHm/4Q/GcJyfjhfo72Yx88Ds3DApGaFzw4mLOGro34kNfhwiLweyV4GloOmDWkLShB29CMIeF4SklM1HdexIkRC9h8jacvLa7bnRe3VEo+L1n7qOCFIGloxb258jez5vvZtDIsCBmFtMWezGTAYMVsJX7LrfNUSb3j64t79YLru5cUH5sQSy2o5MJ/dcPnF5b7E69xbIGPrYo7h75JpfsRxCNazc0hDXryxrLHdZMsqZ5xxe4nixaYYjswSbL1JJAhZW5/pVo4bUY4ZmXGOsYcbLIaaJesN+abkwXl/sIPL4G9CDLry3D8Mxxyf31ZBt0RumZcuMvPR7+M/XZXfhqdlKKl4QE3H99HPg1EIxFGzK5socjt93p4b+6osmW3c114Nmftxv+/I+rSdoxuLwQl0/qOMzdf7r2OfFcDX8GBWMqF0CTPhJIHWu5Mgoiv0ku4p6Sq7SGc+Gik3+Q97OqgvsOJvnlgXBNm6jllh/09lLgqxM+dzr+a/vTwGItvUZxPJVS6WILXSzk/HhmTRVaxzHNDT/vDl3URwqTYxDx7ugT9igPsAXGj3hdbUMpRqQa1XTsiWbvqyvcyqOjn7vE25N9nu8hgfuQgVVaJCdKlKFCfmZzm1PAayaUomkivx0achqFcVi67u9UdOqWL0csxnQkEIlDWfy/MTBc0hzFtnKF7o18mCfLiIPcER2D+f19iv2BeavAa7/SEe8koirLipmRtyQOslMeydafS9cLw0q+yy+rHXQ57cscKJbr7IHrZhLoIAujkH0ebqqx6sGSCDKx3fJvvByq1d0/ogEjg/OFmq+ZRWLseTxF1tbUrRQCGdwOV4Aqi3/jyH31zAvzh9SKHeY11+87s/89dhhPQkMy2gpkWfFmNaTLrHYh1D/FBPwVYAWHwjFmHwhctsDnKJV0R5vJ9ufYKJ8Lxl5NF/tmlRH/CRW1iM93b/Ar/jHSJ+e9CRn6LOsIx31Sz8O77lG3dDE7rHpYvZULZMMorcaCGoctnYkku8CQ4MJholbZDqcdbKYiYZRW7TQsSrgmyYIIvDWrJBhklfksumb1J3sGf1jLGvDYW09mFEHK9B7ilGjsUmlpcuQxONYF/l6lo7DwPY5Y5Pt7coWJ+sL72jyWSAXZsCZ0i5eh4O5usH4ls5cCXu2YQhpgvt62ddyNLggPChj9NG0xOTLzJcJRjunLj6YdBcLlJUm26+6K7B2rFp4o90bg2g2qJ9Ujyn+1nALJjjQYnyJBw6dmPkjI6QDzPRE5Ivt5AU3R0cSpAMwyB7HG9U88DT/jPjqmEm0zybZ/w8luTP/pUHxUjbOxJ2Rq4i9H6Vw3cT8yKK/HiSM8z8WROAYrlMG+A0Z32fvocv4ahfTogMDbXG5b36HM4s9Jwva32ddsFTsXr+QqncGP9PFFuhj5AASzMgZsSTHrWphoqWb4LtCuUqstN6e5y1aXvhKH9zg3q1bCN6r9+i+l0fITCidNGZ3tRaeg+R61eQoYHK/Nc/LkRlcfkVwNTuEiFDbbBf+w2QAmXNvwSCdX7t/cNQbnD3nqzAIT34LffMLoOn6Wn3jnPveJUxiBnIvmMakw6eEJpQXOSlxoUDEhey74dwn0NZYeFCkxYXacE46GP+kMORXlxK/xQnjy/umhEdzy/ddVISi7+1O7qJUO7zL1Y2EMqMdEh+aWhavF9+vdHXVa8p7WLktOqGlMeptrLvPa8oTjAVTdeertpdj3XpKwgxXnrstaYtez62v4UYRqzPgd86TZvjMgnXChBRmvMg0lns4xy3PU7YPfwpo8tAnAWZwfycJK5F5J6Er0TCbEg1WLvJv+khooV7UMrSHMmV9pkYmBvXhwT9ZY3TW5LGO8KBPK6Afv4qtaCln4yELfw91hqEvtHc6+7yYwye1ZPMpsbNB//77n3HPPlaB/DXSaCXZRqiDzSunsKvpzUS6AZlGw8fRuvPw/Hn/cDTJleElYkhkoTPvNzkj2wOeBHEM9pMVdwlE2Dxlg7xQxG733+LjTV8m+nDmR/G/MJxZ0/++k/8uVnaIWRIWUXRHs8n2JZUFvyGW1zwOeafwKwbg984nXMEZ77vJ4EZBdoVsC5/Uz/sJN3H6wpHrvUlrakWkzWNTvq97ul+VVp+0q990kLMUxL0VDj6g0o1WWtRyTdKp9nX7be2g+bDCIITEhnjDV3/uGYdtargr7zznmjol8cjaH/ZWHFPBBCuV/0UMDL3l1yU2lu53YWNF7+S4eNmpScWqAhRDFxsQBw7JHFAL6pH0owoQj/+UZg0sWDTpJVtU+NJmpHAn7MTcWp+OZxbWSHP1qXmXVWVxrQpQkAakwvLcYIp6cwoMmcK09NDTM4xIwNBbEbzictEISHzHyRmuZSZ2eig2fmok+ZBd+Y8lga9tMAAFmFgcds7r0R1EZG7qQgcKju6QxIC5JGBeRTgGhVYRwOKYCCPAZxDJtiXZMfkQ+KdH2Yk0BkFxheS0WDGQMcfg/IwrQBpQpBmPNKEwSaKoU2DynRsqwATB514MDOhMwtxZgfCzCmLKEmlPzUv6Zv55eCyuAKCLKsIkxTArMC4xzHpCYx7EpOqApLMtDBZBTqrwayBZC2YnF6VG3atBzobwGzsqDYlWLcmppd8oFOAVW/AZhuy3pr06r6ZDbBsG8Pajk0f4NSHGLaDIX2Msk8w6rO2szVul77Q5AAKps/idMcuNw3zuFmETKwvezakTFBUjGJWWQ7PjGLqIZh0Ag4XrtarKofUd1VZhPGXluWHJYPPDSoMTxbmayiOuKg1g2eSTBgPcb2EC1f9sVMEdQ+pOEKPiJgeEWGxHwrRWU5oMISFISxWtQ6p8rK+68qG1HRVTfoIJQkFfRRrLhh2Me1wzsw5MiVnxXYw7NKAeZOJgC/uJhBYtvx7PylyOj1znvdqfonLq/+CUruliObVkTwIKRQgh0KcFt/884w1pM6Qv2DR9B5lv9MJi880OPmTGAWWB5bZAmjZN70o+3WymLd39LtLkvo3D+whMrDPC3xiTVY4qGEOlFYIkzo2BxXhU81hirs+AjNN0MkG0BHwkbvfbdjJ1zEvDg79Jo6Cw1YG1g7/ZNNn9z1ueQqcsi7MJXDy2qgsHnq3VVZRZvUsQahYtFo4z5WQufqcr4DDF9+Sl9k+D8AOvLsSgJO+jWy8JUD+aGD1PkmfMn6ftvGPFPvwN0WVJjjhq0FwABJod1IJtrfj8uq973PvVigbsvAitAw/vRjHlYgcP0kZVenUXaUVp6mhel4iaXXJkucoVDv9swb2zqhlT+MDkscxE0FyeNyO3X1Ixg1NGK5lEInXovMfh2onMXkUS7AFOZDb/9iQXho5CeJ9ThKNWpNoWSD3ju93QkfIKw0UEBoCdP0E60XXqqDDHlA3xOI5L4RdYCChSDgOCI77qCHDoXJu4/0yzgFsiGXKfO+tiTUPSzak2GjYCPiKcuVVaKeeHdQPdrytNOxaT8z/yI+oQOsVjAvvO0xmDb4EzjVIAjOEq1gaoW1t0EkHme/jh08HnyIHXRF414zh/pBhrTkQvKHk4vrsOLC9BNxx8T8NS2C2XdiU7E+IQyWUYa+tttQzTjNnt7LWC9e7pfWUsyKrq42twquxPxr7SGbsfvV1a7wP93fEnYzWZVC6u67gPa1Zj8UgP6AONLhVWHZ9/Sleco3mOW/x0Xhd3sn8IgnfzgKsHO6rqfgj2lYUHJrEtBA0C3Okbh/A0eLeopw+z7TYFXnMIg/Gj+TuXLYD2I9lJUfypOd4riONqU2Vd2X8k/vF7v6m5ba23Lrjqq8fu0HFH7nk17z2Tshz/Jz3S+0aA9a4oDM1AcWaKXNWzLLOZVHsc53inwk4FeqpZ5vr5PhaHcW91ECnWuR6OmR9Y3/KVhKt8DdYdhK/e4xxcdH93pi2XenKsj5Z3LVEyUpuf9V8xpZWyP/aRT85mpTClkMAE+/1NeVFYYmSiB6gkg6+tP4ctL0tPLZvMMnA3/oucglcfkbrBOIVO3E6fNnnDNp/as09e9wMMCnHXz9db2hoLJZ6wkmhU1sGOak6q01Cyf64r/eXCXJKdp7Ft72r8gBeQqBWZBU5qpK2vu1DGhBl+zbTImFj3Cj/CvlNQRYdK2oK/4AZuWwsrlwJ+SdASreBOgMvEVfR1LK7ay4X1I2Nfjb64PFaL0ZqLAuOh/vRAi6Tq6lHgU9eoM5YS8m69/yxDkBehoBj1pOY1t/V+3Uwb5bKojsuImX0i3ZLLJahuNxdT3Kn/g4Kp9r95ncaS1ygnXN9jSPanz2GsfNveFzwXB4wJfUnvMzNBAmqfrCihQ34sTyg7fwmy45ahgTlDz8LqbF1oZQw+6Goor/OxxbgM294ScsB7V+Gwk6dPHEXaoFtLzu+FPjLbmuSr8neSSfwtB5P+9WVSoLscOZiKQCt7aGlFp18/BKkxQmvM5hs8vX+6NO0hcIjrHvsadflz4s7xUqjrYHtPn4C8Ve4OLAu8xdki1ZoHMSLAk9q83qBrhrgSF4j9p1DOMKTdcBc6vGzePMaSRvR8LYkmLBnU7DOr0CYzxmeWSEcNL4H87yeE9qqMAdzHWZ+poQ5QdUCQA3jwMEjHmms8zI+Wx+SONG8cXVKtjgBPzhKAzc2rICvR5fFAKB0nub1gdftYfFxPab0ZRSwH9yx59qr9xuKzIWVoMTkj8C5VUuT/yy1936dEVzUo22lqVN12whkFjsd1o5AlAcvplEXcTVHP6T2SJ/jIOkSBodKcKTNfQHWE3PW89f8QhbRUwow/kXdcUBqgTQw7z1bUIz0tigpihnsTwdjt2VnbdquEfcxaxDdzlZodSK6AsQg4G4D9ysA8f91Qf2Bq7C66Y7nZYxqfIDInFidSS5nd7HRHeN0ySkYyEoseFj5KSUGwkvwFgBLgMHXLkw4zGDB/eSirNVpnSgv4fNnlohB+vhi5c5r+9AyMR/RqM87vTOWC3yK5gwsm9YpK6PpK0TCx2nM8TKZOylbvrJBbZLfSza/YcOZYikZA7WqpEX/WZbtqdU6e7fu42198XZ8hHqI7fFJHJmbsQUUz8gJbR8ZrO58fQmQ2vi8826tWcxly+o802PpRvgMi7nAapSBWKo8ajB/ykvkgC05sD/u65G9dD/emWIKnAXJ6x5CkJ/We38Y6GMYXvFulAMfjO7Ica8w6FeLld+RANuPYv7y95zsWN0AMwHATHJKFCgkAACQHQzMTTG1Eou4wyeAsSZELefgr2d6BorScAwyGzRm3djXxMcb/LOiBHAtkmwCTXsS9xxeqrzEAQo5h7fnz/TS+XVyQ9W78Ru3jVV+cEyYq/nFxBcYcMwibnH0P7fR371wlTi7WpUlE6A3bD2OXmDKjnslfb9scm4JWWtec+FcWUL7f4TF/l/btcW9C1nkbQeWNIeoH32CGLDaQ6xI+L2s61LgZDASZA3U6iB/iPbAuOvqPM7ExFEFlhgEo9XvMxSE/OHPA5i3bqt79YIDPu5ELFB1dyq69mw84l5M6jj7qKlp1izx36MWTz+AVrQYtwsv/RkBDPlRDUodPwRKweAB9qMLxh+xoytgpW+nEOl44vCrD2QJDrMekP2BmY+iBQvRTCMYY7A7/D78/gbmER62y5TFM8qQ9KMYgui79//R+R5BCgZikAVdQhQj4Dpj0EMy2h1S0OGQiqqOduqdRtecNDftgHZQc9c8NS8tQAvRYNJDO3XcOjnc2Xz31Cl22tMver7vaV9GN63nQyVoEVyr97Cf3KrQzp5eJWkcYtna0Smwe9awebziqFeNTWu3HiuYim6VsPZPRYv/HBgHaMpysIoN6u4Jcdlw4alD64DGxqp9tEqLnXVQixh7bMHb0lq6sX2N6OEjt8SNXezliet2tmu2Qa3a4lqWgBeWtLIVaqkW261X6w4s36LRjQTAs1VhrOSh7bIoBNnI1M+1SYtHbmZLZcdsDStax2grk9qpx17Uvf9TxQaEPoaMASSnQDNiC9lxQHPkDLkYSsHVMMiNB4XhPCEvXuyo+UH+pqJFmQZFi0abbgYUK56BBIn0zLSU0DLLmUmRylKadHIZskmsk8uY1jYC2+2AihxGlChh74hjiFJl0Anl9P3iJCunnKavUiUrv/qNvrPOMVXlT+gvV1GuuYP4z12Ue+4hGjxAeegRsSZN0GNPsZo9x3nhhbFeeovT4j2RD76w0KqNuXbfiPTqY6JfPzRgADFokC8dHedISMA9MlIwIioy4BMNWfAIRg7cY6AQxoWgCEanScMmXTo2GTKwOVuz+8jOkCRlREpGyohbvE4ZNJSroVwN5frMugnjJptK588wOeaCaBhm1DmTpIxIGVFx4EjFgS2lIaSG8zScJxkpI1IyUjJSRqRkpFwY8WZt2M8uvZ2KU1vtJnUf3PRDfz405pRI0mPZqnsGIxGbERIMPfoEzUFeZqcZo5mwIWBrGdYosWyRmKqYtkVxv3oz4mMUcyryaKoRjB3ur8CxZzs2KaujfP27wDZOttsJ7XEYNgprFgghR8JynKmErZpxkX4XNgcLItKxHCUARcyGkjiGCpowfrzEOgKRuIaADeKkTbGsrLHSGIORjzEYuaAcPtl8svlkx3UCJysrqwLaWAAjh5HzcHDycLDFfBonU0zNARMRFRlHYeRjbIzByC9ijQDGSy7Oxc/Lfazdl0wRu4zcXgLsBM7YbDXaKrK8N4M1Soly8uAhW9D/8DBRufT5Up4SyQVilv2YSSKRgIjPAyo2v33K633kqanzx3p+2TRKkxzV+Q3PbR19qkc+LgO2HH0/e7An25pkbmgS28p258KPBPjt16/EejwPAq+M3Z143/+5Wkh46vI/ebHLXjnt0cjFmG3p17Yq4OtCFhUyKi6NqigpTDSuGuCIvRiPSeCgYInBnQiJiElIycjhFJRUCGoaBkYmZjZ2bh5eaxYFLhpCjFhx4iVIlAQJhYuHT0CoTbsO5w0aOhi+s+U1GDFuwqRpM2azEJBFuOAdFy1ZdsllV6xYteaqax5514ZNj1XOTfoDO8w/i7TuI5WOD2CtLWhfElBPRwGNwRLgCImISeiR0j9MJHR52SPxMGdZ370wINnye1M64mmFlX6U+gDevfuSx6/yVU/gabjcu1gXF1DhtF+d8VvImaQh+n0EPSdAblZOwy+CnBxOARVOp9LmV2f8dszjYQ34U+SEKfFTDqdUOO1XZ/zmrHPHdPRXPqrEFR4wjXCZ4jDF3QWcUuG0X53x2zGVwkPFDJ7MkyUYFKEL9Yy2kTNztbUf4Ci/eylVdJM5sNqeu5p7xTzKdl+ydnw4YPP+bylDjUFp7ZBC2zT/Lpq0g33DPn7WMXN9mbW1zA/WPOJ/PtmCqQx6g8zJKllWW2Ot7BgvlSj5syQ3DLYp98H9tnnIy173tWr/swsKw0cQmDQ1mX4JbJvYUgZFKRbUEWSlbwE5sl/SjIHCbTeeTXFLREDfMmcWT+67bzNZY8FjGlFWFz6fhKXaPz6nn5fL0UfSVvbSusQnsEQ2+/GseCGXZCIZS9d6C4n1InImklbQXUuESc7CD+fp7J9PR/Q7aNd0LtdVY7FP19y1fjvY6HkQpS3PUoHHyyjs7nO6nijRrCTIZbNTrOB9YR/idI3fC54Jc2H04S79ySTX3TBZk+emeOmLmL1dzX/uOZ2cJG2xPKhjUja+WrGzqZXb32xape9XzmSknsrcW1TWu/cfyK7T1rWuda1rXeta9yZm3BCjyJ80rBTs2HPgL0CgIMFChBovzAQThZtksghTRJoqOhI6kpgzV87CbHPMlWSe+RZYaJHFllgaz5GAy4FQfH/E8jSZIdcbjCazxWo7xEXP60seFIArgRCMoARiSBxFDoWLUWl0BpPFDofDuLz5x9xxEgiFxLXIoXAclUZnMFnsb/mS9MeU/JBpnBlyvcFoMlusthZAHQjAaSCUik8VGp3BZLEPvXIyHIDgoMCchKAEYihciUqjM5gsdqTSZHKFUqXW6A1Gk9li7bZ5DwXyqKfsVFdicq2RlhRoDJYAR0hETEKPlD6vtxKC4R5bJ6dyzy+HoUHx4YC6KC6ddlnVrd7RFmcoap1TKj0P/EcZdTp4ortnIpl1qnqp1QUnDvtWQZE2UvVvopOmIM4G+86hbfnHnJ63rzQlDRNp29KYfh0SquuoCtop9K1r3biB77XLxtFW+EMCj0GThaQ+tELGOZJxrtcVYhs7cSPeoX722FB+JJV8wVS/w3l+yDlrnvl37O3YdTeiuVPPPPfCS6+89r833ubHnA69vnd9LeOHez4ar3NSiki/LtcwiH6UfO4vvOjtWD4ysCjrzhTvCASJ2efXPX/ijmC3qLb2FN+d/Ag6+FZbfJf1HcNZsjvHs+pazJYTqBglVUhbHiKvT7a+ASm3Vyb7Oyl7uN8NvYAIdF6AvPgYphegm3WJd3b/iTvv0VgW6ed54ykkn59IxrHwQt7tRdjlSW8MgVfm4jzGvvL7LEa+8U95hpYLZp1nWdS0JXBEJKRkhy/TjJkyZ8GK0k1woLz9m8aWHUdOhl79ybxb86a/X6PVzOkf1T+oilQbVEm926vYZZnygYt+8arFIp2EeC7FrejR7P8iUJQoitCnD7081HHIepBBpJhXHsRAIDjEUl6hqIdS1EdZ3HjxEyRMHp4qIkXK1GnSZ0ibLmOmRImTJE2WOUvWbNlz5MyVu6y8+crOX6BgocJ5ihQtByEKQTFA9o9ElAkxyapIwLg5iZi0snymramIeU9Vx7JXk3DvXHsNlxv6Nocb6fA7NWREKA4VKkxxZGHDRYwUPkKUqDFiRoueIFGbuVZ2CBGslSvSV1lTezJWdegQrJvzq41IEhGRXUaCY0HknknsSzGG2BRWlaUvflri0lOw3PljHe9EJzvV6c50tnOd70IXu4QQaNWaj+FkmJhScQcqfxVLklYlveQlZlxdh5kYExoABHnFpIX+0lzHmsZ+VVyGTkiqamWKrDDxmGGWAWbwNvJOuc2Ub7xQ52uvsFX1Vd21agpTXUnGHmP02ZNAuMz6UFyzB5T6pVrXJKRgCxDT6NmNg0WUwNCOmw8UUsgiB9c86AJpO2cWcN9QqLZmzw3lGE8jj9HW1JyNWJDUJpyRIR+lgiQnG8NWKzuPehLVGD2reiMeiwm+nga0iD3pi0iH0nwa6ggrmPcqBqe93Y8EQq1qJBSKAbQEGo0QRTBcvp9vRrHdHMCxgR2OIjFJcWD5OmbYhMSE9sCCDD0sRWIcPWClDD9EJUbUa2M3IUy4hDEjSUHLC+3mUNBif0fTQUGL7GR7AwUtkvR2GwUtJ3KTL9XOQEGLl2tbERS0vBpPh4KWZVo8FLQsiAaioGUqTNgFkg8WwdYEmwloBuh0nENPskYMM9l8byTH5j1tFGYvI5EuZB8+tbg8EsSjnSlNYF55aZECGbj1xIu0uWo2XaOavLaKKZMxk+bRmNtza6GA81NXiQ+FVB6KTg5OPqyF+XswO4dK4khfo6C0u2ZICZ65gm3+fM0HUT0HRZGYm3XDOms0Ei1KwwtskRIlR8PFlkgERDdCz+F76oGxah6oid4gmk8ewNaoGoa5aiipQh+IaX8iLobftiq8BjZQOrcFSqhwG8REYbPLwpVDQgSYs5gNlZmw+47JQAJs6MSjOA6l8YCU5aEIOVewWrf/7YAdonqukKw7iaZ15pne9Zy7l/rEH+uLDEkKu/oCAmISRt0YWf17Lnhq3J9jMCO5qSjP/kP1HD5wZuvdS5Ku3ZGnQ/94C90gC+9sjZMg7hI2k6giViqztZh4U5l/xzFNOkrQZJTjMqIiURVM20NCF2NCJj846g213nVs9QA66v6Gjqoy6AgVsRrM8WZoOhUimWxpKRakNKU8Uv4kxpBdKV0hHMnGC1OEnGyoDCztziQdIH/XlvYFivjnhari11orlFgzrFhZSkE1B4p0ttWMw9CLJpmx6HbRMHOGociXnVkPn+xIWFN9b0+EBYX9tYKiQsLEJCyl1H1ErK2aL7Xsta3eQbJxGRMK0SYJ5EtVjcsl2HxCsm5S6Qvzo/n1dkSneTaffhLKc43qyFU4aq9tNsiSYr5E7vcWbCxvbhwjQU9vUMkJ0eaPKsOEDPmtTf1MZpXKIMiIvkOLOPlsVREPDjpuTkY2I5uRydgNQ0VZ/liS90lmXtT6SgLVkGG+fGUNgZE8qNiyYEyWJdmSD/kI8u3YbuxgKuqN5NL70TqIS9q7q6Gqxhrfz60oioFoN+vwSsYP6RinqSW5lw1WYN9LE8GTkhQFFGOoK1NtsDg8QhiuH5uSVZ6EuinEJGpjsh3TSuYrXYi5DjUCMmZKpUkJl7nEzJLFR9eN4pGaI1+/w0NrjAPQ4qe/9ks/9qt/4vu+5fUp38vG93zTV37BR8Qg+sfxR3akey/uM5/yhLfnshc51xmO+/TSupMd52jCgZU2u8lFyqdn2vkNLLn6lS1/aza1gbWtdmUrXu9alljRokISV1zvi1L+Y7iWQMz8l2i8sUYdcZBUpSCZEYQebGLjiiF4eIEFOsvO2XaZL7nQWQ6ZstEKE97tEudabK7JRhpumzWWmC2g2T4VxeqGmM4pV3H5ZJdWUmGqlkLZShFT+FekfGWlBEJYsP2HPMO06D80/UOJ0E0zlRRyD9WUU8JkUokmgg7qKCOHNMfQA5WabbJIoZo630DJ6isrvzVNNVBbtZVVXG8tJSoqShOqN0Lo4AnEntVEX47yxdQRB0lVYvHEFFVzuvBIaOTxWpkiTUhNkO2zhYU0u2xUn6RGlYrFrJE3okeLWhVSrunRokaZAtmEIwRfjzqJk/l6mQmU7lOYxqEI1oyaLw6Hw+FQFEVRFEEQBEGwWCwWi8VgMBgMJPqhkvuhNmcjtLIWZmZmJEkCAKCqqioiIpW1HJuZmZlZ7kqTSJIEAEBVVVVERG5EkiRJkiRJkiRJkiRJkgAAAAAAAAAAAAAAAAAgfpIkSZIkSZIkSZIkSZIEAAAAAAAAAAAMPzH7JnPKhO1JnTxJyVFDh8iRLlmcaKPHPIlApvlnvFeNSjFW43uuY1tt7vJyMzYvie56minobFVVSliP1wCPPd4eTwchIQFBCVaskiRJAADDB04HrCmPLOJ4YwkRUVCKkF4F6Vca/odVo3q1qlYsYpUxPZpUybimS4O4PGHUIYPgwcoqcQJsmKGOWJQ1LvzjE/sLRX7frlapmNUm9GlRrcQNPZpUKhAhgP+AhwTDh5VlInV05N1kieHDhh7ZBEwrmTUpIqTJeQOS6pXJt8aUAW1qlSnWq0VCkSgh2IsADU4AO6tE8WJFjfgJ/v0YHkyoYNjAiw0dOAJQpGHgE4/32qfx+NMEfN7s6x0/KP2RHeqUyZGGA0hkSYIAYWKeACR6ZPCpIUUAG1pkiPFigUAEigR6BRoP2NerK8uKd2/blB05X70/dnwQr0VivNbvt+myqEbie6JnNdL/3X2/RiO0shZmZmYkSQIAIA+TJAGQ+rmg1hBhCs5MhwQDSLHShjgSyPay20szwMOcRVsU1ligYPM/9stH2wDrcCfMv84c+XxTApJrHc4U9uXjbqJ/4DpAlDF3+XbAqDX8bHrUXcLISIuH2Gpl2TuvhQ7kQZ/YKiuyCVzEgSwdYitdjsHaC30eYitcVGOkQjVDbLnzcrRIqGyILHNV+YriiTYNsaX04EegtXDQEpnMT5VKc5aUSgZfBV7N9e8LF6mxaLHitZYoVbKWmmpm7GaXaD2w2ERx7iv2+qIShBtn/nM2b6j2ehFgaUYdjUrY57FDRATDV81qVDmqUI4Uc0QJNYYrvMdgkVGSEcDEGChcQLmgrsKkXdBWZTKTYEgArAbGRKZAY04SIafJThNkhZrsIolAlAgWHZgpTpRdLFE7iVrJHAyAPi4ckpDphxa6mIy0bqJWVGCeKv4w08vifjJrtuw5InPmyZuvhtxRuRA0J1QAidiQNKU8L9aVYe+mquiStPLEyMHHQl4IEqRN2eG0y+2A25SSxKI+rsyFdefZ8yKEo0dJTnTeC5joDOeXJT6Nyv6bo2ayXvrlXvqhz/N++WLP8loehf7adNePR39WU05p1P4I82Fs6Q/Hy1pdNqLbz7XsR+5EsY8sKLP7gc/roZidHtq8mG31IX2/vrwJZoG/HjcNsIAXOL450A/68hngj3wm+L32QMXTfq2ng2vfZJIUNJGOus2eNqxGQJefzlvEe+hCyFRM7tiZ+EzdjAOtE/E5rEM8EO1Hdc1meG/Wwv7NZ4HJdBoN1bjQ6uK8+Lm0dTY+bobUE8Fs9UwwAPrvS5aj1hmmgw5rT2dyoJmWw95mYsFOmsT8Zt/ENzLOCwAb/CrFjtQzgI9RDbCJfBrwa3oizd8yoG+czX0LfRm6OJmsPmWUNYb9M58FzGEG0PM3N/D/idm2Mq25r9pHWopbtYWfOhoxyxJdNUT9FI9M4+JVUFaoDEGq5ESvCpIWVbm4hTT1iRoVJe1KilB82740Q5J4USYKNNZInoXR0ogs0byRJOYym1lnF6NS9y0XzR31DVhYdkRagI5nvupENhPzqPhHM65GmFHFpFRNm4lcrif5G5jLNXwzpilSiWC8BdQdAgUrBAQzuR4wSXe8hZf1qd5E6ZpAJ4aESb4vp/iZJtQaZ2PTesY0R6fCqObIBd6MOMYZU1/twYU9K6bkPB02vO7mId/c83ouocMwXG1o1cEolavplFdzCHXsHyYUXNZawYZTyihmnd9mEeoMwQxTs7I6WeqpBnFjV7QbIF2KfoKSjIgRQkHDwlSiqvlfeiH0yMgZMWHHkTM1H75+4C9IlOliJZhpmRRpMqyjVWC7IrvscUSpE8pVOe8vF11z038aPPRYsxYftGrXuxUfS0VnV/zmbKHvCj8jUayxVBhgxfv0ptcLpn/E9GRqGv64GuBEJ3rLPobOjJxybhWdon6kBnEdO+Pc580IaOsDywPaseJCg6jirRibhgk2vnh0mCSM4KIRrYDsGTSFEJ8xplEbwsAq+HLC3hxG68JW32g5se3sLFIQiRJDU0YDN2U3ayYWO5s7UG8SDB2Ehxere9GxxQKz1k/Jm47VPaqnid0eZHmxPTh+r9B09gyp+Im1jZ4YRhhiFB/D+2IRGFvUzoqwqBztt8JUYDsWKjNePU0+OW3ywYBnSFWsy03WiXv/OUuiI4tC2CI3AB4psc0DKkqkFAQ9/eB6fNziO4R2RBQLU9kYyZwtzjD6/EkRpixNNoSECZGhPMgfZ4yxZHwadyl1diTrB5ITUKA3FO640OyEDSnJYnq9w+x8lJJcq8fYQsdz9vJDaq/wi0guTBEV1D23c4B3bIiKHSDIByjg78CNwPKM15E5zT6LbPfPlt0vHZ/lCmeVdb2L3N41s2X9v+mdqdM31ow0oY+a5cXHzj4h23ubNxMNn1nhZp7FfZFz3Wv0/FDh/OQsp6em/5P/vbnXF+xa6NeFdG+6efs/d5acnc497NEj2mcVvOjIyw6+rvRNN989/5Gjn3Lwi3Z+zabvyv+x7T+x5ye0P1X5U5d+ZvfP5f1O8+w34mPwpfiv4Gm4JMBtBZxdFi6uDXFAAQK1TmPOsxBai0/kd6m6Sk+H9v983jAGGS+c8JhOm86aVcz9OSdfkC+iLhDfyXtHcTFpibpUsZx5af+loiveKz4r+DXsVejVpdcz1iPWp96g3Yy4XXpXcX/j/v9ezkPwkPquYiN685nHHm1/af5j3kbHFf+V8DX8uui6o0nSJG0OtUraJO34jRWv5b+edc/VueE99v13P6j24MGOB6f1fPzRJx+XR9ZQPUStz0s4/n8BZLdNw5kk8fihdcwFfxjKuZliqK+2Xa3/BOfSGQA3XOlLQhSz++aLg1mX4h9bddqwOJKLz/7ZB+65Me+/tdcpMGDYbn0OeFT7lK8pKLZOTA3dAz0HXARc6vY2O/a4LR0ug9n0fbBrYPqzRQ3yFKCdudkA1iaBX1p571ueGNgcueqVTLkBAW66KJRt2AJ4yRvuWAMSsVuebCvNES3MWJ4cGaMQJH4AAQJBdlpVPxp3XBGNOyz7G7dfKjzb1Q81xIQKR/s0bpNt49ZqqGErSY8KSkaRhsZ2Qf72ufjXDtVe2C8WGZ7qvyvLy/VVPltz3ZpuJwW1hy5H1+9P8x/ed8+tjJKtAo8nN2W5vPQts8v8CqJoSkjZXSQRB4hDxGlCRigJDWEgsogQkS94XW2rfkf9s0ae6d0BrM2DrxKVubPy5RLDwwBVKe6kU4SEwJ+zhwhCnfL/FHIZjzT7v8PPwnL26a++RjgIO3E7gF8dTIwymvD+SPjRTnoMX5qelA5PLVD/FAz7imdqoTs9T2ZXq/P4I4Kdy8Nu0+ZrwWXFNtilKlr0hYqumqpuUUFLxv2pkGANfU/eOejIyGd5bbb9WK/+uUSJ1vKbDc5PqDFhnbSf87WV9AHngkxwD+8lhcaLVGUP49AFeBweTSfqqi5F31WftN7k7a4rfR1eRN3X3Upbfd93pXRt8X7i6AOfwtFjyJQZc0O4GsaNS/eNFSxEqEAB0Qkyy2xzzJWpX5PN1tsg30Z5Cvxsn/0O2OuUCqf9YsAlt9SodcP17HLTS6+89sxXO3SY6k4BeE53Pvd0NZTubpZXc6gMlkYgBSGuMYchCeRu0GabS9AdLNWt52D4otlGsjm2xd3YDn8z20s5GTvgQ7Oj1LWxU1lA/7vObQOUEYC2OECOAcu9BWCt64AlDwaLNgAsCpR+S5baTGpm55Emeqly8ikJWYpDjzL4raqTufMgoTw8EXoE7pvsNnsQ6y3Wqd9AyxlwsNHUVdTrsdm0SvrflWTdNb+MmUBJBAEQaj+ogpCg66vfMtpBdjMwIlCrCb3CwqrGRpMjPZdskk2KCQIkApKtxIdPoFEYxXT1kk2lqXYwjeYPvy6uoE7ZMaPwzKTuLY0WE0Ah/qKoPZARVHPezHc4CGBN0ByQIESbun5x2jEKGejLKKWaW0sv1uJp67CZpXZX/k0ib+Nmdsib5wy8AYeHZp9cm5HTCfFlN2E1Ghg1hoQnNhhvGTG8WUO/nb1Jb5fZFjvbvgMrAht9wSMs2jnbYuWXnvLlhY/p+HTWmqjCzNnQDVvatpPrmYix+/wq9nPl8Sl2fPkYY4cz6eXU21lpzT02IWPMlUBye7ajkdPAixObr5fe0qLH3HWJgwhja8dtaZHIPIjMsyLvzOWlEIKHZDEHXE14SUWYLSVgZCA0DypgcuR+GZKRXLKbbP3SLOwo6qOGu4gKAyzMemXIJwrHdlFovVOhE+5B7Neg97YjTXqdCManGpTDJ8E2rOHa5G8Yx/7nTkNDU58PpDbyC0S0x8mGguWuLBAbvwf4ky9M/AqB/RM5EpaSWH6+NimOXbw8hwVqj/2YVCnNjtLFlOSlstRGERlaBAfiMA+1kAYOeIedDd7cI2xbkqjoVGHbuvqTqmY8d2+YigfT/RFxYNWgbPyUh8q7y34hRfehOvIfbLrfyNWzklQwqz//I0xvc1lZrQLTTK7uVOlR24Nc0XkNU72Vp+sVmiX417PB+mKfzCWK+0C0exUWeH6pLaXiW6ExEmJciGEJcrzRtal9uf60nXuCZciZ0idrWsu0nqQfuyD/FCJ2G/tL1wqHXo5iirVzKnSxiAVawC+cTC97wfqV6Gj2oy46hV9wMxdNF9KgZhgajdkUozwPPLmLUB7LEPpQnVL3uAATbbWd9T0Gke8R43X5ODOjQNkBCiE9A76RNcJbEK4d1m0Yp7qUy2owqwO1Kp+qD/hkolKdSY2iE1rrkclKKnps5nfNuvwYAhJO8dM3Sdu4glOxUd0yX2qKWDgYQD6n7uPXqSetO1BrBJWj2fEjpCdgcEY/LJCwpOI6n1Mgj244PvFwdds8zcBirX0svsQ+WUYi64B0xwT6GFY31a1tZLNxkhCxQjUdXw95uNGTzug1iZDZkgZygzdpzgebC3YraJ19YndCxTKNWlt7zWC3ga/d1w2SbNYH+cJg9oDaY1SzTOwo3VCXEx+OCod5HiZowbYDbrNLRUPMt4ggHeXVSwTVtJ4p1jb5VFHwyjVTi9E1xcQOpHVmAx5qwZzjSP3IxEcxl2GaU9A8U5qHKMkVX4qTePdMa40ZKB2qFri/pY+c8SLe5WdG3anQTwfv8yFV+57ruL0r3FQLrG/vbXkO58kEdVf59vBPb+gMXUFPyyiYxxKEUIAe52ZlIkI9UVbNRuhYreO5r8WH+/VXCJd+jIWdiWey8MxBh9aV4lTkGl8stBnKLkERHRTRYmqbWp+5pZp6V4+0p7DU2ehy1kIowhKIKlonto54r8uqXKgNwnu1JGfV0znxiZ9J0zjF2BzUP7VyGts95DQUILVz12HERyoa8I78Tw5QGCiEEkwn7TA7Bpxq+XmmXoJ8hd+npBtShkq8ipG3rj/mrtuKYsUAUEv2rVrMdHkSW3lUPc/kc9EN6IN45GlLjUcX+ujgzLvIWILIxJU6pjnaO4TQRz/5i+lIEEqs//LUCvM2Muy+lU0CfkhrJY1uhitEoW5ywz4d+sU4mtOOtjmstOUNrxt3ROqx4VHn0U5BxGGl7QlJBSLAb+iivGxwHqS1/W/k0CjlbtBwEeTbGdejb6usYkAiiXy2Hsd+3/UxQy35VVMf9wcx48W/GQ7N/0NiyhcPyDH4yELoOR22XJu0I/kCRNZM5jsdQi90TPHxjDHRXREcpNvZ/7d4N0fqN7osr+D3CiNbVmFGWoti7vIJwFwUY3V4hNqchCTeGgWc6selKL0UsRPII8LIdIQbyrFvV3Gdx0ZBLUtPWOfjT802eHrGNmZ5ZrqOAqt7wh5rICFujOKOdXT1QHKou5LlzHq0uRKKKFE3FxrR5/Q8n3Rt6FugO7KwmuZUkMaa+ltvf1Plnhkb5jtfegYtyTyWEiUopoeXnG7yPFW50gzGzdSknXitMaXHJ9SkvxJc/VWAE1c5cY0T6O7ttf6G6X6mNaxzaa/T7Rl+w3fjRDOGcxflaOS8CzSx7j+cKV6RcNbuSY39gMdyaU558rOKSU7MogfSCsmjqWagHjOIvN2q3yxTLyB52OTaNNmNqWc5E7VhjEOXNYMQAUlQloFf7slEJiuYllzGgb+vFwq7ta8Sl/XPmfxOKn/PjNCxPoiwr589oeWWGn33rVp/UgLvpzPyqeVr/ni2ZChNCq1g4/3Qy98splbAIN24gH8NjbBwL/8WwtCI/boQirycHQqdNjAlqTqTVRnMYl4psGAIJr7RIXynCWcfti57VYtNBqqABwoPTXPmSa7kC7WtR5jAg5zi21vB2da+EsB9tJ9iiCu66wf7PRDmJv6gnJr7iRCfiZ9lXAL56lCvXzo4BxNa4z0TR+pVq4jqpX7gw4RLp9KcmsQCbHyvc1SsigiIxNkaBPCldmcSZV1zpzV8nugHXKnnIaBOzTHDgA4AXBv3iMQ+X3jEVfbjlt0afvfVemzci7Y7fvsldyYPZNqhtL1bqx+0ed2xr/+QCmEEr+yfcUwizDdxvr59cYEIXHf6Zrhp5m12c2vWDAdYgbKx70coOveo+DtjaATLnXDv9KP3Gu/6tRttye0JEcqON5rGTXjz7GPGmd3b8eeEKCrCss6NElV02qFNvpqKVzk5EzhZK1DJlzvI7i1lfjqz5ZKj723Cgn4CVA489lfkzHlKNo+G+selhYuPuQ/t/3Mx293vqHDwLjy10sPSufPnyC9IGLAPZOKbHpDzZO/+W5B1wh92j/P1yhWMl2klZgBCn9o9sFBKru6aBrdF49xgNAxS12RqNBDU5KyoARszEM11GYjwA7XJJtypJ7sAfyP6OC8ZyuqjWWW/0x27fwCPM/XNANjWPRtAnGeePTWg8os+f2YESJC0ula19v9GHARn2S7RWpIRZz5E9v1vq2t9xT7JYaQEaUz68NXoWzVeGu2S9vw/UrEEwLye1L32xm3cdr7+5CEW9Rf4FZ+oVfofbhTnSDWud+jfIeANulGXOXL/256Rnu+fjbQA6qQ0389mmHt7pnrAX4DKXjpzV545VyjB6BUk5G5HnHUTX3SutFg2/yp3JnNYPHXUnEGhVDZRJLl9RKYpkVJCy6gzd9BB2I+C1YCLY8nffjeWHLC0qryN6jXIF5xLVpyoVJWCYfYl1T2rr9y6umLY+myTmWT2U9CpaifKyh6lfL7XeBsNzB+PiC5831RqvTivBp83TmpGal7CZs9Tv/hqkJ4w7yndALYsF1CZgs+ARh5+fnbk7C/PRj5fuXHk1n9469ha4Ga63LIuDSd/8518Br5Lq5r7uHMm+Zxz/vo+AkWZy6oJYNQ8qavcupZrsH2xudGwKpev1zVdGoofWDrrtOc4n25urWPtSrbfkOMQEEOqbGYWh51vDJ55ylxhNlhaVSV0JA1+K35PH54BUaP3InDZxjxtxeUP/9w12u5x3Vx+P/9Z9bUSwR/Lfn3qmF9WE9fTAbXlnLTvRC/se/vT2uFMH5VXyVrAG3Wxj9pLenXfwIQTsGWUEwLSrExWZsddLtiQ1qBa38JNl80pg3uPcDYg8qDq0HZX4p79VqYttVt04ZzhjGzIJ3vUGBW9A8I+uJ237cyWmpCjEs807HV9MpmsTx/DVx6xUWy7ZGPxY4NwYCUY58bpVf+lseTvvhWW/8WVafPTOsPWlTUjq2Cue1YvrK4YbAuBeN2+PEZ//yNgBy+tHx453P6iRWs1O2VSL35pn05AtMbP9D4JfWgoeGI2Fzz7wDiVNyzRtDGRzQIBsqmdUQYHTCtw772bgy9O/k66ee5F15WT0oT5ezQFj2Zx74OSqROjzZpWLMrAF6Kq24iD+TqV0/O0sAe8vfzctznm5e3669s4GQXdML60D5VWxiAyheYYxt75iPGD4NaB44b6y1/ktB/7KKd6zrp42b5gUWOWtCcyCvB0ibgWJj7ut9oeXSPitubqDNd/+gZs/TRgRDayCWxbrgBqS9DXzGxtbPvh5LOV2/nioel0nW4qPW0o//bKs5NtP9g0ggp/3O28+gCF+W/UEiRqhTGwfdfrszpw1026cc3x+h97iF6dnqccWPsdWXf9SOeU7eR89LnjW6Uz0bvT69RC/MD8/Ws30XH+6LqbeePNLusZ19Tg58IWv71m/w08z+ltBAR9VKgW7yyP15fjQnHx6RGp/6u7JzVREop7GfdMw9nX7ONMfGWjPRsjCBd85//SI4hNWdmqBYJMb0zxa+iHbib1qF8R1U9JOx5ChXx4zc85E1QT/gMfBKGldREoWqrtkpVo54h9g7/1o3Z4eQsMG9GFDwbHEXDZTT7BkJ5USChlBuxJL9qOLPtKh6tfbsVHSnIi6UxlOJ68bwIRIO0omQ5NRrQeqGUkn6n5aLbbHsphm6OTerIbaQQ99vQEyUXsJLA7itxWDMWQkbFxtBxf8MhNPsnXkme0kIcPs7mcRIcC1GSLlH8D3ZFJ60mV6nnjJ4VSTD6ETiVOBblxK6reIap1a6yKDpd0D5gPS13Wg8wWjsdaqtlPTlMuMer82Bwkv1qQnd1Aw+ux6biIDJmE712oLu9quafce9jFkcVWJTYeAaXlchMRJwpxmZwCVJbm6xiMSTESCpsfW8qtZufKrB//PNSX11yMXylV45abC+U5lhz8Rb2ecKVZTvep0JGxAOhrWNn7uz9tM1pPTBtt9K+mblabv4bOK9lHnAhbDifgYamHoovb1LgrxQrc5TZVMSLNnQgPp1weD9tLTlaXsTsCgGa/5UlLmfXcbLnVk+2WQiMBm+Lu6LsAqOzMpIsHXlRFZPTJLHLCFb0ef9GSkyNvLsQtq0vxKy3FQLW//+s2w5aJiQrbj//sFk7ENldznpymZHdbc6IV2LF6iVTalkkxvzhxSiBDI9oH9GSoG6fCeIEAArLFp46ecliX32akmDpQLCTHBRF+8vE9KIfCZd0DmUv6hcSynKCONCOeVg7PrJswNn24OxTLr0IX1D0xVLydntT+99RiKajC41KDd89PV7SbLrzmNefLLCLClK4Mv2CR5chbCvCLxSrCdEsmYJ3tqdO7YVqNZ8SpyyajckwkXm69ufiOqa6jlGnEkczgkzcXxGBHibw4BVaQujoYhT5DXnSCgAPwHR94ven8wGaPSyEZ2LI0QGUvjnsbDXvOASFk4yL47n03DYbDGymZmto4oq7zxF6tqzMnT9uJEmb0csSj1T8vfKetz0mhFCTGFhJeLvxvF2U6qiQeVyZck+xs8SRgv4UcowELxWysn/ysEDbTE0brzz72PmWHCndZUYRb6VArLf1VB2cdgAamYi6O1N4MtSsVHQCpzbCm/gWGo+0nyAfHl5DL/JTH9UuQ+Mu9582pCXsPbo8s2yXjx0Xl7z5MA5qgpl4G0v2qObSqxjl9zG9/ai0vu7QpCxfLpLL3LAV2HTnWqZHkH11ml6n6sNnlrvR+/3x5RkF2bSo+UUjO2Dfi23Wko1OVqei+yQcLz1UqFtYlVYabItV4ud4wJfdxbHeYXT+lyV9az6sdHB5UNzXmK0921JjGUom5RIQanVPfqik+WitnAki2+BT61PCOBTwlHkvYTeD4dC3hdxzpONfdCCQOg+SlFr1DPTLsti69Z1E85eQaeWbFqM95WnDnEmt08RSqJgFbnTu0kBH9V8T9tI+l0VghDShKaJUw5YeDg8VmOjOhtcjPCnx0YEF847tOiAx2H09HW3nQdbKpemPFPjhZChOv1n9xMCvpH2Wvp3t3wr94nvmLtZphb7L4fxRnDnueSvwHz63/YrXF1nz7n3up/r2+wy7Jfs48vxH/c3vJ/TsEQF2sBq/Yszeankdx6B3+GHEABt8B57Q8f9hfYF4ofW/gLxiL2uyHTPdD4pqjWIN/AYs6+LRPodCeQDnA8BQdWMiWrDEn8t7/m+yHznWPRVsvgbikEs4IwzkAQ51vJHRn+jChDersvrN0GCAbN9aALcu3XThnBH1z6pKrmrKSa69UfVVDVbLmBIKKzSaUNSNlVSBSWp9yJKRQeMQF6tD5prH8pzM9ZT/erddz9TE8rm7X4dSa995/OMoj6vXxb4/cstFg1xZ0/18XHO3NtWQQBmVi5GJTeXFekxw7nZOZNN4kB9wXYNumcrBtU9xqz53zBAxLkmuw3WBCPQpSd2y/CtGGOlij8ziC2F+D2JAf04HFgiuOANJAaIApD1//PABrykKFVKmVxGXcurrg0YPy1pILqZqhXcUTB/fIayvz0yuoMaYtTJfRLejIFG50+iHuDrey4e0hycGJo6FmfW1dmHdPZ2AnyP3kOqb9AqwdlnEEfRQBO0rwniT2vJMdr/RG6q7WFdlezSvaenWjDlXslRFjIp+hEO4Ri+f3XjyT/O13WN3epXnlHSowFw99NV/BffuzyftqcXDw68UK3s8/68VqfmiwsKuFYXdlhWHf1VJoyFbGzpUrDLsMMD1Jeoj+o8dHdjl29wd8D06JvndlCwvro3U4OklZGc/k6bEYPfdCrfbWewqz+b5CfamUFdPdcbXGgkuxnx4GG52PfpRVO2tTumaL58qa4DxxO5JTSmMxdSdxRdpBLb82kaSkkZGFZfEsai2cK7UivmOtrpl9nlVjuV2Uvyg31E4rvezFjnUZ+BNiXc3qZwpQFnLabx1WfU/zUFnZrxo2hqQBYtAioDLAca55JKuYs1FetEXRcvSxlJRmDuOYWMLpak8W41oCZ2f38j/aNVwcMbf9yfYwmmyCZKzDLxa0VX3wQRXYUpy2hOnuTd398AQ5rHXjToGx8kZW5exu9bKrxGJSl5w38/+Zt68sEjSG0Ko2Kw3vt1sqPv6ormsopU3I6UxLZR5v4adg1TC+KEyDErA620Tgtr/U0/4fz/VZf54XyHTu+lxedUkrpvTV5LMdty89aFzSlJTOPZCZa3BeNHMlmqqlvIPbmY41+bQ+sbb60ufyE+ez2pB0NYPDMXQQRWJjl2PgMGjqDmTWCkObiFdSKJhCXTyLbXRMIb4jY5UViSDW2Xgjq3J+t+byvkxLjaZkwCz4d8FeXyRoCKNXPTEY3m+zVH76cV23VSp4p7LrbKrTQ5Mc3rJxp6BwBVsaxReFa9DJ7OOtIlFKq4DTKUplHrfwQRdsfLW8n382eF96vlrURTVQhkYzfeeVVVGG0RZyrV75KjWDtr6TfS6/Qmd+WeZ0XXq25nOZ37EU8fHg/C4DEKuNHjHuIham08eDczb/eFCK2O9Yzqdl6dImm9pOCAvrnoY4ZBSXGtNmL8xfAOfMWisP8uEKMR6GNHVVV/6x4AFT9rlGkq2DfJLWVKWl6Q8h3NNY2E6INl0H0qWaT3Oq+gvgWJBnJHEe7IwBwHM+9qSg5KIqk9HSrBWgXvcP/B5EgxHEqSwELziECUdESPmF0ZiAT+IvYIMMiaGbeEKYJew6z1MUn0vmtwuxESpBxin/17MxZDWOhFNUJrCFA0RTPWW1fPI45kpy4b14Iv0lDdx7H1x/OwI23770DYJOj5Z6BIKGotNgLXdJjW11M9dsRC8TdFqPaHL5hRMY1nY2wo5nJWP9UL5CHR+PzC6MxsYVhBFybNkrNpWa6asiTfVKdt5siTZvXBL7WynRO0e4k/+A/xRd5p0NsBNZPKw/Dx8cUqqIxniIOTYevWbmk02r0ryZzZG+NIJ3rgC7aYiwVPMHXogH0NkqMlk3TT1TzIkjHzXDnBQhvNlpw/PqqyB9n+BCYViEQ9XRVaOIQzsz3XJ31GSUtP+D2qv6x+CjfUAwsPXkx2DrKx9/ADbue1dbV65Z0AaFJ3rjX3AclOUDvvbrr8uSXz/Rsr78lqZ//BBe+97Hee7d+Xuf5s81FKhhWk8RqWV7r1miNM/VpHzYUiffXNaVSapwg3bcnmPxaCGSRMtyf/Slnv3l8NL/sWcnHHIv3crwuHAxw+Pq8YPSZWa3e5nPHYtlox1y3vUsMUNDg5/RlMfVaeB8toqb0MwVhZ8rygS3nKQbXU64jciPdrieELmeiN99ugpd2HIY6HXtStnXBdqc9c/S+8dSPzGbpVz/6DOxvuK5eGBUlLKiTwfGSqHuXPk1Q8mm0YSMa/rysnW9etNkNBbrBq+3mFpx64G2Ytt5XZdfqr13D1+ln+n3tKy+uZSruPcABOJdPbb+4ZalwIHoOcD44+wbA4eUo+Ojdp1fD48OA9b/dwvDP74w1DoE4lYDArApUQUCK7Zb0MHjdQiEvHYVBMJ2niAU8DqGArsmu07Dm/jwocCHP9xBStef3gu/JqzEtm3l5XfLTj/TAQyo040+Gvj1WsWUr/d9NZUBT1271XwFNggOz69Dq6zeR61dM1PuJvDo23BNmX2PhrtWgXpLGQyOvToudD+QjPbVgKe33Kbg0ZvwY703ekHR3NmJ0QkQ7yuOrEGoSjEvNrJKrVKpPAlu2DgzNjq2wYmm0aLhNGp0NJUKlxQN/usXnooAmkxRxMJg8AA7MjMSZ0XLxzMQ8uv3v4Lh5i0V7BN1aDJZm8DE036FJuKF/PNbdJwTZjSZWoGkosWfQmMpLCAG0bNxTqd7sVPgG2YC3MyEUWClT4PUt4L17Oe/FEYdcFFiH79zjFDp1jHqBONTrrLtO+PtOocxWoky2gJB/9llZWt+ojW03ottecSoV/2SjdGeLqp+yBOZ/GJb79EaND+pmeD7V8o3Unp7UzbKy0VWuSTLtXkQYmFBs+6WRnNLpyOZ1uu0t8cyvN1/maz+t7r23weuu7xpPnBybByCzfSHXJ/Z66YICyvZp7gK/me16vq6qix3SlDS5SCZcSTVpnOJZXhCGYlI0BhrIlctdiTP2EvyTw4JcsvW1Y2s4frevZrNTc3e3l6RUS7j9eZZPZMVT1MHBlKfVlSQTDKNVzF+u4CoyOVv9mf21w3UZXy1P8I13bXYNcO148uML62ujx/kgt/zBfqx0+u463OYN3xyinPPC96uPJGc8HBOJCzpnAjUuRFBh0Xi+wg3HKyo4zXEMpXsdJn0bBBnO2N7pt3X79pg+ZRkvgwb1wf1pJSI2v2pUWWu8kSMMiV4SLXDZGITzeQcGJwbJl/m7E6zuz5qRx4iMVYSD77UV14qkF011ciuXcqvrFzOz7lWYzIy7E3fypHTYdUMRmRNPoPDLqkaJqOW8Z0DZHzhes7V5u1PUJ7PES7UB3sEigFOzuT3va4nq7aeVZNYytYOo1PvLzSegEAQpQIUL0hmw+19pVU+rq9TbrzS9S7v/J3K0X/4RQSXnCNlNu2V9Pm7puTKFWlKJiM6nESI3OM28KtECiuNT4gullJw1j5oBEbJaL13fmhg9lxAZ5eflyRVJpPk8UhR4WRipI/bIAoqlkUoY5NiFTICyhb6NkJz50eIMxonyQ6Wj4SuWBba3wN3+bb7wM+cgwlslJ87/oO/gSd8Kmjy5PaXsPthBdg2t7qCY//rX7EHPC0RRxAkwodKLjS0dy3U5no5o6Mo0lRWXLdi26IF4APlmb0x4twtuJn9eREkemZCaLg8QUStoNKy4sOCeQgsPhN+aBgUpOR1x4kz2uMZOSisNIVtt3WxvTKDhhPl98eDQth247hUBerZ3ec27t3tf9LV1f/0zt2+ze46KrmtvpHcQcV/yj3a0EBuBfKsoKBz53es/dXXrwfyAicoMZYbEkqODI341X26sEev0p2oSYN4MoVlyel5ajt8PXiTzakJoSeTB3KZnmGxDEQIjIClcQ3caGwiLKg2PJAPiTgVz0o1RVJ5JUlx2dF4YtobO94OtoyeNV4DZulNmOC8NczttJ0PN/2jHwigdwUBbQ6tHI5LCzwdjg0IjGNQEhJ5XMyuBWWLZ4z2Zj3uwIVtr8X9EKoGh9XS6FSdmQBa2SGKg1nMpDOmTuFaZ6qQqo2jS+2QvZ+iwiMp6Xr9Th9pNBKvwuDKGJqB85bqJC4vKZ7BQ0KRPlP4vOQMYEg+tbO1DtEs6AVJtqgplipDh/ty8DEXd/Sgs+OTCBn6aBazEkHISEzAZBl2dOFiAjgRaLqsKTZFjyUnwBAsbEISE4uAkRJweTBsbEQEChGNQCIiItCxIH0HTRtHy7VD9T1BRsIiqNGBRRw7bE5cIr4Uiyunc+jVTSShVZXcLZuGPlPbLbx6LJV3LAgV4IvxxnIlWCQ7OTGBxgNUo1+VH+ep1lcLusdrIbVgywGjo9HBGjpWgWolH3orfzkQfTSpjnK4FHPIkjAUln+UWEr/BcTRI4viRw40IEvJh5F1RwNRmGXfWxWl1F/IZeCbHcHf2xcFQOqBXx/Ur6+0NOIm9uH5pPRqNrqRTWdjGh55YkkVG9UwqUc3Vn3fqKYm5GLo6Lg8OgWZh6ZjEnNRmA/KPq8mNnJD0i6Zi7LtNvxogdw5AgFG6h/XCL12FN0/q28NaAUmsxcE7/phsfMB0yGDlZBeyvRFubWT3NxOkCus0thKkGzhn5qoVBvveVcXmXLhq91sB/Z2f6shK3/2drZj12qBiJTFFrGlG++V61L2gW+kRNmuqDVaB8nXvvfu7ikGwH2SX6OuWXm6e3qeOHR+sJoJhjCWOPHlIAkmMGdKRewstohUsFrPdgy5AKshq4BU6NCwCq3ONRVFePnAF8tiAU8jQcmwKiVLf3Y8V8Au5KmcKJBftVWldLq7e2XZ1pFmsh5ifggGXXiTeCj3ngZPfbije3q6EJnetgXJaiY47yrfkigHjy3RyYT86oNcSlnE3yaavnqaAcen1gzMzZgkD33UCqnyPnDTFMtYdqMu/QNM+JTO9rsmgat/1t0tWYdqYjlY720cKTLlVmf+3eAQfdgBLkMuAZvY5X/fJMkXTd48E4i91SWX9i6uzjFl/a11BH/k/2wO7EY60nZvOA4XLgjLYS8P9zRPASd1bySpMyJI2EgY6hHhxT7YXWo1u+PrZ8a/sduR2jIF+C6DxDIMXonnaLGmiCQNQjGv1OiVUV0OBiMSoyRIv/whAZfsHxvwDQPXXCwaSyL9MGI7ZRR86MjTRE9AIOPRbPfP5oclZ1inUFkCBaschH62qzWg9UGXxfnOEWfgZfOnpFcLm0c3Xrd09u+qgKpuII235nznNWcRV+mbukztvJ9564rQ4U0UlzHcZ5sjXonLFmvQpBVFzw48Ll9KntoJuGhEvmvUNlpQEvN9Jt6y9Mj1JXRgK6u2WE0NxsLuZWrba48geDj5ysRXJ/SvkH5opXn9qzd3mVE0Tde3b302Osb+nJvDGr7DmLUfaI5AAIAAO2BeSTUuD66HDNeijmvwDHei/GoQ3wFQrYMZe/U7LMbVVzz/vfCpG3cBetU6qgDTGtovWQi2Qf7TQyh8N55qiAQy8sImbyK/C8eMSfllxZ3QxB1gS3WgXSI0bBvitzxW9DXuxien9VAjO4llHk3rkPCODF1CkaMMHPDOdFNXzb26v7iWz3ENrOJOfjXX8ye5jh+33cAldMFa6nzhlNSJ4uxfn1jysaNKvoQv5JsavtYPOcGi+aHMMmwtLk0BjvHHuRxUj8xrBOEoIGXA4zm4hki5E1dwHRr5O1xgHmXxgZhuidCoGuK3XH4Ut92EunMSvCfOR6kOvt+H6c2taYbxu2Lt+MDE4hMlEL7QzGxgrpkJiplZngrugGKuh9+5Dnn8HY7Fe+N9PAD9th/5aW5AD2d28cHtstXIkVs5kDKtJVNycA0ZsR24NWXHqNJSQwIyqjV4mLgDYrkO9tpalKYycEwZgvGTyUBU69j9G6oIwavS2t/8AGQ7YfMXix33uiIgGuRaUHA3am1dENUuGLR26p1RMK3Dvbma1pCftD0OPkXRuAdnZ8ikYq12eWG+34NApz3ikNGegPJiw3ZCVWK7lVRwNZelKWEy9nTqo3UEWOqPBAepphQrVLpq4sCuHJ2vROXWfwcxuF7XP63lrXlAtIY7+fJqHX/aZ9DdunWMkq2hYFC+MupnNyzfgOQIVR0gU1Urq4HzJ0vQkyxPyXmlyNhA6a/y4ZXwry553V/MWxDTvPhLUS20u7F+rcbecWAY1s+aEoJFaL0/Va4yHOadcDErULDGXMNjOS66cRaAjeNfdiwGjmFbnqb/IuBz36D6EN/LR/iwi57wYRd9/jGGsDGthfEfEvnmpAMIm3cxD5cpN7os5rCdUL2qR9OMlWpOFOW+hXnn+yh8MB4fth3aGbYWv0vLjEnmA8rR2ulo8O0D/i+EoiS32rrp2FogUyYsVjvBF7YHo9U7wqte2WM07hkm0nY+I2M2KYsq8FTOUoVRKrIaxZa0m83f85+Mq5e0945kBB/xH1BmcOrvwD8mbkW/gC2wdzsWAx3Ao0EyDdY8CukGNs6r5x0aLQHGKrrpWPKIhTHVnnT7WTCmGdCYfm/SjK+a2eExVpHFatbY2msEmAdq1I40KALHQjr/YMjgPwqZ/IfpqjQrXW1rbI+tve4gTMyngIQC5SoIBBNCqI2/WoBhAOClOxYDn8EMi+2EFnd+D1ugOaLOzsEoAMasMAtTmM3siZzaExOjQvUEyrEEC/OFeNUEcTVeIOUpAgCnGpm0Nkl6DSUWWhQDVImTETzpt9AU0DAKsWqXEUQkDA7MFfEK3C3IXOmvNHySTwNAYhozIBMOqFWmygKuhjWwB9bCQWN/npThATyIh7AYD2MJHsGjeAxL8TiW4YlM+XGwFToQ7yPhKW05SDUm2Q4tpsKyh7A9+LL10EmYWh061avTddKzphV8YLEB3sB9DzzU6JEmjz3xVLNnHGQ877AFGMn7iYR5DQB9ft/OD9ac9Ohp7/3E6Viq+8qPu19n1VT1w7nb72OXxM6Ox0fX3tgIOv+dH+N7wfpwoWr5L7IOAMB67L5+GMA6AQAAqAEwUwTpGhd9MXnYZ4XkuEW5zDM3Yhp8KoJlLkpRHsTJd2p2rKmP9FrItJDzHdeW7zWxGwfQ481kwnQrZBP3iIR+/c54uYgbNrgkQ2JYY22KgnT+rjyJh/tPnM09gtwargwNiRl5nkEU1JzkLVjEf9dRCULg8wyULxqO08pOLuWUAjoF9uaGjv0GdpM9mW97qmARsnkkFKYSqe2vBOkEi4yH6iyY1yQPVsjX4xbho9JhcOTqM6QEnEM+RISwUr1PAd7H3/uaTXzvReWJereUYXze+HFK1piOi6yQjdyiL+aRPJwL0FDiNafX2DpBpa79dJeNg7GtzoypZeELVdzEEJnHBb66D8n5DIDeZiRH9nR2P9irvlZbWREMko3NLaBXo87Um/hRZqAy9tmIcjIvVnyc1slmGuDj+nzHjV5Kzjccg4UQSsx2IUvoizCuMvd9ZXCoZoNuu4owo9rJgHVHS6aB/78AioJ02H0mzGAp/sxZiD9L+EbP4uQsfA8ARopiDD7HX5EnvvBKR8rch2cR23ZL19RnShZLwQt0AJ3IvzabV9I9UTN0qCBPbgpE1chLKqMuMn7aUDJrbFIObFXplSEtC6YbjnHkjtNYanY2IORo76k+3KrofNs1MCaWGzOJkhviusqTHVqwHuVOdqw8eWisPVPrIb0WPg9rPfbM1WeK9GoouVArjVnI39s/Kgok8MmxtIIlG5huJ5uMydxvpRNtHW8A9PgT4Q2Mn90BYP/XTF/E2DYbhwIHYJBc5nEOy/hGzH2Tcq3iOms3ZAOoL142nexqf4HM4JVMC2jnivb2VP/nm6qZBoiqVYBO/SCCZlgFenWbWrH/D/B5/auKYD+KuR4/QVQ87eIiEnvnUqttMN8/qH9jh0GKkPpSaAtelVkCPCEoPwjYjH0W6M6ToK1LdfmTiDPVTC6AdpalQnCJWyjL6TnQViDZ7oTkdDz1I8R5v7OKdoFr6qFXk0MlwdcZ1YroI5agQ05ge+XZoFMhvZuSIEsK1uxghPZ1MQwcnLCWbtBBOp42loUE9Cr6X+hOW+mllAZCfHo5fUXngvehP0I783PphT3Jld5NlUMfi7GIvg+zs9Ty2Xx4GzCA45ACu0AIirZWwGPrGncGDZsNirSTsqJ8AXgADcBVRoB+oXJoZ2jIO8jaHLXzpJS3b3X9a5bCxXJ/UzEc4MP2ecoxQohLZX3tcz07DhEC/kK78IyuZmiXVmfy6Yey1AR4H0WZQWvgaUHQ0iH2lXkMA13wsd12HaQX08ZwjcXYQt+AsbSVXk1pCiE+nU1f0bmAD/0R9jI/w14oS670caocdrYOkavMNXi8VYa1Fn1PCVIo9f0ILqHXXKTO+L51gFRI8YWL6OE1ZJ2C87LUg9HReAH/azuSEmYSfD+5z2/911WDF+v3fXz9gY3lpZrWi4gAskccD8De5QbshsUhjsHftavV1l78H5TfSwkonG9EAxmtyHs70nZ+OCYO4AEH9X8MwbK+7gf0EXbM5P6ExxZRsdL/PY256ucPNOhiw/K5GbvVrPD+wa4CO/NcCpgfpUA/ZsP0qDzBN7qC0i3wrNoZfqm3AgDm3l5jSb4f5su5+dCsB/TJZQk7zuL132ZoMAnzsAob8YrtvrXTCTTU02hS+nqjTM0ghq3uxV3S7W3tQCd7oMs62nUDrLdSFuOfL6dx2md+7k/DGqBNln5lrcRirLSVv7SrfmVIY+TUMMACcvkFXWnYWVJIrybp9Zs1AgOrbHfYJeY72yWussxm+9zqPpeme6piTndncCDGuOjIa0cODfw3MDzIQ8aR249+c/Tno3U5O3K+z9mVc2KwfrBtsHtwdIipV5kXHXv92GfHTg31D5ONHLoH2s57N+/EcMNwx3DvFsjMsMZYB7OeyH8r/5MCA/tI9uknnz755snPT9acFBVsK/i6cM2pXadEhb3bAWfF6TOcq5w73JIzM87sLDrOreO2cu9z0zuRnISn560628V7tIuRL22c07iycUPjq8Xbi78p/qv4KP8iv5nfyc/sRgs+QV5TVdOWkvdKvir5q+So4KKwsHla8+Lm70t3lZ4Q1gvbRAFRYcvUlsqWx1peaHmjbEfZ92W7ympEl8Xx1tLWX8sfHJU5Gq1sbHtp2fvLkWp5+6L2x9t/X35w+VmZS5Yjm9Axq2NFR1XHlhW/rTi04rw8JC/unN65uPPxzkMrz+My3IwH8KKu6V1Lup7sSq36bdWBVWcUrGb1GnbrqZ5f1xpV76+9RdDG5ws61GL1pg3Y7k7NKe3EgS821mgvadu13dr06Yw9RTqtzqWL6ooHZwwuH9wwmNr0xqZtwVu9EJINKYLoIGZIK6QL0g+ZhCxD7uif6j/R/6j/12AH3Q/1gYZDE6FkqBCaC9VAa6FHoeeg09AV6APDS/oPXqPed9L3Q5PI74XZyR/tL/Iv9f/OkhkIC0QG0gKFgdJAZWBloCVwPsgzKCwIHSQKUgQZg1qCTgctB922bdret31ltwp2Cw4LRgYzgyXB6uDa4LPB48GXgt+3/2D/P9mGeIeEheBDRCEFIfqQ4ZD7js8cfzvtQ4NCFaFNoY+cb5zfOP9w2YbtCTscFhwWF0YKE4UVhB0Lu+92CleG33H/5cFHLEVujQyLzI40wggwKWwmyi3KLyo7yhR1IzsQzoePRTtGB0QPIRwRPogoBAVRjhhE3Ai8CnwV+D1oG+Mc4xUTGpMQQ4kRxuTElMbUxHTE9MZMxjwIfhL8PWQfezj2cejD0LehP8I2cbvi3OP84+Bx5DhxXGHcSNyFuJW4mwY9OK6RoHhL/HT8+9H4hFMJlxO+zTmUeDtwrGLl5h8VIyPbiAfhd+HP4R/hv3VtPz0/k0RfYiKxmBAlpKSGdJIp89fqT6Y7pzc4UvdcN3Xx7t7dx7yheVL6x0+8Vjkmv8z89sl7nnyx8r3Kf27ro4EOkAQoeABCHAASqVWuZMMvwfYZR1p+oDGXHj82mYDBfG6RogR2afx4CgnJUZpDRTRNP9io77KuSKCpXlu8YK2gQkMExof8WiZHkBAgCJgp8znV1xV602sS1ynuvl/DVpVlNXy11Q10YFTKSQ/A4FoEcgWecWt34CfLXeagcboYtilGcHutu5ng6yugj6XODxzgYaUbUXKO+TRE4geNoRgffuF0UgjQEBw6fBAK9qE9gBQmEww5HmgxCpTItUlPAhB51fDnrzGc1LcYIZEG9n2NaXt8awHNybr6nxfBk/Nw9lVA3zSz4mMaO9OYJHIJwBmy4S2+zKhHI/8esQbHCpWSdNtogoPuMYDzp9HmwpeFmY2fBryCKbCOdvZ6+zuj8GpryP4gBPlsi2T7qT1freAk/OeknK+oOwoVhP2jf46B48HzOVKulLIjJ3VpquRWnyx+ETFxZcgWQjUiMyAsL/sdFP8U2OCa6PKxKRa9pa6K8vUSApja/8o1TkkTpQ7rgD18arX9gWs+rcaj+zMOsCqJ52N1sV7G0JjKzCpGn+RiBGq7SLkErjZ0eV9R+7FxrhEY0zTlpLkOaN8A/bmqgApYbWi7B3VZs2aORBXkooEXXHZ5R/d1o5yqwnPisSU2l/OBS4VRcDUog87Q0N8O6044raFn/9kUsHzZUjkGGs5xrWYHaqqt/7hFUp1P5UnPTAlFUiV0BjVZz1JN1Dgo8jxHIQZvyvr8HJYEtPX/HGvkc2Riwr8C7JIo41s3SMRa5luLa65Jv10eC+psipxdg/sKUEskuz9cyOqCCUoHN1iNywW1aVcxIaFMNkIGOvfKoX3xbdgIWVBYMOTuCarCjs9q/pIexqdPyoMXaJ8oMUbd4/30es4mCeec2pxYns0lBSmiG9xSzD6c23O+0j1MNFtaXvp2VxbkOXjXaqNUl0auqAC0O+PcJvcvS4zTzO+58nyVx8LrBgZ1WzTlVrTXPSCAIckaAdttZsCqr1KDY/sSv6Zn/f34iyhUEakJ9Hi3gkw3dQrXxOrxLLXXE541FMEyMxvbS17BvZJHMCd5EcdKBuAZK+9vVot79LNFJaZmHuzhrDcTLA3ggYWEHSyjzrKM+l9qeOwXmLIe7IyucXmIF53/RHeH02XJWLmAubDWcO76E5XFmtXfjaMfYPeLu/3y1n7Pf+SwrP2FnbHphrmGCYjVUa7bIJYf/ucJPjczKohxS2yeZgo+/smal3e3nLD+GbtJhY4e8fdmP25IaBcskm7uNkopDta08bU8IJQqa9yxL+VGy1O5+eZW4fbpEiEODIbb53U6AV3L9nd+ymRsP1QaWD1O3m7QsQBIFny52uzyTPSRJaNCygYlcQ8a7kKRmY0DAyIBu6AQlT8JlD728PO3/Pdr0GXwnyQIjGCpYM5VExgFObAzRKxPt2frU6mUenn4wXMbCjjAI0oeVcYYkxzSZAGdICF2dLIKt82c3k6wGNtBE7hNjniGLdmIFZK/Y0yyFXdIHsbDkkpcILkIy2vvmZXm3ruxbt9tYAJ/lk8vR4J+Eqb7/JXoYXYNZYLmDJEoSq4LYLUd10Pt9UkM853jhAcSo1aMPVoww0VAp03LcHcSzRKYfD6aR0ynoMr6K9o2CbkY4QX8UGCPfXo7nCTZ43PrLgrk5mr1V5TneF+wGjfC2stoqNbk+3ttFoceUnBa8vmfhbUKrOMzExJ0G+Hya3c4iaBWRUWlSWg/vcxd1zImNSAcDJiYYa3RohOuLNrXqT8xmDZFflxY75bf7H47w+lI6zv8rNATdNfExsDDQgI4myGnBT2AWAwgeBklApcANDWcUpfNNzdBuFUl4ad2m7xp0ygjohUH1SODvmuD2Y5KRFce3QF9vQDBexDYAlurQLU6Xg8s+wZ62z8Vuvj3t7ZSHNHNvcmHY1fCkIQ4d9vitF3zyHaN3tmYaIpFwkFsgMvGeB7lhbwTes/dJuP/SJuZmB2RaH1gsUQT6OQG9crKYqDhgChog5a5zEe0RQ7+xUCKSXJBguo2QBUVcLEQe/nkyhTSYY3W7MnOraulg45NR5tbJsfnpYGezrbCLdTNYXywvDq9UJFACCEZKfKiqgCfZ19ZnuAhjIdLyJWZyUDJ9bIAL2/YXM+rhU4vryfu5+ogI0+exd4dVP3Vrwt/KHoVmhA9dHexqA3yWkHrDhFWY949orXu5VKYDjP2I1SrN72yIxYM8Ls00NJSHR0aPJttP8ldfVMBtzNJsPlYMlRsoiSvu3YNdy6DiD5GGq+YoRwG+VMpKTT8LKodmhwrJvyzr9j8Hq+dsqja0B+O/f71dTpfsYbXjIi6sjDA+iT2aEnBMeeAAB6DMSEUp/8pu/65Guj08iJ6aYUvajdHdP93zkvrtQaHBiOwMbPxCMlHOKC23Kwk90SHumobmARzDZv7vzFkIZDuVhY2EzAr7IxMJDZ494f/K5+ZbRDMG2VwIhj8W1u/fwOhABJnqXNFxQdQNuX85Yo2QzDVziC6l54i0h1EpB43ZFGEfDzI1UsHxMGPg7bVY77r5dWuwNjF6yeWQP8fMDJ6HGEaBTeftLiglOwWbEtAQKRL6+2G5oY7UGZm435JfTwgeQlbSx7FBpL38FvJ33BIwFQnNa4tJqzlwD2/a0QEB698pBk7blXzojPGZh5sCU9NNjaUJ/PA8YoSH9qlBy8BAD+9O0VlF5iKASKSSqHt5HWugnediMyc2fluxEp+d2dcLqfO3GGF/yLQDYUHJMNQM5JBXe6QmVky97V6CdT9pUCeYTfqqSkjdWk6PTOOAU4DLcCGQLtV0Vt7W4qEyU4lJf3syYmJuBODvT3ACbSj8QGx5xMoXjZOz3aOnsnPJ0687B4H65hDqAFifcy83s6U8VVPXjib/bWy36wl3Nrz1Y+gzfhSTOloi2tATxC5YYPGX/I7d7Ki4g5T3FFJpFAjoqaTCNcc7Ws5p2Z1YF4e2kQXDryBJq22Qnf1CjqGZnADKmopvEZwcfG/sAnmQ9XXtvPSpzZRnsyfGzPuL1vQ/ho9pOwy8m+60h3/fn5A4T5P6zlp8N/luyWh6GgCZCZWVrw4CPOHEJSMtVQ8T5IwwDGsds7828+gz/hSlqWt2R8P0rRbiWS/JlJZ+qz7EF3RAJ+dXYMilLvFxvwted9pwF1JvDCThxc8PtFDvbK7dUuEXJ9thVimLrwIOrnDZnCXAbnrJ+v23QXr4GULQ9PDisnyvtqcPNSo6BvhUg9p4d0tWJ2464DOuMWEbAge0cGCLa/QpiEhZ/4bVmQ76MldJAgyGObeJ6S8rZ/g+m3hSFyoF9IGisqUHvKs8+AT4irqWq95lnR20rk6pBh2dNl63wjway9YZo3kn0QQ4fGAkDBPj7QaOZXJ2J98ix/1aNQSpuxSpbQSNRI2pG215S1i4EnSYZYvloKAk7S48M1auC7pHYbNaz5HaDBachjdjnE3xtOWfR+qblrm+9yxWCkzzMF2ZyA4pTYvHR1fgQ5343jtSUARbzWVYjVmRlvfGG48vom+ETVAl39JQK2Dz0+AlaqEIEe97sKj4EH5FBDfHM0KgqoJ1zhT37sYXWGd3gtGwiABTtt69n3/PxGsLPsEPX20C1k763ZkLUC4c7xeXth1+0+eKdTqeUvNSjAI4DBoMjGaScg1jUE9cbrA9Zo2m6QrUCKHDz0icPaLCVsrYMzT5s5O+AsbX5d8E3dK/oh7JTtxjqQLD/6u+SbDXZK3cbTWadaoe+zsojfGzDxYELAbrMj5zkEyAE2lGr4w/9wWNYWWXQ2bXoPdKxiMcauka+1yWl3NVdqFTu8m1fXl8w/JSNAjKzPCd9IvczgkcXj4Ow7GKZ5wNYeH2bMT6JJnU9j3IqwIowbKYY22sXlgxd5bNPzngdxYBPFB2/rKlcX1S8mmeI/VvJZaaqWrSi0FT55E0MWWSJwAUmNcBcxh8vWHLPgKpisS1L+zGgc79rwufKvwgJTVHaC2vgL+YTMS6lCgrnGzgzH+Ag10rqb3v1j5o4uBUDh2lsMIM6VrxtwtmkBtSstKEZgNmD5j3BKBrnA5z/whOpNCh2wYkUus1k918lhDUocsXHc7/TjeQVXeb1AA/Y4+8w78YQVc8L9OJw60McIFqjYxELApRUMkwPCkPsEAoBwWHGdK+OlTPa5+Xf9HcybRa3ZajBurFQrY4mLIP8NeBzTXEmvpGzFcQI1A14cnYSPD5t22WMyuE5TfelY5/YNmp88yqNZC43XO/Lnc7THLKWgQwve4cGDBUDVjw9meizy6iBHj6NA4OjrO6knmaQjQoOOXC0cOGoEmlTk7a5WJ3N6mzKXyvqonJG3aQvDMYMVKyrSbCL7s3hpAYRgcjAQEwPUOQGxt2Ro+sq74pTn1W1xACyn9TAmiRsDbGdqgOI8+kxb14O2LEmKfP3/xC+qWlpTziK3nuYxwkIM6DrYiys/aq8DrpWdU41P17+wAnNVO40uIlohILPaEs88xQF9cxOfoLwUPNDwr0RfnoFZt3oFbWiyECMyeXz1T0wVmkVPnKFQPG3a3cnQRi8IjASsfNu9VVWDCSHb57FUKOpkrhrG/jNn4eTglFxHcKT705s2I/GzTFYJBl/2XhXsgIWWMBE62hgoJzgmAvejDHZoBAl6dVLeR0r2nKw3jxVPOoOKdcFGvRVMZ6LBgzYoajFcMDaA/IaEWt+oBaq8hYCO8Yozu+hsVxLdzEOnrGVBYjiBmy5RBVUJ5cdNBx2ZlDC7iiuHPr31IdacAGeLlV5+tr9O2rQ00ex2J6Hraa+c68VSMLvW5E04eMhdSjzH6yXx8etWTyL0wTjHMIDt2NLPCpu+IpFWrlFQfFKQm6/GSf076MHyhleb2RICcccuZrYHVJMRoauOaZ+yYCgZiZCCUdWZPIhNyNt7Uv+K2gqO/fYA99hQFC9jPLyjxSJbDLK1UB0ITcplZEUvfcFDsT4zuXmguODFK7/BnTkiW0WRXZsuCmwy+1OHyw0EYk8ueaUFnxEtGOxsgVGxm438l2/BtyJQcoLidT6X+zjiXx1lnJhhbDtPBcAQ/Rxg8nrB6wn2AuwJisA/+ycQ6R5BQPp0Vt/qeCor50NAxxvabjvbZJui0d56mAGuAIAT/dOK0CqETDOnh+n9ecpG9ia4ILv1oL3Ls1vCluelsAykmIPAoN0lkoON9xO2FFdq4LkuqDtWquDWyO9TYM9F+XrMZHsqDhaljHx++7wTjYxM7FFG0MTvu/vaGcUaYewJZtu4cC3MLhwCup6X2pPXC1/eDmHckEGTUebwYPRJcq5L6ashlqlsdcE0SHIM4Lgqd8E5nRCBt49FuyFHYKtBnvWr4ypaUp77N7PH+VS+Ml2yJVVQR0C4Xkr632mOxFDiVTTBLq1WPiHQKPvRngmxd4F6mTK6SSdXiQqqNYrnmP7AVe3iBv3lV59V4aR2bSGUsEWx/lx7qaJ33B/vIF5LfBnaJCku5YNyj52IDN+MwO+AHKIMnbZlq27z7jF7vDaYvSCO1j4Vdc+4QTYN8o+IkxEN8YpWykZwFHUHp0EGroger3tdMqEhY+GW0BUFvfNgw39ltRg5bmvYMNVmH70COnygkVry9j2qct8Nd3oqDRkKoT1WFEyDuttz8WjCcOrm3kAGGFY4ITfmoTBaieSWd2aZ3i4OYkyXCScOGljjiA8qqAdByLhJKh2YK3PwEsTF+Nx938zD/e2VJSf/UkWQWkvB3CEA5WkIBYxckkMVaAHUaw2Uz9s32LCOjk1muZ8bJM4V+o8eu/zw2LXE0580wsywlVjpLn/TghAAlkoFyz9FXHtRU5eiw+e/NCwYCbpfIR+OZs0q16zkwK6vl+D//7qWH1PEMrCRKe9ZtvA3y6soh6pNj5ZAI+KXRNNNPi7w2t94ZkxICjOcuOXjsqPzaXBrLQL5gItC2enXeviCkrLdOXiv4ndcvwfHK4Pcxr9lQBpXtqqi0nVa8hA8rldv1yyQGuQT7kgjTi4egbERcB+uT3j5d0rmIifr+AMvgRX/U4CWrolMQNIVPdKplorEvEz/Yte7vQRTsxbxGrcrptlp3n/2N2e1QGm4bOzbO8K7OwQsZ2MnQu2FL81EZJqIFZcBFm+mY1hUNDKber5y6T3liAvx784mmI2DjqhLW3l0+XNdyK0yFuRlzv1avtIQ+VLxNSMottq6aY1umDpkFpTk852i5GkwQVyTGBHA+6CaGJScdS/i6urpqodRu4lOFXby2uhwJCLRIBpSGZ7sst/NEY3ebLn75mHwWBD46Db7O4Q75p7yvr5YNA9fJ7R+3ZTp1VvdMvafrHJTvbJgbnnr9rQWnCtWog75uBORC0RJ3xHVsyR+xSPIqvie5F0+onWNWsPuge4v23GHmwRrnDXPwVWEGSCACucqFr+zs9+pE6GXTboJjoF82xARRX881YVVgDY2vBrR06f4JG31+QFGIZGblKIv83EStKbManUGiO/r5OAEkZ6b4MjRkRMEvwKcJjvmhNeVXnR2FBnWBrnipQ63X/dfcaKiCTZV8mv7mtip2tU7lE23+dUbF/RkpoEfHi+J+sfj/ycUnEVIz76G8eeA40CHq+0Fb/uo+Ufnto9qaHmqNn3PyQ2sjFPJQxzfChoYvNSidkXCQcK+nVwfuyQJ1zioMnf2Bv8HutWI24F4c1mFEeN9jkta+cfoa9RJtc2/IeAo9Rp3a5bXZ9kjEqcnM5li2o21zPjltVtaUCDviMrZX9KSjLC0pbe4rP6WUg/6cbUpaNtOlorY2fU6IrxRknbb0PoT/0I2+qGn/46pYV0aa1xwuPpduCI5HsAMywAPj46ZnArrJ3dbWYXUFPWjZ2h9fIMG18HSzsLamEPx0eqZcps+k/Bl+7cHUy6fvxjxW9mJCBIWPEOFMrw2V6nGEX4H4hxTgxzDZaR0dD0dpHa3qJP6zPdS1g4KEhiy3Vwf/KqNEYIa79lw6IcOrhLrrPIcvY98cKyTXGjAESahp9hV82WNO3NBz+Q7J8Xa2pC9WSP6LWckB/ESyGY+RzMbyABaYHDOdlZYui4JNqWXJ8xfgy4nYVnaRZV1NMijBOGOpe7nX4xsokkidve4z4K5RWmWtMMq4ZNoTwsHgTt8Vca1SVaQHD4i4yyW8l+aCXdqLepNqmicWvSq4O+ZlQ8EEnorUkSNKph8fhs85J4fNuOFnCFMBM82jpkAhS5NqKOh//o74+m6ts1+M6+xUTQ3ufhycnzsJ5zAGqMpoXtPS9lVb+ym0x7va5Ytv9jIk0936Wv5herGEiZA5rAV1EEJ6LBlM8fHQVY/7Q6yTgINWUXirVnxaMtltU7fK3iYdwAx4KWp9sPGtm6KCLYnUeCiKIcEAFrAG3S0u0EaBGbRNlPRHZkkGuBisqFcKE0HO30QLdS0Y9sWTLGj/x015VgWPru7Lj6lJ6KiGapyPQIgDFTrMkHigsNGCE4IASTpI0kMfXaVeb9SQU3MW0FDgB72+cMgOTwkNBDcwA0ZsbMnZEao2Yq6r8u/Zhk7R3qHF9qRJLITO6MGzKKj75Sx99mktvR388JrDZ9CbUOyHu4d/Rp9BXMJiLfreq9ugRGAlrz+rGlM8HMMqAitXbdYy19uggWozxK3YkgRbbnPUl7CCjt6aT6AA5qxSu7qpiHk1RDdWKDfzO7p6R7zsxGkwGXQ1Q6dhE7QIG5Spojc+dM1qbfNyTGGfoKzYV4cvxTPjW6PTCE5zOGRnFW/ZzrVMR7j+yPEzGJhGutczpRnCwj3ObSbxCJqfKzuwJFjS2k5yn4mTrb2KBKKoYrxd0PhcXsA98T52gLIWgbZuiJD13Qepi3FhK+c5M8Eyydf4jeRVHFybZNaF26lx0RW1mQdbBHxehUZ3tbYPkqQRGZJ0XWOWS3iHALO4FCagDJ6KqnKZ77wTtLDfVspPuwyW66EltQqvrQRRJmbP4sXrbMU8uAu5nKjF9x4alrR6bRcaSIk0Ne5JjwDyI14cVHartq9R+i3m6cwOJZLtfoxG91wuqPVmrgAtnMhknv3d1xMXsz+zk2bzbrLauVMX83TmQuuJsgInKkyCkbYqk/72vZbfSSSynpR32kYjncHq6xvQxR/QD4QQNTsTkc1b5M67sJeDbdRSA8JPOrI2L4+x8zRUtlYHP3QGq7GxnsnA3o5g1Zjt6Rc5RFXEB58ivmfIkU7j9tS9SoM58ARzWPPlAdziU3v7UcXQROSrzmiQzelJWw6Q1HJ2y4s1M2Jjh+Oggd0wABJGbxj7ooPXhYsKMukL/f9ntaJLI2MCYVf47kXxqsjWTACyu5EUW5nEiMlu/OPUoZ66U4t07RcRKXkbauoJtvcuonrbEVhLC6ccNDe5bgqtkrHA0RIsrerSHOxKCYWWPfGtYL7ZWeYPw27L+ggudpziIQLaXK1j4Xoyw1a/PxpfUTNp23/hEp4+8LMSfie3p+7yz6ASNupMbxGK4Wx0Vtcl4Bp26dwaA5Iv6LN/0TlofAlr3a5ZfWxBpQBt3AjYBwEjNLsKcXJpOTm9L4n+1my+5pS8hNB6+thSdJ8YH/BX4iqJ5tlqZsXwAZVryhYMDOee41xouMxR1iANGM4u8tBDGXWV8jOrHH9E2WdXcBoFYX7wAWM2QvvSldauqW+vJDJXT0HDf/+P3oRobKZ7UC4V2tZX0NT9L65usk7zSvEC0ViBFyckSFj3V39jxJbtPGbkWSDMNp60+8wBqRceHap9X7I9tx/R6jWyV/1LY6ouumm44WMzg9Mz0UMO0o+UOiwosbQnyWnyFhbAqD25M0eoIH4hJKqobGOg0ewg40ilHqJBToV6QF0sdRF2ciqQgtqcbmJIsjx2U0NfiLPtYniyvTtP3SUXTRSCnjAyHejD9KxT02JoUzCC09uI31Q7q97nchq/ubNR7XH5RD+spvNkZtduxANJCX0clIZlM3ooL02DKhdIpPLxFA2zD6pGGndtQshHidPYAbkwHtbH9E2lmuYqdmBS0J1kLEOSwgnjWSy7qqP7jHPa7T5J4xh7d8dhuX6+jkWUceqIygJjtrq3c4Rc2GHAWeFXyKKc8vFofpsiVHTXt87bEaaiHRx7djvEU5Yt9ZkpX6701mioAVH7CBi7MYgoZyDElFUUqFyQBD9MQR2aLLsv0CUUiDWvK+UNxZeitidukc95yczGuCQFP1jODQfDUd4NQ8S6VFI01/NUej6OmwQGsEEB1t8oYw7HB5PeANyPmJKu+J/+C8wZY20tncrnI2MiAvqjcYSWRWyUmttWsJvNHBJMBIzcGAcD8rw8iE2SkGGIYHv74SmES8rdqqdqK5msDSw/Vg40w/WXGOfqAedM4L4//hvUyd06Br/o//RTb0xzDei/TrLA8j1wMerud+h4oSvVY8dSqh78oflvDf6uop7rfsvOK/PRDy6jUlISDeWXKjj+G3TiAoxlMW0yI/RYrcZOGOFiQoic2nRr5PUcOhhd3RDzLE2OQs7oDRNQBKjOHkZc0xdEo4kKaP4Tv2qxK7Zbtj9qHgdm1MyP6jZGXX+K4sE7CJ+fiw4y405syQZsVotmjbs9Ptc1ZUIejPsfRaq/59s3jY7zwZDfcyUnJq/7xuv1VNSfLg39ei85OqKvQBqB6jyTrAN/nZL7366YUMj3EcpKi+xjS20ic+dy401HaAT3YtY07dao3qFv4xEhSpTA4qmDzWSeqJHrCJABgxmBYsrNmhDSSWPNQ5T7+m1eht//vvY0o+Pvu5FHbxOQQNdgEEBT3g0ACz6SDFMtnX2EY8ekPxTso+vSqf81O1tnJRlF18Kiv6AWyO32P5OsVxyjiYT3PyKUVs82p7Kv9Rjcfnm/C6/HkiZWs/2+m/no5AhHGEKeyzbSYASdQVEeVIgRIErrqAvQllwvy4+hNJJ/FU1LbKpwbwbMwHS8E89g6NCZd2B9h3HxKLUaBGF4jnp0cUs+x7tS4G56imIkdPEhUKs0Q/z7DmcUB3gNwduIoQKlcpxiOXuHKT79C57Ljx8HvUbo5dmnSvt5pvZtAT+bAwgJQSQUdnVpDFt73BqiAaAZ4Rfz8qR6mVzBMEEgCcvP9e6wD8LR6ta7Ufd/OPghzhhi2a6/6e4J56Q72cZhilvIunTSZhM97AMo46VnJtrZh90SY6Yv9DOROdrMZ+V3H4DkdA4dUPauVCXS4wHj1GNkr/xnClmx3PTZwcUCPB+81B8IZBFMnyb0f8Xrsy4zN6xGWzUMy2BjIcY6uGyOWSdkVqV2BoPjowSQmxsiUvH0br9XPNKKeKzJy/YgFI1IZPmjjYEuOCdvc046dQlAdIOBYmM/n45EdpQY1Q2XvOYYYFLxs4rGSztjK3LYsY7T1xxQ4ODMxLpr91a5mL4dxZ7XT9gPe0IhLU8lm6oXhcnktUtlCeuKZsB0YGDmumY8A/RMZEecpqMiuea/1zpPAlC6hcSv8k6/NVDAmoUdP1zZFUgsW0x86JQUEJvFQpO8cYevN9insMwmQEgKVfD2bWNhmX9bEgpv9fuI1taTkwoTbCtt78RCjfXuvy2SC2EGrLx1rBxOTU0k7WLB6a26zGy2Wq+nXTI4BRdkzyRu+lSjY6PpDzrN5putO5uL+dWxATVB6HfOBXcCWb5B2d9E89Cv1m0sC1Iw3b1LnwDMV3ceIjtR3/WulheX33oCdLDzepr2/FMARjjyV7U9lP2bm88lYacV5qHq+QB2HNcHvDqNiNTPR51mHdv8gFg02cKRcbXJLRD0HxsLOq7HmqvVSBPR2fy2QBAY7aGDsIcKtaHy4AxjnDQt6Fl0KIDAev+Y5egQerr37NnLU7kdFCbw8VCxbowtI4EhLIcGeh3TGEjwOLYTavUsccFRklS3e8zcDD2khsm9v8R2jN5KisQhvanS/mseMFpvSPmndWm6ViZozGxHRy0/QaC5ig+eku9ZXFa5XOqZJL3xbFOjrLAEVtJY8yBvwCY9jijvqxNS4uAfLwSxLu8faBOu2tQjxeFS+f2gUJ1zkjktN1PPH1yvPvjX6gIN9IZpoqwRdN3JU0rbNRcbs2GHwTSRWP1/aFloTviqURMH3jjl9OOOITu6IoMe/gDG9fMbdDpmCJ0W8V+KHBbngA0JnXkH20N5kmkCb/8Fa6sr9cCRx48NjR1tgUV0FnYIfejaXHp7dCxNCwXrIcTW1IWgrOtpvIpSzLamzf+pi3C0T+cGFDnGxyb7PhBcfSBkk8EIIP2/9vyoAiwDL7/jOQw2VhSchXkAPP9FiJfwIURCI1Jo+2PUt1nTzl9GPD+fjFamaWmrPSmfPmmfCITdCO6aDSpYhPAgBOKQOdPjogDWGVvuXrxB8SAFacrP3cnuwHFmXDvcowO/GoOerxIwwarm0Ig+NHaMZkjB3GAc9a5XvDD0CsUwh5brdFxHNFBWZpSz9unogyEdZZgyT9PZ3IfF8qz9WgkdlUSWfNx6YlihyZ5TsAqHOCtLTnWymTVCpbG6kgIBv7Smpueue519T4Flvrk8/w9v6sKuRJmGmvoKtHAtD7+ib6YL8HgQGEOdILh7fNZ2wrU4HGyqDXRu4rLDHM0h/o1YlIsBE6bGwhp4wyK7pd9Uat+R2vvJVsMaf2SN92LXuVu7s6xkfbEN0mTdrKFtimxOeCB0YnGdxmLRuB+0GF0PYaGsPSSA8BzM99pi6HR3Qo175Jk3g4BMcDqah5Z4bEC00bJbqMSTGHZsHeTXwYXt4vPbi+wFP+rf3zkANQ7g3K49BHaHMy9NQoO+nXFgPdaC8g1W/Z/yeHYZqP80G/BUjk+CMoTBUlWEgQxbSRMnpq8Img81dFc/+f3zRj7vKBwklbAmEqMFQ25vMi2qKbJZELPJCiyrXcB1IXLu3t29TRctTG+SId80jKkCoDPk3IlykCFrvzU33w6whs+zrscPPLPom1vqizr1y31lIU5DJ30h+C7Qnpev1VWo5ydyvSvBhVEvBuO4JyrVNNZswat8qX+Abvl3hLwW3mhr2aj+1uNXKoxk2KmtB8GRAH6tOAaRWj4mCOGertTyDKxNmyaZX1W46WgggX2KlwajeBIjwr9yoEMHJdLNk5oN4kGYivK+xVySAKoLUxx83G6em82GZRARxIcbZy80vSwtxBdBs3i+UpW9REFS0ovVQvmofawNUcJWJWROT2Ys9/r4XfYTKzQ6Md35hmdhK4XW2FNghcdgJLjY3qjgmCYwu65q3mjQq9Uy2KqjaouSZ40spVeC4AAuJc7DdteCWwy7m9F6X6cDyIwyeUpur3VlbnQrBIQcvxGSffJFQhXssLAGE3wLffG2rT9RH/djoaevc/2bL8BzC/t6Ih4OJtFouWdSqIPCWk5jbmy7VVu3HezZjQkLAWKkiPrvtHCd6D/Ui1SPeHJ0Wi1yHGssDU2aC187C6ZUOdQkgVFLv72+lNDzVEMBv/6rJzbAINlMamqNDMJRpbcLh3P71r9yZHQSFDuWEJDYchABPjehXfhWj3JfSgpmjNDWrSrtj6AHZuMW4ST6WuvQUICHkgjXoILl7TXGMQlb4HNj3F1IZB5CZXa7ra5YIgITXMS2QQRJMtCcINonuNY+RcQkaXvoQB0RnuW6tiDGRrnIYen8+g6qQH3QPFIsdwtyyCkrh4BzK1nPsQlveq4oxwBeedc3w7d3D2OhGeWjh0Q9Vnor4Zmdp5x1nmBvshqKokQX5eIVQu5rV+7E6Pz/xLDCRkq0ochCgP1iCK1YzREJmo5kOHlctJKBmQylydUKkfphwuHlsehcBiLsUJUwzcauoHlUlclJnYfegEeJc2umyfveaMUTGVYl9Nghp0hDWrBQFuMaTXRBetYl70OX1QgD1MnJcsOlbngcXrGJn2vuKpsPZY2jVIXzxEaDUmTL7E9da7ZNyrit0Or8fttkJKvls2Laa7PNXtktkzn7Huk7ITT6//+fNzJ9w8ZyXEvaEbkNYkoMVD100YoWDoFTL+GHrG/RXsnq3Rt6ZL3LwIhKOs7BOlCYzj0hIu4etzqRoHkl3jbCCHa7YWKVgaHlFaq2T2sW8J7Amr1zW+wT9i7O7ju/oMHXYaaVajiPDtAIlAXSm/mH2ZhX6qB7W9NVgKg0IkNopibEbW7lyCgX+PvYoH/S7S0Mxd2uGuRDhaEe3eOOFuEUjLLOFaKfbtuOPGIai/PQXPdQHvw51LaUkZfbwJv60R3G0nRokpIIjil7j9f3KobS0b8vEHKuMM0o43NnoCTnCgRZ0kkYjTVZY11gSSgBOS1b1vSD5pu4OkeG+jDYsIYAqS1QAnF4LJnsj6hGs0Gjm8CJwVAQ6E0ZfuYtyP/Ou2N6NvvrZDKZ/h3Km47Xh1+gAS1B6t1O82lt+SmTSVFnuOsAS53iq+M41YJ/OySIv5oBQikw8IJ0aJ0CQAHKrgE7xQeuPg8dYBbEttoIjKlDX2+fhgB+J4C0IU86KOgdDb3g74n1msB2hHdTiJcCA1TcZsMholiNsKSmBUhAObP6AFb8HeZAZc46Wa1XsS87MQLDKbQvVji5buSAgoeH06vVgq5GPQUvx2k1mLq5+2BbLPHMBDkD4/vDbv0nTIoVu2O9rGPy0QUM08hX6JTsL+16/fbHMtubmz+2aOTo2/aXBsf1wb4ubh2uGV4nUc2JzNgOF+h6fJHPZVPsrkdjJX9ZlqVMcszAZ3n0jnVW5I6+sMOXOWFPMBAo5mfoAHw/fw32i5B/fm7Jf3E5cr8d3WWykC/hcNCXrMb0QGTRiL8+nInf+lskmJ+e7PttwGmkqrrZFCNf6YlEGiC1Hiq7MtbWtoj19kCBUqfoGPmsWv7/frae5o/Rtsotmrp/0c6+OE0n+/J4PeJZNPyvDxcQLljkiabpiw6HSi8fsLoKGmWW6w+FFKlMZa9ZWUeJPjF8bBvnHlc9dJHu5Pk/BUOJ1bfPU+BzkueWHmgPZjn6TAxg1uaW1nQN5VosNmsgaSQS5FJ/27b1RszBIQh4AHA7zOwEi816MnBrisehcp40EQcm1e8QSV13iH8vNGUXuflwJzWWXHHvFlENp0IQdxLOmnc4sRb9DppZCZcF5x7NT1sPtXC4tu3BhQ5xzRNf2dFGF1l71WzRA/6Bt+A7Q9g+Jp4N+ShJU1u0CrH7kvlffJpnhSo/eqMe8hO1ki4h9/ANh5awGQVTR+TzEZwWNWyrbPnR0XYkJgELbTFalq50A0utmfYjA0pVUQZb9lWd3mYQJDkoEd5ZIdbLUBmLvEptdmgFE6cQL2msZzq1ViUl5k7Akb1t1csypb6Rth6yl+KkzYrbzLHFRWY2nSagOXP972k+A9GsOsKlpv52h0lFQ+AHlR1ekI9IEQJwBlTjnXSA1mgPUUJvpSCtYLoSCGl/J+2HjVKewczGXrI1d3sRXF929XtDJDMi9tc+edLvsyzEW44fZS7eZWGAw9GjolZP5wmI6ozvUC+ptIO9KCsUyg1tglwNOzzns+CS+D0fHwLjodVr34F16wQAEGVQ9F4ybf4yx97s+QxE7qG1KGDaDX5JXl/Fy2bPynseyzJ3wACELycgnOT60YbuLatJn2NOj8CUjUPvGL5HfVKK0d4L0AKn2CHuoQ+oSd4iXxVqZmo/MUrr2DCd7ZQVrISkzjZHlKLZnKAdzUh6UcyxSPWJrfJM2jUXRmwlLXaq/mRvtkDbZP79tF0g4+LhR08ey8pVpcg+I8X0YBvJxKs6hfSCIjRt3WXInvqllrJopv7qcL7Xxya0qXwUEyqMxWbbOHCCi4IYH5E6UjH8pSEFrHTSmPv2z0yYEGTb7Hm0bX74bAa1+CEUsXsjLc7hmsRcDpK5d3ESOa3fq9kw99oy3c1liNylWCpfVk3cY6vIDCugWqdujR8VDcDWHtVWpu5Ejzd/89d4byQhMzaiVFcppPVXdgmElpnm/trIPZP+5TWVGN1K5kIH5VKJy+1YR9z/ME/ZD/cGcNcEK60cMDFJTceH53VbE2nD4/jKx04wwXGOMK+1XQKzYZpClTOQoQs/6HbFdvvDiFk5xtQzbmRASNtJtDlHQAOf+nayu7GsKFZ7JVcZIzgQnNLSkjQ6LIGO0w60DLplCgHa0yQOMVvrxme4rBsShgBc4LCgFUbkto864/Ch/Sma6JLPMYvHRygFB7zEahjNqiCB/Qgr/+6Jbp21XM8sK3O53B8coIEgKo0he5n/b3Vw4PYkQmM4JpelRRyQDeRJqKvH/oAR3IbcoeCwJc2cHb8HdIIjsDQCk5GCF/9vs3nrYUI+6EyTGuYGru5ylKIg3AHdgQjxHC6iErV4j9tl6ol0wInoXIbhWBj5y5YBdxVnNno+KPPqRf5As/114NKdMyiV0RMhVLT7Jo45kfgJsFXY4fnErv80sl7x9TsXF2br8YkZHSi3JyDpx4xhWLwlQcjYVzXcQfu/rH5yKSpx8V99tazMl8Dxzj0Uqfuty61IldCROHM51nAjwTjo+FIQ9DDoPrGXA7lu9HBnPT0Qi9ABuaQRnC4dVnU/Z3sZLGqnTaRuo4Ah7e7BPHghz/71wX6Fin2FWm3aPeXVHa5FE/714RTw4n0uMr9xWPkok3H9rdvQ4RsE07BZePRIkEfGo9HUCStYkDRL0bD8rcX/OS81uFCCBmx3vXSlFd0t59JiqFmRcjs5g3AIGqnYVbrJKIuf3sTtrgvme622epHmxP4r+KylX+U2C/GXSoXmpbXd3WOiV5XzC35cU/dAsH7NIWbmjrtZz8hvI+0gqKPxcTkIlYAPzTlgObsDEMktY2OG65JhMsY18esvnyBk6esyQhct1w6NEpHfFSsi+zNHvqdeaPLSAynJbiM/XZBr8xNL0h24tWa2siWP3DbCSH+nTJ7MZM9cAps5fgbap8RzNcKhhIcp4czuUKkEUga5DtZ25BdW7BqlMNtoMOhZRJT/fqc6FILEpqZLJBiwDNSb5YWpHL5+PJ5IJkrNyrcnFZKSMIm4VDToAdtAdQ6vmIdMYDg+Nb8MBxrAexDb+hWtbJxtrjh2DIqwopzNmlB+ekVb077kTJNAquHG5jyRTov9hNHPQFf2M6O7LSBFvbOHsj7joNSBIhUFytrn0+zoXC9fdVuetrCNd/ablxW53jGuceisdCugGklM5r+i21sfx9JZ68Fisy518NYTBw06Q2i68HwAugPW1o28NFQFHeD3HNSgLsP1+86eHR6tMZ+y+4crFEBJnJ517txlg5XvzJkrUkVX/n3V8xb5SsK0Mf+av/W1Rd0PGL0p/BEy48roX9V2tQ2FlbCQsmqYjBNM/Ig4iiB+p0V3+j8rl9XrkYi6F1kQc02Xd2yVVz1yOlIpsr8dMl61RtyzpvYPk42C2yjE89ufX5d65sCm6ak274ZB8PQX6VO/x67Aug/dLfz90G+jR1/7LfXoBOlGlsPpyIoUcWqTOxAMuE1qTsYyEKyM4zTGg9RwCYU2r1Uk8kSXoXgYj8sAI33zApdLCcPQRwErpeuAs/LoLuS2XfmmF2FjEFpVBAxA7TAlJSUCUGUBBynS/Pw5+HQtMtfiUfLzF+Kw8VH9oX0uobkgx/ZvCuTjvFFV2rE2KMwN5AhbsvNBDDGCDwa1cixCofjECqKd0PPnd7EoTK61Utu3FfnTooEWuwVoDt9PPLTDbJnb7OZ8a9wJAxfQzXZ0K57iQNyYwLCJEyBSZQV0mEOgNs15ah2A2373O4J1K95cgEMI3ETd1I0Wui6XCbyvWuP5mf3SizIxgMTRlj2gcDWaDwDPI950fAIAUbzlwxYLMoMfwg9NoQAiBEVj/dBKJh8CC+BgJ3Z9RqGsjm3yEZEA4m8NPhlDKjUm2IAAHsXS7dMIGM0Iv4aykqpIuUsAy+eqrntAzpujnwHWtVjyZArK3QXlNcvPe1qrzrIqLjeZGthpIjoLGjHX41toAL9PRB1wmZIrpdLP4pB6EWwvGOhQD2iIjc61wAX+cJRINHzeTkK/MhzcnoIsrBKgZjZ09RhkPkvMnFkQP36yG81hSG/m1tSggGZoQSG0jgO8iEjqCLSrFB8QLdPcY55XUQo1uvQBZHOIhC5N+8g4/ioa1o/pR0KLbnNTpWLqGJAHUBs5ufkCUJtAOIQUnzO2RKs5KVJZKk0JpGnYRwg9tAMa2aUDyLj54SyI2bpesYD2oxSfwYBJPq2lFcCYk2ODyYqieY6HQqf2dFwBh9LujBKaQ1/M01nfZZhjDjp3pMe2qEKAy2HDAUKKEIWJYMLzrZkKBSSKYE+PH31EMRVW/HciS4/qAaJUgItjbu0uDuENYKgWAFAq1Vb1kkNqdtRTvs4VjJrm2ARgZPn7IFI1PC//NPnr1zVnaRixg27M7h+c4B4hhvgzFxWYSfZDqgIC8ALx8VHBWWaz5a3Kr8GoIceBEXlncPC7BlmA6Z47+UbvAafTy7f8AThZlDX8cjhmafLb6xNBYHEM2x1G5mlyak+enlncq/1585UyME5/NHxFJAF57rnhY6CnyMEG3fP7jT9cKBy9/qT//qr74M0K8vydzy28C1hF4vuSc6Scw1+0JU8lDg2+gqjPzFn2r4lMIetHMBqWxVTXeG5j3dkpGvX7bfYtHdyVdd9zAE5Yvy08O/vbHc9+pUfwovwkxhauNCZ0OssTsL4vgY8N3N6mO9Ofq+zzDkaPPD/FWrOlVKD6FbZm4bUAKJb4n7p6CmlZBLU6Z0VarCYXj0Yds9oEiZRUPNLw5B8cw/l+jyPhne7/Lgzvnee56neevIgeHjYMKRfgL6yrV/6aLDZ8O9p77o7/3TCKA+bVV9n9A2vIhm/ejAPJtGNKHyEH5cwTUEi0EkgorssUTItHm/+mQqNRRqWxYR52hASjWenumXdH8I0zqXmPQ+tQXKvVSwRYTYbzranVnXfihb2sLBZLg3VY+DGzRz3hsjoipdvWSAycO7NHrp40VcHpTMaRo56t3yWYTXPRSROdhkECjQKEOBf1LDuQGuMXJ/+50rVscw58aMIrOaY7rwIDIeGFZMlDbH+NqoI1X1l98QHyvND2FwF3GL36HDCJ1aFNQIfQj6AFRV/q8YlAz1ZGwsIc3HF4Ji0HsMnKzM6eosOiuVCZ5ly+khl3+s7VfXASXoKHTpCnoc1NUC5ec6jdrQQzhI8H36m5JSpsuaVxXrh29J3dZ4++dgH8G4QZtVwGtzQc0zOPIeeDyyOj1VCCI8BP04en3xmaQMpgQM7Lqw/N8Hk5Ywi4R5avTuFnghcymmRGDVdB27HaIAKRD1eMFAT40/rKu9+92IB3Tb0TsBklSVg+NfT+XQk0Ls/vsZV9kNuLfjlBrqaPIxN5onsPLptU5h8U3teEPPcQZNuFIbLLYM2OuWgcuGbPJoDWUcOX7eGzXLxwwnVwk7Z55rGxCrdb4Z/25OHTdN8PUn4DhlloHgVkd+t98kJnCEknuPWok5k+fU3o3n/bObcehTvxU5DwKbXdn7OXAPs/u0F14+eO1GmwouAwz3b0ecSRNdyQgMDUbhj0aETQsaJj99T2WiWJgiJhTKiroWKIkZ+higJoDTV5HZvhdqpj14kDQ2JKYQDOUEqntpmp79zRa1ghFnNGuD5q1Hp7KqkDmTDPTjme72k+VKAJZ8plZAwxoGHgK9T7qMy2RCyYfJoeYX+jVscLjFMi77VSigXiIAGQfZE832aLlcuWgeZvCUJNkqnTemjTjuQy8UdUBD4QSAZwdXWUNZJMnoj/zf5vkUf6HW70XSyOkm3fLnuy9SETT9HZrPMfravH+XyrIpHcYHhyNTIPFmzvjuxLxNRE9f9gPr+cvCyspFDonFdPv+AHKWMg+D5dIgG6JNiUggqiBOR11mBJnKZJEBDZ4ViX3Ify6H16Ho2vgoGKN8H+gP0ahUJUuF4kBGqI40oxtvsCSDHTJyIIUaa6NZHIVJPDC+YznqWRdnE8Ry9qeTDLab153KuDpzrTzslBsFcIvYbl92ACwVu2mObpEvhejfWua2i+O9Yr8Ra0YcW/2/fhdFkMN+H+jVLR1Z9NpuCFvXiH1bDa8A5rsYI+d5q2jPbJLTproXFrCdLHEQJZsOBfJpIx+xFCJSO4hIHzt9FeO+jMXYM1f+B67dFknOT4Pa7pEFtLKkZQz7q5rvJMdh8jPLpz+tRf5kjA53EZoa7vn/g97W3ebV4CTcbDPrLI9huKNG9f87FbneM4Fv+nryWCoaNHYgHCI+wSGqfbWwCG5F2oIQNJB05cdk6AWR0nBJ1P42L/wQdCqwIzXQ+H48QYSjawBUEQ60VL3LZBISqkgPo+KJZI8CE37rIQrrjQ3D2X6BsWqCW9RetxMJe1D6tREgyGHIvBIEiE/4LKP9uo5Fth0q3D+GEVvp6diByE2LFUjizCoWK7rkViQNjqKPc+vHYa4Mm1SD1TmDwzNU3XrtpZkzBTfM1dzXR0SWjagb0EbQGXIH70n27VFB6x8Ey5MZA0nqvVUbrx4+x5sVeXKmpuvo09+W9aQbH0BekhsGibaiNatjbhGUNYTIgDO9hTop+Do/onCvFwKIjW2R276f0RdAbckqLBTHIgmv1kliU6B0OUKiuRPxfoSClLSBVSC59rToBy2zh8eCEaqx9pxnxaTF2HJmzrqwN4SRYItAdjsC8EOLWeTBu1uhft0Rymff8JVF3KDrecsrtiqds/AqNvc8Af6CIbYMPbZBzkZef5SqUijCDz1Qj01xZMyCBcuWsBH481nImsRtdoM5T5D7AUvmldXWjd5cs4pEujUvsHUSLGHTm8w5Bk/L7cYHYbY9oByw/tnY69QSuGm/Tmj6fsDck78tuiN+gY0cYlI2Ihm2v1hOKEaQktf3uNQrG0ZLmsX2z2VsdlmSUBRO0UlK/BW3taOh5b2bBWTY/ykVkpXiEYq1vIfLR8DeubIMPpQHkz4iGwTC6zIGO1nt0+XrjZkjq9JQJpNYZFKruXtBMSedwbu4eGmeHtnYds7kC6e7VEXWDRKlhqPcUkQd4ezg3dHFr1/4zrOAPeEHHMU1AMtKjSXfRsIYed55yY0Nr3fVNgnCtPf44Puyo68Hx5wXE5ZCioZRdinHgIEqW+zo+j2kmZGhAtM6SfR+p6d7MZ/JRSxZ1wugKnGnHS2W3ZksWwIhEHv5v1Vs4rkcteP+VeaVjgNzr8oLGyWALW5svol39KdjyOShWBfFoik43uUmuSovejUne62X3Xfmlv4xCpq6d6S+93gNNZxdu7P98nkBpjigSPN8jaaehoQWXz/hGPL00tG6qX0aAIS5M7J3Cv3OhU4w5Ocxnm0ZvqLXO5FpVZ1X/LOE7tMZhVkSwPFd6eaJ60JY5Td0mln0gDi2AR03n9vx6ReLs+NdMYl+wL99EXFyvsAWyddC6X0rZh9gkbotvvNxss/IMg7Ft5PKYo9hZPIUzkew2oUZB0TYLoZ6iJyFZRaFEqRErgjTArl7rdoKb3y3f7hFpkM+Tu+GH2qb297KzaW2H5sJiU9VkTHYjbUqnDbaFdAZW5tV8mcpPJW4AwjqM+UoUJOrKemxaEppbKoknZjwkgwTpwNCdnWG0q6W/qgMQClF4kxcMfCkA2+LLSppFShOGE6f9C26FyXuhLOMZZ/SDh8rGxvlwsDCORa6TfekZzfVb84R3e/fhyA9YRthpi8wWRgTcq5AzhSYxVMCFoKcvOK2HwMQNFowQWE5zTttXRFGo4UdXbdAyKkuNJwQGD8TDM5tClekN2kfTLBteQDNBsoDW97WS5qZQFYhCmRHw+ZczQWJzBpMl0tok+xNbo7IRZ/9PKj6bBH0GW7WmZ5SvMpEgaSCsRS7bYKTP8q4YG/qqmJhW0BVZdyALB2bOxatPP4GzJ/UKJMADY7+XFcGzECyC2CDmjJIUQ6nkvcGXY2YMFMI/puHa7paJvG9JzjbLk7bp+eEGlzO4Jz1OefMRPhjang2i+AL4suxekfMvYGAmA5fsRRulWgTx5wkwUFTORjsWwMGI/yXE8ny2wbL6Spm4bbm30BE9X0BLeAxmpuEJla5LNyYOi9MIZmC4FRQsilwRlC5MDxEn0Rnrd6QzGEDxG/ggaF3hjfQxBc1wzp9yTHA1BH8vSa1KGHKAH/XHnsswD29oGvm+wWLKoAO/YQMAFmtP1oZtiJ896TgWMtlDo0+wbNHW+jX6Mv1CynwWz8+RYkyy4c5JSWVt7y94BCwP6sEiYABOYuobWKqG+ZWqaEIdjY1vMvpHMoXzhD5P2SCzmc5L0CfeBVm+IrmR9f8mEwsHCkH6ogNINhc61XLhwu46dZDZXCnFqk1UyyPI3BF0WJVPW3gGrwzfC3iFt1yCOz/FurQW3DmLJDSTIGNxumxtBI+MOslatnjlRefu2ycTsYZdyQsGnQcI/N9eou0CDMu31eGH7YY18gdQVXg4FPVa3hzSoEeLjjDKj1e5lh7khMwp8vnlsTLQJ48vpbmGwHDfglu9bQz0sJ4wXuj/6hxJyFmYm7Z/y47dK6J5QwJ6Etql9QV/7vWZVWyJn56e6nUohgkZMd2eg5kutkbhkFOiT6I2MokLOancUFskTXa+iI5Xi+1l6TgIhu13CxB3OLgmJZzcnEHLCKHriLcPh7E+bwEiQLKfFUl9/QXX2bY+HZY+RZoGxIFkPeP5EZaeG4Gl4ygjefWSJGiGW4rhCQDA5hzvWidampmQmLfZiXNcmULf7x4UJTmUSxu4ih+yNg7HcPzbWL3e4TJZjODaTxsKsxsk/sTMZriBH6e+N44ycl9HPhKa6LUxF1sOgeYzFsE0uHOuCqCVCoBKR8ud0wWJCGA6HchWnrenk5F5dd5coCOUsIWhyZ8SWHfiT6L10Q2OaoZtaViCUKmFIBQIeYuq6qmwUKEivV4novgxFROilUj51VOJ0LgmkqmpfaOdtXWpv5yU/e9LjmVoUpcwESkZUJGVzKBUwqpnJuWRew0Td76PWCZgjwGf05mExl4P+D9FZKQpFPJtsKvIYjIStK/trdSk4/myo0CUaskxOWg+2+OQuV7gxYGSQXdFovDTPbMMLklxO0oy+ADNLy6MOWCpVNwkfKR3QW5BWTLXR6JgooVOJok6xTQFL0TIytV7BBpxFxaUevZDP6eEmZZ7CkwomfT8t12B1hPZQ2QkuoHSe13eGhLJn77ldGTFrRxNJcpQw9h5Dcs8uKUjfZ89EHdX+shi8RP3G5co++MTRE1vAgAwMwGVbUlB5WUdlXpwW7W9gK/jDhQyyBY5G6T4G6vkrw2Fr7aK6uhAS3i02kVUJBZd+fN8Cf6WQKhOMMaJRmWVgjMgpoVmcx7KKqOAHEkEqGckAzenPKSpz+54OZbUMZmTM3mzHgu1EkjndYNR0wIRUTZZkBEGIRFUHLAd4PjFGHc61pHte3jmrhb5WHQMALZxklXBgobPKdgJG4tzBWtFe6ON0yZRwUNHARpxZAarMf7wB0JL0AWngtRn95cd29r9x+uljZadDJygBt6Inxj/OxhnJDfgPyQKckizHAck1uFWyAvskN+MRyUU8drHeLw4fk1yGD0kuv7BHeXD0ovxFthgLL9176+Tunn8cTLv0XxDuzCjjgBeDJYkJu9nwD5HDAKU3ERsVf83dS9/g1q87/YqeAAxqcPziQ2rYaHFRTXeCW+JXgcdxPTlQlIKNeFaYS/x4gAJ2wlc52R8jaZJ9Uu5pHR9vqtVHE5cHLEQb3rdAH//fi92VEyCU9qOZbVRgQHqIE2F9zJOgiqp1ztoG+6m79W0jRwKqwDWvr3A69UoNiQFPMLN2V+qdV69WdycdOkGLWdLuD/EtLCJA+os0ShBY4J8264fWCXC0n8Vy7HVg4kHB2ruXV0PGJzPNtaumJmmai24uiXLgTeFSmRGUbd084x4DSqAocdPJAZruwjVLY3kxpqXAynonbblNT7WwqPTi5wyHDwe6fL54eXPrbP4gTIdt6M039UV7izYdWAzIYuQqrzfXHFA3U4/1Bi41qvwwlDSWHdImHR/4fmTb4QXHVrEcVLh+BaA6Qu5YOn70UO5qze81tMyoil6BCSEOwvGv+YGr1JVlgB8F7McCWaDeGsbp/LExw1+IhOLI+bGhDx0tGTIc8hBK6x1rxi5IzPYxwQXg6NuUuzyscl2Ezv8HunDOGrzgrVrcw1dQ90dsJgLoMAfdv6vCsnpuNaUN5VKpzh2JmIXjtO31KdhpICTZqG7aRnnRD/vbcPx3ygPZhgJTqaSSL/aPYvzzD0zwiozbvS2r3oLzb9zkdg844mColtuEwogdYtzfdIJyAeSMmmoHf+Zo14LyzFuYVYWW4HPV1Gns9uChiA01IiYQ1MfmoKoiUm1r0wVZ5Tzd/c4REOgYeP5id2H1sPOs3IS6rUHXv6N4jWrEUD2PhBADwQ4jjB2IOEGSJkxI0Gl1OoUAVwtI7gqAdiqUvloCHTL0+EmT5Hi/nmwxIrzkoPA93ymriz9PdPUC9odCTRKZ7+tvaDgKvWA2O1dWNuQMveCFHF8pAmSgpqg+6LtjHNQqdqS8s1kYmf9M93Xhv3AYLLgQzLOQSaf5zxCrZQSpKmHxaRGgr7Exd9r4B7JMGUw9ZBx/22IKml/79MRTI771rH1xVKrNosWHu97744i/+aYf00oFT75ZLv30zEubXlcvzJhzDs/PbhiHw2CQWxgQQhGmkwmO+lGOMlHmHIZCiJXjMqEGnrs4QHDCgPDMvEU+YuPkTdHjOWpuNCHfmedYJSDPX/yMRXqQwLBDCJ6wbtzKVccpHhJCjam6deOOrTyy+FE0dXVTmIh5q/t7hCeTvvshx0qC8G20YrGSv/fwFDcNhAfQ7JPp2SYjjoPI322h7PnqoegkQALKfGRjNThuKa9Z7AYBWzU6fKz7/n8a6MlBDuf6KY/TIZJzgK2mJkaJ0Xg16jtozE6PYmi3Ylgt3ERAvSGKm1L5bDXs/AfAIr/SKoNwslR1ZGiUq2kZ6pCxJ8Dy1GAtS/B2UOhGIJ8zyY0egOyQgpecmsEVHYSv4h+HtuQLW2C3z0UPzy6z9NYlgtptkU1bjyPUni4eKZpobuBeYJpgNgKDwO25ot2DsXsx18HbtySt7FrY764HtzaklAhsrvdgGLj/EKRMqeYPHVwNCaFVJW6P2liIvQX6yCcPobk89JMQ96eKg8AUh02hMJnmQEwukE8tT4vcH4LZHBylUvT2VyUS+pziEi5DmAnrtrqT1em9CucdKWxWgw9awxO0IJjxkGCEaT/GNCMk8GAGoZ52fit69IGwJp5EKCnsRIqAPaBIiBGlnWGq1zwHbVutLDDEq6pAjxauWICLNJfkcDlBDqNCS5w90vrTDq5WWjmc6+9hY1h1x087HgZRJoUdrmnjcAMSOR7ffWDCCH6mpB21c/YNDEM8WKra5fkfp2fR5dmKcrFZPb66Om3dYSJczDxMsCwwqjwHVWVr1bdGeyE5pnt61V0EzZ1TpPBigJenAkOAHBl4jYvbpmma+1Qzo50oMaTwwREgRUI8iupCQeYGyGGWKEFU4Mj1YzIFirP8aYI/9fsEpeQfJZBDoMBJnCizfV5i0P0ZCK2Hv2/5PLptKAboQO+k3lr/e0yf5Y3w1oKwgOyN6hOBZiNgpNO5LvCFtpc9cMCRysUJlNdpBNKR9xvWlrySZIX+nzDwa6rgeheARGB6OFYciEOcMXfbwouGlENuZ6M8eSSpp5Dp2wrj7Jccs/yZ3r64pvjCLASRMab0GiH72BkEbHVfqjwabQMxCZDPL3xwW7Diypnoo4dxNoSTHmqigg5P0WffcPi0XCi4jlRmmg/Yt1jqaEnHWzyR4AYWZOGZSOg9jxWRKMFkxSn0D7kWsFPw1i6beTD3/IAmMH7efzcFSWNggvcIfZp792A4TKEWDRq9kCWBI1oiRbFKwFNJkEqqGhA2qT+zHu7gNSezmuH1kNuL5/P596QlQXUmNbOsdtaMIyXMkuEcYZiUSrmtxlB9tCUiOnoDZWciEAIWyKH47e2+SFn/pY5kdjZuUpoI76gBWXJCoCR0StmODnDl5x1lsuU5tO5ED0Y0QQVP2kE/nJimmZFgUTMno7IIUh5TG8HrSOlDlhP9g6xdvODJm9PHQ3FOV7dRaKyLF7suQmNdbIzzvv/YNbAF7QobWPb6+gu4JMgqF6zItZaFYkNJgmg3Wsi51to+Tc4PoyQkKLRfuK0oEMYLN1Rsf3S7mQC2OQ/u/q8KvcdqACjokcnFRMJ0LWibMzuP6R0sktSv9wg/BiH8yLUzjWMbjor9PPMnAjT+FbQm8GPry9Lt2mgfY8dhOzxppyo75ZSe+ujx2ozmkw4xRLW446LukGahat3zFDkK5Dn/CcvC0ItO41dieqSeWIxfkLm4sjMfA5LuuMgW+evUBaGfB8CChkSidYUjeuRy6rb6ZNCxKUQQ9YquL9RKzz3bdChHccY4fTpMi03M+nw7s+vtKlGP1esdguTEKbCh8WVRJoIomGBCCdz6/D53Cv1DjtEJkUm02xmabnjjyOHOo2lJMyQAfiEdCrcRoXRNAhlaNNNaZMMLNd5o9a2TgrRk/dyspCsQK5E/qAp+JGKg53iQuAJ9Rk1gXv2wGC3kCVUQnyLgyAmIjR2pEqsKJxS9tPu2io9dzbF1KRI5RRtPUgKBRcR3AVAqY1rKNK/OP4jWzrvv570nK++KrLpPii3crLaFZl9mt/s07cv4Zxb165dRIrl3T7ivkT+RQ9rwtFYd1YRQa3SnfhFWAbqTQ99UD4fR3irqtr5UHtuymzpJmS+Gjne2F0bhieSJ/Z6c/FlFCoRmidbrKZ+Cw4K6reWkJbn9U7NI+6KtcgsGNk1N34IkM6ZUbW3X0Vmj4IYw8A8PzqhJCTARs3WGxGHWvbzXnVag4bpv8Xff3nyyTS6AxQtU8Jj0rPNnFbfvszz93v/9jWl5BCXu/NmcG/zI8ZZb7l4DOXn87kOhvwAEaPz/u5MIHz4V//uU4gDw6xu/uFvv/4kZ1nWX/wGeAioCAlo/QKO+whsb18DqccDtu5AyMpqI6xkwLKR+a9zX54RNRFXjtCzvTVXPqLYPJR46/Clr8c+q3GWLay6gK2uITWBqDeiJy9In3NfqJQ0SVY2N0Dh50FMbWS/UNbL4qd0nDYdUyQQXgkaocYPUhgBzXuC/qDKXYYJ2nLB5yqjnfS31YhiyXu5mENs44Xto+1xxo9JC5+crOUaV3yjWdyyCT7ik2GdIV61Bxa4xAtpWMmER0WtEumGdxtJD1u8rDvkly1GtUGrtxIpT8NRa8llHLBxvqmm285P/R6feu7BaQ7F62NoWY+kjf6+qWCmSczmtCCCyIqnFP/N+iXuvCz6hifkp7i3F4lWyqWGf8tZgofpTSnSsZazWHZIHHvUGhayKMqt9ZH+7Zu0QKLOtymm/y2r15rS3sh5dQ5htN7yCf2A3rIKzsAeqtb0It+PYQmpaWg/jISUeqd1ptsh2+hBWKblcgovwAKpqr7Xa1T2Zk4HWx82yBdAyw0YWFpqSJa1cZNP88o0nMAteN62ueQpv9urJsiya0bCb7easzPIxt+X7mMTZ5ce36eoXhQ2AKdDmBMzTyIpKVNOHGmqygVDS9KbMfC/eNr82CYUuR1AynpcVRvzTZVctlkRTRBuV1BQxUFTCF3gN1wIb4M7FUebe28vqBvVzIpsVrBz8M8f/eUkTpvJ2QmQdpK0OAfW1STkhplaY1TYkt2ZZpcjc2iildliQxh2mdplUDppQforKO0BS9RJX/pJa7cvgm0KqLUyq9pZzs6o6kH/AplywkaYxNcq5xOeHE+MtE8b8shNHSJq80lI0yqF3t2Qlq9KdjWYHr+uYB+VdLoveAVB4EAS+u+yvc0VWQQK+6cz1btTkWXWLJulYQa1lzwf4wNoG8AjZzlwSwJdVxxh42+Zhw4djFOtNqtyOMMsDtwIXApsC5wOPAd9tkUrSCukhqzqlDcCv3UG0Dx/Tls2y2xlsqxWZfLH+3zv1E54QlBFiicRioFusmpkVY88jmhDA3VH0zUiUTc2ENJnNFI+Km2nmOZoZ3nqbWeaeq9IIlw9ABImDaHbH2dnsQSGneTiR9DGeMRPodeZc3KwmE9s8Aiey2ZucptmHiHfzSKas1FE4jZs1JETgtzdwrOWWmS3ZeKlzuqUWmWs4tRSpJnehhWJNK01duSzz+Dd1dpBbIkjmVl2ptL/lWpWk1amZjcssMiEcktQ0Uyfa9RZYKDV09DIdZeE6J9l08xB6k6tvih/5cleXW26eZPPr+mSpkkML9cdHdQt6VlpgvD1IbqVhIlvnAmmiZYtFq84fLQrNV1Jz4zFyw422QGpqOuZNcujxMVedwyiu5SjNoblIU4XfF3Z0bLMx2icWkNTGVVYm3ankydnpTZkVdd40SVAjenq5xS4217PTT1quYstTm1RJlbcwhi+UZg43c4sfc/dUl91Rd0WYT3NG3F7b7AMFDqmMAMLeHJVOq3XL3KvoSUJhf4/AIRgcJRnkFANU6s1Toy45KL5on25w5nLZPklD+/1wdScl/nPbvym9XJ8KhnFLmoz7RfwkeXSnGW7+lfzsW83TAr/a4b677mXDxfz012fImAkVnOGVjdqIMcm7j9LCuo3U6IGHFibiqn4SRjVvhO9vUsWKG13CGJ/8FW6YsOHC+6GiiAItssTSkCwOOYpky5TkiWiCQtcq2HI6IWEI9aMVUqwMM1bsOMYLCzeeCUmOb6JHMiKQJlX6BbikhONscekm//UFkiL6zUyRGekFhN3nkdZY64gsq6xObnnJy/ebqSkQZVoKU4hOUcW2mh5lJWLk5rvU1smWk0sASprRrxXb8+J2Id6fPl/iT1JCnwU/sC8+Ethgt40hGFIwYszko9u2LXrp70JQkvSxovo/1r+nTpP2A+FeveEiAHpUrtzXASAaWuKf9v+voqnmWmotQYh2jK2jxCTG0kg0i117S5UuU1vtdWD9Q26m98aROeuczemsq+56VDtPhFHldzdcT2999Bk4xbJ/WLnmokt+cZI1G0pSbdpd8LPZf1OuvwSONNre9rVfKX9+9HJPnnwF1jukOGON22JTJjrYpL8z1d8JVjS8WPESJUuVvhQh+tfz+utcjOKkLw1ZTq5U+304QGaJwiUk0yiruqHpd6QQJVlRNd0wLdtxPVw8fAJCImISUjJyOEXIciIVgpqGlo6egZGJmYWVjZ2Dk4ubR5b0j1it6nZn1/C4NmlWlPq4rFRpgGxhiTJG2ToeetRToto5LEMpQUbJYhu1QBXkXKpSdZQSEmR/RAmeHcyy6+GzH7Duei5gqY04vSMCLwdWxwxW6ZEt8zVr2RIeOZJ+M/I2QspSedYkrHIjTS20Mc9/Zum/2S/r/az9B1EC3vsvrsCHOkOilYNPYxz+dAQUFcgDLepcwFIbS2KxjTw/oARf/u/qU29pi092v3Sm36A67m9dCOkeiR7CCHwr6u6wgorKOwrwveco6yrDnTCs96L0Q/15gnRCAfu6lhK1KtbGonWUAWmLAzNTw+Z8QFnXgfCTj93EJqX4WaAy+TPxo2VnD2A5NJ5tVQ8iGKzPFJT2MGy7xOKuK98e+QkU7CZosEfMKs9LDo6joiKfaq0V+11mKS5VgUsq93xMa+B8rM0zO7JKSlUsw50wuB5hpMgnSHD79z7Gj9SBXcJ/n8Xl4R+gsjePD+dA5Sh0XX5LqOdFrBNzykr25oI+G2WPchpln6zNeuNs85GU2tX7ogvvLe26DiGqXUwtD/L5ysTXwYYyERUuShF8tmv0OGg0zZhJRIZRdLfoD78W+zPuDWvU7ppRoz5cDRsLcxAJYeNGA7ZJNOQfd3bdzBbFIkdjS6glx7Sap15IWRI0+ijJyWZ5fHFWZm1vfBW8l9fGnAYfWZ70T7L037Det+ZSkdwH1fGh1zek5KETbdPitrJgFXYnB9+Yj3f1KppB+xqqoyH4OfM98WgNxtfg+6SoHH0+yhxwFRyrtNaOIxSLKTqY9/iQItH6xWI6hbXV949G7kPeWZt5+1bZ5icZH6rHSqmsfV1E7va8k7dxF3gQUM+jxqWeR8OQ+j5FIorFNAzpGpjkw16dgLVZOtft1/642TsNu/IYrtyLWz4MluTBFgCFcOVe5DgwRYQB7FzY5RIGjBMH6J55AK31xR9AgubfJqjAvQMwaD86bAFQCDNoHAAE7BQwAAAHAKB7AFrAH0CCCjwFDXKPTf1x496Mcbg/P+OUuMeTyIvT2YPyKw1eCGLlyBnCVH5qt97tGqQHRJ55RSOfKMO7VImG6ER4ueib7o9ZHGjvqzD9T9csjVo2Lkq3nMBzHnA7Zq3g6XGTV9Rt2UT9cteBDg1Exj0MUseiifsaVhyzapLUtR+MBh6WGMsmmkKQPOabYbXOv7G6fPSyW9PFtmKlTFhTPkX/qXBm7aJu7LrW6Bn7XuRk8sT2p8B7smynMe6xr/vZRM4Rn8+lZ/EqqvCkob7UmTeIl+TYTmK7Co5HYTfuDeFZ6+DP9utwr7Pqm1jGfsKzl6vam0jBjqqhxjrz5lD+Z7+wyeNjCwAA) format('woff2');}
+@font-face{font-family:'JetBrains Mono';font-style:normal;font-weight:400;font-display:swap;src:url(data:font/woff2;base64,d09GMgABAAAAAJ4gABMAAAABfCAAAJ2tAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoFfG4dOHIGacj9IVkFSiUwGYD9TVEFUgWInJgCFIi9qEQgKgdw4gawuC4YWADCCojABNgIkA4waBCAFiUwHowxbsF9xAU9mXL3crao0IYAoCrjzg+5wHjkVbcuCccwS2DiAgXoOZP//n5pUZMw03LTdmDAEARTPJXggPcuQWjEmkjXItGcLM2nuSMRCXt5ylWlbhNmErM42b9XRjSLwriYzp+dkSilsP2a7vJEQOVEnljweZkZY5RXso5cGenEqyCjgX7HAXc4ctuPJ9HAXaT842yHTZLqsy1zWrbwrSMNJJ/arHcL/VIONfi9b8fOs/ipY81101Io8q0dCOERHaXQjuN/j0kXaJwIyNdzch9lwLZ13fvJZPiPYd002hQatB9VO9Qg3kmpo//N14OD8h1RdxkrnvFAQzTl7HyNAsEDN8FJ1amoOT99+v/tmv1lIaOQQKqURm2aIENWbmEaxaDa788bnf74798CjPMZ4PMbjsT7G7hB5PGQMGSMdQcTuWkklHTKsSBBJR3ifNA2pFQkhFRlh7NrQH2F92DD6Sa1Nw/ukPrvKWENq37+piAQbUglpsEFE0lRCSKUHuK3bqDQLjAxeMSPQ/ohEvyPRNwdseNLNfygUguIABElICAkZJEDIWpe7jMsmlyOBcGYAiUCAMHVD69hovxPHArX2Ozbfat0dutu6v9iBY9GhXQuIh9/v25z71qSpIm5VulsiraWfKJFIIgUink3S6qBenRwUfGg9Tj9aewowwb+9w39irn3GSiY00dCJ1Dxxf5eJ3Tr3plpfFYBCKBIEKZGyZbvtTn9Dzu++t93LYd/dJNS7+XgJOUzyBPd0u4McqECR8P/T2fueZDhn7owxQDVSBdgBD3itBUuLn9hfaqzWTniXPwEmaRlrrMKj20KLT1kM/EdlHNNYuGqauQeGMIqW2JBwwCGG76W3/fX3ca93dEhJ7O2i8oIlNgBSD3EGvnL+3m5y+bcHRsEMNVLzf3P9e2cS3s3uQJIJ0QRo6W0+kq38qkJXVZGyZSV6anSFrDA4mDr/FSAdYYSWhNFBC+lb4/x/T4c/bpca5e3T6d/2gC5GlglZlodkW7Itr5EEiMV01cxxCysESXLCi3v7TWERUAAgBO7aWSlh+H78dK9eMBah4B/7rbudvdoClgpaq2LBK96rudybur2vC34eucQOKVAGYUi4VlhEOJornFmi0AE+cRFT4+vMbHL337IiWYWKgFWFrQIulJv51Pk1si2QRmEUZiSNwkgwAoQNDuB0m3J1odpQ1NcUXxabq+bS6+/aDSH7B/a8tjEO+PtjZw5zGv/jxA44bbPQ3X0EeL5VdvfB8fb/CYAXKIWQ7UiyNIIR/H2pWtf/AFL+ND1ewLFhb4BmllPgREy6S7I25HjMv393s7t/A0SjAUoNkBYbkDxuUpbdAGUZhEMRDZBmkpeikxxCnhQaoDwDUZpdSLJq6DQhemdjDKetPZxmbnPc4+7hNsc93HO83fdy2tt5D9c9XNb/1zTfFngArDuE8EPkN/XlGMpfJzrnNhfdwwwgcjkzK4iDXfHn/THXPkcjOmygA3flvE5x1XR2abeFoaql0m2VrmpPztAMSxR8lm6tcUjcCDqfQ6RIr/hZlQZXpSm9+uH75dKXWnID9DcGzh5TcCPpvC7S2T8JCutt+L5dfY8sp7OCgoMCcKz31/q3qllc4E5pOyRjyADGyLl/b1v8Xswm/6vr9Ei4pvsMTVXXdfWMmB20wgivGrTmOhuwplCiEdjNXjEsLr44QghfBaxNkPjgLe8gjqUEkdLHUiuIZnSLGVNwNL97fG5YUztcmeZGxnTgQBGITJXY8fhq21vG5iNDPHayDfzPWHuHx+9fbW7tbsdVSUlKSoqAgPAw9m8PYRHs/j+qpjCEEi6Em2giViwRpxBRRFGihDJEOeWICmoQtdQi6mhCtNSKaKMj0VlnoqsexGefiR9+kJomn6XmKWKpdSpY6pEWlvpFxEJAHhaQAYQDLwswgD66Tpo5LEDoGzHZAMG3FUhCmAMOAIgXDwFuwmVmipwuUwVPmytd2uHBBnCjR7MVwIWGMII4MVokGRDF6fB3AXxCDrcrlNCLRwGAfmMXPVJ8qOhXtglj2S+s6avGSFvJoy2C/PFLJ4Dxhsh9hWXIanFPVKwA9ACJJJFaV36GqQMgf+no0BzA/sN8yAWBPK86vlMorRM6qv0A5LfpeQEQbCG0AATdAoxtCgwFKfj0CJpiRZnyqxxw+xxmgKM1sBi3GzUPUl6dNJoXGjDXF7NWGafaM7YblIkqdAAWiuN+lBa5NA/ccXSUuA3J+a1jd0DNjxJfojE1kfnUbwgsSI2XSr/LH+WP9hfwF/QX8xf3V/BX9Nfy1/E38jf2Nx9qwQOujIegE14IWTKizoAyUAziE7lBxzWlQp7fA6UqkgPxTyFr7Z5DAX8pFufyeNT0JoGfZlnKP/xQmuExO9P1kVby4Q1yrL3YruKYwseqpJT84m/plAJXtS9xRSzsnt8Grs3IO9COHY2vtOlC/LXGbTuQ83LseWU8CZnvx43bEKdFLoXWCv7W0K7cqEkKwajj33ix44OHICFCJZBIEsmlFi5KrDjpZZZNLnnkV0hRJZRWVgWVVVVdLfU00EgzLbXWVgedddVDH/0MMMgQw40yxngTTTHdLHPMt9gyK6yyxnqbbLPDLnsddMQxJ51xzgWXXXPLXfc99NgzL7zxzkdffPfL34CRTN2wlMf9IEqLqmn7aTlfH7bHT5+/fE3PCGVh41ACg/Mo40PwC6pUrRnf9jK7xvbUds922eaz2Qhftp6w7hX2rwxgeWy5Y+mwVFvGmX8zQ+Y89BZ6Aq1BHabHpjumi6Yyk4XSi8anxqtG1ChhjwyfGI4adhky9P/op+irkZ+Qp8i9XboAmYbUwX/Ag+HjvRqeAafDb+lauiW6WfAEkqFGSxAOSSC29rh2i/ZdzXPNHU1Eg3/n1OfVO4YXppapvlZ9otKoiv5hKc8qD8PHG1YyFEcVaxUj5MeWO7XkETnOkmRDsu9kS2RN0iHpU+k9KS6FIbZkt2St+C/xd9+WuEPcNCQPiegP0dei5aK2lORSuKQv2otEun1OvgifRVL2B7+cVk/4qfsdsP5dw+vYypMwJaS3o0vgr9bCfBumZL41D04n09GPNekmNeTmxr1xg/ugH9U3asPBEBpcA+MGUdjs4/1U7+8ZwqN3s0t0wY4laLWh1nXz8kg+M8wZ9Ul5iWG52W+sje7D8Q/qbU++pR6oqlWhGqqM8eCB8u9LwVvDpfXxWSoV7RSNYqLwFEKU9mYqX8sNOZYruNlsM9NmykvuvXjjON1LvenIepJ0kto7IfEmd16E43Z8XKYpxv7IRdtRkidUd4vfy4epcC2gfF0YCjaDFaeUzb2aFPOzJCG7ymYt+hE/6LOutDy/5/SA+/NF2B13h2mJn/FDPsL1rMQyzMDkl+/T+K9KqPIySr9Poj9fpwhGZJdKuZfeHEoKrXH77uqb/mrzWr6WXWTq2Vk7Kw9E5b+ysbu3cYsohZVeJUt68XDuzNFpmiRybcTGnMEl07pSfUeHuvikbNtsNU0X7SiFM5xBTD3YntXZqqkd3KoWPqu2yrUSVZxSahVoFdpnwrgRNkazmKk/gwcHI71j+xo10i/Mek5o3vZlONzy/Jw4hgzh3JxceIn0/XLUlrTko5BY84LC30abup9cK1q/AzsTFYY3YnjHU19fQrrTk970pT8DGVRvTwrh/YfQxVtWTHUDEDwStWAwr8QBMChr8HXzA1VUQ+fOiUAVVK/+C1elOjWpTV3q02Dl7mx0UkMsD5ZuPL2d5c0YNJgb4+3B0FSzvdLpp12bOqSBM42T52XwiouDlFa7UYPUe6m7gHDY44sZy2MTVd2n/2CWumNnWGQ4XEhmKcVouEits9jaTGPWR719BrswoNP2TUyxuoqJpItclssX/U/oZPywpvb0AFb/XMt3O7JTTxk5hQvcnaroG6bY5tLe+Rp2FP1/Uh+ZZ0PTFP1SvgcvgXSe8wVW0b9e2hT27LbQwCtB9yPpt9FIj4/xn7AJRTfb+CGqj6IPXXybro+iLanAQiOaBTm0wFedLVqj1xmeznc5xEe2SdUfToxwzVr7AbEtNXONaN6Vw5uQjnkzziJRZgcKvSF2u75l3oQo9RUjGoY7qs/nTz+dLOT7xwEjkADGhfDyv7pyXz/jSG5boqSfCJ8MoyYuKfqyb1rQCnyaXXJ4zE7SvB1jCUKjhW55Z+X+lgx9R7Ckodmo0yjkqKHiTP/BWymAVQJ1FbBT9voK/+UZpQ/o2V9np7j49Yhap2a+vMde+HetnUNn+M+cbTJnUZ+svxENIUdZR2Lm4cHbdSRDrVRHWW3e1sfCDU0bG5DdD8L/dxnVq8+5CoahybYu0x7uN1fv6z3kKNXpBmTJyeF1ElP/DfjYCBBEK/NqK5Y5wc1WlJK4G9HuywG3KpuLC3wdq2AYAcjMSETi+HqtJzP8uFg1hhdQ177bogmzfvkgGMl10eXEQ43JSSO4KDqeYfX/MVaA92zllctqYbeqO9BL8FqqTA3IHJPDKy2MYYwV4LjlIZrD5jnW6znYk1ht1GnvuIMkzhjHXAEWj6gh3EYJ5j6oaEucUjLzerUu6gRq7NCGsDoBHR3KCSNoUYjBxnHHmAGN25JFAUbkSqIOIHMqToxKTb87vCg74xhjBtRjiUEOOu0IaAdiJqwbdRqiOwoPnXGOOQPcHWGiWEEGuh84YQs+maQVerV0agPEd9Au+CcBHbrlpBFoEAxCscYYB9Rsfp8EsuPyuBbAk5RPGJBh0x2ee2GsY4wDshZ8RBCTgxFNgGQCi1GnjbuDdM7YxhwH2EZAK8oSgI8wtG2WJki8r1e7Rg0A/s6Qm1h2jSbaqBnyr/Hj7TXg2o+T/pydEAGYfUSjR3hudduZfgRA01ZtQAa6dNsBfj2CiEtKoa+JIHIRJtU+F9Edz2ruOVvfYRyfeU5SkbJR4NqzJgpkkdZl8WGs2rWpbiLk1iNzE4G0ZhvRjMnamkEBI+PYBGYXuroIvps75iLQNNeMaOju8Lm4QGboGOeiVKDnOd2zCDrh6Qb0jJ3DtKanifFqPdQr9BhvehwGdnqIAh71GE8uKnWMpYxo+7DErK6rZwtS3CqhZyyuoS781mn0pWPKbmBeBmVNJ6PTAmVTT1L8z2QYZTNAqcV2FzbJ+/5c5A404MnDrG2LX3JcwCfx8WrXrejhZfcTkNpcnvjZAVCWZkFU4FPvyQJqYy5bzYYsl8aY45FqNPsnsNmtyTSPYMcadelxR6+2QN3hEdiZ+8adBHRbXU6Cs1z00IhhjtnBlhzdFKJRkngcKG48ZVVy6tRj+rXENrpzbY8KIqRN2L7W9XjkM40LH1cAHkZH19UNpRqPmrhG7EalOj0qw7h7S9fFg2IxfD8ioHvgC/O5zfesgsZcwu1oNBbuM6oUtzDu2Pu4KqdGPeaOLnFb3Rnn74MEdLeo/BMc8TuG25IXAFcoVsdlLt2GWoEybJV8GxAP5WnL6tUqqTNcLPObgAHdpV8W8MZMj4N+8+Pgzxhy6VqigoqFPV9fiEclU71e7SZ1jGFufl1mQDcEZQGvM+lTKdQW55UOg/oolmFl3NriKCzu5XNl2IbTT4sBvvY0qBRdbIPzQyP0iytbUjU792dy+JVcFNKslsrzMTAuz0bI+VGRwH0AyGI7IYl0V45Xy6QWuIR3kPw6SFwS6RXeL0M8QZ1XoF2fen8RtP1SbjKU6SEPDxkH+9oFpJknpnAAvkwyTdLh3JpDHAHbEMayRowqrgiBmo9z0oKxZkak3PRqhjN+FqSTZ/ns2RZH1Hdkwg9DcJAZrkDiJYFcTp3gVSCC2yN0DCun6Jhui/VqvdRHyFuprT42sJODsoBtwV4GinR/Krvf00JAorZdJAc3uWuntIPm7Pp2/BR9WZuOvAlkcWptBT7NC1lvByxIrXx/eRbQxDhdywHtcF1HE7Qtmex0nRuPOdU2GiubZClRu9ZRwDW5dyjC7fGUkn0jW1xUphQJop2fKGPK0qvdoDZQF3nTnDCwq59RwL1zMdpQvYKcqKNpNr8KpOGyirnP1n5S0yVSxtUjRhXmNHPlREqt0KaZmh5skBpDgKmQaqYVFBKCogYKKDxlwLiqphGm+XlVQEA34bKA1W76VMqVClshTEa2rkp/Djg3zp0mDYPKOwB5Oofr1dziaZBjYvMmntGoX5MoYOb1DrA0MZ4y65W0MOvqCfa8e43c0esWI7U+zUHSmGpXtmbMsEjFmSxXupWylhUgXcDTif723BQg5YtOYdNivB5+BGBXRnxaCtTRIcrFYK6bObJQRkP2loVjPf0YpZgqaeS8EgOYxukORvJgyg5gKp0G9WrSPA1TmNbSUHpszFk9Jws47NlTt6VqHFjYU2WiAk1gPS4qTOlpPK25eozKjAthqjhyIiVLsFJFSQ+2Ox5DiIGdRg8V1JhwbIynG4hQo1PDMK5v6FH0xTSqHyew65/JAo5iL+WJyNoDPm2Z8sp3zAD+YamdXhmn4S9WwPjUMLnZ4LKNitpdYeIN/ZC3Br10AL+x+NBzwyAAEjvTU4XULOXy090ZrgJBQ7yaRSAdx6ck/cTCyaiHHvqRFvIwDvH1dyA6WzKwgw6l2H9K8jx7C78C5dQMyAw6bABfMUfQycIgABAfdijXEvcyvE2/rt2My093YP+PCDj82juWCfVNCA1QfRas18GuT5g0AhNMcCcKisIVwN+23Ci7B3VkAB8wraP2h0EAimaqnQ3IRUWOqm2lo/JjzKJIWtmQ76rKuiUPod+hwJN80ajTeGRNpgCDdQFyWb5oKLQ2itAbjAcu8us3KPjDyCkd0ZfMqa1RsSHKWqRftC/La9D8mvkh9Ob8GTz0CqPF5Zv6JfIVhk/gdh5lT+kvSseBcZpC6uD4lKTnGJo5NdBDz9JQHq9WTf0UqYi3dIFdyqbAnEB0/TspCRDCWbsWsPN4UoXL+f4ofCcnOeehxxgcLsnoR0juMz4lH0aSBC+N/hd1vUBpFnMn4mMA4EF8AV3H1vfRkZh8HeBC60M14xKjrTA+YWozz34Ry5OVeIWFdtnWYrqL3uvqbn0XrS/V5E4UhfP2qhXJG5usVcfuL+Ei8LWakNnYrW4Liosd5ragnY2NYRayk2KsAVnW5fBYvlo30Rr4PW3sITfYeaXCAG6iwyETg0o4gBupc43Xw0wAO1+Qbl4+WxWwUDsoCKmsp2ejYGLJ/R70pfRGabdLXZMkwbHREF1N7UkYFw3oq2hOeTk5UrJryhSEFAnTY4GIK/ArJJqkDUbpMtqgC2z6Mho8BQOJGo1H1gO1k4npW/d7WtVo+tguoIAuouWgkVnRpAvDliwgO1HWF9BQmHR17wSi6kfd4mSRQldXIODhYq0IzJvmnPk14+60oahXGT6dGCadg/SinuF0YhB0NkmH/ubvndA4eeY+gtQ774dFAHZlTM6UuHwgmNFkraJQOGtXgU2oWl8rPC0SuHO8XR4GnUJThBuwuYdOpubJeLUO6pNwLbwpNxjYuf0U8Mhc80Yxy/OvI2zWOVzKA2HaXzd0HM0AwjXt0/HUKOt1jvo4+N7bQr8P/I6n5CQYOr36KZeeVTaW1w9wnw3ldBT1rgt5+ii4ZRjSr4SjL3XbINRuVLIeNCrWMfjgadrgNI5PSTqM2pBZmx46lGr1MI5V9EGwLFsysGPbFJBzuTbqru0PREP7P7x69gHvuxYm/xFhMvC3dww+eJLtzGjioT2ojI6e6d2gVWY7KQH0gOETuE2fsbfUlpoO3EsSNGYzM+1EWXKZVu8EdaVM0Ri/cchaJoA1F+/5pVBYfkttF17HB812wUgcM6KBbo3LYcG3wovMgezbeLfeehAsF2/orSDrKV5sQCbzkuMZv4j9s4l+yUpxyl+hU7aItYkYXgUaRhEFUdtYTuJh4S/8Lka1GDE1ERZ8A7uoLQtBiPb4WFQCifJ/o0DQmCF6Kj03wk60C3CbKHnajIKZo4d4DABsUr8OFFwU1xsR4QyfJ+gugIF0z9wIdopEKhy8nGiwNlJATp/HUIJlcXLEdx5aj3zMRQy9DhFgtulBCzthAwQ5bLjtsIQerD4T8vIcFXCeD3K/t59yaf814Sog5Ii0BlnrCZIFMAjTTwcAku1OdMVYIvdfQJEUhX2LJApnY+pbGvVUDjHZIr5QqZDyPU6bFnlX4BUQQjiiuyGkVcj0oA9tUKeVw0zFVbngQK9EsJso/vgGdsGGLCB12y9lal8BWXVQbBT4Ah8tQ7qXg2HnoeUp3RqPMelloOR5gCGgI01ZiECWS/mPCClCy/uNe/DdipHJlnhoCdI+R1b1YpAo4xO0NoNcdqJTf/08pnVAdFaEaCGSghMuvRBEmIR9glIhjDN2H5UbsqwLbOvz6zag/IF15j8r/b51RhIYRWNJgOYj6Udks4mT5qVEUa/WQj0PiTZFPY+dFGApCxwJvHwzslf7zpgx+IWghxsrzhrNKeKUyFonSnNSvFrGOX49pxBnizWniZivuirsZ8w5/gKhK+rbW4iNkVf1qjSIuCd7eXpoKMX8YZyX0YMQ7uQleWI/CBhIx2wek0UsZQE9PD1DBeDyJyEnn2HRD4Gy3ZVBUD+iZQiq9XrrvqGY+gNPAqDr/IoTcNvjmIGfY5JHOZcv2vMDG62VwAYXftS6L6gHEce5W7oH/mhyV99EbTbU8PLtANhpDHLRDe03el+/3i0aeyM/9qLzWovdmBVrJEIYcmJOi7DTJxFs0IfnyDvNipPsfYaRJgejoGkQN/R5X94BwPsKu+k9wvyeZVUG9hNrRqkTQdGZAd0JezmZow3IdkQON4ewqViqj0uCbbKcI9urqrrFKdDtsOVD1nIz0Zf8W49tvmROC41WGqL8NHuCq0CsGqr1DCvP8SlJrRDH2crQQy1J5IZxVlI3w4qxJQM7K0QBOX3lY4/wfnFky+A8daO6dLQazBoGBTfOJBIIWu4sLlqYv6AByDZlyofZYS6+M5D1jfoq8TBiHrpe3ZFmPitv2oQttOYK1cHfghm5ZJBZNfsXTb+tPafFAjduraNgo0x8lutjBusd4W/dW/CW3Ngjs2khudKjGgnLx3Z9CFQDnw5r2BpVqh56Z96ZM/K6GhbGpJ450Uwto8BbXfcP0r5AAeanu+KH8kO49sdPterLlZa2uDDzI8PYjZsVa18avBWpMnmGYZwh1hUwY3ODjYDODMkCGqQso/rT57GUNJg6y0lUBvfQsVNdBlOYWJlYgoIPk31um5lNsqyzTEkRKcuk6OeeXYCULZtSJfKWGdclBUnfNKxLM0nK4czyhqHP6zOhIJ4REzKEVAjeyYwJDxUNeZVXHQO6EESdaG1m2tKHgRTPDhjt1N2ywPRJlm2XyHyFCLxhCMfinOKsQLngVtAxXk5Fyk9ci7/VVikd5c25zPlqtdS5OAYylTGgOzrlPgLlctmbZXbrPrRsDMBR8pjOIyZA2WAPodOsOkHZicVlnOrW2Tic7GiVaiegO5TkJKjlqsGIwcfs4JAY7fOVoTIFH/uMVToqc0qXcUrVZAr7zj5W7hEhDcLw5ftQ+eRqkEMP+KwseLxsRUoHXckHGj2UluiMjHPaOhVOhS0Z2Dk5CsjpceRs8eP/RQG3W0y0erTcCE3CPQoAklFQwbl3QLdJ0wsv0Cf2Q4Avh6fDE5uF0tbMIsEvVM1Mh2hpU4XLl/Xm95qJjxkAh2gBowQQ3IFMJ6ztS286yvt9N8F+YTVjHOMc+xmLiSpOsB06MXFi5HZUUqmx8ii0X3rGfuOcpeUrF3vuexzthUFgUDSOCRwHEj7rZGQBjziPguCKVJQx9xGOY/R9Tr2NbglfvQvxSIVbLi5S/VCeJhxaXkm/wkrjSt95BwB23oSdqUAROIKMLeKhyHSoyTis1RHYaeZYjqhfS2SBMS899QKyRnUSFeaEWgdxatExheHgcSjfhk2/6z4Q7dAbfLl968Zpkveny2+C705AQBHYWLHU52y9E0/7gcjV2BrWo/IrCHLgT9lmPiswMyiXlmcTtmhkixAuhcBJwmZZRKHg5MTKOGi2wc2FrL+tTlm5LoqEvfL71wg8UilGox97GtbEe0CQj48C4dAAzhHccYcCh/vWaWUw0kNB8315zzhQ60BY8kdBoke0XaPytALd3MTsq6X9p5sPtbPSRD6hYiMVG3kSYG+GKrVmhgLSvk/GmUkdAJXMm8ixBHZKk0KsjRCOoxT5MC4ouxw+JQfgh10xKw/JDMA37Z7InFbip8EHCs6WjMq1mwJy+vxlK//3jqFH0YZlRSke8sLO4BSh9oTCYp7oWgX4kjQlTXDbuOmWNYHtXz5I5R5ngdMWMHKHnXcg0+5rOFavM8bdBKdmrwLRC7yda+gZjk9JcoU9nPUkPeQytE3L5PSYdoYeZMousNPHKCCnxz/UzUx6v1GHONms94iHHGEdOV2gHaAzGZ+gtUlkb/+HWp4T70qe8AFX0B6yPiXJDtZo1uL0kG2yrMM4Ddc20FxsycBOs1NATn+R1fKK/2gZoImtBsgKZt2pdW0FjXxWLQYZaiupLxIgAeqxU1Nifa4W+ui3T2Tfeeeg8uDn7pr7TuNGWA1AtVoVVxZSZ9zaolCV5x1F106MSP5U/yaWJXOqabQkpZLYSJmVU1lT0YX8Q+zht6dWyfs8PuO4UDZuNNhApoWRkGqlJrNkTNRjRNq0UNwzFqKR2iHslOiSzc3Hxb+hSNkO2QMZw+BsKHRoC2Q0NMhdZIdWtBHwKZM0c4I+kK/A5QfK8rkO7zsBj9AIBvzriuDuG5SBIxbJiA/d7xCq+cDOM4iG0AAdYNtp6GSs5xrUcRzcAz6sMmNec1KBDKDTaiwVSH+otaPtUFvrAVWYsgvsUI4Cci5lmdPdDe+BdX5ko2x4eokXKKqipFNoARPQ2kCjvJMS1h0gC+MTLGzqePnsb3LeEHlk0qobFJFV+KQJDTqFsVvz1FH90cc9NdRXn/uLpIkdi9OkDjXq8LpRF4mEY41op+QgXEdtP7AQ0FL+H7BohpeD/g5QzsI8qULlOcC1KtD9i+DOrrkrYhdhaMT8TwZO6czncuSUwrT3mE6DHdLKBAegZEx6eeaAKBb5SBmKabLaGmWsQaUgMuRlGcy1MRJATAsYKQLXHMi0IqDBTN6xL0t3Lt0p8Schw9WoOr6eLRRlxB0DnMwwkgJYGxO7DqLmRK0XzLTmdtU4iXsbxoydMhNnjiUPLoXmaLjTKkHDqYi8cCzqFHLcPX9FH2uIUg021Ia37CqSP7QCqsbhVCS/qqreJ8W7iuQ7V5894xSr3ZCXDQzsBIVVsr89OMYTJasfOOerPgdyQX6ZXfCQM3wWwi2WQTvAJLbsAjsGUJr9BnwAyV0/fiAlyPbhDPnArf1mFLUJvWl5aFVbM0FBBVWKVBBsctZa5HZk0N5ITRl257B6+aHxucYNYNi2bR1e94+KDm5YYHD/rwUb2MEBTnCBD7jBF/zAHzwQAIEIQjBC4EUowpAACZEIiZEESZEMyZECKZEKqZEG4YhAJKIQjRjEIi3ikA7pkQEZkQmZkQVZkQ3ZkQM5kQu5kQd5kQ/5UQDxKIhCKIwiKIpiKI4SKIlSKI0yKItyKI8KqIhKqIwqqIpqqI4aqIlaqI06qIt6qI8GaIhGaIwmaIpmaI4WaIlWaI02aIt2aI8O6IhO6Iwu6Ipu6I4e6Ile6I0+6It+6I8BGIhBGIwhGIphGI4RGIlRGI0xGItxGI8JmIhJmIwpmIppmI4ZmIlZmI05mIt5mI8FWIhFWIwlWIplWI4VWIlVWI01WIt1WI8N2IhN2Iwt2Ipt2I4d2Ild2I092It92I8DOIhDOIwjOIpjOI4TOIlTOI0zOItzOI8LuIhLuIwruIpruI4buIlbuI07uIt7uI8HeIhHeIwneIpneI4XeIlXeI03eIt3eI8P+IhP+Iwv+Ipv+I4f+Ilf+I0/+It/+C8CCRlkIRuyIwdyIhfyQW7ki/yQP/KgABRIQRRMIeSlUAqjBJSQElFiSkJJKRklpxSUklJRakpD4RRBkRRF0RRDsZSW4igdpacMlJEyUWbKQlkpG2WnHJSTclFuykN5KR/lpwIUTwWpEBWmIlSUilFxKkElqRSVpjJUlspReapAFakSVaYqVJWqUXWqQTWpFtWmOlSX6lF9akANqRE1pibUlJpRc2pBLakVtaY21JbaUXvqQB2pE3WmLtSVulF36kE9qRf1pj7Ul/pRfxpAA2kQDaYhNJSG0XAaQSMJCCbAr04VYTO1srDjzKiSlKZ0H6F6MkdzvAGfL0ipNge3Aq48pY7zwvrg/f+l4qccrD8oHqH5n3uAiSwHICU7qtH94I2yUDjT/VaLLgL48UtS4tTi+xMpt3Ia6WaUedYxABJNIDBNHBLjJ/wE1mY4oCBi9CFf4gQUEZEprEV+DxnQkFOsRT+7rA5T4DngrwGDgIL2c4AQi/xOcIAk6NmLI49Z15fX3e+/XxpWV/fVXwMAwMV3SIF88ppG3F5CEyf0QRWH6T+hC1+hgAXveOI75wL5NvKRU77oAxcLQiASLhK+gTLRbpSL8lAB+i6qRLFiveS9NV3OVgzelc7/MgYAC1BnT/0w+wDDckBQCORHvIayUc77JUPfT+mq+x+cAHiqbsK/V1pJYCPw78LNYsCD50q8Lf2KQMi//+m6vu+HR8jPICA/qOURQHPc1zTvZmpClsK/Lr030SYzfA1Jbjaba57pfhlrsTFmGmd8gH/+6woN4cYXfwLwChUmgaSSSS6FlFKLFSed9DLIKJvscsgpt4VmWRQiy1Mtj8KKKKaEssopr4LqaqqltjrqaaaFllppo61OOuuiqx7mR8mCoHwwyWffffEjzFDVISx6WhcCS8JWt3CDMMzw1IQkX6am0VC9rDfKSKNN4cBgw4UdJz74ESJQkGBJJJRIYh5SiZRGuGgR/oiSVSaZZZFLWq0VkFc+BeUXr5CiyiiplNKqqaSyKoqrq5H6Gmiiob8a66id9jroprnuYjRNfsqtsdYKq6y2koBABuHlxL1CDZosl7AG5FsvwrC7SwY4EfCR1aG4AbdsgSH5yq5+YcBPjhWzQf5yxjDkuQj/l8rEqELY8u7euCH5ImL2wJ4cVulc0cL8v58mq0/s5REWPaj05d2Y2QbXyQ+qB9PHEuQZQpiEsaEx01E3Xk1wYLWpBttjkpIfSLqyr1lMKEi2JAdOIxPiQO4lJx7GRm+3Jhs9zWbb/f4VJLEdpMexRLqSuX4btsugA1fCjMYVRHWk+3K6zChJRpnFygcJ+0EMBXulUYyDQlKiA7lQ5NFBBw6vsgAo5MuKrGnJUCq9trTEgawqz3IxXdnLiVRd/h5Wmq5E9eArGmyWdWIm36F4v17WJUCChG2RrG4lZ0O2dVNvfmbRH1HWnVkMK3wjfrTVsjrapi5CXbMxmMb9oTA7WCqQSeM1nJyUrGszC5kVAy/h5bpsDeKXLdTnecOKwQTScCNOtY/qLPSWPDfA45eyv0+EZc4Hr0gxCjOt7yNPV0MNpPYjrcmqbYpFf9ZYKZ160BEkQXfGuVvY8Y/aM3riu95NDau4uLN0QFS2utVtE53vkRFYKwVUu1WnC3PPg8kwXNg+M166nFtGZk8bIugUamzznriNbQEq7FH6U14OWNk+I6pt4RUJJeXspNRPkXRU44I3Tu/MxaiOSd6oZ31SdR6eZ7LaOCN6RHKwG0Sl2WDQiQCzznVoXh+3qj9CV9e/bDX+YzNI2FQQ/VHKPWZ+KU8Uf8q6mB2Y097HPvQIK3QAu6HjRhsL+hQJAgkPJDl1V75AFp0WqPnM5Hc/vuhooy17knYoGIwO29038dP+p45Y1Z2L2g2wVpunohwrjPTSEzrcvfl4BEiW8TgCSWITrDHm+zcdsKIaFCOblMTIG3OvmaoTWDCIyJ558JERvvDAyApWJDKga2mCYsjHKiN4jgC1LlEH4jAy/FBmplxxhje7ynrafyLMNVFf3TLINnqmG+flZO8UVLIi0s/UQGbplqQlaLr8SUrepnRJBKvLT+aksVsJa7SCRXwpQuqtE54vLV6J04LQAXQnQ3tlP4Ck58k2vlyfJnNhim8Amk1YNKrHWxcjGOIK1wml4wwbPQKmwUAWGWBkAUp70bW+FWd6+1vt3i3QM0UOwQQ9IvUFbWwr3aJ3mhrmRolBoRtBHWbKVLO25NRi2mmrtw1Bwyeja6q0LgXQ2APPkaxoRJFpUzVEwWnVpgyCvZHABIurW2JW2OULoLKM5CMrNAGRFh+XRMzYD6VtENSazmxuqgRHnZb1YtK4VY+MS/K6WnUJZoIeLXSLIJEFadyckooDGZEvvBXMQhaWf4MGQjkHdnSf2gtTcjFu5jv4BJaRESxuA6Ie7dcci3EvZDU7i8cdaXP+YzA7QuwZuNC3/gtAEurIzb1V+EYo+ILBM4VcKoGhxDDMozw7cdNKZil5AOKjqfUdNcteEtAaJkzOAGPNKw+ESe6PGvqi1LOCFHUiND+loHryuCatveyVuPki1oesyQagZSqI+avKllJVufm3JGkORly+aD7VTeZDG0tY15fOFsu0hGFKxKyhEV2IIUdAZ0TjN68rshO3id934lJAEESbToOACSDi3YSpKz0uJ+msawO1rWI6Q4sm7SlCkR9uo8a2gn1RxFgojWiMBk1Jt+7tbr8Pb0Evok3Aq91O30x2eIrFvCQ7C3SL+jTHjTJCzRrgMfQgnMfj2CeDMNq4XmWEfMNoIDDMYl8ybCeCWJvTzhVAt28kzfU3r0ArNVx+G5o8tLWrHtV3WAK0ikJ1jcuuN9TaM5LOaWcKrckYk9PsQJvA7sNPObzWfSqwrKyVAOTXj+gwx2yfZk1whrPkYQygwZCNqWI1ScXC7YtBBDGpB/5PpY6+WUyA2pULrty5RS9P50galOPdxQY0d1JBrNB1Ua1i2XiyZZcZ1Y5VzQZXzWpWRfr2kbUAe76K4T818lCQ3mrzjgLxLcZwogYNv3RFq0oy9ImDgiGENp2DERWtOTlHatuIFruhiZiCFjN4VGFewK/WSqcGbqaLxcy0uAySNY2NakONohSNV5VB+eRQeddXqlAbdqYrh7f1iX4Ow7ZmFP2pq2C3VXSRlemWTZUMqumKPrPYcIAu6k3C2JdOcd1IVOI86YTSM7Afl8Ug1U4HDLH+16DQOk/Nupn5CX/VlujatbZoNqd77NXT3DhhUIsZFa6cGB+4JQ+9abPpuGJseiRCv522Bq7sogA+CftO6E4SWDg1EE9vEjTDGCtDS7leo0uNnbG+MgzvBXM1vzMZZC1db3cbZ+06YW6zG/qRZDcXo/n4I+ROK+tVV/oSsHKT/aRXqPo4za29cWK9Ra+bru2J1axvMGnyOy23VfNZlnsHSfcZn4txsaIwQE2q0u08st86aCODR+93FkZLEaa5uz1sGQTUlRyKNV7CrsYIeGn70FUTbgLmY07GIc74BS76yKUFS1xmdn1Ihav8uwxup86Paz432W+rRznox140zlaKtwHUg/hm7S4kufhKMU5ORhjqC/3j1kgOD29lbi6EPHKNvCKZU/cebsVj7qkqpnsGG0RBLbKOL63yfWTu3xrz45Er4pCavWGaet8YpyEfW+ciuuhNqexs60mRJCuigOigN1ykgp4b5TlddvyiSYLBki7blrfqPN7CiBU1CX9ORR1jSiiAKYVeItJJ97Izw8reUUPxFQo1KvZUq53HWLrcWvzxkY0vk3FNNm1runt40gXCiJpuW9IM17AwuTXzy09byJt8/7uGZDq95JFjW5CVBhe1M+O5sAQljqqkqCtbI54hnLYiDvlctWpCAhlHUDkpg1nHuGrHOX7cskstCzTGpQ6jEbg15GeKFLvVbZ5NdV8XBYThiMs0vzcWJ2jGnNCe3pUGHK8XUYN6YWcjXCThL6sFU7/JxTxyRZrLVQqX2VsC02KT3bTB9s6lX3LTHkl9yb5stu7Na+jNvainWGg5gok6+QVJV8/YvpwCLZ8a+JNPVLTKDP9G/JJn0Mf0c30VTw+shmTidz/E4firrH8I1cQyUH6/YByl3NdrDUg/SAykACnrrAflnfUFSb31ZScbRCnFSFlzaW206dWhaEgAsMbRRRJd6xjsNib3krMvG/eiNi9Y3qk6V0+tv/XYNcU1J/qCCL/V1NgUMGOhMwTDWQWNSD2yR0tz5JGXBKKaPV6eh7V56mfpw6IAXaI+TaavINRMFnRTKFd2zIkOOsQa4CVRSlmy4IkQTzP9sURMfF9oNqV5MfqpuT8ku0PjxBgJmTBis13e1CiZ3yYYTPw83fCzQFcTF0nFvsIMFhOdEuL6oKCzht+SpLVd1lXL6DPrUgvWFy1Cy/Uakb2AsB/ZTh5hNxn88TCHDeSEHXX9WBNWSzgH3TI3ZXH7dC7pIAVu6LLsmqfNx7PrD2ywebxB0lW83ZKsQmsZ108MhTEdi2VpkpZkcRcFWaFQzSqFG+7WDdUnI4QGUFAHwUYNReB3rtBOLcOM5bkS3sETnNJz6STDaGHHOb1mDAHSlrymadZbQ/25ZRUIGm3yyAU+vG7e6kb6HLD6wC/T4rb54+ZXB0vb+ifM8XfqePz9tvpBCkpboj+vgiLJ2kcfaUPWmavkDfPwilTw4iwoQYQyhDwvSONeJB05zSovOZkrbD320T5qCt+ofLeLaCEPbx3z45lrSJ/RsYdnlmpAfRarzk6oACe3AdYLuy5u8Fdrkgc2t0kthU++ekMnTq76OR7VaHFVq50kWFL8XckSjqJRcTilv6YUMCTPMH+Wg1iy0og6D2eKSZm9mKvUBFHwSQJwe+fiGCArTRQSH1EiZR5p/5HWVUiVB1e0bzirQTlccD4r4NmxWBbKicgKM5+T4tcp1QKjVIqEZG7M45Ir4nm0kBdQ3E3Sk3ZzZBcYzTCpw6qcSUrkUkBTdZC+WRSczCjAVJhjIFstvR6SUKwNKxyzsRFDgR1LvIjFhmJVxUys8tZwm8KMqV4TcZFUnFaL6zNNOp3SEI9KdPEy3ln7nZgyL1d5mcW8BDmbHdiUJIzU2VzOVPisopXQ1SPHi6ipx2nGBrlvN+R3Psmd7+J5dryFNVvRMNt7uPL54nfv4h1CBj39FEmTcBVyVmCbqVG8u2pWT8Zc/3xecLcFhjqiVbxDbF5hEQoT6Y+zCcd9hWbFBGkgFy2S7HN23FOs5e+KQsds5crKHMES1igXdES9VMZIm28oB5UuOZPSnldNlwDxm0XnUwIdfeHgAV9drJWTB6y1bvHw9rmlMDu76zARU5DUz4reeo3FLxYbOFvBjsjP8Qewen+yXEmzxi32gxhTNxLOQXPuhxsJKLDt0/Hx/r+fGE5hrB11qlLifpG7miaER3fUV8rzpYoYYk8LI//ZVSCQqdEo465q2pZsfn46NFoX2RriA+/NkQ+rN84TnzJXSwtunYy/8Qei9idzF2R9KAjDiqSdVmkPCDpE73Nrc4TXZHyu1FWowvQ5aL6+EVbPAX5rSjsKVb011dZm85FGNY2RVAcPprOoY0VzXt6tT+8E27jN82NK0Wp/qWaT+MruU2GSkrROfAKJBmREgW9N/lrdPug7OHlyldeWK/83/dfcE3jw0f8nvJ3uPT30nBqq7jp7HSvv4aeOvXyH0+sNBv669R/2xjBQuv0/VDo0OvKr6z/PtXmcq9IJ77QpQKD/87yWcIUo3+rgYGNXegqLvGpIPClUbFiIdegsepXGYtN1lExT6bVSKaJVTQcCkr5SKAkiNr0kUCnU60MicQAhIFivVusRyA7pZ7KzIQIWB+WfvoGbN1zQjN0p42+LGEGlY3V7KZmBFMuSzlf39vefMddIFVUGpkFRbeqYq11hvc2qZyLheR8GpJ19ov3TkvyfKiP9u3D7Y66bO9KOg9DDg3jZzxpcZWwHGJBhw1r8h/1sOAP9hGJQQQwLYYMYiOLrZOvwRb+8Qco4On1qDWFALTDMX8YNxw/hpKSaGVOBv59QNvYqqvuCZ2fV7nFHcdDeTyyx4cDRP83+7SFaMTy00jw4rd9HKrjQTJqSXC+f2hia1oiSahLbElqFJJDSP+PrlonxlhFY3qby/hlftWSO3MpZmwCfpA8KRYwHRIEg3RDQ7UhEsATB1JAeskEhq1bpLgQKAIfyJMPD510fFcXzI1rx9wvzvKo2dZ7HPOBi5pcbmAkYCT/yfAO+YegITsISGHe/JLl4f4nbxH/xAm+Q1v+tICyRhfSIrNI+dMZVBZ2r1KhFC6Fm9SpA9BPdG/WVQmmFZtLUxvDGvviNKgSWK/Q65Ubw3sH6w+viz1MN1RJppWLqpSFjGYxVEmxFDxuUYcuU84+m1ahVC0OoRQ2WBYK1hyHg73/sl/8/0QM6myOKpG3Q1XdJp8oWL1EYUJXaYFIsAQKSpUYgr0gh5DadQYdq5QVFyOlqmi0Da7CqJWWhYqSyvR74CBmsUatguahQgNwI51gyXDGbRl4REYLhocv4IH55KeCTahpaqlKJVI3KpNWoTZpUIrW6vhn8cPJBYPbrjxV8Mtk438ezXk86/QDESh+UySgToPwx1BslLAMloKWwSqwpKfkDExQU3PugVcvKsEtHjTKp2XoW4N5svVhb13J/Dpuwsee03Q9frLo5vbbjxRy23c6a0/kSDCs8vJy+kn/iVmbm4xMr+IGHlxWAl7AUGvHthKWwFAd/k8rDPoczXO7dKxdfVAgRrp5IQttLy0OxKs8sX3TsD55+kwyF3TpRyX8Lhfyip2APDdLaYQ2EW1CbreB3ZnYu1auzODQc5S56PD1CYmEOr23V11GWk0Z3U706lwNhZS2gx9Nz0QwHvZMVteSk0jTU3ONxS+1sR26Ohg3sJKPboktPjRL9RE9cR3o6hFsNpeFYqDcYjrU4lYgB7oYRg1IOm6BuCDYBAUlfLZQGkW69NFAt1IfaJ48oJ/JghUJt0kPrIZNBrYCVTGJEeftk8MVggkgTU/m+jxrjkViwNxSOlRrdVig9Pa6jh+gnoqnpOreF5VToGCKhV8Hi5zPgkYy1csVkg0FSHZTpqDf/bBijPO2DiR12bLrcXF13bo0RixY7W85JVsCosq5GaXLBDhdSwICf8KFZQdgb8ElIpVgS1HXDkgAw5MEOwFVl0vbLqVEr+SVCJBmnYBw9C4FNkBYxIdQE8GpdD94TQtw2Sy/emzOa+vNH+KOtoOcgfog3mYvGhVPHaD40GbxVTcEpwaqY1+AyacaMv12hshFed15eC/xRBOlROFAb9L9GfdG0PMSJmkqrJvvaiDo1BMsUsAkOAi/+8by9ePyd4zjwHCudCxn12v89x+HEqumtk0Gon1hfv/1x7YmEUznR7b80/Aoai80sjknw/Uk8Tccoox/CgZ7t0qfeL0rgSYQG6D0ep4jFkyic8I7SnYxPsylPGbssO5lPs7P7GLuAn03QoP5AYMjzE/UhSwyrfSEslOhrkIjMJYhLjSDwajhk1So9IHBaUHi8YdIHDQfTLNlK3W3rHS6N3qjtJt2gMZYB6tYeWgTHaAZnmfUvm9Nr4OavBfGTQD7XQM1s3V9H2Jocskvp3Wq3KOS6C8bFg6VmVEeOhv2XS9L9o+0/MQydxOjmnZ50zFia4BZjaXVjqFdXMAkTKp6SKeVn/K6EAcA+BCHPmGV7nhHP1m3vF+neg0WWu63G0srjQ1WNOPqcm5OG6oMQtK/NbF90QjZc4SAc5TWNgVwiC4GMKqWKv1qRExUGxlg74UcKeFJVHvPlveBRWEqJBbUFsCDbFbJuIyqG8tniZ2zGO7uto3wpmN3iqCyrBv4MSOwPimA4xJPgGhHPWcJ/p/BlRSsNhCSIHldoTKhKZUS0BSU8BWSSqobLEUSVAerMJXaTYTO+eTOx+Uv8S4NO040DHinU2lIVJIKQzihXwEZobaWqvQW8Psryz2ztyS6Gs1dOa53UNQezy1mYbCGrety4eSzNwjIN+Ob9OaJY6JjECqtmq9fn5Ey3a2cD0Ufk48n1jXvqr8g5V+pje6LHR13QqJ96rP66RfHdrGnHwJGD2N1rhMg7pZVndbqz2PTSqjEPgCDEMwvwVYRypgkHUy7KRy7P5NHI0lyR6YpQ+g3v41XxhVYOp1M4mTuZfGlCRlY251jOqMJXNgsA/7TklQATvJKchuRUMRVjEVwk4JNeXgoSOasleofG4uh1rWXq8Uepf6DEZV8DFP+qzI4DKfhF7adrIrtmzV6yAwd+/9ffzRUHC7R6kwq2mHVEHKKojIgN+so3KotAyEyb89hJJw7oJH316OdBaI1GLWQwqyThITFAdqLvEBefT3x0elRkamulRCcLhCVg00bbCvr+au457pujxC6QT6ponURyErYhuQ6qT5oheMg4Gy4Q8Wvm4PkjflqcFNikOh+obgqbq1pbQAEJrVMpo6icFh04zo58ZhfxEWq+plwumIyimrNGhbpgp2clHIfPC4KTxMXpjcTZS75/5vLloSySlqsRNODIqyzqExjyi1/IZC+LuUWG+ZWFrjxzUF8xrS7i0qKQlF9o2hUqcrHNFTqF0D2Jr9MhQYdCZ/bhXO308wuMPBmqA6fIY7WvrMZkVtbVqkzsHVRnnnd0gJovrZuWwvN5M8tclWgoWgeD95aW984ILc9gb2IyN7HREYjLCRudDoSZb7a9E+yHAWWZ0WWHTcyNLOZSJnMGk2bw+z6A37imNGXrnWYIdtkBEXmg8/WAGp5uZHIzqCLqzaFJM2plCn6Aopxri/zi5N51GTERZa1o2ney9D13UZPGm9YgGliLNJUKuwdVooNr0UNY50HTotPj2is0Nz8qMXVg5z33PyqTUqDJcubQnFnDPaPSlBi0RXRfXo+nyg1KgcCknPGfKkvmk9jPWZwbbPYNDusa2LXBJZs3Vwb4G1n/ZzD+z2Jfhu0vs3Y+pMGe7NEcZe7GXPpeejrzS13wipbxVRaadSYj80C77YE1kZXfLwGj/pSXzaif8RgqekgeT3YmjTpgSlPJ4LdjnemLYFhCJ1RLFVIoOmo6FaJkC6ng1q1DItiGqtX84wHp9HaiNRJFSK8UEB5pW1Rzs4ZFS/eYa0TyIKwsKveI50WJSssRtcqmn2euH2cp/xeJwSCRGvRmCXq9VKI3gL50s1Dq/EgCP2Tn/pKMludQcbbQy5u+ze/08JTMkC+UOeUwbvh72WXUJxP0kiX/si3/Fs47InP+RKC1I7FCd6K7MHYBlOZd8iJVzEvVSNOioB3rObrHreKkHuazENhiGeL9IV4LDoRf1p42rmBsvbGur9qybVFsUoZ3KOARd7r6nKLOID4EaqZXwGMCuKjT2ecSdwY8Q15/xsKYZVt137qtN8DdcrWHzbcxSTvzgkgT1oQE86zOtwpOdSFWKCCTD6UjYZMDTtD1OWfSk5Mi0AaBJwYnfVKXkJQdVojrYGteB9wUZPJtC4Pr5ft/xTaP3oyBdeVn56/7QZcBBoPieqATO2RgPgyow/YBO1CZjSYDJij+ghRs1eocoq/0xYv9wuTK62t/S258f1uCX3VAUfJvrtaLY4kYJwn+OtKUFVz7/o4ELDM5sWjs7qDxwKibKVVE8k2Vsw5xUf113VXdyetAQS62HdvAOhizDJ/BQgCElNadn6qqf85+wY6e+YG5MTcIA8x828R7jWDIM30ntrODMOQuVMtchi2TzDSCZkYkeBw7njo5uEYfn4y92WA8awnrgKW8S0Of6j+9LP9Nv6etJEHgdOSP2I/aRziljN8khh8KUGbuVSwlgfFxDrmR17WcJzAy2XCBxquhe+mURlVXB1BL+f1ux9qJtljffmI/MMb2z8U4ozn6Q5HeoNyOnToHyFKtM+ogUyMOzEVWfMCOIGf6DkE4fkwBUi5dzx3dOjc7STpHHLgXKW1lWItt03Y+nlXzevdOXBsxNiZGZHmnWHkf5nmLdYrJH8kOnUKnMh++epZrBuI/97Rhu2u2p2BIy0HCmFOxPWiOw4ySN9AKy7tmobtLOn5Fc4PZgm7ZK+4uMBt9/4DffngCXbfylFPVXOyD19gJTLTyDXWtbPUxC60NH+XB37JzfyWh0/KpOMsDyCGdvk6s/0tK12Uk8CmwrYEYClDSlfk/+qCeg30gYbt9GGlWQ6ADWfK+7EdOXFzJT9Z1LfUEPvW7+b79gyT1jdCZGPz3EDtmP2FbHs/qHUx0Hu+wEHO5sTXhiNLNJv13O3FsrpFBA8hc/gElzmXy1XupSbF59tR584nLsozp9d67alnFQ3Kv1To3i0adM15b88j98ThqeYZX0OU6vSrUILFaG6SqaoO2KFAqXxMhDokQs1WPlNhMqMus07x14UJakU5cp+24S4WyKUJq+ih09uAFG4k391qzZHzKhRMZ9DfjgbI6s670zGPu4y9W2Qhi4zECN+eqQbQF4Nm6iWDiUWRakDqeqKzVGQVcF7AT2Ad/hksN/uKy1PPCsJzv1l5+ZP7AX3ZVb2x5yRU9Ef85aD+lq8ht1+/tkzvY6xDO9pe+tk+6ielFS/dgdOzz11FfYNrVSWCAoJ7q/F6sohJgnso3fDzAIju0tVeoYUnwfig9cuAeIe3mJrfOTZ5YfknqAxu3Yy2YCJQP0jHEmTjj+tMnoB2I2BcmEokL7YAStivsILML0kDMuWqTh+6HqrKyQBMtpynm8XyFl/5GykEn/u71/lBeHgvQdEOlpddx/MXvOTlJL+I8QMfaQWGzKTtYrKN82Af+UZDaNT+QWF8X5yWEB8reer/bbZ+w6trSxAWa+XhiuBa4CUHyxamODrcGeF1DedL8O4mTijvp7v6Y2ppyPIEv16EngI5WDXHdiDvCMS692iMoUKQoayS8Ro1cYzLruO8h70XAwdUZzVq5YHqJxhRJtwTskbZ0bhYf+vhzV7ZSjIcK9HrzShJ7RoVEiFqu+kOaA127oKQv5jMseZ1t2LVirA4D6hT7gP2bdfbssqer3041nHFxDjv3se9sg80DzOUf5wrGiuUrVzIbMiri3bMFYbZ9pf3mzcZg27Rp61HAsxE7iB14HS4UeGBRkBxhB9KO1ToJoOiHj7xs8dGHKICHULUZVbGU6L0/0zNnU1DvbgA1q+c4o+sVCE7fmjcdu34LXKVHF3oOL3Q3x7V/kq+8M78tDiQf6yciGgUM6ZSwJvJorTLaEBLAEw2u+LhZkbHJu8GY/5/7fbE9XvdDsw6Z9twKISOiRwwIXoR+wPWDSHT/GqEDBsIAAKdyqtHJ2y6e2Bpl/Eb/NXpyK77PlJwtzkgC5qT38Clp8miNQlQdJM7+xyowHvN2osZ5Pg8Bz51h8jhiKlXMcdAsz2aytxUjxhLHDIexBCnexrkzkWRKUH7TaeHIiHB7nSdS3xZA7fH5N6okzYKGfG6HYIagAzyj4f5yZ6dUZimKvqKY84oLzBhbpvLkF9qlBHXm/3Io8z3kLGv+vu/Qt4MtF6f0hKEya2XQxfiufPXVp18NOrnfgaFjg966gANz1vm92LvEu9i7IHujzMdWGDtDc/7PoynPcvKKsialGlNKfSql1R1JpMTeltrqyoI0V6OLBIca53No4i42vehBRSo6xu3VqiwuTeL5v3vFJTGiegx+99ogk9nHto65e6OPwd6dAfgxR5ta12Dptuga2tQOZ+sGtTYTaiqKhF5lt1LoqRBoNEwmOlC8SgnsURghyTxJMBUKwzwKoQAyBVDmsU0GFERyrtnJ511Kl26DVr/h7Qq7dy6sCLbJXhYXv5TJlp+Vkb8k+4dMBtpaZRFRvMguW1yH5U52LqNS6530ySV18q/SJkpGld7iUmvE9FruzVJKHjftK8C/YMBdCMIZg9E9EdidUZSfxuOn5XNH8kUjgZgsuJEGYygGVwuHLniJjgpBGACp4RyyLP79y1ZV9P/UkjbyxX8oAvuTuHf8SyvNOg9YLvMpz11rK50+78Eery9Laws2PvN93qarY/S78bHoGN4mR1D5yR8KH5aMx55snMAyRK1HSIqkk/ufvQd7iAGfx0B07MR2Tgf6AWYJMaysAtIlS2X8+S4PwxbD2ums0q7V1mdz809KHZOMyMaWTdkBr+yL2MXpSdOQAShWeolulRG4S7w1gjfWnU4JRNasrfGfHm8M4tUe1oaNHijqmckz8PlyO7GdPRgbjsaGxX/XLwoDmay/F98vhRiHQt7Fn0t7ABA4MMtc4flT3oKf7ZkGpzSy7R7B7s7/p3UuKeknXWqY25b20gWXsprl+/FAQg/NK7UlvZEFv/6I/fir7zwvnCaoRk3ciOViNXPeQJL+mlKpUoSv5aH9SvqGfkC5rkYZ63RxpHCh6khJLOXGYQgggw3QuIHASwrg9NxF1845H784cIpXv8hHB5ifnqQ5/ziAnaU4F36u42H1i3VRjMeE5iPKsO7gOqysOs0vbWVEF4UxFuT6miwsskmEfspBcr+QMbZnG3arZrsSi5HTQC92N6jBWub+zLBNUhhsAIIvmIzOG8oL6ZVEC7u6o6A123XEq/cTnmUlVj5LeLXDVzUQqTpPDIyw+CwGWYOc+uiinqKl9B7W/ffejv5mvZALiMbxlF0a+gn76XJn3YtgUGaS8iyGpYYqkIq5x+rOYTH88a2ajc0Sz5KcHATyASbDEaQDe7ASklvK1Pzs1uHKSrthFFyRz9JXh3iFx/FlleAq6wplGLiiU9x7eSj6nPXcj2qPuCa90oWfVNj1EvG71pODYAjLxVZi5zCixV5Q3hxWEfT5dfXwSztu72XI3+0erbp43icV5WlvB+PwxgjeShgqaltOj/fXrF0TCYDpnrqpmqa/oBadJivjG06PVdvXrJ2sPj2h1hZEFKua8aYSIr3U6Xzvrl0e3unxsc5ZxCww8mf+heYslPx9wH7QzBuVufPxAX96VeL71gx3vQ27v/NG+/sQIPtnb7QxOMHdgGqe3ULNQqZrop6QJMpNJZLedGscf+fwATmP/LB2dSiK1V0ZEp8fxmKwmjgGIZzyZeM2/4a0dJ9S/gu2jiv1jOJ11ZMNVNjld6sSk+6ayqpHHXuU1+U2IEaIhOSee69T9MQeBpoSPbkuI/FaLVaPySEl91TzQL0mv1A7Cqd/AeASBBsrt5N2c7Hdk04c480Ubb+4J7oo+oL1ohlg2/usZ1vSqykB3Guv8zzf7O+llc49ygahcGaS55Bl38RNCLx5InAz4n7EcfuHn43sfsm/Yr3iaIq2ehRhTVCJDothRd2yE6cCL1kv21itDbJHjJqQO0tLZ7GUsouvlCe8uuicn5plZex+kJ7ZQeF6uSrUos7RW8qEbXQvw2bl1+xQJfXz9SdZU//3DCz79C8PzOgSbhEZpAw89crut7KeSNtsn1kav4QkxdJz0RT1PKvGGceHs+xZbNKjO5jw4HhGFutYYbn606oEDZ9DYs+9UNLMCzdxmzgxXgv31v4CSaeqqk4lXf+s9fo2/SxG//0VNDtUtGfjNzXf/KWeAeGH+R3L1I2UnMl0jVdTwIZNzCLe8mX8RjK9nJaQqr9JN+WBqbLt1J6ILAUyq6C8yKewWgvErFdl9/b88tItJoXof9tZdr6VXyYqM1iDfGSTNk2wuW5wive/p1PZJ9d/nnodFWWxWUrZvesB737LS2k2q7heLqUrIz2n16Xg1HQsqGSx42npOxOS3/reuHgvCxB8tsz1wEne96y04vs7UzNfkfMeZx/Hd4XeOTvLvQQ2z3jwiePJ3bfstXhx1aWAZ1PKIezZtIE1BzIybuycPcB8nSWwWzZemwapuVQag0pl0OLkv4824C/JdRuH5+biryA34C5o64rEusDt3mhXVVMXmLZgWVdpV1fY7XQ5AT8kQyCx2OOyvtRDAdnZcZRrcd0+AFC9lObZPGV8ClCkIbTC8VzXOebNz0UcmLPODttB3DftVko6iiFR9nMmPaEd8O8oz3z9PW+uFsg6JjQ+kLqGd2UHUgLvYvvEL95F09SPWZZyF2LmDMsfy/kBki424P+bwMVWYwoustRf4YVjHJP+2W1m+2mzI5hgAyM7iZkeMf2ivtuNZtGOc9MBnO2MzHycTjBvz9jMEmV2ujPOzN++TP2Lp2mmmZuusxnzZMiQIcNiiy22eG/zKzDqX1H9McVJ81P4nJLklI4lRVUpxvwkDgrvlPvDCsq2qDEwjAWsUA4dFL41PlLzbr+VOwdNMGICE7wEqnR3bJ6JRUxw51g7NbQ6Tqava4S5C3VAeMsy8wXEhsdMA2zpxDwQ8LSkS+HyKJz/JsZYNRy94fz8N8LaMpjMw4z3enMnAXqkGtHbZc+ZAO5f6Arh3ArhAWqbXMIU3dfFrz2Qw/3vhqnxbv4ksv4bqYKnTjwQZ8HuxlLy622QXy/Hx+vIaBtO1i88M9xuC6NtjwXwuvntf1TUgvtXhU9usGj9xjXG/oi5E3b+If/kYJzOHluvTXrPxUbIaK694Qt8XxusotlonDfeKb5DN8ZiTjqbsYmf1msBvn7WsQCbg4vBtddH6c9HURo/PTMsD8CpyZsPvfrqw3Xzcbne8KN3g8u+x/GL0kkwwBQ4fFigZJaNLuj8IQDbWI3o3fWJggnlVF2qIlWsSlSpKlOVqkk1qxbVqtpVh7kTdd7nAtONfxnTzchzzXn2m7sIYOuxcwH2P6/2RU0B+0t94PfyNoifBvgPBs8TMgNmSh7ZTbffT3wYgzxoquRYoOL59QuJ/YAUdSUPJ61OMHCjTJkoBaPchWO5nA+YXX6/6RQwHQ3tggAT4jEjuGESDXnAbPApZciuylRuNQyvAaVJsdumKvvpaIwzU5hOgQkaT5Kv6pgBCEqfh4h0Rjv+10AH/iZqwqC7JJgb8fBWVMN7cRY2sp4vuRcd4xTYGN0f9shR5fPjxTZw7+khPoE2sMUvAGhB1fJZEmuixv3shaXZKwTkh90P4YTt4XoS3uH0AoURsUI7CFWUwwZKaLQ3x1lox4LpMo6hR0ldhri1g3A1ewudrqtryCgsAiqT4TMIeo9jiIAnb+xCx0EJLRNLhNT2pKTbR2A6eMrukNzaEFbplEIzB85TifXlkEII8pgSlOM8Seo40ek9oLMM4UtHgyPSh4NcAe4cYANMh/c765OsSMwFLJfZeMsxD2j9vZLv3F51Wg2aOis7fOn2wxFnjoP8CDw6wAZohPfOQyJHxPzDHuxsSA1PEPZ8AykTBZS+YCza/F+cQDQhFQOnMiF1VvEhprgcbwgR1RZGwlq4Cj9JlC3sJHsor+Sz/JUpgpEUumS3ll9z9xMaiqcslJPyVrPFEvE7qUnRyWH5OuWhI1KtqV41T61QG9W5NJsiTFelm9OL9Lf0KAWjEqksqqrVs0ctmRacPehQenHuhLuUu517kruwb1HCYmy+33t/Ge/jS/yMX/CnhLxVPiOXyPfkn2r1jLKqT42oRer04zuFpwozT3+EPz/IX+bBS0W3kQkSJV+QVfKA7FPmZR11Ug/9hP6O/pcJGAH2BTvk11/r4xFe4mfumPulm/MuXfnQ+5n3tXfO/vq/8H/j/9E/bOUzUzLVmc2ZpyYmTmRMlEw8nhWXdSnrjSxuljirOmtV1iDZQK4gN5M7yYvI68g7yUfIH5Kvk78mvyH/SRlBYVMkFDOFoEyjLKdso/RR+infZadmu7Kbs7dkP6caqBXU+dQV1GfUN9R/aUk0Bo1Cy6MV0uQ0Pe2bHGoOO0eQo8jR50zJ6cs5n3Mt5z5dRTfSH9EHcytyf2E4GZeZKuatPGfeH6zbbA57GnuQ/TMnlVPMqeCEOYs4/+Hs5Bx58Kr6gxvm3s5X56/O/zj/ev7T/O9543gYL8xbwjvAu8ofx6fzYf5M/pM7/z5RUFNwq+BV4YrCz4pyiqYUrSnqLTpWdKHotsBTTBXCwg+EV4W/iUpFdaI20RLRB6Jbon/FE8Ql4qnivyVUiVWySHJXSpUKpCbpdOke6c8ynswvWyA7L7squy37V66Wm+QN8s3yXfIr8h8UYxTvKDAFoTikdKjiVDdUXtVC1WV1ifpbjVOzVDOgTda+qy3TLtAe1Q5A6RAV0kK1UAv0p24XvBA+CP+MaJHn+lb9C8MHhqeGn4xUo9JoNnqNUeNy4xXjfeNwhmSym7ymoKnW1GKaaZpn6jKtNZ0z3TA9NL1Gx6MStBV9B92NfoReQ++gX6HP0dfoH+Y4cxwMzr8RAm6xTUzQByXgAQB+FvW9uvZ+Z9eucwQRV75tgFD8uJ2wpL1alL50QH9lOym7l2UB8mkWV75PAAofnvzt7b+9L8NYgAKqrjVBg3ZSjkDE05kVBbSQ1saYAyIcwleCwFx980RPbhf29cS+p7Vu58HWr0DN4c8HNfVqXAnbe/KwWCgPgbmPm3c+B+MxOPuffjQI8QgJwFTmjRbsrohNS5QRQh6v62UkPBydRX7cGpyOsPeiAKmzo1QupqZyxfFpmaPX3HTe8FAxmRI4iQLl31sVQqE42iqpFyHL4oAxIg6fmqh4QIvze9qiM3Km70aqrGztnoxqaf/gwX5oDnzAd2hzyhQV6utGTN7azyS62Oxl5pOQSN6CT20nCqwJO5S59a3nDNty30lPETWAq0FXGBIohLzrSjA3P+90vgb4dNGw/kaS6Ff7RLqU1HFviLkSb9tp/a3QKhtQgIs4rmQsm20jiieJibylc1fSq2Ya4x7exhdErQZJJNSi9qvruBIRpGYUYLTys4Cv8xDsVWiJZXAEJ743YXRz4lsrqsFUL9G73FrEEIMd+cEWnhm9aXIVR2JhktaPljaLIFu1SguswKpwaFkPJD+heyD1IZ0cKUL0hL2UKQNiaxcRjiHlT5+gGPbJllfNulc9O7YnXFmAfzGi1GKdk3KB4TpavzyR1g84gMOs+qdy07w9Eg+Uaru4uRxr7vWAjdhpRS8zOarH/bXeldix/+A3IN5U6oc/pS7Fu817X65oYCJmSirVpqoGXt6tTD5//BSsXFc5SdrwN9u/gTAQ3uyAAHZfjK48KZttoS8rFaRv1whqfMQZ4GpovbjrJDA/1r9NqVy0+ZvxbYdPoMpcS9XuzuHO7it4z9AC5c8P7jy+c5Chx7NYCf0fqLBA6y6s/v8D4Su/AfGa0L2Iit/yFfjq60xjowRp9ocMKo7wy/aY8Z88uFiORDxfUm3KXtk8W948/TxIrxxuG9w6mO+W7lElZc0XS0uR9JdAiop1ANLyhjCzBvaOO0y7XRoLISnA9xzNW+xYvfDDOKhc/edWB/3LAoVFhzbLYb2vT9YXUBE1ywXmZDcfZFfYA1M3H4uXeA5Mgi9yawoLw9haHGJKRfrEEX8mLwuC7FAD12qwNAQ7Fcqdf3jFySLsdc8fBJt8X+aFC8zrH31/zLJ78+3wzwdksuA4ea1Ph9URIvngutXDDQj3J3ZKE1mlCIrx9ifi1aWY4X/1+923/1kZAFPgl1QY313XKxuRQ/7sZDy5rx7YLYhwZ2ffgC9e0nv2PzrsB10sb1H48EHjdGJMIpHoVm3TGawn/wNA9PyZRlVFT+bS/G7xSO9iyamC/5oBVeWeBX7/pmU9yEceuMvKMFH2LadtFtJjTauGut5n+L+JndWLmp6FA/vDBNLGjWKyDrEcSzD6PhRD/jitxRtAhGWDAnXtCG76hBvCDj17syrKEAugwKcX7KJmdASJrf76LuyG0aUOySXH7sRDPcVlocY1IBon9GaoZDxQFKKyDMfe7y3fdxL4mWI3gndU54bxiNS6A7OEyc1F+oPemhzxB8Zd9dvoYf+HXjE0QmYnNnAxB5bwfjchEJXISMRe3OVOhwmyUHWey8ukHbpxveIeeCdrWtImCxvKsfy4tf05uCP92+O8aCvSfA12sWGCzOi6Tiv1E8E+z25EOti3nwi1iZn6MUh1ccS5lqsLvzwwiSL/IomXWLn/XPXk1SRpbHIkMsD4EJ1mAmyxLSgdoXBNwaXsFCjgWnhuORX4CrsmQhgj6IDhN5eDq/ViVDP0cVb282Qi8zUMHNBJhnkf1/Iv5QoLk+/ocG6cCv830kJABITV2Q+8iEpo5xTdbAl3A+3mRrzgEGLciNZNS0xRspMVijWrbggmrDVF+LCNcH3CoQR5+R2C+wNj5uMV59ktIlBF3c31GEj+PxRCmS1RiwRmJQnREFIzFESVsQYcuq447FtSLOs76loEO7Bzji3rOjpkxEEJP116Fbi5eGLoY2vgqRorZd56C4MAXKoXPKoY/zC8+aqOCDn+NfxM6oDlhD1/ZSLSKSM6wesAkdv3WlsiJEKS54mgOfefG3nhTxGShto3cgqko/yYL8P/0rfoyGN42By7A0E0SPK00ulRQDDyrJKQxCWPIDJIhsQDbbw+KU1n0qVlTnyEnM7L9ydP4heLI+eXsZ3Plsjp8k0Zw1Yp5sO1wM5aJS8lHc3hAPtJyBYeEG9aO1Lc2brhaWyoqsIBHdGzQmKx34NGHPplPmmA5atwfT79F4u/SA6MwdiqhDAzNODmhV2gA6+wzVgiU7hHUqxYghivqeQboP0BC3hQpQqsF2brUYd6hPDHqulW9Qs0QKMwnFuDJSGxxekjBwR26pmoYEU8/TYs0Q90LTU04Zs9vnoa5/E/20t0hq/NhVkQ/HrfI+g6UYZimhodblMCSSYPoR51dei0xBSsOcBeqcMRO/Py0e5XJvRvH7jGxOfNveXw6UzlaK7E/TKlBIggC3fVcJSMnOR7Az525sQj63N8bv2R5fzXb5fC3H75vbExPvnbm6sW9JvGWKvNe7ZdpHJmh4c8/pzrymIYPBUScKtyv1etmWegW2XZaTu17N44lL3PSlaBzLr/fljFP8x9TEDyawsC06oz3dU/rXbXc8BWveh2Wp3OmR4YgMFuU43RFzOXQGo6GXV8ju0ZWNWcYA/MKnmYf37qQJDj/6gx9hTdRf5hyVWsvIDN4m6RK9suhAjr6Sdi/3Za/fcLcHDYYf+nfy5/Mjn7bR+AL352B2JwROvQtE0FFLnwUrA/sE1TSnpQdA37QUDk0mHgFdCimzZ7SC/9JoQnfPCohdRhGVmhm9zCZ8Mvzr1Xk76D02lBIIr8X8Dvm1JIxOP9gOfFbdkD1epeNvUn/r0hXr29U23dcsQ6N+wGA5XGjS0srKuvdk7NpGBXg994BrAEFuTqGUUKbIZNz0u1H19NU27nskRHoUhOBCRKwddBfGUm2goB74ZkN6nMDBmi4YZr1hPiWrS50NxgFQIr/6Q1QyTVSRG8D6kJKnvf96pGBUSxmYMqJBHe1bNz2mJYbt+801FXXiaMSGQcG/kb2FnpZtYqo1VgUL7FZI2NbtoTiD3fYLiQkQNFcFMfrFg0YOhXpj+blktiLnQGhBDItp3i9vm0kUSTiatiD4ST2iydWUMXYR4ICcypnjg6Axe1SDy903dT/zzzawgGYdnevqWqycHmaDq3Hznmulwht6TUIQXvD15pm7lZXGEoGMuObVvRIYMkbtY1p9OBDwcE9wYziubHoT/Mw2oc0h5Ng8Ltm1BUhKdLQTGjVrwAbjGmps5wpcFxOYb9h3ONIFn9aLkgDDzBK728EYSNdDV5MWxTZdLoDGlaLZ2D0KuYRgRtPPS0WsWKrGTIsH4pi14k1yuyPw3vqkH2z2hqiac1TwL1EhlHlQrxrkWqYysdbIxRsKtnyIXc/OXT0vP8YomoV7JvjK1IlapuO6i5os34BvexOc61rkzeRDoXllz16naD2s/Hrc2zto2LIttNEgePY8QV9ZFzJ6sLSyvpXPa5zUxSFUUqP8VgrD28IcNrZKeywg4wfOgQ3PNNmliE9DQmH/mBnHJ08f6thYJcPNsLPWauZb1rsJAM+EXZbHMUwQ3S2i8gE3KylSAV2patdVU8t5CmVFMtn7H3b9jgpxohwz4V+TJslvBu+yqL245LQOzc+F5RyGy1wMOCjYe8Jh9P7dBFuMJRYReSrgqNfSlsDph7qqKxasc4xOKDm+oX0mMjSeraRUXOU/Duac7OC5+Va3HA2FcEp0tVcSCNy7v5Y7kdT6p38A1hFBKNv3uNY3kvdL2q5muFrQ4Z2BWoo2QJRwVP8UwtvuebfZozVBK3Q0vbRZaVxdqIbkIM53l/Uo2FQ4F1W1cxTmPBu7HdhV2HyE4Lp3gqjNG6vH2DtjV5pSWENtuCWSqGexubSWVxh1kfNRjtQzZA3B7Gb1EsK3Xkz2AO5o4GY8g1hssHpUIHIhMdLz3kjnSyCK4zO0330IPMnb3Gp6neEt+uAmXAdSVzviri7v8y3HjKG1qXKMO5xLSQBqmOM82/Ay6fgJAoIoZtJm0jWb7jHGJtzJlXnKiZVHxnVFTdzOmjpriYTGXko64CW6QjiwOr1JHr7MUGnm3w1xKm0kXO0E0d5K4YiZx0+bGtvdx0aPUxCEwqdyFqtjEmWqthP4AeXIO8g7jdyuPhBU9k7cOqkwWwAgttJEF28whxg0HZJgdh4rAI7IRN6bFuUMRGjth5G65GwymOVq2YBT7p0Y14bl7zXmNsGkTBVCidcq6WKRl+kklAFVXtWhyX8CX36wdgYq278FNbx33Xp2AVASlOYghx/+o4z8SfK0/hc8sYdEHXEZlLGikgu4eIeVmQ+tYMOx/UchzGz2NBHxNvFJzTV9RaQTkLi+t/+Qbbmsr+LlmBuq8YW4a5Ne3sMJYMsMNdm1LWOfUf9RXyHYg8cddecQf6SL8IUu+mzNZKX9jOStosMt59UJvMEE9wYjO16KEqOc5QKIVrj7JPz8w9CyuUMEE4RLZwqPlXtmxbNrd4tLwujL4qI9ETTjVJobNFCbDecWDHuCmiaMcfS9D0rdLCKZIajVC0rNPqMGBV1BgGsQ29OJLnNnYwBdrjkliVaMSFqlgsVHQ8liE2MqdPJaiIVvFOQdLJzH+UiASLmLl9Weimq+SbOOObKAs+4xwNZ3yarbgSroaarEs4IAgGhxi4IiRDgCpP4ctGDzU1VpR0PASu8TiUpZc3Kaozs37R2X18Oba3685g/GpjmOyFSXoGJG8UCiE8M1Hc3BMxNXZrYzMxWrMwcvrOYiRtbzv4U0kvFo8WC/4oW5g+LM/a8Q03Gwt8MK+Xo+D/S5aSigfeSx9OlHXw+WPQOuw7+qYFFWP1OtCO27WE+9h6ADwJJchZid3JBrwLf9ZqyUWmrVFiOTSSqxqExN0gB7zg8yaBqeaUbea5XkiFGVnMrCikPa+vWyb4rWLUcz63mfTQKfG4NWCc6t4XT0BGIU2kFCBvTppFIfe4N5Y1Bz8XToHifJIKpXnFmKkqtwUn8RJrpR4jDLUGp49noMDdsm+6V4pv2E/rslnLwpvts//G5L1KeWE5Djdnus2XGQBrpiDIyIslbcdtdmxaRofUNsoyq6FgtmqCrtIfur9iKp75KJlUN18XV6sdM1k8NaZfL7vzjUh1bWWHtGgLlJIP2IzRB3EUjyPXPfSjwTCmE/2Kw1POjaRQSM5KGjJKu5M9a6Fn/Tilefto6BxWC8SVLskj81EjDemIFcHSZhPKZ3Xj6YULQm4aqX6M6ukLPrXjYCdJXBuP3lQGZWrmKrhHCdzgDSkiOjgv24gucrLVEXvVVfoewb1FWetp2iAIaielmtYjxFxfvxTQM2xSx3V+sA3m8jpKn36sQd5ryfGwYTg1ymIuuNBjrjyOOwGdqhI6B4Kok6r44tUnO27m+3G1nhoPi9+sLsBDhaoiaTuebVx4PVwVMiDD++wBFVL+H3LTizJU2PPPSyrVGzI4fjwoT0zisZLH5yPruovIRQLRHsSvtICVxgdopleSKEJKVbUl2FCueR/1RUypPcuHiTis6Wof+FbhAOHVpNTJzflXgjuGF/RqhrAMWH2uK4dXR4k0m1HKOBo4mnwYT56fUsn5+71F2NLDziech1J3eJEoBamxVNFaYCErEg5O6diyRKEobdB7mLNIC6wo4c+yxtRm3FgiMVOLLpY+OFTj4IYextQ03ydjMy0roCMuLOtaGMurs6UIGrmqiSNDG3I4ZlFOeVxlor8vSCYpi/toBbbw2FkkthZTE3M02qWoyIyAd81+zoXjCVW5Xa/2+7DXEqCG1DZ6BgTn3Xgu+dIaNUb1MOzAiLFR90HOdw4n4JZNNpjjfdR+q0LLLP6pwJ83VoAryzAGpUgzeCAM1lxjJ+lqceDNr2zpYf9WvttQCet70V7O8AIrj9hrmAf1iy5YjP4o6ZXoAQ1N/XE52V+MKZTme9j8Iqu2U3n4rVjSG6LoROXfPqmerYtPad09pel/BC/wsjcwend9JOqWYX64NLMTIYv1abOklQBZHPeUrroa0jgXlPORZPsOVY2bgMBstfE/rQJUCElmW++ojI3vP5qOpoN7Ms/fjLzhKjKc/zMReaOkkD//V8L+65Wvxp271FZggxyiQSx9OljaKMpAddukO6Bk7iyCLyFBss3tlcMdEzeVHRKbhKw3CIj14RnXASH+ezvyfi2BWaaFr6pFwuPCQ8ud5YceyUGmk7/qipdit3Uq0AEdPTaqtxvqDIKLZo+9g2hP8YgJ5sXv4tAghw9MymD46mn2BO1ekG4RGsdHXoksgjZ0twc+AP9IX9/H1b9/AD77FYg377zaY1j8mq/AT1+/gkgcxjiGBbVwOrEyGmSEAAiKxKHmwePRBJIjZOyFyuXUwtRAioURigA5TibCRw0t4MqH5RmYOR47Nt/P7A1Cj7AhiLsBCOPj4FDQ9ppHPSEJZRkgOoSyJwcqq7LybwCJ2Do5tWMCNjwKVGuhb7Topdaj9xUzDYh0FXBNoTdYL+/xAUJdCe8QEgkWjqPfx8Qgw8AegUoyrvonBp9Mvg16gSKQguNvOBWUm4HI4WhGLTepyOchFfs+mwFRIQXSOusZL8SDgJ1nK0WGz42AiXag0xh5jO7WVP1PEaDzOJ+NC7L4K6D0QZHiTi5Eh+/gEDJ374Lx+ZP7rx+w4sspoYFgoEqAkycOu7MzNq+OV8YVH8gG7kYuAFqX9uCF0Dy3rHQvm/3ffnIC/wdK/S5R/gu49C3vnC8DW86DXQG4OmYzyh+n5kDTeKuvXXI4xYCd6PHfV2Yixe9DtZjXJYNAM0NTTbRTd/hq0pwN7PhmyIb85kG9PmA8B/JqUk7/IcPY4zyaonv+7j1tifPI4xQi5X5INRrwB39rU9BhUIc7O2y9kAzqXoLC1hIxynAU2lz5tOgHpDDLzheVe3PyxVpu9ghTmvvehutNfVKD9+msU+o3cqazgV7EI1MzSrUThkiHyG2caFvYBPfuXkctf98XzNfR6nEO8IkYrJ6AhtiEIFpdYnfA90Ylf7JInwveRZQOn1MaiO+oILZifpqzruPwOQgEYb2dKZmFazMp3FImhLH6u6uijdkxTdcDN8dXlBPR+t7AaZQpv1dWIXfWtqnqCkIWqZSrHXij0Eaiw2+kXXqL7DzZtXa9OOFxHNAiWom5bDOWdcKBSO//rzwsVYvPzwQje2+aJkSiVvEg0El+e1L2WQOutghRaHDyTB+im7pFCJMHiyZtljLQeE+E8VgfYzmUoZjRvLx5WRqGOAwIHrYDS+JBvNp2rkQ98S0r4G+em9gNqWsPYPSuWrkl1EpdBnmIhXbOxwKsJuKCJFDBKmCvzVHYx2WxR9kS3xLfHxk86ZmX3WbOVFG+wj168/59/O/rAtW4mk3XKIYVzufaBed0GN+GnKlALoA/W65sM/uwhRkXw1Rl/e1iSZuvFs4a4w1IXdlU97KMyViJluADxOJQ16bqDQ5wLYxgQlYRZZQ7BOkaftQZtsn1iYj6km1JT1gIToN/78Nm+A9IiaAZ8FEc5g9bQdLUKPLVqrFZplje7lFXr0PZjksWRFaB9XzFEncS7kfBTU5pwwWXxZ2rqmS+ANBvDfckE/v2XCXp3kDWQVShhmUKF7I1cwKu52vw/VVTazSfExCoeLoQCMJszrk4M8HBRwtCsQ9Ciequzy3dsu6Zrmsa/IJ5l82QGZ3gcEq3xvFqCP9WAlwmIviiKE+6vXyCz+ClbvF2+odIN0P7BhoEjuCIItu4TLwkmOJ8qVtTWi3CD/6cWgq9sXFd+Rn4VoTATqk6nSzGmpNkzINFeSq5NE4VldPdrOpOpbaSwLSYku5592lKuVMierSPbQbB7gm4GbVJpDxPJbxruZqx7z2Yyiwl0LwJDvGqFLQX7eK7u3w2OVQOlK58wXnN/DtPjY8NLKSeMlOpinlCiNxcnGzUFBU7vkgPqUobqYABBSienE3v2gseLuGbaYwCDGkFNgTO2TysalPLOysGNbRyKg3essqw7hVv+t53QhklZBMXp9ZVI24EqXOqk4OyiTidKTOXeZDeYXT+4dKCHk2vUSctwpJeusJmm6ZXXw294tkujJESx5jS9EnFMKpVSnYmDaDcdWT5KO/hNEdOn4YhhZ5rL9mlRHfu5vilvUE+uIBHNgtIjZaZx7IF47mmzRBrHojYCoKoFqkL1BXm5teXx7d9f89JgR6TkLovV6VeJXe9HRMT+85kLJqAHutWAhk4hD/QD6Kw8JTJ8QygD0YCacKSXaErYmtjtFoLhCS6oxsvAr0ymdxxV8jcKmZSFiR/fTLVTbJSKFuBxCz0pywe7VWPdI1Pn5x1JeFtvpoh1hXdr6KvW2QH5sz6BvMadgmIAbEmAE2DXMV7lcqQNZV3vVqpj9ebavqlFXYcVaZVq8NUNxJiZQUsFFriYfi2Pt2j2DQB+y1ChijkevNMMQ+ID81XmhAQAnzwlC9H6cm4Akw1twzbvYjCw05oG56KIxaMGRb6Uh9ypwc+8EoqjK55ueQsTDQQenpqe8HYEEXhw4Y5WtIYmNOwHRN6sD69KvnAViyGIeEmKsQBx5Op2OWQrEPN320Ws9MYmu/i0XX3ON3KrVBqOs7A9jdNorBpnI5yYTQt4v8L+CVjtlRxm6Hz9NwHpvnI90AhELZM0qDbVIXtPvb2c5RLjMshJ19Q3W8Zh0GUd8L7vqT4uL9rlreDV1w5R3bPZEoZyM3/MNmu719OcfMmVAz42RlFqp17WgM4TqB9lrkdeVoLQZnwCRRG3OhE1RnnzEMcaSbEJ44fdsiVNREUWjLIleE0+zZsKIVDlld4o26OHQ9Vz94gKl9f07La0EiiEj30ZthNtS8jRtVaa42jgL2/a9+I3Fi6rDUEQBAeYiSkB/4hnr9Wm7lfkX7KV7g1xmjhEr83g0sBe4ma90D5YjQqKQZRmOzpWO6xommI+FE2XGaR0zc1XMJDeGJK4jcjRpHHBIHkLN3w9+JMQNcUkEpCpFZkSnQSrYAIRGsFFD2+FZugjbTZvaMJb3dg3JLK/ZZm849kTraDgOAOJV6qVAgLIZgkBVNYoQ1a9/Km4/PH9Uh3pnjabpQPH696JSRrkKXj7pdhF2C/V/Ty+YseCq0Rm4kWr0fjJ2JKM1ZxzDYPXHMGnTNk6/s7w50m2N0OkLDtDvQpjLYzaPS4rLQxqCrPGC+ftbgBubLWi6vaB4OJlVNw+6FYzK5oRDGSPArVv5rrWklVLNn54hsbrqS0O2rM2aOF6gQInHw7Hp29DlxOB2+N67YSZpeV0vNqlpd7qnZJkZ2zxB5OjfWBpVx0ayf/NXKuczocRyK0QvMeAdDl7SsttLoe+vG8PFUMuWB2JGp/x3ldjlvSjB/0KuuRoSNNEskF7mow/HKRuJkcQ8F7zqPDOtmUoFDaGOuLM4FiW36zIC0NFgz0KZYjkSZJr2ipC4oM/HK6li8eVZOhE0R73OVNqMF7PNQzD71KNknC341SudtvQC5bgAmY5UiqtR4OO52KezO66yxirAvXWicJbdj3RBpBUutY3VnKtNGw/XWkFVWGTDB6gj96S/TBpGw/9jjxcVPMQ1lrPrB7YVslsSu+bsl+lYiVe7Ew4bkwC+7lddb8gPtRnClTtWPdLBrr8mNto496J/73PzD4OChthH3iWOWL7ahgDiUqzLxCqRRvt6HYMhV7VMRMsqNYFfxXHKXmD03D0IHFvU0FrLLtkXlZnhOiq460ML15uCdJzduwXh5jZT/lUwGuQFDiUnDEDQ+kGHjESi50MZvYGtDTKDKJFDX1g7woOyk2m+eVpYdxwQkEYr1NCMdeHFGqtYvmpx7FGb9waBNqwW+0KOdCYzo/LihEpa4dPJQRU94Mm86haKNQs/JgzlzZpG6a1aPC80NEuEFQeBQ1KgXA/JRPr6RlkbmDfeILMZsVtfy58ksVG5ZmPxxl8QRRR1WhZG4idM+2FzNdr0vcBbiII0EBR4VhO79izmbuA/aB4jSAD17uBpwDuKejpbguPmjkmXKtO9G4xS68B1i34IJ3Dv2H7ZV5+6zvelFXNmbHA+mPN1ojcVmouuZQYbUbng+le8Qfy78Pw3kO5yb8Ub7VdgpgYAYwrQQIyoh+tx4cX8l+Glbg443m7+4nrv4TcICzJH9s+kObP8bRoevD+/33pdvVFfS34b/cfuHm6KJrvhJ8ScwtTrY8vOObkGC6hun3Hj5cWkXffvQv4RdvPreC0rbp1xZ47CXIhUt2XAZ7wJX8mry4P6vE/p9c7ouOLHeX2fuP+jWJ/5N8SfmqFEc8wAGtl93nRfHOD9eVeSxVe7/nWn8lq/8yHK4qLhL8bn5XUUeKuduckDFa/UbgqZpyjfNncTRTQeDWPsbdmg0EViAP2tpii1fiMu73f5N3IXMRVe4GBqD7hkpHu9l+h/HZedl94yyPiwzYSqvFhSrODv9KpvFP6npF5P7NyMjWkZkZce/W7T29tPe3H8pZHwV+kQMN0STmb6wM6d8R5bXIveZ1r5RV/VQf3rkFSMfbtnXDMHH/9p2dH+8PC6kHbsihRRJv6Kw9/rSg+zXtzl3TZWpVMYucxeWTqrElUvxMDUoGgm/3fn52OLJ0yWIMW9i5bMVhqUR6fduhkydOHt553LnRd6pvhx7p4xdkmVHniv46sHYx97WIuWxejoM/a4kfYw8EBqlYuftkTjfHlTmawVVaBsGVLADWBA//ANWPcsjPH0VGyOJrQxzC+x+g+s+X/qY/efgXcHDz7rhV4lisIICAkcRoUedTA+0oVUb1OjMuOqWmugFLKFJTuzlDvT8UBNhYznlPUWXNUDhnoRX4Pi0Ou6oqhah8S3TTDj1ItVY07RY4Pehw8N8CrQKDos2qiEsViVHodC42nLhF2wjiWaKQeuROPMmykhJlmbjb0ca0NPJJqIcEHNEsRg2GEyGoCr4/dTHWbgUKGAn46IvvC1BZHC7OpaCISxaI0UDNehMirCo5Q+XCs6Zddjl8hc7mkXwfrtfimyn/4OUG7Ib5yXLDBKxlcmFnfA77Vt3sIMiVNhsb7ynN5+3gk7SD8T1jH6xbeOG98kU8eFnAa9rXEE08GhQu19qFSkVthSqzwRnOYaulsLV7b3iNGvy1w+S44x71qElu07YLUlWj/Nbu7xT8wCPvnXyrdGX/u15vRARkIHuwr5oM4TkbLOpxTH2B7Dg/J5TFRhUqAE+oy0s915if/KQbQQVX5+TBb8sYVsCyBq1It2piZS/rVTk9dvuulqncVCXfdWi98cNQ6Mp2RnePc1vtuQmJIptq+9PWwJTPow35afdi0mqfxg0VOOg+qU9Y8+DwnX00d4UvEAW8I37RsGoUI3ox4epdOEtp6vdGj23Y+OyUAgSn/NEGGQjWRiDm8Va/96dx65DYE2D7xFqNFCVOgpTmRtgO/36TXdOZlo7k8z4T2+F8WEPQvBzjR4uyBaiRprtCRIm4Ret5dx+7e34Glhd+Y5SbiZP4Mqi9erMHFgdiDGVQ+WewAIv7gHOeY22Zc1LtSQImdwJWPSQ9Q3uR9ZIJ2mnPInlJDxffCrjWeo0bvX20iNnXdSgndOCh1w0hcRKo4Vvi1eDCPPHjonCIJznSsze5erE+YbmL5u8F3OBtZ8lQciufOteRWSeBJH2VLVv8FgNNwGQj4PhW4HjajXNsnBtmp8NmWcyRKYy1cJyJIEzqRiO5XjO3zVrAXQD7IogGuvQG+AOs246ABzOGVMig7g0bPmBhz8dv1bCakKiv3SLQPznBjN6E3Yo0IWAWVken13zf7F19e6Ir6vbpgbdmh0lkaKv5QfXhJIQi+6GghnZgNeqP/xVL132FoHVZN67AZUhR7v/UNoCvnuEYQfjYAiOouHg4dIR3nYEJW+VrdIGUTYNWrfo300n0QqP1t7ZiKDjKWlJH604eOzM86mCO+tFSEj0CPuJzVWOW843EIpfMBm0Fns7fwTFXESn48RFnV5PBRSoKGwJm5TGbdsUXLkhsjtYPxeCzFlQtDRu1QcigKF5sY0A7ByNirYmPQdODJj4+o0PVqXqssEMQ9SCc4zvLqxnAVL62cW3ZtNpUX8hgWXxpzVZq8Uy/s5w4Ec4axT7ZKNQm1qJEOwhEIXvOHTcv0FGcWRlGy3HaWgQJKf3I6oKG6yO/JtnInBki5tbTvM22GfDc3DtL0/V9yqi+3znkB5kM0i09PQRbPF/V1jztE0m9EgPdRNSmN9lpq61MpBjEtMestPuu5ORYh4G21MdJj6dfxx2+iZotT/kxLcZpjTpZwx+cvHyEW0Md1J0Tmoi18VnQJm+JuUrxt1VgWdPp2oG60jWXjd2Oz+KW2hqKSBZW7Gh3112jW0FOToAlDkqh1GMIXbWF2KoaEHLufXeuQlnbqhb5rWvMiD81XbWmmo8wA4UYFZXKzUxk01lWNemfFZ21ERbFF7HhSrPiroaRBuyqLGPycCgELH0SxcbfTrBxLU2JQWGUN8poXoWwKRLU85SpUBZH0dC8LEybBhvMa4tXdb+VoZmu3If0vOcWj//3Svbnc+mslCLma5yddHExlfXlDBsFWphHRxMRzt0jn9W8ybE5Ek1OfY4TAKkLUONHwPnAPJmPzOnzrgfMGllj/mko+kUvIJvxpEAWGE3bMud+v12GjS25jh0h4SalJlmiH8brOoHWGVxCjbBEYu3ryBAJk5RqHRAxiBGXwzWejPWaT491CtyYEjpFcFMbUYYotECbTymkWEJ5ftPlNyFtBqMNQCIKIsA8Kh9TdKFNpOz0hnwKH5zSOsX1zWAjAdLR/Sj15Nf+j7bVps820cWVehZntMT93eRao6vPzZbTJs6fNGbwOTq7MF+I/v6x6Kh/1DIHbSFKBhs9QJktZsJN+GdezBttygmdm/DdbIT7zAv3UV9aMA8huIzQCG/JkjHUaoI4SKcQ724WsyG3I1NK2HfG9s/WqYXAFOQ7nd3uyK5anueK23dQvvoVaJb72QJnwhgeKIZrlmZFUdmybkRnDHu2gdWsR/gxIAmo/mpfnftA1Lm6R5l5FmfXsEL0okb3aJwe+seVsiL+m1M0rf9M9MDUWdaiDYC6T10iWXTzMd1NypWXbPV1HCm2EWf+vhXa3fU26WF1+7sDfWp4jIRVED6ySHD9DYbfe+RRBjyAwR8KeG33LcEx3ri5t3ujbmAXOluP0SvXvy70nCz2yhDvMxTW4t+6hmv22tWs6HT1ZBB8SkCM8G9NMO+RmArQBu08KtWmTBPnQiD3Ng5sng/Xy4OtaEw1Z/WT/QpYwDIyN5NmvoHzW6rI1uDMq/BHcHf9oOUqluALfrdku6RvZfDybNeBymwbgDOe0OStWy+sxnkhf3ArBv6z8kr++A1IKyUu1EDwX4rzkGvN3q+5hNzfch2C5I8uOX3a1Imy0jhRhsA699ZPaFRrn9OgsCqv+GqKMYMkkkPMXayIJkIgSEOolOhqRWmY9pywp2Dmviy7HFm1kqoiRKSpUlEyb12BcTZ6cJRAkFYVCekAZEVmhxIo8rgKcp75z415LfBcxtzro6RD7PHoxsAa8fw0Uhqw5v3dkokEc6oCUTeW6gQjnyvsokJSzmrpkVLD/VaBFb0RTadHQWimdUc2o26vGuuTQRtcfdBRURQrZL1frhUHwi1RdHkv3KHM6z/8VRY8RRpGioCW+WJleTM+SrZ4Hu6yFxdPboziXU6sOLYQKHw4fnCz3KS40/Ml+0AOZNuXXU2yoHSWbUjrKQ7Bj13NVw9yy3SGyZJoHM5P8DD2oc1nFYpH1rmbm7feHtYZETQRPWrrVbogG2STFNjoBgxe03XIaXWZzPeq0rnZNFGtAvzjGuuzAvIzpCEjPVRrFtnh/VqsxRwVyzecysYlXvrsnPM9xoP3YvgHA+s/6GyNp2gy5skruzpEnZiD6mv0IpHuasBvmndAcSy8TBX9QOHVWVt2ZyPcCI1Pt3Izhx1OD3XQW2kw0U2jwhsBdMOrxfki53cKvFkOFJbhlhbEsxNxUaWWGYEMnWv5OYUL3QrGpjShENw203TgfNJC5MhLsiuxI+k+8gjgYdshBEHNcHFDkueI+xTQnM3cmGT6i5xZOkBXe4QSdaUaosP9YjCH8/2sL+MRrC9F+iT78AxeiFf74nl/frDMD5fiN/NZeVPYnQxnGL3eF9nAzQL7eZV5Tv+/re9Offl0JdlfOgR61YvTtPG92fr/30KEHRLwoRZiWqg4ih+fso00BOq7bF/WxcO6cEQuDF4Loamdg7QOQppGfVc3Vu4+26TUjwzJNLIfXPUe9yhB1L3zfZ2+XB1/dHqohko+297bXLY8NTgP3Kz/ZF4eiX/rTFSp1zbTElS1pMlYBMWr+CKfbKwLVPd0K3xsIpX8ybXn9ODib12sJen8UuLc1/QPrkMU+YhfJKCIFDcYgyJZ6FJtFqvB/ADK15fQ3gbl4f76rXqBnovmazf3wN7mJ8ICfPQlttEzg0UbqzwkZYjRt3WWMyU3wgGXlEUPbuSdFRkiEYaa8xV2IxBTXPqjE9BZZomml5SPwqHCjNb2ggseihRa9dJysYkYqQcWoiPlLO6H21AFvhVj8ZnAz4fnbFTD2cz8Rj/2UWFtHncrIp3u1RBiu1JEsGchViHUnuEfZz6mQtHXrJpvxL76xA6Dgh04WFPI1+Ay4KWgiTebmVFpLU4eg73YuEFB0ELq9Cp1wqV4ZeLPciwMr3x9ka4tZ8x49UpadGqCd7tdbrqlzkyal+qDgpmgGGWMhmtKRxf7OViEADNDMKezjuEQLMNZCBJugwUtguKkGqR2zQVVokuhpiZ8biTlhOScvhN+5S87vzAV3erJe3hNvxRN5o5byFGcBUfqO+bLINEeVVAGRdrEqmUy6+MaRKDQ8MQ4gbA3JbIhBuF3MGkcFopQ5E7QCc19dItqkSPA1HNhhOh3igpd5UkzV15OwDSyuweiYRJCYpDbsqjVgFLpsdrJKouMMwxRxwE+s1vC7GHmcMIwHGabG7N04H1jy2Y6rcYwNUA6S61UeQ+m7Kx6Jvt+m/FCZzaSThaH/AJczeWlGHiXTiDizV5GAQg4vmBVqiLWdGcMBvTkJdguqur9e8RwCFg8jxIWjgR4rzYZ4GLR2yAXFQ7BlWNghJdpg1FGhh0PYz4dezqrncDO46x4NLL0VS3vJ4tKabtRq0Hb27gspZsk5UNsiioWqOuK7g0p4SDu1GbYAhDylkNWuoW7N9DSzVGtAUuy3T4tai9O01OT6trnmXa+0L14u+bqVzdlQe/YdPVIrbtF9lY2Wp47P46sQPmmyEXvGuMr7f9QJrohf5jDnoUeyDLzaq9b4VcaWZ2AZTAfLxY4SqIU1jOO1teyKwxrhVAsV9ywXg8fZQNYB+satffN1Je/Yyv+iCPIpolpOoqQlTLFrJG0q/COf5LZ4m4Bte1FxVYiD96bTjo8PRZ1JeodWPX5YaAxq2+SVDB6xE7CsOllS7cIdqdaVptO5Kk6nmrMNcdD4Op08Epp7WwfHKkT+5xuhVSY81DZupEwrdpW+lhRd3A55buDwnmeBi1CdV0bo1J3To9Y9IeVB72cIyz006YaUaE0iJJIYxKc3LVhRKQX+cxJqVSxoTQR4QJJojwtChSX6k5BNGl0NgQ716kWxYuitFCmSyo1dySVwEtcOHCvZe/adlIoW1pwNBAia2vHEfEaMCiYfFjMkJAClRCLshlcodiaKdLp1Vn39QGx4v5KACD3ljEzdy1sGeqhhTVLja8IiChRqH01PxOdLPl1/i2rvgxav4CHPXZZXUN9cshF9gc+jwMaUSaASSxy3Gh2UY3Ll4mrqtg4GCri96agPCe8NAAIkDWQZDaOCgMWBYq5RDMhVmMTwO8NQ2/PuAfJLCEvrC+RUjTd7RCw3uMSSIjIHqm5EtlUqVK9CoSLYF3ocal9tFoTSN0kEWo1CiFawq59+497L6Q3Pq8qpoTmzAEjA3rOWiheYUEsUXB7XxyiYsyTYw3qjh5eo5vsplNMWSoURMJIMF/wGlIHacX/e+Ob0Em7gF6OAvH/e33SpCPwENdYZcrRu5QSC4d+6QIZxYKxZ4CRj6tsKKWXQsm9KIIsdmK2dGD8ADz5UFQDp5NHd0R/Tzc86d9o0pNAOzSed3TG2+dtYvZx2yyp8JXTW9Ln8Uays4/z9pufT9CazmY3/YF9lG5ncBYu59oH2Sl8zOuR54V1J/eIn2KuFtk2eP1ZV/7syPivqFlaORbMVMnp68KHoknEzQedhT6q/MdVpdkKImN128KndPpwfrFkoTmqpHBdD0PclFazVnd9XclmLJvH64/omfBpM2PioSdi3HZeVaoukDCejMYLAKCa3J9buNpebFSdzLM11bav6hU36mLP70SzcFS/KNS3OaQ1qmbqLzBhu/JNUVpdzCKk7JvR9OKd+Rf6LLhMQhi788qn/rTGHVdn+42/U0w8EhUVqISa3FAMS3Ug6kiiaaaqvuDnY8MY9z3L7UxeKaM21Pqb5htRbCZ1rN7AX+tHMRWIJwhP3cLdG8MD8KBikDG5nucLtKpGAx5PuaFV2lvA6k921FqN65Gv0IEtG1+/UB9B5JuGOuKN+W63pP2SN7trqPPYU9SBPLGyUVGgOhetATEjtP2MisENkx+uWJ1X1dwlsLlHN6Em26QeguErFl2C5at9sP/Vb/cBAhMwPGMN+Qp/1qzGcGGlNS+DnYjE6PObhkJWeQirGvF7Hb9dGcRLjH9F9KbVhGft1CY0dJ1Z0iUB7Vvksyqi6UQsC3jP+OMpFWkTtDRASoGxImOAawjxNAvZOt+Zb/y2KvzAe9Ay3DlUVYGlEc0+2N8b4eiSUl3p9wj9R2AKpmxUb2kjFHZxPtN20+cO7/LBNuiZ3k1BdbRQjMZpj5H4JqXt9o5JsoxpfVHzrZ8cgIcVK0VC9Tdw2W+FPcAyzb58pYQIJg19Qw+KYJQYwbAhrnsNWaEqKas499Vkrf7HGGfZ75qMkKZ/XHYho7p1if+TSFdMkKABmiDAxLMfgD3YszFDal/d64t9xbc9wItJH3YYMJY8WZyhIEPodz7LYuqc2j/u9d9cqfrkieHOvuaVV15+pBsceyPS4b3oIqD/5+fmTk2f/9sLCuO/udZ3Fd20ie7H2EF7TBSt3+kQ99AvY4GrkKm1DcQTtNwtCrc3OBGtHJuIcO7S5lqkJYIynnl3No5pJh7RTkFq58L4DvCmaVrZczXOTcaY10AffSsiP6hHEqh/t8f4UTrko7GiqdUnIHdKZD1Wh0jRw//0N+Isr8ecsmXnZYDtVC5QOUhMsBg1IuWPB62WLdkvPVqoZMPuxcHFBagi1ac6hwLtyh2j4+OLl+Fu43hZj8DGmK1Ft6Ir4kxe05W0Al1iQlyRioJ5KyV9q2Uf2DoecUVTza+lFSHT1uJKXoEz8UgA/lHEGHdqEF1Afcak5U2vI5KEaZB9z8ZlTeDknsV5qgDdySB+VvXV6YDdzwc47ImBYdetzTpE8ZZuiwWQ2kEBbokT5YEofiqsQG1zXn+N52EG8ZYqoHXQHPwah+CxJaJC88lyAV+FegbsnaYyyDa7Dci1RmyLEFwjg7etZN8EDxDO4v5gXFa5e6lY6/lULThXwfUiiDM05x6ysxBCdYcrv8G3hVXPp2qhu26LY+jcGj0Zz5493FHdyev4FFAKlFu5OvRYwm9E1t44HEkPAPikkO5FSOcoKUgfZgh9bJmfCINM0by4PoRhQ0l7TGHYsxl97HFs9ieEz1/HDwEQEEix4Rnb/Nu6nSXXu01MGxAuU/1U8pIZ4bT48AMIcZaK2Y+ODM+Nd1hBFQxbGj5TvRquS2jAFmx9CZImZx8xTgDMmEAYRiVDAwKERHgfNV6zhWEL+xfe3onuD74ENiExjHo8Bo5UuSymEsqNO7U7qKoBjuQTnvrRIZf0OIQIeuaMrN5rH28lfeyhR01/1FvBGNmcY0kvlWPE2/VMFpPBLIv01KtAeUq58ez8+6JoodmtkaNnTp85tudW9T6JNKZ06KGL0RK4gJSACzh+noka2Rw2i80NlOcf1g08Dp1aw03p+EW5CBIixEkTC56+t71p/sLgDqfS7Lfl8GNy2Jrtq0dDS1d1rHKpxfsPW0swBb1GFWO/05RIb4mAp5svEVhNP9AGJCpf2Jf2TrOEz4us75yMdX1y8t+fqDwsIAIBU/5n4O7MPl2+gnGLNJfa0npKo/mR91+M9V9M8j+kEX0V6XQYi/w4+221OmTnqqN9pH6RxQKrNq67RFZT1i2gy2K1xbaw/Uc9w5vTNax+6MgVENuRrvOAq3RUpaTx5MnPxuZ3HDFRBCZ+jfnA1Ks5y9t/1HPzT4Oz+/G3p2t2acxMERi6QySMvgZV5i/Iwu5TnpbLTLdjIJdxVwEJJHSX2imwf+VpqN8pi//YHSIGewuHcfAemLrBld4g/uOXfBXEXHGzoswrL/D/w9Fq64T+zamK5cmky26G/3U5ihrkyV/XMlqWPlpC9pcDvqM3kWJUviwFY/YR4wuGbXQXwjuIHas32eFVqwLd+PWSlFdW0Tn2MDHx0HZtLR6ifcEcZQtfMNjjuk8xikGL+8V2BSwmb7+dtVkvrXbw4282L/vZV9GK6VP/5LhC4Z8RQDViPzBhuPbKSL7e8Qmu3D861DQpjc5XDYeI4yJpKbvmEyIsAKabaqm22Zi2w4ia7EfDqs2dzp5IOJL2DAvqBLjZAWBUNaRBDsthRcu3nj4KKj5Ugh9lVUdZhJZwAOlyoVe/s+clhvBurHD18mLoRLJDV5IOzoSK0fsJJWBuVdecHidh3gtooDOYkxZ5y23j9eXATK3D+34nKz/S/cJ7e2KGHu61IhGQbBGMq69LsYhS12lmHJQFlTgPaTDOz4TNxxvS0FYfo62cOxUy2Id2PzNAe/UsmbVCQYT5297L3GVemNLwfPJL2cGPsYvq+Qx5Zftg0NeXiPg3Kt3JLvPUT//R6Oy1FUPDrvaRi8zr+mIrom7pxNLdEC9q3Aec3Dky776KsIjjYML0nlKxiv5N3PEDkVXvKR5s7+D8+wlmIW0WEzDqNdJUXfGtYiU+ueI85hWYgZlvVBXvqu7wjariPuY7wBM8HcsxXrqOgi4e++rMjcXaNK/YQpY6eTsNGaXlrwb8kXC8CxZUZ7Sa6OV3S5v9THXck5iCvCQ0+1Gjnmp9k8eDmcKPjFHWqAP9PXAGS4Nt8L949BG0/j4lDUTQ0ZogqpNmfh3i0uxGO3MLYonExnKaaG0Pbp2AybxnHnAkMCwiZ3pR0f37M8oDSDO52FvAQlGy+HoiaazTGt5NnBx1PsJF3O+2dOvQiaeLbVoWv7oeOH7aqKHNd3O27UmRQ1TAc579U1s1N7ML4InjTc/8x5O/bqvzb1uyjN0kHbqdkqzs4/VOZ3M4IPqqFn2eOs7PZ8GmqEIGq2JLloQONuk8FMNeFaeenZmcezFHh8sN6nh+bbPdGwHmRZ0j6gSW7AYBbfMk0GTlgZe5TRy8OFainRJl+fPH/XnRZr3Gj9UoxzGyojdx6GMwW5PH5lC0KGg6r0uvjtWV2Vqz++mMywPVm40UbzwlK4tR1DwBLSHuDZNxfc6w3qV4E3n2dxhodX4OfJtSMDpdIeJYoWbQa+/ElD8cdlqN9jaH3Z3QLTowE8Lx+fdKwC8R44iwYaOvnhlIxgcc1sSY/Xybizflom1KIOID++qsAitwAmcqxyvOuf8ZDYeVYrDSBFDpneOCKgdVF1RN6EAURLH9l2khzu27nAvjSA3ZDPsEVBcK9v7QqUDnPmlCro3Py6T5N2oduN20AmEiUPYRJyg0vPFEk19/3AGraLkEdNIjfpVP2bjSVzRGYVh75IklxIMd0BOcQkISfcvFh3uVIkoZVdhiHcnR/JzRuz6QbCMGDGo9YHiVpbZigNiLMqT5izb35JfPPF/v8ELJ/JKqL8PQtIiNdPZBohmeyCDI4L4kqoBP+GJC9pufKybRL45RuSc1uT8YsYah4y+1lZIfI/E0Iif3tdIkxW9YQZi/kaYn5DLC9uu/f/XVc3lnTyuT1hWv8CQhAp3W8R4foHeMf3SvNi+H2VdR10dhcyC1pxUg8vFxxYV/hj8Fm/9+8ddLrx8AwBYsUjQIYmcp5oR3gPHUZwZWsaFDSvYQDGu/jG+QmNHYrxIV4FOgdl2kf/l/cSwe/7e0ulJP6iurhQ3tOiaDbUFga0G+Kk3ybjXBydu1HEn20//4V2v82XfnNiwz2PMJSmAFyVaD+vmmo/Er9rNRnyPjSeJHFQF4rDlU+efWiB/eifvsfyVMlZiCYvE1joZCq6d8hrv297KmPts9ZvOjTgbd0ONrzYk7EwUmZnnn3PhsARA4kdXawYtbCP+tY4naajk5dfL8GG3MoxF7XTe0CdiBq8VAnBsok1Wi364QOiNkc0wrcMWMeIPE0lGxJYs0XbUVXlrL054sdeZn260GjzByMINS8MFhRBmJRJm1xUTvl275aaqcDyX2WKPdefQ5p9sN9hT9crGWmkKqMnC+tMmgbWjbYVW1c9R3LN7bjNvZbpDo3IXYD2EYxB6udyFYcdCGaPmoHXWO7XiJjaVlSyJlyRXlQpffuWahtAzNysmMYhwEGarTPWd7lw0FMRNN9CnGpsBNHsMvZ1jnNtU280kPmNBlwwmHxsWawT1qmjm4beoKwqijAy56puvnqxsAJWftbalxl70ihJmj4aeICHGjxvDg6de5gOAlPG+9/XagENPAkdioo+75hTiUkDQaXl2FB0Ioj613qKXUBJSF4NmSyeuANbLzfOkH3pzd3z81eh9BaiMPKA8G0anDHVMe9s5PzzsmAVtDkoSOtLktp0Au9OoCMqENXeuWRRfAH6fEHbVq0hfVxLnJ6rpj3eWV9UefZPKe1LiLzEfPN+u1lDNWuTejrkt9Siyb2IiNZjQpHK0cHDp8dHmO/mX3LGkzDxzK0SahLElYyPzZhDHPWguLi5Pvkp4WcJB7QnTNTbLav2RYEdtiW0Y8pOIw9um834rom6ppX1RTeImLAg/4YaxxHsqWdHuMKmcDSF6J2c9thU9tUwTs5Krflp4eyQdGZyGm8ULn/v/XWEHB/LKmf3wrlFPf/hq2Sd4QXqHHcLzhhudkLqtOa8veXgggfW6s9Ja+1ZW5eeax65292XMRO29znx8X0mAeMkmRzLf9x2akIo+ZaLDvTGqHQh9tpDxsFYWlBdkALc0mrkgsPwhC0jCczDmeoeWds8SjyFxiF6VOaCmGKKvR8z9+8ws/jNzlTuav4pXCWMZy/e3L+6Zp+RcbjtWZuJGCGDbN1Pou7W5mFMpmSVJprSZLqJcMMjPqOHc+2FonwU9q2bpBnGIZzrTibINjlGHpt6bAvjlWFGOdReRRXyeMNSchOJSvng78nmZqAU67E9o4zosQZsTzqUcJx7R2iGWsnFJPIRZKekmpD9ppABRqcvZ+aps6VN3yY1RW7PF3eTonAdHTfPNtNDUrOuAUKqcDDykhS/SJuQfAYxYnIdattnmYOa5jqkakmMD6kBtpgkOXa2yVpCw0vTaHUcb6gZ4xdzeDLyHdSIXK5gMDS0PHbEfesvQjwFX79LdPPfvKuy1xhBn3Q2loklVuxMKQedDQN2YaFTb+GjRQwRomRUfQ6FLs9y7acrjtvN8UgVvQTWue64gxeXsHyhRInmvL6OQEaFW1bmvTUDltlahbxeHqyTmtBdMf304YQu0HeTBut4yQJUz1Ts2wqXG8xiKuH1Zrs20huGhFWVrnoWPIpBDwccYXD5yC7ilL72C0qcxCaRV70byIIt2cqLLM5WGGBy2Ub0fqqk04ip0ksL7Y+nDTf+3+Mc/1/DhrLyyvLs9nVZ9gh4ZR4CBWoxtZPLUcreqZYdCoEvqgWDN44siV+qD1565AZ0WRsdHWN5Sl2Wwzq6c8bbZX1jrzrjKzBVvaxriuUeuWjV1mZTnLp+yzkXvcFliotb+/8PIbb/3v/8cnr9+8b/UGo9GgPxh6q/2hpOmGoZuUMduLjHfW570WumjBGTVaJfjg+97hnklU3LcmjSVZlgZi93Jw1et02ufvjv/9KmIvOc/uSgtvvMhGQVF9q0/Bt3XzkWeWkUA6iRiy/TVNDYxeA/z7+A0y1zj1LeQ11Si8AG4Ln1bgkC5qfaK4TKN5RJ+WOl0rVFZh/jpcC4W8u3nv/PTs7Lw3z+oGLsXoWganyrBXZHqvKg4IUkkhhEQ3LkZel3CyaaknNXG+dYundk/kMJ0H9r7h3lTj6n5aGtP3HwSMoEpcgo7sQCIZb3ajq7DIgJLNt32xmEt0iAuRodIespCnHoQuvz9q4RydjtAOAmABa8/UhfrwYQu4cAUXPRXoT72TtJrN2V5HKvbrZCXSu5aMDXY9oYnm5u64eLDB1s6wlMNCCpRxrr5Vr1peVzcLI1JpXIHgXGbJaHEgIcN4OAFTlo4rqvwGqPhygFxDCCxBKjqViyM8M2JYpGviIsZJM1FDaPxzY8VvHYLj3Bjsm78wS2gqaxozh69vslBg2X+BjMiC58G3Rz0sHWwINzWhHtlpWbmPA6v5YEfpomM2NGZVEtRjZ6msUsSFAeLMSeKnVuGtBlo+jXEkvIb2+1RamMDSPtrNfGGHDszAfLgSKVS3D0Imi+pU0xmv/wOvHuuLRirZMOLM+lgaZ2/D/6Q7HYwQNkMbs/RN6afx958NFiZKitWMNluD9yD58EbdD2Q3ItZI9o0CDeFBe9BZthbUoiI74dAa3YCMWgNE8IeWuJS4q531e6WBIDsGt33p01Xs5eyQZfpvnmTm96WcCOSrtwo3B+oldHKpUJi1tJWGqL0KlJnfYA0gwHdGoF0joZr7PYw9KFHRXskQxkp6Uy7q+4MaLgCzW505EPZlcjwfqATCNwBuvx1Z3e/q3b3RaTd7RFzMpQA4ZgkzxHN51W2vCzgswIBU3C/QHEuC8HeIqDOhEUg+/CQvixCSL/SjKFQ4l3YcIrDMJ2YvbjiEMIdlJn/MIVLWHDGBd1VEzJi1F4G6x4Dm1Bf6XBCChv6zfjdnrm2oXIPmIPjUdCVHiI5rGcghTiYMi1Afr4wuYWxmvZaEiiaQeaD3evai0SOwWE3jdV/ew85j4L+GmmzU7Slzg+5YzpEAaXTwyt7zvO6xozVCt/3m5pj1lY24pXmQ/dJhXpgCCLCT/ifNNh9ve5j9AqvKJiLN7md/vQgSB80yW4xEYLNd9jDlunHPlpFtia5rIkwVGVa5ad9dF/36c0PW2hizOcY8UbV3lKQzKBUe7NMtQBzG3MDHQhp2mBBC8kq0iuT9/pqo0fJgjJKFQsmncaoQjK27l2c7jJvwONfpYtmaeKCTtI/uxdf/1/v//JNplEw/NE68SL+TdY7vLeXAMhfGvNGDeS9D0F0/zPtBrn15Tv/oGgyhF38B2/yxQ24r3Tde/HfkfCkUvndm+vTu3GFsHac4sg6KrXG92aHRynY8J9fhO/syKcsZbnm8A+jrPGUbV+jOljRGl6a6NUMnx7nD9KpvDTV08FCMD8fE6dB0bbnp6OtgIrBANTwGFYvpyCeN/bOggESxh5GQOhoAe+TNsQuhXS50odjlUBeBZ2nqIrIsYV0kmsW+i8y8UN+ezTkPHgsB8MuVLgSoOdOFgnJ2dBGAno2TiJpJhLSvfSmQ2+d2UUAxLV1UsE5YFw3co9hFB1uPuxjg6GAXE+x1INbDlHSxwVWGwsHD0O8tF5IBlTSLqdLEaooqjaLCbCZnQ3ptqvrCJu2cmsPk5lC7kMmMCqHL6DXvOgsi3UQGkqU6eTCjpg4TEQy4WtvdGo2qtB2CDtFLtc6UtCd2VtajbqJK5uS+Ilk5clU1OY5SbvKQCukiW7RTEfBBDe9Qowt1Sq8WOUlqY1CbN9Ta0s10QTlsu+cSytQ2+qNDdCJFrgq7KvMT9N0q6GNnqOqe6S8nRr3Sq11RNbjZYua2nBlqVSt2Gj1zl2QyumUVAwlqfVkLz80ipmaY5k4Imp6b7f5a0cnMVNWDFl72mQQKsxWkG89vlQf5n3/m8pX3vwRVAyDclaBwVY4D5DrIQoywRXC8Ymqyy264yQwPX4Hrbrvj7jlLv/RCNUS+cF+h2xaxl304+J7j2UzXu+OxIve4UXWFGt/yYiQ07Fu9JjE9zIJqZjZIqCUf8dYzhR7tcF+daaZzUz1niOdA/fp0mwE302wdZuml3RFi/SCOV5mlJPJ52xxEdJ4t9cbvnCD9bK0TSudiLZ7H9H9dUGSHhJARCpziP2hAeGgsHTT7INoCzw4uGoCFTJEuVIQGDEwZKkFg40KHAxzE3ycuO8RhjnCU7ezgDGchoY8207KV41LGXc8XQRjFSZrlRVnVjWy7fhineVlP58v19nDfHj1+8vTZ8xcvX72G0DMwMoXzmVnMYoi9nCppqGkJ4eG9D3ZIKZUUJmtoiYIJ5VKZhEvDhxGGGW2UMQYnIpHq+17+YG681OMtK/dVEJP8gWCosqo6HJlcU1sXrV+DmWCcpnnRN302GW/G7I7OOWX8sweEYATFcILBZLE5XB6fpARCkVgilckVSpVao9XpI+wDVAEyMiZnn4E2mswWq83ucLrcHq8P4Z1uiJaZlTl110GsB/+/b+Mycrd7sfx8+FZ/3b7/AXcO0qSPJn2uTz3K3bub/y919BNYeEB7G7nHTps4EMmpfT5ybVWIK9A5Yjd1p94fgzuaGj1F5VekJMLH0M1uqd81GQYZs/9Rc911CzcwTP8W1qbH1E1JKTW+oeM/+2axmHcV9iHpZ7XUl5hhqNkjOUxkBk3bLQglYgFHcvLxsaBA53CEPdHb5ayb+uUY+flIDXzy39pBS/7oncTGctM46ojCBipSUlCKiGywlD8C1IqXfG6GbpKuodrHZqMHakhOHkR057UfcQkO62nWgJOJSsFWU3J5EYpxfPsT1W3MqWOtE9fnTRhs646C7PNgjY6qmT5E8oWtOd2RoV5LCTSlTrconDL4XAwCHCz5Dba3EEPRXKtXoV5i0a1euMmQiJEFPyGtfuZe7fr0Zbokvi3FZUEtW5jkDZTsjqeNMEmP0GhHIAebWLI8ZnGgia0pxKiY3tnc+9ve3e/t+ePD4+Ngnvjd4tF+L5QO5+20VzPhQV0mU+Cm2jWOpj02jub+9ZdYLeq9x6thclypyo5c/e/Zcz17SvMnX4O/BUP/hotqu56yoKUZ6FY1LuwtoAj1W77b4ybhFBgK1DJmBaqjRyxhoEB/mK9aoR43abIbcgjZ4RGTFiFCZBsS7WXk0uRhrgLNlKqK7gyPIlHisyKmD2lxPA0pot4nCglkU5GS+DsJD4rCE4YGgWAcrAMCgWa1HcSGxiLhUZoYyxnvQLxQQN95DGBjGt/vlPwO62wyTOQbcOXi2BxHO/3QmhtiHPyOxTg6dklMDRF0vJ5J6BBVIK534FNq3WVzDmBcUJ5huKLes2MfsRYLQBNZVKBU7iXVIwjitJwWNmmSjkVYxK74+1N6VMxCp15AtbT4NrYmpyDp2kmGiGgBH6MKLipYKFYF9QuwxqJyDhOfKFJw+jxdI43fJB/nEFXxM06n/u7YQ7HirMtJ10rVytTjUJuq1VpxleBx0dZApgQqoKeVpDhx7KtaXGn9woiLue8dszpMJB+tKT4lJVYExEehGRnEF6QqtivJ/EhiRUMF3C9JYGrkvF7EkJy44tJwzW+/VXC0GTvijbIighgQWs//OoIQZdMJDhau2qxpYdM3D38mPIKf7/993wEAAA==) format('woff2');}
+@font-face{font-family:'JetBrains Mono';font-style:normal;font-weight:500;font-display:swap;src:url(data:font/woff2;base64,d09GMgABAAAAAJ4gABMAAAABfCAAAJ2tAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoFfG4dOHIGacj9IVkFSiUwGYD9TVEFUgWInJgCFIi9qEQgKgdw4gawuC4YWADCCojABNgIkA4waBCAFiUwHowxbsF9xAU9mXL3crao0IYAoCrjzg+5wHjkVbcuCccwS2DiAgXoOZP//n5pUZMw03LTdmDAEARTPJXggPcuQWjEmkjXItGcLM2nuSMRCXt5ylWlbhNmErM42b9XRjSLwriYzp+dkSilsP2a7vJEQOVEnljweZkZY5RXso5cGenEqyCjgX7HAXc4ctuPJ9HAXaT842yHTZLqsy1zWrbwrSMNJJ/arHcL/VIONfi9b8fOs/ipY81101Io8q0dCOERHaXQjuN/j0kXaJwIyNdzch9lwLZ13fvJZPiPYd002hQatB9VO9Qg3kmpo//N14OD8h1RdxkrnvFAQzTl7HyNAsEDN8FJ1amoOT99+v/tmv1lIaOQQKqURm2aIENWbmEaxaDa788bnf74798CjPMZ4PMbjsT7G7hB5PGQMGSMdQcTuWkklHTKsSBBJR3ifNA2pFQkhFRlh7NrQH2F92DD6Sa1Nw/ukPrvKWENq37+piAQbUglpsEFE0lRCSKUHuK3bqDQLjAxeMSPQ/ohEvyPRNwdseNLNfygUguIABElICAkZJEDIWpe7jMsmlyOBcGYAiUCAMHVD69hovxPHArX2Ozbfat0dutu6v9iBY9GhXQuIh9/v25z71qSpIm5VulsiraWfKJFIIgUink3S6qBenRwUfGg9Tj9aewowwb+9w39irn3GSiY00dCJ1Dxxf5eJ3Tr3plpfFYBCKBIEKZGyZbvtTn9Dzu++t93LYd/dJNS7+XgJOUzyBPd0u4McqECR8P/T2fueZDhn7owxQDVSBdgBD3itBUuLn9hfaqzWTniXPwEmaRlrrMKj20KLT1kM/EdlHNNYuGqauQeGMIqW2JBwwCGG76W3/fX3ca93dEhJ7O2i8oIlNgBSD3EGvnL+3m5y+bcHRsEMNVLzf3P9e2cS3s3uQJIJ0QRo6W0+kq38qkJXVZGyZSV6anSFrDA4mDr/FSAdYYSWhNFBC+lb4/x/T4c/bpca5e3T6d/2gC5GlglZlodkW7Itr5EEiMV01cxxCysESXLCi3v7TWERUAAgBO7aWSlh+H78dK9eMBah4B/7rbudvdoClgpaq2LBK96rudybur2vC34eucQOKVAGYUi4VlhEOJornFmi0AE+cRFT4+vMbHL337IiWYWKgFWFrQIulJv51Pk1si2QRmEUZiSNwkgwAoQNDuB0m3J1odpQ1NcUXxabq+bS6+/aDSH7B/a8tjEO+PtjZw5zGv/jxA44bbPQ3X0EeL5VdvfB8fb/CYAXKIWQ7UiyNIIR/H2pWtf/AFL+ND1ewLFhb4BmllPgREy6S7I25HjMv393s7t/A0SjAUoNkBYbkDxuUpbdAGUZhEMRDZBmkpeikxxCnhQaoDwDUZpdSLJq6DQhemdjDKetPZxmbnPc4+7hNsc93HO83fdy2tt5D9c9XNb/1zTfFngArDuE8EPkN/XlGMpfJzrnNhfdwwwgcjkzK4iDXfHn/THXPkcjOmygA3flvE5x1XR2abeFoaql0m2VrmpPztAMSxR8lm6tcUjcCDqfQ6RIr/hZlQZXpSm9+uH75dKXWnID9DcGzh5TcCPpvC7S2T8JCutt+L5dfY8sp7OCgoMCcKz31/q3qllc4E5pOyRjyADGyLl/b1v8Xswm/6vr9Ei4pvsMTVXXdfWMmB20wgivGrTmOhuwplCiEdjNXjEsLr44QghfBaxNkPjgLe8gjqUEkdLHUiuIZnSLGVNwNL97fG5YUztcmeZGxnTgQBGITJXY8fhq21vG5iNDPHayDfzPWHuHx+9fbW7tbsdVSUlKSoqAgPAw9m8PYRHs/j+qpjCEEi6Em2giViwRpxBRRFGihDJEOeWICmoQtdQi6mhCtNSKaKMj0VlnoqsexGefiR9+kJomn6XmKWKpdSpY6pEWlvpFxEJAHhaQAYQDLwswgD66Tpo5LEDoGzHZAMG3FUhCmAMOAIgXDwFuwmVmipwuUwVPmytd2uHBBnCjR7MVwIWGMII4MVokGRDF6fB3AXxCDrcrlNCLRwGAfmMXPVJ8qOhXtglj2S+s6avGSFvJoy2C/PFLJ4Dxhsh9hWXIanFPVKwA9ACJJJFaV36GqQMgf+no0BzA/sN8yAWBPK86vlMorRM6qv0A5LfpeQEQbCG0AATdAoxtCgwFKfj0CJpiRZnyqxxw+xxmgKM1sBi3GzUPUl6dNJoXGjDXF7NWGafaM7YblIkqdAAWiuN+lBa5NA/ccXSUuA3J+a1jd0DNjxJfojE1kfnUbwgsSI2XSr/LH+WP9hfwF/QX8xf3V/BX9Nfy1/E38jf2Nx9qwQOujIegE14IWTKizoAyUAziE7lBxzWlQp7fA6UqkgPxTyFr7Z5DAX8pFufyeNT0JoGfZlnKP/xQmuExO9P1kVby4Q1yrL3YruKYwseqpJT84m/plAJXtS9xRSzsnt8Grs3IO9COHY2vtOlC/LXGbTuQ83LseWU8CZnvx43bEKdFLoXWCv7W0K7cqEkKwajj33ix44OHICFCJZBIEsmlFi5KrDjpZZZNLnnkV0hRJZRWVgWVVVVdLfU00EgzLbXWVgedddVDH/0MMMgQw40yxngTTTHdLHPMt9gyK6yyxnqbbLPDLnsddMQxJ51xzgWXXXPLXfc99NgzL7zxzkdffPfL34CRTN2wlMf9IEqLqmn7aTlfH7bHT5+/fE3PCGVh41ACg/Mo40PwC6pUrRnf9jK7xvbUds922eaz2Qhftp6w7hX2rwxgeWy5Y+mwVFvGmX8zQ+Y89BZ6Aq1BHabHpjumi6Yyk4XSi8anxqtG1ChhjwyfGI4adhky9P/op+irkZ+Qp8i9XboAmYbUwX/Ag+HjvRqeAafDb+lauiW6WfAEkqFGSxAOSSC29rh2i/ZdzXPNHU1Eg3/n1OfVO4YXppapvlZ9otKoiv5hKc8qD8PHG1YyFEcVaxUj5MeWO7XkETnOkmRDsu9kS2RN0iHpU+k9KS6FIbZkt2St+C/xd9+WuEPcNCQPiegP0dei5aK2lORSuKQv2otEun1OvgifRVL2B7+cVk/4qfsdsP5dw+vYypMwJaS3o0vgr9bCfBumZL41D04n09GPNekmNeTmxr1xg/ugH9U3asPBEBpcA+MGUdjs4/1U7+8ZwqN3s0t0wY4laLWh1nXz8kg+M8wZ9Ul5iWG52W+sje7D8Q/qbU++pR6oqlWhGqqM8eCB8u9LwVvDpfXxWSoV7RSNYqLwFEKU9mYqX8sNOZYruNlsM9NmykvuvXjjON1LvenIepJ0kto7IfEmd16E43Z8XKYpxv7IRdtRkidUd4vfy4epcC2gfF0YCjaDFaeUzb2aFPOzJCG7ymYt+hE/6LOutDy/5/SA+/NF2B13h2mJn/FDPsL1rMQyzMDkl+/T+K9KqPIySr9Poj9fpwhGZJdKuZfeHEoKrXH77uqb/mrzWr6WXWTq2Vk7Kw9E5b+ysbu3cYsohZVeJUt68XDuzNFpmiRybcTGnMEl07pSfUeHuvikbNtsNU0X7SiFM5xBTD3YntXZqqkd3KoWPqu2yrUSVZxSahVoFdpnwrgRNkazmKk/gwcHI71j+xo10i/Mek5o3vZlONzy/Jw4hgzh3JxceIn0/XLUlrTko5BY84LC30abup9cK1q/AzsTFYY3YnjHU19fQrrTk970pT8DGVRvTwrh/YfQxVtWTHUDEDwStWAwr8QBMChr8HXzA1VUQ+fOiUAVVK/+C1elOjWpTV3q02Dl7mx0UkMsD5ZuPL2d5c0YNJgb4+3B0FSzvdLpp12bOqSBM42T52XwiouDlFa7UYPUe6m7gHDY44sZy2MTVd2n/2CWumNnWGQ4XEhmKcVouEits9jaTGPWR719BrswoNP2TUyxuoqJpItclssX/U/oZPywpvb0AFb/XMt3O7JTTxk5hQvcnaroG6bY5tLe+Rp2FP1/Uh+ZZ0PTFP1SvgcvgXSe8wVW0b9e2hT27LbQwCtB9yPpt9FIj4/xn7AJRTfb+CGqj6IPXXybro+iLanAQiOaBTm0wFedLVqj1xmeznc5xEe2SdUfToxwzVr7AbEtNXONaN6Vw5uQjnkzziJRZgcKvSF2u75l3oQo9RUjGoY7qs/nTz+dLOT7xwEjkADGhfDyv7pyXz/jSG5boqSfCJ8MoyYuKfqyb1rQCnyaXXJ4zE7SvB1jCUKjhW55Z+X+lgx9R7Ckodmo0yjkqKHiTP/BWymAVQJ1FbBT9voK/+UZpQ/o2V9np7j49Yhap2a+vMde+HetnUNn+M+cbTJnUZ+svxENIUdZR2Lm4cHbdSRDrVRHWW3e1sfCDU0bG5DdD8L/dxnVq8+5CoahybYu0x7uN1fv6z3kKNXpBmTJyeF1ElP/DfjYCBBEK/NqK5Y5wc1WlJK4G9HuywG3KpuLC3wdq2AYAcjMSETi+HqtJzP8uFg1hhdQ177bogmzfvkgGMl10eXEQ43JSSO4KDqeYfX/MVaA92zllctqYbeqO9BL8FqqTA3IHJPDKy2MYYwV4LjlIZrD5jnW6znYk1ht1GnvuIMkzhjHXAEWj6gh3EYJ5j6oaEucUjLzerUu6gRq7NCGsDoBHR3KCSNoUYjBxnHHmAGN25JFAUbkSqIOIHMqToxKTb87vCg74xhjBtRjiUEOOu0IaAdiJqwbdRqiOwoPnXGOOQPcHWGiWEEGuh84YQs+maQVerV0agPEd9Au+CcBHbrlpBFoEAxCscYYB9Rsfp8EsuPyuBbAk5RPGJBh0x2ee2GsY4wDshZ8RBCTgxFNgGQCi1GnjbuDdM7YxhwH2EZAK8oSgI8wtG2WJki8r1e7Rg0A/s6Qm1h2jSbaqBnyr/Hj7TXg2o+T/pydEAGYfUSjR3hudduZfgRA01ZtQAa6dNsBfj2CiEtKoa+JIHIRJtU+F9Edz2ruOVvfYRyfeU5SkbJR4NqzJgpkkdZl8WGs2rWpbiLk1iNzE4G0ZhvRjMnamkEBI+PYBGYXuroIvps75iLQNNeMaOju8Lm4QGboGOeiVKDnOd2zCDrh6Qb0jJ3DtKanifFqPdQr9BhvehwGdnqIAh71GE8uKnWMpYxo+7DErK6rZwtS3CqhZyyuoS781mn0pWPKbmBeBmVNJ6PTAmVTT1L8z2QYZTNAqcV2FzbJ+/5c5A404MnDrG2LX3JcwCfx8WrXrejhZfcTkNpcnvjZAVCWZkFU4FPvyQJqYy5bzYYsl8aY45FqNPsnsNmtyTSPYMcadelxR6+2QN3hEdiZ+8adBHRbXU6Cs1z00IhhjtnBlhzdFKJRkngcKG48ZVVy6tRj+rXENrpzbY8KIqRN2L7W9XjkM40LH1cAHkZH19UNpRqPmrhG7EalOj0qw7h7S9fFg2IxfD8ioHvgC/O5zfesgsZcwu1oNBbuM6oUtzDu2Pu4KqdGPeaOLnFb3Rnn74MEdLeo/BMc8TuG25IXAFcoVsdlLt2GWoEybJV8GxAP5WnL6tUqqTNcLPObgAHdpV8W8MZMj4N+8+Pgzxhy6VqigoqFPV9fiEclU71e7SZ1jGFufl1mQDcEZQGvM+lTKdQW55UOg/oolmFl3NriKCzu5XNl2IbTT4sBvvY0qBRdbIPzQyP0iytbUjU792dy+JVcFNKslsrzMTAuz0bI+VGRwH0AyGI7IYl0V45Xy6QWuIR3kPw6SFwS6RXeL0M8QZ1XoF2fen8RtP1SbjKU6SEPDxkH+9oFpJknpnAAvkwyTdLh3JpDHAHbEMayRowqrgiBmo9z0oKxZkak3PRqhjN+FqSTZ/ns2RZH1Hdkwg9DcJAZrkDiJYFcTp3gVSCC2yN0DCun6Jhui/VqvdRHyFuprT42sJODsoBtwV4GinR/Krvf00JAorZdJAc3uWuntIPm7Pp2/BR9WZuOvAlkcWptBT7NC1lvByxIrXx/eRbQxDhdywHtcF1HE7Qtmex0nRuPOdU2GiubZClRu9ZRwDW5dyjC7fGUkn0jW1xUphQJop2fKGPK0qvdoDZQF3nTnDCwq59RwL1zMdpQvYKcqKNpNr8KpOGyirnP1n5S0yVSxtUjRhXmNHPlREqt0KaZmh5skBpDgKmQaqYVFBKCogYKKDxlwLiqphGm+XlVQEA34bKA1W76VMqVClshTEa2rkp/Djg3zp0mDYPKOwB5Oofr1dziaZBjYvMmntGoX5MoYOb1DrA0MZ4y65W0MOvqCfa8e43c0esWI7U+zUHSmGpXtmbMsEjFmSxXupWylhUgXcDTif723BQg5YtOYdNivB5+BGBXRnxaCtTRIcrFYK6bObJQRkP2loVjPf0YpZgqaeS8EgOYxukORvJgyg5gKp0G9WrSPA1TmNbSUHpszFk9Jws47NlTt6VqHFjYU2WiAk1gPS4qTOlpPK25eozKjAthqjhyIiVLsFJFSQ+2Ox5DiIGdRg8V1JhwbIynG4hQo1PDMK5v6FH0xTSqHyew65/JAo5iL+WJyNoDPm2Z8sp3zAD+YamdXhmn4S9WwPjUMLnZ4LKNitpdYeIN/ZC3Br10AL+x+NBzwyAAEjvTU4XULOXy090ZrgJBQ7yaRSAdx6ck/cTCyaiHHvqRFvIwDvH1dyA6WzKwgw6l2H9K8jx7C78C5dQMyAw6bABfMUfQycIgABAfdijXEvcyvE2/rt2My093YP+PCDj82juWCfVNCA1QfRas18GuT5g0AhNMcCcKisIVwN+23Ci7B3VkAB8wraP2h0EAimaqnQ3IRUWOqm2lo/JjzKJIWtmQ76rKuiUPod+hwJN80ajTeGRNpgCDdQFyWb5oKLQ2itAbjAcu8us3KPjDyCkd0ZfMqa1RsSHKWqRftC/La9D8mvkh9Ob8GTz0CqPF5Zv6JfIVhk/gdh5lT+kvSseBcZpC6uD4lKTnGJo5NdBDz9JQHq9WTf0UqYi3dIFdyqbAnEB0/TspCRDCWbsWsPN4UoXL+f4ofCcnOeehxxgcLsnoR0juMz4lH0aSBC+N/hd1vUBpFnMn4mMA4EF8AV3H1vfRkZh8HeBC60M14xKjrTA+YWozz34Ry5OVeIWFdtnWYrqL3uvqbn0XrS/V5E4UhfP2qhXJG5usVcfuL+Ei8LWakNnYrW4Liosd5ragnY2NYRayk2KsAVnW5fBYvlo30Rr4PW3sITfYeaXCAG6iwyETg0o4gBupc43Xw0wAO1+Qbl4+WxWwUDsoCKmsp2ejYGLJ/R70pfRGabdLXZMkwbHREF1N7UkYFw3oq2hOeTk5UrJryhSEFAnTY4GIK/ArJJqkDUbpMtqgC2z6Mho8BQOJGo1H1gO1k4npW/d7WtVo+tguoIAuouWgkVnRpAvDliwgO1HWF9BQmHR17wSi6kfd4mSRQldXIODhYq0IzJvmnPk14+60oahXGT6dGCadg/SinuF0YhB0NkmH/ubvndA4eeY+gtQ774dFAHZlTM6UuHwgmNFkraJQOGtXgU2oWl8rPC0SuHO8XR4GnUJThBuwuYdOpubJeLUO6pNwLbwpNxjYuf0U8Mhc80Yxy/OvI2zWOVzKA2HaXzd0HM0AwjXt0/HUKOt1jvo4+N7bQr8P/I6n5CQYOr36KZeeVTaW1w9wnw3ldBT1rgt5+ii4ZRjSr4SjL3XbINRuVLIeNCrWMfjgadrgNI5PSTqM2pBZmx46lGr1MI5V9EGwLFsysGPbFJBzuTbqru0PREP7P7x69gHvuxYm/xFhMvC3dww+eJLtzGjioT2ojI6e6d2gVWY7KQH0gOETuE2fsbfUlpoO3EsSNGYzM+1EWXKZVu8EdaVM0Ri/cchaJoA1F+/5pVBYfkttF17HB812wUgcM6KBbo3LYcG3wovMgezbeLfeehAsF2/orSDrKV5sQCbzkuMZv4j9s4l+yUpxyl+hU7aItYkYXgUaRhEFUdtYTuJh4S/8Lka1GDE1ERZ8A7uoLQtBiPb4WFQCifJ/o0DQmCF6Kj03wk60C3CbKHnajIKZo4d4DABsUr8OFFwU1xsR4QyfJ+gugIF0z9wIdopEKhy8nGiwNlJATp/HUIJlcXLEdx5aj3zMRQy9DhFgtulBCzthAwQ5bLjtsIQerD4T8vIcFXCeD3K/t59yaf814Sog5Ii0BlnrCZIFMAjTTwcAku1OdMVYIvdfQJEUhX2LJApnY+pbGvVUDjHZIr5QqZDyPU6bFnlX4BUQQjiiuyGkVcj0oA9tUKeVw0zFVbngQK9EsJso/vgGdsGGLCB12y9lal8BWXVQbBT4Ah8tQ7qXg2HnoeUp3RqPMelloOR5gCGgI01ZiECWS/mPCClCy/uNe/DdipHJlnhoCdI+R1b1YpAo4xO0NoNcdqJTf/08pnVAdFaEaCGSghMuvRBEmIR9glIhjDN2H5UbsqwLbOvz6zag/IF15j8r/b51RhIYRWNJgOYj6Udks4mT5qVEUa/WQj0PiTZFPY+dFGApCxwJvHwzslf7zpgx+IWghxsrzhrNKeKUyFonSnNSvFrGOX49pxBnizWniZivuirsZ8w5/gKhK+rbW4iNkVf1qjSIuCd7eXpoKMX8YZyX0YMQ7uQleWI/CBhIx2wek0UsZQE9PD1DBeDyJyEnn2HRD4Gy3ZVBUD+iZQiq9XrrvqGY+gNPAqDr/IoTcNvjmIGfY5JHOZcv2vMDG62VwAYXftS6L6gHEce5W7oH/mhyV99EbTbU8PLtANhpDHLRDe03el+/3i0aeyM/9qLzWovdmBVrJEIYcmJOi7DTJxFs0IfnyDvNipPsfYaRJgejoGkQN/R5X94BwPsKu+k9wvyeZVUG9hNrRqkTQdGZAd0JezmZow3IdkQON4ewqViqj0uCbbKcI9urqrrFKdDtsOVD1nIz0Zf8W49tvmROC41WGqL8NHuCq0CsGqr1DCvP8SlJrRDH2crQQy1J5IZxVlI3w4qxJQM7K0QBOX3lY4/wfnFky+A8daO6dLQazBoGBTfOJBIIWu4sLlqYv6AByDZlyofZYS6+M5D1jfoq8TBiHrpe3ZFmPitv2oQttOYK1cHfghm5ZJBZNfsXTb+tPafFAjduraNgo0x8lutjBusd4W/dW/CW3Ngjs2khudKjGgnLx3Z9CFQDnw5r2BpVqh56Z96ZM/K6GhbGpJ450Uwto8BbXfcP0r5AAeanu+KH8kO49sdPterLlZa2uDDzI8PYjZsVa18avBWpMnmGYZwh1hUwY3ODjYDODMkCGqQso/rT57GUNJg6y0lUBvfQsVNdBlOYWJlYgoIPk31um5lNsqyzTEkRKcuk6OeeXYCULZtSJfKWGdclBUnfNKxLM0nK4czyhqHP6zOhIJ4REzKEVAjeyYwJDxUNeZVXHQO6EESdaG1m2tKHgRTPDhjt1N2ywPRJlm2XyHyFCLxhCMfinOKsQLngVtAxXk5Fyk9ci7/VVikd5c25zPlqtdS5OAYylTGgOzrlPgLlctmbZXbrPrRsDMBR8pjOIyZA2WAPodOsOkHZicVlnOrW2Tic7GiVaiegO5TkJKjlqsGIwcfs4JAY7fOVoTIFH/uMVToqc0qXcUrVZAr7zj5W7hEhDcLw5ftQ+eRqkEMP+KwseLxsRUoHXckHGj2UluiMjHPaOhVOhS0Z2Dk5CsjpceRs8eP/RQG3W0y0erTcCE3CPQoAklFQwbl3QLdJ0wsv0Cf2Q4Avh6fDE5uF0tbMIsEvVM1Mh2hpU4XLl/Xm95qJjxkAh2gBowQQ3IFMJ6ztS286yvt9N8F+YTVjHOMc+xmLiSpOsB06MXFi5HZUUqmx8ii0X3rGfuOcpeUrF3vuexzthUFgUDSOCRwHEj7rZGQBjziPguCKVJQx9xGOY/R9Tr2NbglfvQvxSIVbLi5S/VCeJhxaXkm/wkrjSt95BwB23oSdqUAROIKMLeKhyHSoyTis1RHYaeZYjqhfS2SBMS899QKyRnUSFeaEWgdxatExheHgcSjfhk2/6z4Q7dAbfLl968Zpkveny2+C705AQBHYWLHU52y9E0/7gcjV2BrWo/IrCHLgT9lmPiswMyiXlmcTtmhkixAuhcBJwmZZRKHg5MTKOGi2wc2FrL+tTlm5LoqEvfL71wg8UilGox97GtbEe0CQj48C4dAAzhHccYcCh/vWaWUw0kNB8315zzhQ60BY8kdBoke0XaPytALd3MTsq6X9p5sPtbPSRD6hYiMVG3kSYG+GKrVmhgLSvk/GmUkdAJXMm8ixBHZKk0KsjRCOoxT5MC4ouxw+JQfgh10xKw/JDMA37Z7InFbip8EHCs6WjMq1mwJy+vxlK//3jqFH0YZlRSke8sLO4BSh9oTCYp7oWgX4kjQlTXDbuOmWNYHtXz5I5R5ngdMWMHKHnXcg0+5rOFavM8bdBKdmrwLRC7yda+gZjk9JcoU9nPUkPeQytE3L5PSYdoYeZMousNPHKCCnxz/UzUx6v1GHONms94iHHGEdOV2gHaAzGZ+gtUlkb/+HWp4T70qe8AFX0B6yPiXJDtZo1uL0kG2yrMM4Ddc20FxsycBOs1NATn+R1fKK/2gZoImtBsgKZt2pdW0FjXxWLQYZaiupLxIgAeqxU1Nifa4W+ui3T2Tfeeeg8uDn7pr7TuNGWA1AtVoVVxZSZ9zaolCV5x1F106MSP5U/yaWJXOqabQkpZLYSJmVU1lT0YX8Q+zht6dWyfs8PuO4UDZuNNhApoWRkGqlJrNkTNRjRNq0UNwzFqKR2iHslOiSzc3Hxb+hSNkO2QMZw+BsKHRoC2Q0NMhdZIdWtBHwKZM0c4I+kK/A5QfK8rkO7zsBj9AIBvzriuDuG5SBIxbJiA/d7xCq+cDOM4iG0AAdYNtp6GSs5xrUcRzcAz6sMmNec1KBDKDTaiwVSH+otaPtUFvrAVWYsgvsUI4Cci5lmdPdDe+BdX5ko2x4eokXKKqipFNoARPQ2kCjvJMS1h0gC+MTLGzqePnsb3LeEHlk0qobFJFV+KQJDTqFsVvz1FH90cc9NdRXn/uLpIkdi9OkDjXq8LpRF4mEY41op+QgXEdtP7AQ0FL+H7BohpeD/g5QzsI8qULlOcC1KtD9i+DOrrkrYhdhaMT8TwZO6czncuSUwrT3mE6DHdLKBAegZEx6eeaAKBb5SBmKabLaGmWsQaUgMuRlGcy1MRJATAsYKQLXHMi0IqDBTN6xL0t3Lt0p8Schw9WoOr6eLRRlxB0DnMwwkgJYGxO7DqLmRK0XzLTmdtU4iXsbxoydMhNnjiUPLoXmaLjTKkHDqYi8cCzqFHLcPX9FH2uIUg021Ia37CqSP7QCqsbhVCS/qqreJ8W7iuQ7V5894xSr3ZCXDQzsBIVVsr89OMYTJasfOOerPgdyQX6ZXfCQM3wWwi2WQTvAJLbsAjsGUJr9BnwAyV0/fiAlyPbhDPnArf1mFLUJvWl5aFVbM0FBBVWKVBBsctZa5HZk0N5ITRl257B6+aHxucYNYNi2bR1e94+KDm5YYHD/rwUb2MEBTnCBD7jBF/zAHzwQAIEIQjBC4EUowpAACZEIiZEESZEMyZECKZEKqZEG4YhAJKIQjRjEIi3ikA7pkQEZkQmZkQVZkQ3ZkQM5kQu5kQd5kQ/5UQDxKIhCKIwiKIpiKI4SKIlSKI0yKItyKI8KqIhKqIwqqIpqqI4aqIlaqI06qIt6qI8GaIhGaIwmaIpmaI4WaIlWaI02aIt2aI8O6IhO6Iwu6Ipu6I4e6Ile6I0+6It+6I8BGIhBGIwhGIphGI4RGIlRGI0xGItxGI8JmIhJmIwpmIppmI4ZmIlZmI05mIt5mI8FWIhFWIwlWIplWI4VWIlVWI01WIt1WI8N2IhN2Iwt2Ipt2I4d2Ild2I092It92I8DOIhDOIwjOIpjOI4TOIlTOI0zOItzOI8LuIhLuIwruIpruI4buIlbuI07uIt7uI8HeIhHeIwneIpneI4XeIlXeI03eIt3eI8P+IhP+Iwv+Ipv+I4f+Ilf+I0/+It/+C8CCRlkIRuyIwdyIhfyQW7ki/yQP/KgABRIQRRMIeSlUAqjBJSQElFiSkJJKRklpxSUklJRakpD4RRBkRRF0RRDsZSW4igdpacMlJEyUWbKQlkpG2WnHJSTclFuykN5KR/lpwIUTwWpEBWmIlSUilFxKkElqRSVpjJUlspReapAFakSVaYqVJWqUXWqQTWpFtWmOlSX6lF9akANqRE1pibUlJpRc2pBLakVtaY21JbaUXvqQB2pE3WmLtSVulF36kE9qRf1pj7Ul/pRfxpAA2kQDaYhNJSG0XAaQSMJCCbAr04VYTO1srDjzKiSlKZ0H6F6MkdzvAGfL0ipNge3Aq48pY7zwvrg/f+l4qccrD8oHqH5n3uAiSwHICU7qtH94I2yUDjT/VaLLgL48UtS4tTi+xMpt3Ia6WaUedYxABJNIDBNHBLjJ/wE1mY4oCBi9CFf4gQUEZEprEV+DxnQkFOsRT+7rA5T4DngrwGDgIL2c4AQi/xOcIAk6NmLI49Z15fX3e+/XxpWV/fVXwMAwMV3SIF88ppG3F5CEyf0QRWH6T+hC1+hgAXveOI75wL5NvKRU77oAxcLQiASLhK+gTLRbpSL8lAB+i6qRLFiveS9NV3OVgzelc7/MgYAC1BnT/0w+wDDckBQCORHvIayUc77JUPfT+mq+x+cAHiqbsK/V1pJYCPw78LNYsCD50q8Lf2KQMi//+m6vu+HR8jPICA/qOURQHPc1zTvZmpClsK/Lr030SYzfA1Jbjaba57pfhlrsTFmGmd8gH/+6woN4cYXfwLwChUmgaSSSS6FlFKLFSed9DLIKJvscsgpt4VmWRQiy1Mtj8KKKKaEssopr4LqaqqltjrqaaaFllppo61OOuuiqx7mR8mCoHwwyWffffEjzFDVISx6WhcCS8JWt3CDMMzw1IQkX6am0VC9rDfKSKNN4cBgw4UdJz74ESJQkGBJJJRIYh5SiZRGuGgR/oiSVSaZZZFLWq0VkFc+BeUXr5CiyiiplNKqqaSyKoqrq5H6Gmiiob8a66id9jroprnuYjRNfsqtsdYKq6y2koBABuHlxL1CDZosl7AG5FsvwrC7SwY4EfCR1aG4AbdsgSH5yq5+YcBPjhWzQf5yxjDkuQj/l8rEqELY8u7euCH5ImL2wJ4cVulc0cL8v58mq0/s5REWPaj05d2Y2QbXyQ+qB9PHEuQZQpiEsaEx01E3Xk1wYLWpBttjkpIfSLqyr1lMKEi2JAdOIxPiQO4lJx7GRm+3Jhs9zWbb/f4VJLEdpMexRLqSuX4btsugA1fCjMYVRHWk+3K6zChJRpnFygcJ+0EMBXulUYyDQlKiA7lQ5NFBBw6vsgAo5MuKrGnJUCq9trTEgawqz3IxXdnLiVRd/h5Wmq5E9eArGmyWdWIm36F4v17WJUCChG2RrG4lZ0O2dVNvfmbRH1HWnVkMK3wjfrTVsjrapi5CXbMxmMb9oTA7WCqQSeM1nJyUrGszC5kVAy/h5bpsDeKXLdTnecOKwQTScCNOtY/qLPSWPDfA45eyv0+EZc4Hr0gxCjOt7yNPV0MNpPYjrcmqbYpFf9ZYKZ160BEkQXfGuVvY8Y/aM3riu95NDau4uLN0QFS2utVtE53vkRFYKwVUu1WnC3PPg8kwXNg+M166nFtGZk8bIugUamzznriNbQEq7FH6U14OWNk+I6pt4RUJJeXspNRPkXRU44I3Tu/MxaiOSd6oZ31SdR6eZ7LaOCN6RHKwG0Sl2WDQiQCzznVoXh+3qj9CV9e/bDX+YzNI2FQQ/VHKPWZ+KU8Uf8q6mB2Y097HPvQIK3QAu6HjRhsL+hQJAgkPJDl1V75AFp0WqPnM5Hc/vuhooy17knYoGIwO29038dP+p45Y1Z2L2g2wVpunohwrjPTSEzrcvfl4BEiW8TgCSWITrDHm+zcdsKIaFCOblMTIG3OvmaoTWDCIyJ558JERvvDAyApWJDKga2mCYsjHKiN4jgC1LlEH4jAy/FBmplxxhje7ynrafyLMNVFf3TLINnqmG+flZO8UVLIi0s/UQGbplqQlaLr8SUrepnRJBKvLT+aksVsJa7SCRXwpQuqtE54vLV6J04LQAXQnQ3tlP4Ck58k2vlyfJnNhim8Amk1YNKrHWxcjGOIK1wml4wwbPQKmwUAWGWBkAUp70bW+FWd6+1vt3i3QM0UOwQQ9IvUFbWwr3aJ3mhrmRolBoRtBHWbKVLO25NRi2mmrtw1Bwyeja6q0LgXQ2APPkaxoRJFpUzVEwWnVpgyCvZHABIurW2JW2OULoLKM5CMrNAGRFh+XRMzYD6VtENSazmxuqgRHnZb1YtK4VY+MS/K6WnUJZoIeLXSLIJEFadyckooDGZEvvBXMQhaWf4MGQjkHdnSf2gtTcjFu5jv4BJaRESxuA6Ie7dcci3EvZDU7i8cdaXP+YzA7QuwZuNC3/gtAEurIzb1V+EYo+ILBM4VcKoGhxDDMozw7cdNKZil5AOKjqfUdNcteEtAaJkzOAGPNKw+ESe6PGvqi1LOCFHUiND+loHryuCatveyVuPki1oesyQagZSqI+avKllJVufm3JGkORly+aD7VTeZDG0tY15fOFsu0hGFKxKyhEV2IIUdAZ0TjN68rshO3id934lJAEESbToOACSDi3YSpKz0uJ+msawO1rWI6Q4sm7SlCkR9uo8a2gn1RxFgojWiMBk1Jt+7tbr8Pb0Evok3Aq91O30x2eIrFvCQ7C3SL+jTHjTJCzRrgMfQgnMfj2CeDMNq4XmWEfMNoIDDMYl8ybCeCWJvTzhVAt28kzfU3r0ArNVx+G5o8tLWrHtV3WAK0ikJ1jcuuN9TaM5LOaWcKrckYk9PsQJvA7sNPObzWfSqwrKyVAOTXj+gwx2yfZk1whrPkYQygwZCNqWI1ScXC7YtBBDGpB/5PpY6+WUyA2pULrty5RS9P50galOPdxQY0d1JBrNB1Ua1i2XiyZZcZ1Y5VzQZXzWpWRfr2kbUAe76K4T818lCQ3mrzjgLxLcZwogYNv3RFq0oy9ImDgiGENp2DERWtOTlHatuIFruhiZiCFjN4VGFewK/WSqcGbqaLxcy0uAySNY2NakONohSNV5VB+eRQeddXqlAbdqYrh7f1iX4Ow7ZmFP2pq2C3VXSRlemWTZUMqumKPrPYcIAu6k3C2JdOcd1IVOI86YTSM7Afl8Ug1U4HDLH+16DQOk/Nupn5CX/VlujatbZoNqd77NXT3DhhUIsZFa6cGB+4JQ+9abPpuGJseiRCv522Bq7sogA+CftO6E4SWDg1EE9vEjTDGCtDS7leo0uNnbG+MgzvBXM1vzMZZC1db3cbZ+06YW6zG/qRZDcXo/n4I+ROK+tVV/oSsHKT/aRXqPo4za29cWK9Ra+bru2J1axvMGnyOy23VfNZlnsHSfcZn4txsaIwQE2q0u08st86aCODR+93FkZLEaa5uz1sGQTUlRyKNV7CrsYIeGn70FUTbgLmY07GIc74BS76yKUFS1xmdn1Ihav8uwxup86Paz432W+rRznox140zlaKtwHUg/hm7S4kufhKMU5ORhjqC/3j1kgOD29lbi6EPHKNvCKZU/cebsVj7qkqpnsGG0RBLbKOL63yfWTu3xrz45Er4pCavWGaet8YpyEfW+ciuuhNqexs60mRJCuigOigN1ykgp4b5TlddvyiSYLBki7blrfqPN7CiBU1CX9ORR1jSiiAKYVeItJJ97Izw8reUUPxFQo1KvZUq53HWLrcWvzxkY0vk3FNNm1runt40gXCiJpuW9IM17AwuTXzy09byJt8/7uGZDq95JFjW5CVBhe1M+O5sAQljqqkqCtbI54hnLYiDvlctWpCAhlHUDkpg1nHuGrHOX7cskstCzTGpQ6jEbg15GeKFLvVbZ5NdV8XBYThiMs0vzcWJ2jGnNCe3pUGHK8XUYN6YWcjXCThL6sFU7/JxTxyRZrLVQqX2VsC02KT3bTB9s6lX3LTHkl9yb5stu7Na+jNvainWGg5gok6+QVJV8/YvpwCLZ8a+JNPVLTKDP9G/JJn0Mf0c30VTw+shmTidz/E4firrH8I1cQyUH6/YByl3NdrDUg/SAykACnrrAflnfUFSb31ZScbRCnFSFlzaW206dWhaEgAsMbRRRJd6xjsNib3krMvG/eiNi9Y3qk6V0+tv/XYNcU1J/qCCL/V1NgUMGOhMwTDWQWNSD2yR0tz5JGXBKKaPV6eh7V56mfpw6IAXaI+TaavINRMFnRTKFd2zIkOOsQa4CVRSlmy4IkQTzP9sURMfF9oNqV5MfqpuT8ku0PjxBgJmTBis13e1CiZ3yYYTPw83fCzQFcTF0nFvsIMFhOdEuL6oKCzht+SpLVd1lXL6DPrUgvWFy1Cy/Uakb2AsB/ZTh5hNxn88TCHDeSEHXX9WBNWSzgH3TI3ZXH7dC7pIAVu6LLsmqfNx7PrD2ywebxB0lW83ZKsQmsZ108MhTEdi2VpkpZkcRcFWaFQzSqFG+7WDdUnI4QGUFAHwUYNReB3rtBOLcOM5bkS3sETnNJz6STDaGHHOb1mDAHSlrymadZbQ/25ZRUIGm3yyAU+vG7e6kb6HLD6wC/T4rb54+ZXB0vb+ifM8XfqePz9tvpBCkpboj+vgiLJ2kcfaUPWmavkDfPwilTw4iwoQYQyhDwvSONeJB05zSovOZkrbD320T5qCt+ofLeLaCEPbx3z45lrSJ/RsYdnlmpAfRarzk6oACe3AdYLuy5u8Fdrkgc2t0kthU++ekMnTq76OR7VaHFVq50kWFL8XckSjqJRcTilv6YUMCTPMH+Wg1iy0og6D2eKSZm9mKvUBFHwSQJwe+fiGCArTRQSH1EiZR5p/5HWVUiVB1e0bzirQTlccD4r4NmxWBbKicgKM5+T4tcp1QKjVIqEZG7M45Ir4nm0kBdQ3E3Sk3ZzZBcYzTCpw6qcSUrkUkBTdZC+WRSczCjAVJhjIFstvR6SUKwNKxyzsRFDgR1LvIjFhmJVxUys8tZwm8KMqV4TcZFUnFaL6zNNOp3SEI9KdPEy3ln7nZgyL1d5mcW8BDmbHdiUJIzU2VzOVPisopXQ1SPHi6ipx2nGBrlvN+R3Psmd7+J5dryFNVvRMNt7uPL54nfv4h1CBj39FEmTcBVyVmCbqVG8u2pWT8Zc/3xecLcFhjqiVbxDbF5hEQoT6Y+zCcd9hWbFBGkgFy2S7HN23FOs5e+KQsds5crKHMES1igXdES9VMZIm28oB5UuOZPSnldNlwDxm0XnUwIdfeHgAV9drJWTB6y1bvHw9rmlMDu76zARU5DUz4reeo3FLxYbOFvBjsjP8Qewen+yXEmzxi32gxhTNxLOQXPuhxsJKLDt0/Hx/r+fGE5hrB11qlLifpG7miaER3fUV8rzpYoYYk8LI//ZVSCQqdEo465q2pZsfn46NFoX2RriA+/NkQ+rN84TnzJXSwtunYy/8Qei9idzF2R9KAjDiqSdVmkPCDpE73Nrc4TXZHyu1FWowvQ5aL6+EVbPAX5rSjsKVb011dZm85FGNY2RVAcPprOoY0VzXt6tT+8E27jN82NK0Wp/qWaT+MruU2GSkrROfAKJBmREgW9N/lrdPug7OHlyldeWK/83/dfcE3jw0f8nvJ3uPT30nBqq7jp7HSvv4aeOvXyH0+sNBv669R/2xjBQuv0/VDo0OvKr6z/PtXmcq9IJ77QpQKD/87yWcIUo3+rgYGNXegqLvGpIPClUbFiIdegsepXGYtN1lExT6bVSKaJVTQcCkr5SKAkiNr0kUCnU60MicQAhIFivVusRyA7pZ7KzIQIWB+WfvoGbN1zQjN0p42+LGEGlY3V7KZmBFMuSzlf39vefMddIFVUGpkFRbeqYq11hvc2qZyLheR8GpJ19ov3TkvyfKiP9u3D7Y66bO9KOg9DDg3jZzxpcZWwHGJBhw1r8h/1sOAP9hGJQQQwLYYMYiOLrZOvwRb+8Qco4On1qDWFALTDMX8YNxw/hpKSaGVOBv59QNvYqqvuCZ2fV7nFHcdDeTyyx4cDRP83+7SFaMTy00jw4rd9HKrjQTJqSXC+f2hia1oiSahLbElqFJJDSP+PrlonxlhFY3qby/hlftWSO3MpZmwCfpA8KRYwHRIEg3RDQ7UhEsATB1JAeskEhq1bpLgQKAIfyJMPD510fFcXzI1rx9wvzvKo2dZ7HPOBi5pcbmAkYCT/yfAO+YegITsISGHe/JLl4f4nbxH/xAm+Q1v+tICyRhfSIrNI+dMZVBZ2r1KhFC6Fm9SpA9BPdG/WVQmmFZtLUxvDGvviNKgSWK/Q65Ubw3sH6w+viz1MN1RJppWLqpSFjGYxVEmxFDxuUYcuU84+m1ahVC0OoRQ2WBYK1hyHg73/sl/8/0QM6myOKpG3Q1XdJp8oWL1EYUJXaYFIsAQKSpUYgr0gh5DadQYdq5QVFyOlqmi0Da7CqJWWhYqSyvR74CBmsUatguahQgNwI51gyXDGbRl4REYLhocv4IH55KeCTahpaqlKJVI3KpNWoTZpUIrW6vhn8cPJBYPbrjxV8Mtk438ezXk86/QDESh+UySgToPwx1BslLAMloKWwSqwpKfkDExQU3PugVcvKsEtHjTKp2XoW4N5svVhb13J/Dpuwsee03Q9frLo5vbbjxRy23c6a0/kSDCs8vJy+kn/iVmbm4xMr+IGHlxWAl7AUGvHthKWwFAd/k8rDPoczXO7dKxdfVAgRrp5IQttLy0OxKs8sX3TsD55+kwyF3TpRyX8Lhfyip2APDdLaYQ2EW1CbreB3ZnYu1auzODQc5S56PD1CYmEOr23V11GWk0Z3U706lwNhZS2gx9Nz0QwHvZMVteSk0jTU3ONxS+1sR26Ohg3sJKPboktPjRL9RE9cR3o6hFsNpeFYqDcYjrU4lYgB7oYRg1IOm6BuCDYBAUlfLZQGkW69NFAt1IfaJ48oJ/JghUJt0kPrIZNBrYCVTGJEeftk8MVggkgTU/m+jxrjkViwNxSOlRrdVig9Pa6jh+gnoqnpOreF5VToGCKhV8Hi5zPgkYy1csVkg0FSHZTpqDf/bBijPO2DiR12bLrcXF13bo0RixY7W85JVsCosq5GaXLBDhdSwICf8KFZQdgb8ElIpVgS1HXDkgAw5MEOwFVl0vbLqVEr+SVCJBmnYBw9C4FNkBYxIdQE8GpdD94TQtw2Sy/emzOa+vNH+KOtoOcgfog3mYvGhVPHaD40GbxVTcEpwaqY1+AyacaMv12hshFed15eC/xRBOlROFAb9L9GfdG0PMSJmkqrJvvaiDo1BMsUsAkOAi/+8by9ePyd4zjwHCudCxn12v89x+HEqumtk0Gon1hfv/1x7YmEUznR7b80/Aoai80sjknw/Uk8Tccoox/CgZ7t0qfeL0rgSYQG6D0ep4jFkyic8I7SnYxPsylPGbssO5lPs7P7GLuAn03QoP5AYMjzE/UhSwyrfSEslOhrkIjMJYhLjSDwajhk1So9IHBaUHi8YdIHDQfTLNlK3W3rHS6N3qjtJt2gMZYB6tYeWgTHaAZnmfUvm9Nr4OavBfGTQD7XQM1s3V9H2Jocskvp3Wq3KOS6C8bFg6VmVEeOhv2XS9L9o+0/MQydxOjmnZ50zFia4BZjaXVjqFdXMAkTKp6SKeVn/K6EAcA+BCHPmGV7nhHP1m3vF+neg0WWu63G0srjQ1WNOPqcm5OG6oMQtK/NbF90QjZc4SAc5TWNgVwiC4GMKqWKv1qRExUGxlg74UcKeFJVHvPlveBRWEqJBbUFsCDbFbJuIyqG8tniZ2zGO7uto3wpmN3iqCyrBv4MSOwPimA4xJPgGhHPWcJ/p/BlRSsNhCSIHldoTKhKZUS0BSU8BWSSqobLEUSVAerMJXaTYTO+eTOx+Uv8S4NO040DHinU2lIVJIKQzihXwEZobaWqvQW8Psryz2ztyS6Gs1dOa53UNQezy1mYbCGrety4eSzNwjIN+Ob9OaJY6JjECqtmq9fn5Ey3a2cD0Ufk48n1jXvqr8g5V+pje6LHR13QqJ96rP66RfHdrGnHwJGD2N1rhMg7pZVndbqz2PTSqjEPgCDEMwvwVYRypgkHUy7KRy7P5NHI0lyR6YpQ+g3v41XxhVYOp1M4mTuZfGlCRlY251jOqMJXNgsA/7TklQATvJKchuRUMRVjEVwk4JNeXgoSOasleofG4uh1rWXq8Uepf6DEZV8DFP+qzI4DKfhF7adrIrtmzV6yAwd+/9ffzRUHC7R6kwq2mHVEHKKojIgN+so3KotAyEyb89hJJw7oJH316OdBaI1GLWQwqyThITFAdqLvEBefT3x0elRkamulRCcLhCVg00bbCvr+au457pujxC6QT6ponURyErYhuQ6qT5oheMg4Gy4Q8Wvm4PkjflqcFNikOh+obgqbq1pbQAEJrVMpo6icFh04zo58ZhfxEWq+plwumIyimrNGhbpgp2clHIfPC4KTxMXpjcTZS75/5vLloSySlqsRNODIqyzqExjyi1/IZC+LuUWG+ZWFrjxzUF8xrS7i0qKQlF9o2hUqcrHNFTqF0D2Jr9MhQYdCZ/bhXO308wuMPBmqA6fIY7WvrMZkVtbVqkzsHVRnnnd0gJovrZuWwvN5M8tclWgoWgeD95aW984ILc9gb2IyN7HREYjLCRudDoSZb7a9E+yHAWWZ0WWHTcyNLOZSJnMGk2bw+z6A37imNGXrnWYIdtkBEXmg8/WAGp5uZHIzqCLqzaFJM2plCn6Aopxri/zi5N51GTERZa1o2ney9D13UZPGm9YgGliLNJUKuwdVooNr0UNY50HTotPj2is0Nz8qMXVg5z33PyqTUqDJcubQnFnDPaPSlBi0RXRfXo+nyg1KgcCknPGfKkvmk9jPWZwbbPYNDusa2LXBJZs3Vwb4G1n/ZzD+z2Jfhu0vs3Y+pMGe7NEcZe7GXPpeejrzS13wipbxVRaadSYj80C77YE1kZXfLwGj/pSXzaif8RgqekgeT3YmjTpgSlPJ4LdjnemLYFhCJ1RLFVIoOmo6FaJkC6ng1q1DItiGqtX84wHp9HaiNRJFSK8UEB5pW1Rzs4ZFS/eYa0TyIKwsKveI50WJSssRtcqmn2euH2cp/xeJwSCRGvRmCXq9VKI3gL50s1Dq/EgCP2Tn/pKMludQcbbQy5u+ze/08JTMkC+UOeUwbvh72WXUJxP0kiX/si3/Fs47InP+RKC1I7FCd6K7MHYBlOZd8iJVzEvVSNOioB3rObrHreKkHuazENhiGeL9IV4LDoRf1p42rmBsvbGur9qybVFsUoZ3KOARd7r6nKLOID4EaqZXwGMCuKjT2ecSdwY8Q15/xsKYZVt137qtN8DdcrWHzbcxSTvzgkgT1oQE86zOtwpOdSFWKCCTD6UjYZMDTtD1OWfSk5Mi0AaBJwYnfVKXkJQdVojrYGteB9wUZPJtC4Pr5ft/xTaP3oyBdeVn56/7QZcBBoPieqATO2RgPgyow/YBO1CZjSYDJij+ghRs1eocoq/0xYv9wuTK62t/S258f1uCX3VAUfJvrtaLY4kYJwn+OtKUFVz7/o4ELDM5sWjs7qDxwKibKVVE8k2Vsw5xUf113VXdyetAQS62HdvAOhizDJ/BQgCElNadn6qqf85+wY6e+YG5MTcIA8x828R7jWDIM30ntrODMOQuVMtchi2TzDSCZkYkeBw7njo5uEYfn4y92WA8awnrgKW8S0Of6j+9LP9Nv6etJEHgdOSP2I/aRziljN8khh8KUGbuVSwlgfFxDrmR17WcJzAy2XCBxquhe+mURlVXB1BL+f1ux9qJtljffmI/MMb2z8U4ozn6Q5HeoNyOnToHyFKtM+ogUyMOzEVWfMCOIGf6DkE4fkwBUi5dzx3dOjc7STpHHLgXKW1lWItt03Y+nlXzevdOXBsxNiZGZHmnWHkf5nmLdYrJH8kOnUKnMh++epZrBuI/97Rhu2u2p2BIy0HCmFOxPWiOw4ySN9AKy7tmobtLOn5Fc4PZgm7ZK+4uMBt9/4DffngCXbfylFPVXOyD19gJTLTyDXWtbPUxC60NH+XB37JzfyWh0/KpOMsDyCGdvk6s/0tK12Uk8CmwrYEYClDSlfk/+qCeg30gYbt9GGlWQ6ADWfK+7EdOXFzJT9Z1LfUEPvW7+b79gyT1jdCZGPz3EDtmP2FbHs/qHUx0Hu+wEHO5sTXhiNLNJv13O3FsrpFBA8hc/gElzmXy1XupSbF59tR584nLsozp9d67alnFQ3Kv1To3i0adM15b88j98ThqeYZX0OU6vSrUILFaG6SqaoO2KFAqXxMhDokQs1WPlNhMqMus07x14UJakU5cp+24S4WyKUJq+ih09uAFG4k391qzZHzKhRMZ9DfjgbI6s670zGPu4y9W2Qhi4zECN+eqQbQF4Nm6iWDiUWRakDqeqKzVGQVcF7AT2Ad/hksN/uKy1PPCsJzv1l5+ZP7AX3ZVb2x5yRU9Ef85aD+lq8ht1+/tkzvY6xDO9pe+tk+6ielFS/dgdOzz11FfYNrVSWCAoJ7q/F6sohJgnso3fDzAIju0tVeoYUnwfig9cuAeIe3mJrfOTZ5YfknqAxu3Yy2YCJQP0jHEmTjj+tMnoB2I2BcmEokL7YAStivsILML0kDMuWqTh+6HqrKyQBMtpynm8XyFl/5GykEn/u71/lBeHgvQdEOlpddx/MXvOTlJL+I8QMfaQWGzKTtYrKN82Af+UZDaNT+QWF8X5yWEB8reer/bbZ+w6trSxAWa+XhiuBa4CUHyxamODrcGeF1DedL8O4mTijvp7v6Y2ppyPIEv16EngI5WDXHdiDvCMS692iMoUKQoayS8Ro1cYzLruO8h70XAwdUZzVq5YHqJxhRJtwTskbZ0bhYf+vhzV7ZSjIcK9HrzShJ7RoVEiFqu+kOaA127oKQv5jMseZ1t2LVirA4D6hT7gP2bdfbssqer3041nHFxDjv3se9sg80DzOUf5wrGiuUrVzIbMiri3bMFYbZ9pf3mzcZg27Rp61HAsxE7iB14HS4UeGBRkBxhB9KO1ToJoOiHj7xs8dGHKICHULUZVbGU6L0/0zNnU1DvbgA1q+c4o+sVCE7fmjcdu34LXKVHF3oOL3Q3x7V/kq+8M78tDiQf6yciGgUM6ZSwJvJorTLaEBLAEw2u+LhZkbHJu8GY/5/7fbE9XvdDsw6Z9twKISOiRwwIXoR+wPWDSHT/GqEDBsIAAKdyqtHJ2y6e2Bpl/Eb/NXpyK77PlJwtzkgC5qT38Clp8miNQlQdJM7+xyowHvN2osZ5Pg8Bz51h8jhiKlXMcdAsz2aytxUjxhLHDIexBCnexrkzkWRKUH7TaeHIiHB7nSdS3xZA7fH5N6okzYKGfG6HYIagAzyj4f5yZ6dUZimKvqKY84oLzBhbpvLkF9qlBHXm/3Io8z3kLGv+vu/Qt4MtF6f0hKEya2XQxfiufPXVp18NOrnfgaFjg966gANz1vm92LvEu9i7IHujzMdWGDtDc/7PoynPcvKKsialGlNKfSql1R1JpMTeltrqyoI0V6OLBIca53No4i42vehBRSo6xu3VqiwuTeL5v3vFJTGiegx+99ogk9nHto65e6OPwd6dAfgxR5ta12Dptuga2tQOZ+sGtTYTaiqKhF5lt1LoqRBoNEwmOlC8SgnsURghyTxJMBUKwzwKoQAyBVDmsU0GFERyrtnJ511Kl26DVr/h7Qq7dy6sCLbJXhYXv5TJlp+Vkb8k+4dMBtpaZRFRvMguW1yH5U52LqNS6530ySV18q/SJkpGld7iUmvE9FruzVJKHjftK8C/YMBdCMIZg9E9EdidUZSfxuOn5XNH8kUjgZgsuJEGYygGVwuHLniJjgpBGACp4RyyLP79y1ZV9P/UkjbyxX8oAvuTuHf8SyvNOg9YLvMpz11rK50+78Eery9Laws2PvN93qarY/S78bHoGN4mR1D5yR8KH5aMx55snMAyRK1HSIqkk/ufvQd7iAGfx0B07MR2Tgf6AWYJMaysAtIlS2X8+S4PwxbD2ums0q7V1mdz809KHZOMyMaWTdkBr+yL2MXpSdOQAShWeolulRG4S7w1gjfWnU4JRNasrfGfHm8M4tUe1oaNHijqmckz8PlyO7GdPRgbjsaGxX/XLwoDmay/F98vhRiHQt7Fn0t7ABA4MMtc4flT3oKf7ZkGpzSy7R7B7s7/p3UuKeknXWqY25b20gWXsprl+/FAQg/NK7UlvZEFv/6I/fir7zwvnCaoRk3ciOViNXPeQJL+mlKpUoSv5aH9SvqGfkC5rkYZ63RxpHCh6khJLOXGYQgggw3QuIHASwrg9NxF1845H784cIpXv8hHB5ifnqQ5/ziAnaU4F36u42H1i3VRjMeE5iPKsO7gOqysOs0vbWVEF4UxFuT6miwsskmEfspBcr+QMbZnG3arZrsSi5HTQC92N6jBWub+zLBNUhhsAIIvmIzOG8oL6ZVEC7u6o6A123XEq/cTnmUlVj5LeLXDVzUQqTpPDIyw+CwGWYOc+uiinqKl9B7W/ffejv5mvZALiMbxlF0a+gn76XJn3YtgUGaS8iyGpYYqkIq5x+rOYTH88a2ajc0Sz5KcHATyASbDEaQDe7ASklvK1Pzs1uHKSrthFFyRz9JXh3iFx/FlleAq6wplGLiiU9x7eSj6nPXcj2qPuCa90oWfVNj1EvG71pODYAjLxVZi5zCixV5Q3hxWEfT5dfXwSztu72XI3+0erbp43icV5WlvB+PwxgjeShgqaltOj/fXrF0TCYDpnrqpmqa/oBadJivjG06PVdvXrJ2sPj2h1hZEFKua8aYSIr3U6Xzvrl0e3unxsc5ZxCww8mf+heYslPx9wH7QzBuVufPxAX96VeL71gx3vQ27v/NG+/sQIPtnb7QxOMHdgGqe3ULNQqZrop6QJMpNJZLedGscf+fwATmP/LB2dSiK1V0ZEp8fxmKwmjgGIZzyZeM2/4a0dJ9S/gu2jiv1jOJ11ZMNVNjld6sSk+6ayqpHHXuU1+U2IEaIhOSee69T9MQeBpoSPbkuI/FaLVaPySEl91TzQL0mv1A7Cqd/AeASBBsrt5N2c7Hdk04c480Ubb+4J7oo+oL1ohlg2/usZ1vSqykB3Guv8zzf7O+llc49ygahcGaS55Bl38RNCLx5InAz4n7EcfuHn43sfsm/Yr3iaIq2ehRhTVCJDothRd2yE6cCL1kv21itDbJHjJqQO0tLZ7GUsouvlCe8uuicn5plZex+kJ7ZQeF6uSrUos7RW8qEbXQvw2bl1+xQJfXz9SdZU//3DCz79C8PzOgSbhEZpAw89crut7KeSNtsn1kav4QkxdJz0RT1PKvGGceHs+xZbNKjO5jw4HhGFutYYbn606oEDZ9DYs+9UNLMCzdxmzgxXgv31v4CSaeqqk4lXf+s9fo2/SxG//0VNDtUtGfjNzXf/KWeAeGH+R3L1I2UnMl0jVdTwIZNzCLe8mX8RjK9nJaQqr9JN+WBqbLt1J6ILAUyq6C8yKewWgvErFdl9/b88tItJoXof9tZdr6VXyYqM1iDfGSTNk2wuW5wive/p1PZJ9d/nnodFWWxWUrZvesB737LS2k2q7heLqUrIz2n16Xg1HQsqGSx42npOxOS3/reuHgvCxB8tsz1wEne96y04vs7UzNfkfMeZx/Hd4XeOTvLvQQ2z3jwiePJ3bfstXhx1aWAZ1PKIezZtIE1BzIybuycPcB8nSWwWzZemwapuVQag0pl0OLkv4824C/JdRuH5+biryA34C5o64rEusDt3mhXVVMXmLZgWVdpV1fY7XQ5AT8kQyCx2OOyvtRDAdnZcZRrcd0+AFC9lObZPGV8ClCkIbTC8VzXOebNz0UcmLPODttB3DftVko6iiFR9nMmPaEd8O8oz3z9PW+uFsg6JjQ+kLqGd2UHUgLvYvvEL95F09SPWZZyF2LmDMsfy/kBki424P+bwMVWYwoustRf4YVjHJP+2W1m+2mzI5hgAyM7iZkeMf2ivtuNZtGOc9MBnO2MzHycTjBvz9jMEmV2ujPOzN++TP2Lp2mmmZuusxnzZMiQIcNiiy22eG/zKzDqX1H9McVJ81P4nJLklI4lRVUpxvwkDgrvlPvDCsq2qDEwjAWsUA4dFL41PlLzbr+VOwdNMGICE7wEqnR3bJ6JRUxw51g7NbQ6Tqava4S5C3VAeMsy8wXEhsdMA2zpxDwQ8LSkS+HyKJz/JsZYNRy94fz8N8LaMpjMw4z3enMnAXqkGtHbZc+ZAO5f6Arh3ArhAWqbXMIU3dfFrz2Qw/3vhqnxbv4ksv4bqYKnTjwQZ8HuxlLy622QXy/Hx+vIaBtO1i88M9xuC6NtjwXwuvntf1TUgvtXhU9usGj9xjXG/oi5E3b+If/kYJzOHluvTXrPxUbIaK694Qt8XxusotlonDfeKb5DN8ZiTjqbsYmf1msBvn7WsQCbg4vBtddH6c9HURo/PTMsD8CpyZsPvfrqw3Xzcbne8KN3g8u+x/GL0kkwwBQ4fFigZJaNLuj8IQDbWI3o3fWJggnlVF2qIlWsSlSpKlOVqkk1qxbVqtpVh7kTdd7nAtONfxnTzchzzXn2m7sIYOuxcwH2P6/2RU0B+0t94PfyNoifBvgPBs8TMgNmSh7ZTbffT3wYgzxoquRYoOL59QuJ/YAUdSUPJ61OMHCjTJkoBaPchWO5nA+YXX6/6RQwHQ3tggAT4jEjuGESDXnAbPApZciuylRuNQyvAaVJsdumKvvpaIwzU5hOgQkaT5Kv6pgBCEqfh4h0Rjv+10AH/iZqwqC7JJgb8fBWVMN7cRY2sp4vuRcd4xTYGN0f9shR5fPjxTZw7+khPoE2sMUvAGhB1fJZEmuixv3shaXZKwTkh90P4YTt4XoS3uH0AoURsUI7CFWUwwZKaLQ3x1lox4LpMo6hR0ldhri1g3A1ewudrqtryCgsAiqT4TMIeo9jiIAnb+xCx0EJLRNLhNT2pKTbR2A6eMrukNzaEFbplEIzB85TifXlkEII8pgSlOM8Seo40ek9oLMM4UtHgyPSh4NcAe4cYANMh/c765OsSMwFLJfZeMsxD2j9vZLv3F51Wg2aOis7fOn2wxFnjoP8CDw6wAZohPfOQyJHxPzDHuxsSA1PEPZ8AykTBZS+YCza/F+cQDQhFQOnMiF1VvEhprgcbwgR1RZGwlq4Cj9JlC3sJHsor+Sz/JUpgpEUumS3ll9z9xMaiqcslJPyVrPFEvE7qUnRyWH5OuWhI1KtqV41T61QG9W5NJsiTFelm9OL9Lf0KAWjEqksqqrVs0ctmRacPehQenHuhLuUu517kruwb1HCYmy+33t/Ge/jS/yMX/CnhLxVPiOXyPfkn2r1jLKqT42oRer04zuFpwozT3+EPz/IX+bBS0W3kQkSJV+QVfKA7FPmZR11Ug/9hP6O/pcJGAH2BTvk11/r4xFe4mfumPulm/MuXfnQ+5n3tXfO/vq/8H/j/9E/bOUzUzLVmc2ZpyYmTmRMlEw8nhWXdSnrjSxuljirOmtV1iDZQK4gN5M7yYvI68g7yUfIH5Kvk78mvyH/SRlBYVMkFDOFoEyjLKdso/RR+infZadmu7Kbs7dkP6caqBXU+dQV1GfUN9R/aUk0Bo1Cy6MV0uQ0Pe2bHGoOO0eQo8jR50zJ6cs5n3Mt5z5dRTfSH9EHcytyf2E4GZeZKuatPGfeH6zbbA57GnuQ/TMnlVPMqeCEOYs4/+Hs5Bx58Kr6gxvm3s5X56/O/zj/ev7T/O9543gYL8xbwjvAu8ofx6fzYf5M/pM7/z5RUFNwq+BV4YrCz4pyiqYUrSnqLTpWdKHotsBTTBXCwg+EV4W/iUpFdaI20RLRB6Jbon/FE8Ql4qnivyVUiVWySHJXSpUKpCbpdOke6c8ynswvWyA7L7squy37V66Wm+QN8s3yXfIr8h8UYxTvKDAFoTikdKjiVDdUXtVC1WV1ifpbjVOzVDOgTda+qy3TLtAe1Q5A6RAV0kK1UAv0p24XvBA+CP+MaJHn+lb9C8MHhqeGn4xUo9JoNnqNUeNy4xXjfeNwhmSym7ymoKnW1GKaaZpn6jKtNZ0z3TA9NL1Gx6MStBV9B92NfoReQ++gX6HP0dfoH+Y4cxwMzr8RAm6xTUzQByXgAQB+FvW9uvZ+Z9eucwQRV75tgFD8uJ2wpL1alL50QH9lOym7l2UB8mkWV75PAAofnvzt7b+9L8NYgAKqrjVBg3ZSjkDE05kVBbSQ1saYAyIcwleCwFx980RPbhf29cS+p7Vu58HWr0DN4c8HNfVqXAnbe/KwWCgPgbmPm3c+B+MxOPuffjQI8QgJwFTmjRbsrohNS5QRQh6v62UkPBydRX7cGpyOsPeiAKmzo1QupqZyxfFpmaPX3HTe8FAxmRI4iQLl31sVQqE42iqpFyHL4oAxIg6fmqh4QIvze9qiM3Km70aqrGztnoxqaf/gwX5oDnzAd2hzyhQV6utGTN7azyS62Oxl5pOQSN6CT20nCqwJO5S59a3nDNty30lPETWAq0FXGBIohLzrSjA3P+90vgb4dNGw/kaS6Ff7RLqU1HFviLkSb9tp/a3QKhtQgIs4rmQsm20jiieJibylc1fSq2Ya4x7exhdErQZJJNSi9qvruBIRpGYUYLTys4Cv8xDsVWiJZXAEJ743YXRz4lsrqsFUL9G73FrEEIMd+cEWnhm9aXIVR2JhktaPljaLIFu1SguswKpwaFkPJD+heyD1IZ0cKUL0hL2UKQNiaxcRjiHlT5+gGPbJllfNulc9O7YnXFmAfzGi1GKdk3KB4TpavzyR1g84gMOs+qdy07w9Eg+Uaru4uRxr7vWAjdhpRS8zOarH/bXeldix/+A3IN5U6oc/pS7Fu817X65oYCJmSirVpqoGXt6tTD5//BSsXFc5SdrwN9u/gTAQ3uyAAHZfjK48KZttoS8rFaRv1whqfMQZ4GpovbjrJDA/1r9NqVy0+ZvxbYdPoMpcS9XuzuHO7it4z9AC5c8P7jy+c5Chx7NYCf0fqLBA6y6s/v8D4Su/AfGa0L2Iit/yFfjq60xjowRp9ocMKo7wy/aY8Z88uFiORDxfUm3KXtk8W948/TxIrxxuG9w6mO+W7lElZc0XS0uR9JdAiop1ANLyhjCzBvaOO0y7XRoLISnA9xzNW+xYvfDDOKhc/edWB/3LAoVFhzbLYb2vT9YXUBE1ywXmZDcfZFfYA1M3H4uXeA5Mgi9yawoLw9haHGJKRfrEEX8mLwuC7FAD12qwNAQ7Fcqdf3jFySLsdc8fBJt8X+aFC8zrH31/zLJ78+3wzwdksuA4ea1Ph9URIvngutXDDQj3J3ZKE1mlCIrx9ifi1aWY4X/1+923/1kZAFPgl1QY313XKxuRQ/7sZDy5rx7YLYhwZ2ffgC9e0nv2PzrsB10sb1H48EHjdGJMIpHoVm3TGawn/wNA9PyZRlVFT+bS/G7xSO9iyamC/5oBVeWeBX7/pmU9yEceuMvKMFH2LadtFtJjTauGut5n+L+JndWLmp6FA/vDBNLGjWKyDrEcSzD6PhRD/jitxRtAhGWDAnXtCG76hBvCDj17syrKEAugwKcX7KJmdASJrf76LuyG0aUOySXH7sRDPcVlocY1IBon9GaoZDxQFKKyDMfe7y3fdxL4mWI3gndU54bxiNS6A7OEyc1F+oPemhzxB8Zd9dvoYf+HXjE0QmYnNnAxB5bwfjchEJXISMRe3OVOhwmyUHWey8ukHbpxveIeeCdrWtImCxvKsfy4tf05uCP92+O8aCvSfA12sWGCzOi6Tiv1E8E+z25EOti3nwi1iZn6MUh1ccS5lqsLvzwwiSL/IomXWLn/XPXk1SRpbHIkMsD4EJ1mAmyxLSgdoXBNwaXsFCjgWnhuORX4CrsmQhgj6IDhN5eDq/ViVDP0cVb282Qi8zUMHNBJhnkf1/Iv5QoLk+/ocG6cCv830kJABITV2Q+8iEpo5xTdbAl3A+3mRrzgEGLciNZNS0xRspMVijWrbggmrDVF+LCNcH3CoQR5+R2C+wNj5uMV59ktIlBF3c31GEj+PxRCmS1RiwRmJQnREFIzFESVsQYcuq447FtSLOs76loEO7Bzji3rOjpkxEEJP116Fbi5eGLoY2vgqRorZd56C4MAXKoXPKoY/zC8+aqOCDn+NfxM6oDlhD1/ZSLSKSM6wesAkdv3WlsiJEKS54mgOfefG3nhTxGShto3cgqko/yYL8P/0rfoyGN42By7A0E0SPK00ulRQDDyrJKQxCWPIDJIhsQDbbw+KU1n0qVlTnyEnM7L9ydP4heLI+eXsZ3Plsjp8k0Zw1Yp5sO1wM5aJS8lHc3hAPtJyBYeEG9aO1Lc2brhaWyoqsIBHdGzQmKx34NGHPplPmmA5atwfT79F4u/SA6MwdiqhDAzNODmhV2gA6+wzVgiU7hHUqxYghivqeQboP0BC3hQpQqsF2brUYd6hPDHqulW9Qs0QKMwnFuDJSGxxekjBwR26pmoYEU8/TYs0Q90LTU04Zs9vnoa5/E/20t0hq/NhVkQ/HrfI+g6UYZimhodblMCSSYPoR51dei0xBSsOcBeqcMRO/Py0e5XJvRvH7jGxOfNveXw6UzlaK7E/TKlBIggC3fVcJSMnOR7Az525sQj63N8bv2R5fzXb5fC3H75vbExPvnbm6sW9JvGWKvNe7ZdpHJmh4c8/pzrymIYPBUScKtyv1etmWegW2XZaTu17N44lL3PSlaBzLr/fljFP8x9TEDyawsC06oz3dU/rXbXc8BWveh2Wp3OmR4YgMFuU43RFzOXQGo6GXV8ju0ZWNWcYA/MKnmYf37qQJDj/6gx9hTdRf5hyVWsvIDN4m6RK9suhAjr6Sdi/3Za/fcLcHDYYf+nfy5/Mjn7bR+AL352B2JwROvQtE0FFLnwUrA/sE1TSnpQdA37QUDk0mHgFdCimzZ7SC/9JoQnfPCohdRhGVmhm9zCZ8Mvzr1Xk76D02lBIIr8X8Dvm1JIxOP9gOfFbdkD1epeNvUn/r0hXr29U23dcsQ6N+wGA5XGjS0srKuvdk7NpGBXg994BrAEFuTqGUUKbIZNz0u1H19NU27nskRHoUhOBCRKwddBfGUm2goB74ZkN6nMDBmi4YZr1hPiWrS50NxgFQIr/6Q1QyTVSRG8D6kJKnvf96pGBUSxmYMqJBHe1bNz2mJYbt+801FXXiaMSGQcG/kb2FnpZtYqo1VgUL7FZI2NbtoTiD3fYLiQkQNFcFMfrFg0YOhXpj+blktiLnQGhBDItp3i9vm0kUSTiatiD4ST2iydWUMXYR4ICcypnjg6Axe1SDy903dT/zzzawgGYdnevqWqycHmaDq3Hznmulwht6TUIQXvD15pm7lZXGEoGMuObVvRIYMkbtY1p9OBDwcE9wYziubHoT/Mw2oc0h5Ng8Ltm1BUhKdLQTGjVrwAbjGmps5wpcFxOYb9h3ONIFn9aLkgDDzBK728EYSNdDV5MWxTZdLoDGlaLZ2D0KuYRgRtPPS0WsWKrGTIsH4pi14k1yuyPw3vqkH2z2hqiac1TwL1EhlHlQrxrkWqYysdbIxRsKtnyIXc/OXT0vP8YomoV7JvjK1IlapuO6i5os34BvexOc61rkzeRDoXllz16naD2s/Hrc2zto2LIttNEgePY8QV9ZFzJ6sLSyvpXPa5zUxSFUUqP8VgrD28IcNrZKeywg4wfOgQ3PNNmliE9DQmH/mBnHJ08f6thYJcPNsLPWauZb1rsJAM+EXZbHMUwQ3S2i8gE3KylSAV2patdVU8t5CmVFMtn7H3b9jgpxohwz4V+TJslvBu+yqL245LQOzc+F5RyGy1wMOCjYe8Jh9P7dBFuMJRYReSrgqNfSlsDph7qqKxasc4xOKDm+oX0mMjSeraRUXOU/Duac7OC5+Va3HA2FcEp0tVcSCNy7v5Y7kdT6p38A1hFBKNv3uNY3kvdL2q5muFrQ4Z2BWoo2QJRwVP8UwtvuebfZozVBK3Q0vbRZaVxdqIbkIM53l/Uo2FQ4F1W1cxTmPBu7HdhV2HyE4Lp3gqjNG6vH2DtjV5pSWENtuCWSqGexubSWVxh1kfNRjtQzZA3B7Gb1EsK3Xkz2AO5o4GY8g1hssHpUIHIhMdLz3kjnSyCK4zO0330IPMnb3Gp6neEt+uAmXAdSVzviri7v8y3HjKG1qXKMO5xLSQBqmOM82/Ay6fgJAoIoZtJm0jWb7jHGJtzJlXnKiZVHxnVFTdzOmjpriYTGXko64CW6QjiwOr1JHr7MUGnm3w1xKm0kXO0E0d5K4YiZx0+bGtvdx0aPUxCEwqdyFqtjEmWqthP4AeXIO8g7jdyuPhBU9k7cOqkwWwAgttJEF28whxg0HZJgdh4rAI7IRN6bFuUMRGjth5G65GwymOVq2YBT7p0Y14bl7zXmNsGkTBVCidcq6WKRl+kklAFVXtWhyX8CX36wdgYq278FNbx33Xp2AVASlOYghx/+o4z8SfK0/hc8sYdEHXEZlLGikgu4eIeVmQ+tYMOx/UchzGz2NBHxNvFJzTV9RaQTkLi+t/+Qbbmsr+LlmBuq8YW4a5Ne3sMJYMsMNdm1LWOfUf9RXyHYg8cddecQf6SL8IUu+mzNZKX9jOStosMt59UJvMEE9wYjO16KEqOc5QKIVrj7JPz8w9CyuUMEE4RLZwqPlXtmxbNrd4tLwujL4qI9ETTjVJobNFCbDecWDHuCmiaMcfS9D0rdLCKZIajVC0rNPqMGBV1BgGsQ29OJLnNnYwBdrjkliVaMSFqlgsVHQ8liE2MqdPJaiIVvFOQdLJzH+UiASLmLl9Weimq+SbOOObKAs+4xwNZ3yarbgSroaarEs4IAgGhxi4IiRDgCpP4ctGDzU1VpR0PASu8TiUpZc3Kaozs37R2X18Oba3685g/GpjmOyFSXoGJG8UCiE8M1Hc3BMxNXZrYzMxWrMwcvrOYiRtbzv4U0kvFo8WC/4oW5g+LM/a8Q03Gwt8MK+Xo+D/S5aSigfeSx9OlHXw+WPQOuw7+qYFFWP1OtCO27WE+9h6ADwJJchZid3JBrwLf9ZqyUWmrVFiOTSSqxqExN0gB7zg8yaBqeaUbea5XkiFGVnMrCikPa+vWyb4rWLUcz63mfTQKfG4NWCc6t4XT0BGIU2kFCBvTppFIfe4N5Y1Bz8XToHifJIKpXnFmKkqtwUn8RJrpR4jDLUGp49noMDdsm+6V4pv2E/rslnLwpvts//G5L1KeWE5Djdnus2XGQBrpiDIyIslbcdtdmxaRofUNsoyq6FgtmqCrtIfur9iKp75KJlUN18XV6sdM1k8NaZfL7vzjUh1bWWHtGgLlJIP2IzRB3EUjyPXPfSjwTCmE/2Kw1POjaRQSM5KGjJKu5M9a6Fn/Tilefto6BxWC8SVLskj81EjDemIFcHSZhPKZ3Xj6YULQm4aqX6M6ukLPrXjYCdJXBuP3lQGZWrmKrhHCdzgDSkiOjgv24gucrLVEXvVVfoewb1FWetp2iAIaielmtYjxFxfvxTQM2xSx3V+sA3m8jpKn36sQd5ryfGwYTg1ymIuuNBjrjyOOwGdqhI6B4Kok6r44tUnO27m+3G1nhoPi9+sLsBDhaoiaTuebVx4PVwVMiDD++wBFVL+H3LTizJU2PPPSyrVGzI4fjwoT0zisZLH5yPruovIRQLRHsSvtICVxgdopleSKEJKVbUl2FCueR/1RUypPcuHiTis6Wof+FbhAOHVpNTJzflXgjuGF/RqhrAMWH2uK4dXR4k0m1HKOBo4mnwYT56fUsn5+71F2NLDziech1J3eJEoBamxVNFaYCErEg5O6diyRKEobdB7mLNIC6wo4c+yxtRm3FgiMVOLLpY+OFTj4IYextQ03ydjMy0roCMuLOtaGMurs6UIGrmqiSNDG3I4ZlFOeVxlor8vSCYpi/toBbbw2FkkthZTE3M02qWoyIyAd81+zoXjCVW5Xa/2+7DXEqCG1DZ6BgTn3Xgu+dIaNUb1MOzAiLFR90HOdw4n4JZNNpjjfdR+q0LLLP6pwJ83VoAryzAGpUgzeCAM1lxjJ+lqceDNr2zpYf9WvttQCet70V7O8AIrj9hrmAf1iy5YjP4o6ZXoAQ1N/XE52V+MKZTme9j8Iqu2U3n4rVjSG6LoROXfPqmerYtPad09pel/BC/wsjcwend9JOqWYX64NLMTIYv1abOklQBZHPeUrroa0jgXlPORZPsOVY2bgMBstfE/rQJUCElmW++ojI3vP5qOpoN7Ms/fjLzhKjKc/zMReaOkkD//V8L+65Wvxp271FZggxyiQSx9OljaKMpAddukO6Bk7iyCLyFBss3tlcMdEzeVHRKbhKw3CIj14RnXASH+ezvyfi2BWaaFr6pFwuPCQ8ud5YceyUGmk7/qipdit3Uq0AEdPTaqtxvqDIKLZo+9g2hP8YgJ5sXv4tAghw9MymD46mn2BO1ekG4RGsdHXoksgjZ0twc+AP9IX9/H1b9/AD77FYg377zaY1j8mq/AT1+/gkgcxjiGBbVwOrEyGmSEAAiKxKHmwePRBJIjZOyFyuXUwtRAioURigA5TibCRw0t4MqH5RmYOR47Nt/P7A1Cj7AhiLsBCOPj4FDQ9ppHPSEJZRkgOoSyJwcqq7LybwCJ2Do5tWMCNjwKVGuhb7Topdaj9xUzDYh0FXBNoTdYL+/xAUJdCe8QEgkWjqPfx8Qgw8AegUoyrvonBp9Mvg16gSKQguNvOBWUm4HI4WhGLTepyOchFfs+mwFRIQXSOusZL8SDgJ1nK0WGz42AiXag0xh5jO7WVP1PEaDzOJ+NC7L4K6D0QZHiTi5Eh+/gEDJ374Lx+ZP7rx+w4sspoYFgoEqAkycOu7MzNq+OV8YVH8gG7kYuAFqX9uCF0Dy3rHQvm/3ffnIC/wdK/S5R/gu49C3vnC8DW86DXQG4OmYzyh+n5kDTeKuvXXI4xYCd6PHfV2Yixe9DtZjXJYNAM0NTTbRTd/hq0pwN7PhmyIb85kG9PmA8B/JqUk7/IcPY4zyaonv+7j1tifPI4xQi5X5INRrwB39rU9BhUIc7O2y9kAzqXoLC1hIxynAU2lz5tOgHpDDLzheVe3PyxVpu9ghTmvvehutNfVKD9+msU+o3cqazgV7EI1MzSrUThkiHyG2caFvYBPfuXkctf98XzNfR6nEO8IkYrJ6AhtiEIFpdYnfA90Ylf7JInwveRZQOn1MaiO+oILZifpqzruPwOQgEYb2dKZmFazMp3FImhLH6u6uijdkxTdcDN8dXlBPR+t7AaZQpv1dWIXfWtqnqCkIWqZSrHXij0Eaiw2+kXXqL7DzZtXa9OOFxHNAiWom5bDOWdcKBSO//rzwsVYvPzwQje2+aJkSiVvEg0El+e1L2WQOutghRaHDyTB+im7pFCJMHiyZtljLQeE+E8VgfYzmUoZjRvLx5WRqGOAwIHrYDS+JBvNp2rkQ98S0r4G+em9gNqWsPYPSuWrkl1EpdBnmIhXbOxwKsJuKCJFDBKmCvzVHYx2WxR9kS3xLfHxk86ZmX3WbOVFG+wj168/59/O/rAtW4mk3XKIYVzufaBed0GN+GnKlALoA/W65sM/uwhRkXw1Rl/e1iSZuvFs4a4w1IXdlU97KMyViJluADxOJQ16bqDQ5wLYxgQlYRZZQ7BOkaftQZtsn1iYj6km1JT1gIToN/78Nm+A9IiaAZ8FEc5g9bQdLUKPLVqrFZplje7lFXr0PZjksWRFaB9XzFEncS7kfBTU5pwwWXxZ2rqmS+ANBvDfckE/v2XCXp3kDWQVShhmUKF7I1cwKu52vw/VVTazSfExCoeLoQCMJszrk4M8HBRwtCsQ9Ciequzy3dsu6Zrmsa/IJ5l82QGZ3gcEq3xvFqCP9WAlwmIviiKE+6vXyCz+ClbvF2+odIN0P7BhoEjuCIItu4TLwkmOJ8qVtTWi3CD/6cWgq9sXFd+Rn4VoTATqk6nSzGmpNkzINFeSq5NE4VldPdrOpOpbaSwLSYku5592lKuVMierSPbQbB7gm4GbVJpDxPJbxruZqx7z2Yyiwl0LwJDvGqFLQX7eK7u3w2OVQOlK58wXnN/DtPjY8NLKSeMlOpinlCiNxcnGzUFBU7vkgPqUobqYABBSienE3v2gseLuGbaYwCDGkFNgTO2TysalPLOysGNbRyKg3essqw7hVv+t53QhklZBMXp9ZVI24EqXOqk4OyiTidKTOXeZDeYXT+4dKCHk2vUSctwpJeusJmm6ZXXw294tkujJESx5jS9EnFMKpVSnYmDaDcdWT5KO/hNEdOn4YhhZ5rL9mlRHfu5vilvUE+uIBHNgtIjZaZx7IF47mmzRBrHojYCoKoFqkL1BXm5teXx7d9f89JgR6TkLovV6VeJXe9HRMT+85kLJqAHutWAhk4hD/QD6Kw8JTJ8QygD0YCacKSXaErYmtjtFoLhCS6oxsvAr0ymdxxV8jcKmZSFiR/fTLVTbJSKFuBxCz0pywe7VWPdI1Pn5x1JeFtvpoh1hXdr6KvW2QH5sz6BvMadgmIAbEmAE2DXMV7lcqQNZV3vVqpj9ebavqlFXYcVaZVq8NUNxJiZQUsFFriYfi2Pt2j2DQB+y1ChijkevNMMQ+ID81XmhAQAnzwlC9H6cm4Akw1twzbvYjCw05oG56KIxaMGRb6Uh9ypwc+8EoqjK55ueQsTDQQenpqe8HYEEXhw4Y5WtIYmNOwHRN6sD69KvnAViyGIeEmKsQBx5Op2OWQrEPN320Ws9MYmu/i0XX3ON3KrVBqOs7A9jdNorBpnI5yYTQt4v8L+CVjtlRxm6Hz9NwHpvnI90AhELZM0qDbVIXtPvb2c5RLjMshJ19Q3W8Zh0GUd8L7vqT4uL9rlreDV1w5R3bPZEoZyM3/MNmu719OcfMmVAz42RlFqp17WgM4TqB9lrkdeVoLQZnwCRRG3OhE1RnnzEMcaSbEJ44fdsiVNREUWjLIleE0+zZsKIVDlld4o26OHQ9Vz94gKl9f07La0EiiEj30ZthNtS8jRtVaa42jgL2/a9+I3Fi6rDUEQBAeYiSkB/4hnr9Wm7lfkX7KV7g1xmjhEr83g0sBe4ma90D5YjQqKQZRmOzpWO6xommI+FE2XGaR0zc1XMJDeGJK4jcjRpHHBIHkLN3w9+JMQNcUkEpCpFZkSnQSrYAIRGsFFD2+FZugjbTZvaMJb3dg3JLK/ZZm849kTraDgOAOJV6qVAgLIZgkBVNYoQ1a9/Km4/PH9Uh3pnjabpQPH696JSRrkKXj7pdhF2C/V/Ty+YseCq0Rm4kWr0fjJ2JKM1ZxzDYPXHMGnTNk6/s7w50m2N0OkLDtDvQpjLYzaPS4rLQxqCrPGC+ftbgBubLWi6vaB4OJlVNw+6FYzK5oRDGSPArVv5rrWklVLNn54hsbrqS0O2rM2aOF6gQInHw7Hp29DlxOB2+N67YSZpeV0vNqlpd7qnZJkZ2zxB5OjfWBpVx0ayf/NXKuczocRyK0QvMeAdDl7SsttLoe+vG8PFUMuWB2JGp/x3ldjlvSjB/0KuuRoSNNEskF7mow/HKRuJkcQ8F7zqPDOtmUoFDaGOuLM4FiW36zIC0NFgz0KZYjkSZJr2ipC4oM/HK6li8eVZOhE0R73OVNqMF7PNQzD71KNknC341SudtvQC5bgAmY5UiqtR4OO52KezO66yxirAvXWicJbdj3RBpBUutY3VnKtNGw/XWkFVWGTDB6gj96S/TBpGw/9jjxcVPMQ1lrPrB7YVslsSu+bsl+lYiVe7Ew4bkwC+7lddb8gPtRnClTtWPdLBrr8mNto496J/73PzD4OChthH3iWOWL7ahgDiUqzLxCqRRvt6HYMhV7VMRMsqNYFfxXHKXmD03D0IHFvU0FrLLtkXlZnhOiq460ML15uCdJzduwXh5jZT/lUwGuQFDiUnDEDQ+kGHjESi50MZvYGtDTKDKJFDX1g7woOyk2m+eVpYdxwQkEYr1NCMdeHFGqtYvmpx7FGb9waBNqwW+0KOdCYzo/LihEpa4dPJQRU94Mm86haKNQs/JgzlzZpG6a1aPC80NEuEFQeBQ1KgXA/JRPr6RlkbmDfeILMZsVtfy58ksVG5ZmPxxl8QRRR1WhZG4idM+2FzNdr0vcBbiII0EBR4VhO79izmbuA/aB4jSAD17uBpwDuKejpbguPmjkmXKtO9G4xS68B1i34IJ3Dv2H7ZV5+6zvelFXNmbHA+mPN1ojcVmouuZQYbUbng+le8Qfy78Pw3kO5yb8Ub7VdgpgYAYwrQQIyoh+tx4cX8l+Glbg443m7+4nrv4TcICzJH9s+kObP8bRoevD+/33pdvVFfS34b/cfuHm6KJrvhJ8ScwtTrY8vOObkGC6hun3Hj5cWkXffvQv4RdvPreC0rbp1xZ47CXIhUt2XAZ7wJX8mry4P6vE/p9c7ouOLHeX2fuP+jWJ/5N8SfmqFEc8wAGtl93nRfHOD9eVeSxVe7/nWn8lq/8yHK4qLhL8bn5XUUeKuduckDFa/UbgqZpyjfNncTRTQeDWPsbdmg0EViAP2tpii1fiMu73f5N3IXMRVe4GBqD7hkpHu9l+h/HZedl94yyPiwzYSqvFhSrODv9KpvFP6npF5P7NyMjWkZkZce/W7T29tPe3H8pZHwV+kQMN0STmb6wM6d8R5bXIveZ1r5RV/VQf3rkFSMfbtnXDMHH/9p2dH+8PC6kHbsihRRJv6Kw9/rSg+zXtzl3TZWpVMYucxeWTqrElUvxMDUoGgm/3fn52OLJ0yWIMW9i5bMVhqUR6fduhkydOHt553LnRd6pvhx7p4xdkmVHniv46sHYx97WIuWxejoM/a4kfYw8EBqlYuftkTjfHlTmawVVaBsGVLADWBA//ANWPcsjPH0VGyOJrQxzC+x+g+s+X/qY/efgXcHDz7rhV4lisIICAkcRoUedTA+0oVUb1OjMuOqWmugFLKFJTuzlDvT8UBNhYznlPUWXNUDhnoRX4Pi0Ou6oqhah8S3TTDj1ItVY07RY4Pehw8N8CrQKDos2qiEsViVHodC42nLhF2wjiWaKQeuROPMmykhJlmbjb0ca0NPJJqIcEHNEsRg2GEyGoCr4/dTHWbgUKGAn46IvvC1BZHC7OpaCISxaI0UDNehMirCo5Q+XCs6Zddjl8hc7mkXwfrtfimyn/4OUG7Ib5yXLDBKxlcmFnfA77Vt3sIMiVNhsb7ynN5+3gk7SD8T1jH6xbeOG98kU8eFnAa9rXEE08GhQu19qFSkVthSqzwRnOYaulsLV7b3iNGvy1w+S44x71qElu07YLUlWj/Nbu7xT8wCPvnXyrdGX/u15vRARkIHuwr5oM4TkbLOpxTH2B7Dg/J5TFRhUqAE+oy0s915if/KQbQQVX5+TBb8sYVsCyBq1It2piZS/rVTk9dvuulqncVCXfdWi98cNQ6Mp2RnePc1vtuQmJIptq+9PWwJTPow35afdi0mqfxg0VOOg+qU9Y8+DwnX00d4UvEAW8I37RsGoUI3ox4epdOEtp6vdGj23Y+OyUAgSn/NEGGQjWRiDm8Va/96dx65DYE2D7xFqNFCVOgpTmRtgO/36TXdOZlo7k8z4T2+F8WEPQvBzjR4uyBaiRprtCRIm4Ret5dx+7e34Glhd+Y5SbiZP4Mqi9erMHFgdiDGVQ+WewAIv7gHOeY22Zc1LtSQImdwJWPSQ9Q3uR9ZIJ2mnPInlJDxffCrjWeo0bvX20iNnXdSgndOCh1w0hcRKo4Vvi1eDCPPHjonCIJznSsze5erE+YbmL5u8F3OBtZ8lQciufOteRWSeBJH2VLVv8FgNNwGQj4PhW4HjajXNsnBtmp8NmWcyRKYy1cJyJIEzqRiO5XjO3zVrAXQD7IogGuvQG+AOs246ABzOGVMig7g0bPmBhz8dv1bCakKiv3SLQPznBjN6E3Yo0IWAWVken13zf7F19e6Ir6vbpgbdmh0lkaKv5QfXhJIQi+6GghnZgNeqP/xVL132FoHVZN67AZUhR7v/UNoCvnuEYQfjYAiOouHg4dIR3nYEJW+VrdIGUTYNWrfo300n0QqP1t7ZiKDjKWlJH604eOzM86mCO+tFSEj0CPuJzVWOW843EIpfMBm0Fns7fwTFXESn48RFnV5PBRSoKGwJm5TGbdsUXLkhsjtYPxeCzFlQtDRu1QcigKF5sY0A7ByNirYmPQdODJj4+o0PVqXqssEMQ9SCc4zvLqxnAVL62cW3ZtNpUX8hgWXxpzVZq8Uy/s5w4Ec4axT7ZKNQm1qJEOwhEIXvOHTcv0FGcWRlGy3HaWgQJKf3I6oKG6yO/JtnInBki5tbTvM22GfDc3DtL0/V9yqi+3znkB5kM0i09PQRbPF/V1jztE0m9EgPdRNSmN9lpq61MpBjEtMestPuu5ORYh4G21MdJj6dfxx2+iZotT/kxLcZpjTpZwx+cvHyEW0Md1J0Tmoi18VnQJm+JuUrxt1VgWdPp2oG60jWXjd2Oz+KW2hqKSBZW7Gh3112jW0FOToAlDkqh1GMIXbWF2KoaEHLufXeuQlnbqhb5rWvMiD81XbWmmo8wA4UYFZXKzUxk01lWNemfFZ21ERbFF7HhSrPiroaRBuyqLGPycCgELH0SxcbfTrBxLU2JQWGUN8poXoWwKRLU85SpUBZH0dC8LEybBhvMa4tXdb+VoZmu3If0vOcWj//3Svbnc+mslCLma5yddHExlfXlDBsFWphHRxMRzt0jn9W8ybE5Ek1OfY4TAKkLUONHwPnAPJmPzOnzrgfMGllj/mko+kUvIJvxpEAWGE3bMud+v12GjS25jh0h4SalJlmiH8brOoHWGVxCjbBEYu3ryBAJk5RqHRAxiBGXwzWejPWaT491CtyYEjpFcFMbUYYotECbTymkWEJ5ftPlNyFtBqMNQCIKIsA8Kh9TdKFNpOz0hnwKH5zSOsX1zWAjAdLR/Sj15Nf+j7bVps820cWVehZntMT93eRao6vPzZbTJs6fNGbwOTq7MF+I/v6x6Kh/1DIHbSFKBhs9QJktZsJN+GdezBttygmdm/DdbIT7zAv3UV9aMA8huIzQCG/JkjHUaoI4SKcQ724WsyG3I1NK2HfG9s/WqYXAFOQ7nd3uyK5anueK23dQvvoVaJb72QJnwhgeKIZrlmZFUdmybkRnDHu2gdWsR/gxIAmo/mpfnftA1Lm6R5l5FmfXsEL0okb3aJwe+seVsiL+m1M0rf9M9MDUWdaiDYC6T10iWXTzMd1NypWXbPV1HCm2EWf+vhXa3fU26WF1+7sDfWp4jIRVED6ySHD9DYbfe+RRBjyAwR8KeG33LcEx3ri5t3ujbmAXOluP0SvXvy70nCz2yhDvMxTW4t+6hmv22tWs6HT1ZBB8SkCM8G9NMO+RmArQBu08KtWmTBPnQiD3Ng5sng/Xy4OtaEw1Z/WT/QpYwDIyN5NmvoHzW6rI1uDMq/BHcHf9oOUqluALfrdku6RvZfDybNeBymwbgDOe0OStWy+sxnkhf3ArBv6z8kr++A1IKyUu1EDwX4rzkGvN3q+5hNzfch2C5I8uOX3a1Imy0jhRhsA699ZPaFRrn9OgsCqv+GqKMYMkkkPMXayIJkIgSEOolOhqRWmY9pywp2Dmviy7HFm1kqoiRKSpUlEyb12BcTZ6cJRAkFYVCekAZEVmhxIo8rgKcp75z415LfBcxtzro6RD7PHoxsAa8fw0Uhqw5v3dkokEc6oCUTeW6gQjnyvsokJSzmrpkVLD/VaBFb0RTadHQWimdUc2o26vGuuTQRtcfdBRURQrZL1frhUHwi1RdHkv3KHM6z/8VRY8RRpGioCW+WJleTM+SrZ4Hu6yFxdPboziXU6sOLYQKHw4fnCz3KS40/Ml+0AOZNuXXU2yoHSWbUjrKQ7Bj13NVw9yy3SGyZJoHM5P8DD2oc1nFYpH1rmbm7feHtYZETQRPWrrVbogG2STFNjoBgxe03XIaXWZzPeq0rnZNFGtAvzjGuuzAvIzpCEjPVRrFtnh/VqsxRwVyzecysYlXvrsnPM9xoP3YvgHA+s/6GyNp2gy5skruzpEnZiD6mv0IpHuasBvmndAcSy8TBX9QOHVWVt2ZyPcCI1Pt3Izhx1OD3XQW2kw0U2jwhsBdMOrxfki53cKvFkOFJbhlhbEsxNxUaWWGYEMnWv5OYUL3QrGpjShENw203TgfNJC5MhLsiuxI+k+8gjgYdshBEHNcHFDkueI+xTQnM3cmGT6i5xZOkBXe4QSdaUaosP9YjCH8/2sL+MRrC9F+iT78AxeiFf74nl/frDMD5fiN/NZeVPYnQxnGL3eF9nAzQL7eZV5Tv+/re9Offl0JdlfOgR61YvTtPG92fr/30KEHRLwoRZiWqg4ih+fso00BOq7bF/WxcO6cEQuDF4Loamdg7QOQppGfVc3Vu4+26TUjwzJNLIfXPUe9yhB1L3zfZ2+XB1/dHqohko+297bXLY8NTgP3Kz/ZF4eiX/rTFSp1zbTElS1pMlYBMWr+CKfbKwLVPd0K3xsIpX8ybXn9ODib12sJen8UuLc1/QPrkMU+YhfJKCIFDcYgyJZ6FJtFqvB/ADK15fQ3gbl4f76rXqBnovmazf3wN7mJ8ICfPQlttEzg0UbqzwkZYjRt3WWMyU3wgGXlEUPbuSdFRkiEYaa8xV2IxBTXPqjE9BZZomml5SPwqHCjNb2ggseihRa9dJysYkYqQcWoiPlLO6H21AFvhVj8ZnAz4fnbFTD2cz8Rj/2UWFtHncrIp3u1RBiu1JEsGchViHUnuEfZz6mQtHXrJpvxL76xA6Dgh04WFPI1+Ay4KWgiTebmVFpLU4eg73YuEFB0ELq9Cp1wqV4ZeLPciwMr3x9ka4tZ8x49UpadGqCd7tdbrqlzkyal+qDgpmgGGWMhmtKRxf7OViEADNDMKezjuEQLMNZCBJugwUtguKkGqR2zQVVokuhpiZ8biTlhOScvhN+5S87vzAV3erJe3hNvxRN5o5byFGcBUfqO+bLINEeVVAGRdrEqmUy6+MaRKDQ8MQ4gbA3JbIhBuF3MGkcFopQ5E7QCc19dItqkSPA1HNhhOh3igpd5UkzV15OwDSyuweiYRJCYpDbsqjVgFLpsdrJKouMMwxRxwE+s1vC7GHmcMIwHGabG7N04H1jy2Y6rcYwNUA6S61UeQ+m7Kx6Jvt+m/FCZzaSThaH/AJczeWlGHiXTiDizV5GAQg4vmBVqiLWdGcMBvTkJdguqur9e8RwCFg8jxIWjgR4rzYZ4GLR2yAXFQ7BlWNghJdpg1FGhh0PYz4dezqrncDO46x4NLL0VS3vJ4tKabtRq0Hb27gspZsk5UNsiioWqOuK7g0p4SDu1GbYAhDylkNWuoW7N9DSzVGtAUuy3T4tai9O01OT6trnmXa+0L14u+bqVzdlQe/YdPVIrbtF9lY2Wp47P46sQPmmyEXvGuMr7f9QJrohf5jDnoUeyDLzaq9b4VcaWZ2AZTAfLxY4SqIU1jOO1teyKwxrhVAsV9ywXg8fZQNYB+satffN1Je/Yyv+iCPIpolpOoqQlTLFrJG0q/COf5LZ4m4Bte1FxVYiD96bTjo8PRZ1JeodWPX5YaAxq2+SVDB6xE7CsOllS7cIdqdaVptO5Kk6nmrMNcdD4Op08Epp7WwfHKkT+5xuhVSY81DZupEwrdpW+lhRd3A55buDwnmeBi1CdV0bo1J3To9Y9IeVB72cIyz006YaUaE0iJJIYxKc3LVhRKQX+cxJqVSxoTQR4QJJojwtChSX6k5BNGl0NgQ716kWxYuitFCmSyo1dySVwEtcOHCvZe/adlIoW1pwNBAia2vHEfEaMCiYfFjMkJAClRCLshlcodiaKdLp1Vn39QGx4v5KACD3ljEzdy1sGeqhhTVLja8IiChRqH01PxOdLPl1/i2rvgxav4CHPXZZXUN9cshF9gc+jwMaUSaASSxy3Gh2UY3Ll4mrqtg4GCri96agPCe8NAAIkDWQZDaOCgMWBYq5RDMhVmMTwO8NQ2/PuAfJLCEvrC+RUjTd7RCw3uMSSIjIHqm5EtlUqVK9CoSLYF3ocal9tFoTSN0kEWo1CiFawq59+497L6Q3Pq8qpoTmzAEjA3rOWiheYUEsUXB7XxyiYsyTYw3qjh5eo5vsplNMWSoURMJIMF/wGlIHacX/e+Ob0Em7gF6OAvH/e33SpCPwENdYZcrRu5QSC4d+6QIZxYKxZ4CRj6tsKKWXQsm9KIIsdmK2dGD8ADz5UFQDp5NHd0R/Tzc86d9o0pNAOzSed3TG2+dtYvZx2yyp8JXTW9Ln8Uays4/z9pufT9CazmY3/YF9lG5ncBYu59oH2Sl8zOuR54V1J/eIn2KuFtk2eP1ZV/7syPivqFlaORbMVMnp68KHoknEzQedhT6q/MdVpdkKImN128KndPpwfrFkoTmqpHBdD0PclFazVnd9XclmLJvH64/omfBpM2PioSdi3HZeVaoukDCejMYLAKCa3J9buNpebFSdzLM11bav6hU36mLP70SzcFS/KNS3OaQ1qmbqLzBhu/JNUVpdzCKk7JvR9OKd+Rf6LLhMQhi788qn/rTGHVdn+42/U0w8EhUVqISa3FAMS3Ug6kiiaaaqvuDnY8MY9z3L7UxeKaM21Pqb5htRbCZ1rN7AX+tHMRWIJwhP3cLdG8MD8KBikDG5nucLtKpGAx5PuaFV2lvA6k921FqN65Gv0IEtG1+/UB9B5JuGOuKN+W63pP2SN7trqPPYU9SBPLGyUVGgOhetATEjtP2MisENkx+uWJ1X1dwlsLlHN6Em26QeguErFl2C5at9sP/Vb/cBAhMwPGMN+Qp/1qzGcGGlNS+DnYjE6PObhkJWeQirGvF7Hb9dGcRLjH9F9KbVhGft1CY0dJ1Z0iUB7Vvksyqi6UQsC3jP+OMpFWkTtDRASoGxImOAawjxNAvZOt+Zb/y2KvzAe9Ay3DlUVYGlEc0+2N8b4eiSUl3p9wj9R2AKpmxUb2kjFHZxPtN20+cO7/LBNuiZ3k1BdbRQjMZpj5H4JqXt9o5JsoxpfVHzrZ8cgIcVK0VC9Tdw2W+FPcAyzb58pYQIJg19Qw+KYJQYwbAhrnsNWaEqKas499Vkrf7HGGfZ75qMkKZ/XHYho7p1if+TSFdMkKABmiDAxLMfgD3YszFDal/d64t9xbc9wItJH3YYMJY8WZyhIEPodz7LYuqc2j/u9d9cqfrkieHOvuaVV15+pBsceyPS4b3oIqD/5+fmTk2f/9sLCuO/udZ3Fd20ie7H2EF7TBSt3+kQ99AvY4GrkKm1DcQTtNwtCrc3OBGtHJuIcO7S5lqkJYIynnl3No5pJh7RTkFq58L4DvCmaVrZczXOTcaY10AffSsiP6hHEqh/t8f4UTrko7GiqdUnIHdKZD1Wh0jRw//0N+Isr8ecsmXnZYDtVC5QOUhMsBg1IuWPB62WLdkvPVqoZMPuxcHFBagi1ac6hwLtyh2j4+OLl+Fu43hZj8DGmK1Ft6Ir4kxe05W0Al1iQlyRioJ5KyV9q2Uf2DoecUVTza+lFSHT1uJKXoEz8UgA/lHEGHdqEF1Afcak5U2vI5KEaZB9z8ZlTeDknsV5qgDdySB+VvXV6YDdzwc47ImBYdetzTpE8ZZuiwWQ2kEBbokT5YEofiqsQG1zXn+N52EG8ZYqoHXQHPwah+CxJaJC88lyAV+FegbsnaYyyDa7Dci1RmyLEFwjg7etZN8EDxDO4v5gXFa5e6lY6/lULThXwfUiiDM05x6ysxBCdYcrv8G3hVXPp2qhu26LY+jcGj0Zz5493FHdyev4FFAKlFu5OvRYwm9E1t44HEkPAPikkO5FSOcoKUgfZgh9bJmfCINM0by4PoRhQ0l7TGHYsxl97HFs9ieEz1/HDwEQEEix4Rnb/Nu6nSXXu01MGxAuU/1U8pIZ4bT48AMIcZaK2Y+ODM+Nd1hBFQxbGj5TvRquS2jAFmx9CZImZx8xTgDMmEAYRiVDAwKERHgfNV6zhWEL+xfe3onuD74ENiExjHo8Bo5UuSymEsqNO7U7qKoBjuQTnvrRIZf0OIQIeuaMrN5rH28lfeyhR01/1FvBGNmcY0kvlWPE2/VMFpPBLIv01KtAeUq58ez8+6JoodmtkaNnTp85tudW9T6JNKZ06KGL0RK4gJSACzh+noka2Rw2i80NlOcf1g08Dp1aw03p+EW5CBIixEkTC56+t71p/sLgDqfS7Lfl8GNy2Jrtq0dDS1d1rHKpxfsPW0swBb1GFWO/05RIb4mAp5svEVhNP9AGJCpf2Jf2TrOEz4us75yMdX1y8t+fqDwsIAIBU/5n4O7MPl2+gnGLNJfa0npKo/mR91+M9V9M8j+kEX0V6XQYi/w4+221OmTnqqN9pH6RxQKrNq67RFZT1i2gy2K1xbaw/Uc9w5vTNax+6MgVENuRrvOAq3RUpaTx5MnPxuZ3HDFRBCZ+jfnA1Ks5y9t/1HPzT4Oz+/G3p2t2acxMERi6QySMvgZV5i/Iwu5TnpbLTLdjIJdxVwEJJHSX2imwf+VpqN8pi//YHSIGewuHcfAemLrBld4g/uOXfBXEXHGzoswrL/D/w9Fq64T+zamK5cmky26G/3U5ihrkyV/XMlqWPlpC9pcDvqM3kWJUviwFY/YR4wuGbXQXwjuIHas32eFVqwLd+PWSlFdW0Tn2MDHx0HZtLR6ifcEcZQtfMNjjuk8xikGL+8V2BSwmb7+dtVkvrXbw4282L/vZV9GK6VP/5LhC4Z8RQDViPzBhuPbKSL7e8Qmu3D861DQpjc5XDYeI4yJpKbvmEyIsAKabaqm22Zi2w4ia7EfDqs2dzp5IOJL2DAvqBLjZAWBUNaRBDsthRcu3nj4KKj5Ugh9lVUdZhJZwAOlyoVe/s+clhvBurHD18mLoRLJDV5IOzoSK0fsJJWBuVdecHidh3gtooDOYkxZ5y23j9eXATK3D+34nKz/S/cJ7e2KGHu61IhGQbBGMq69LsYhS12lmHJQFlTgPaTDOz4TNxxvS0FYfo62cOxUy2Id2PzNAe/UsmbVCQYT5297L3GVemNLwfPJL2cGPsYvq+Qx5Zftg0NeXiPg3Kt3JLvPUT//R6Oy1FUPDrvaRi8zr+mIrom7pxNLdEC9q3Aec3Dky776KsIjjYML0nlKxiv5N3PEDkVXvKR5s7+D8+wlmIW0WEzDqNdJUXfGtYiU+ueI85hWYgZlvVBXvqu7wjariPuY7wBM8HcsxXrqOgi4e++rMjcXaNK/YQpY6eTsNGaXlrwb8kXC8CxZUZ7Sa6OV3S5v9THXck5iCvCQ0+1Gjnmp9k8eDmcKPjFHWqAP9PXAGS4Nt8L949BG0/j4lDUTQ0ZogqpNmfh3i0uxGO3MLYonExnKaaG0Pbp2AybxnHnAkMCwiZ3pR0f37M8oDSDO52FvAQlGy+HoiaazTGt5NnBx1PsJF3O+2dOvQiaeLbVoWv7oeOH7aqKHNd3O27UmRQ1TAc579U1s1N7ML4InjTc/8x5O/bqvzb1uyjN0kHbqdkqzs4/VOZ3M4IPqqFn2eOs7PZ8GmqEIGq2JLloQONuk8FMNeFaeenZmcezFHh8sN6nh+bbPdGwHmRZ0j6gSW7AYBbfMk0GTlgZe5TRy8OFainRJl+fPH/XnRZr3Gj9UoxzGyojdx6GMwW5PH5lC0KGg6r0uvjtWV2Vqz++mMywPVm40UbzwlK4tR1DwBLSHuDZNxfc6w3qV4E3n2dxhodX4OfJtSMDpdIeJYoWbQa+/ElD8cdlqN9jaH3Z3QLTowE8Lx+fdKwC8R44iwYaOvnhlIxgcc1sSY/Xybizflom1KIOID++qsAitwAmcqxyvOuf8ZDYeVYrDSBFDpneOCKgdVF1RN6EAURLH9l2khzu27nAvjSA3ZDPsEVBcK9v7QqUDnPmlCro3Py6T5N2oduN20AmEiUPYRJyg0vPFEk19/3AGraLkEdNIjfpVP2bjSVzRGYVh75IklxIMd0BOcQkISfcvFh3uVIkoZVdhiHcnR/JzRuz6QbCMGDGo9YHiVpbZigNiLMqT5izb35JfPPF/v8ELJ/JKqL8PQtIiNdPZBohmeyCDI4L4kqoBP+GJC9pufKybRL45RuSc1uT8YsYah4y+1lZIfI/E0Iif3tdIkxW9YQZi/kaYn5DLC9uu/f/XVc3lnTyuT1hWv8CQhAp3W8R4foHeMf3SvNi+H2VdR10dhcyC1pxUg8vFxxYV/hj8Fm/9+8ddLrx8AwBYsUjQIYmcp5oR3gPHUZwZWsaFDSvYQDGu/jG+QmNHYrxIV4FOgdl2kf/l/cSwe/7e0ulJP6iurhQ3tOiaDbUFga0G+Kk3ybjXBydu1HEn20//4V2v82XfnNiwz2PMJSmAFyVaD+vmmo/Er9rNRnyPjSeJHFQF4rDlU+efWiB/eifvsfyVMlZiCYvE1joZCq6d8hrv297KmPts9ZvOjTgbd0ONrzYk7EwUmZnnn3PhsARA4kdXawYtbCP+tY4naajk5dfL8GG3MoxF7XTe0CdiBq8VAnBsok1Wi364QOiNkc0wrcMWMeIPE0lGxJYs0XbUVXlrL054sdeZn260GjzByMINS8MFhRBmJRJm1xUTvl275aaqcDyX2WKPdefQ5p9sN9hT9crGWmkKqMnC+tMmgbWjbYVW1c9R3LN7bjNvZbpDo3IXYD2EYxB6udyFYcdCGaPmoHXWO7XiJjaVlSyJlyRXlQpffuWahtAzNysmMYhwEGarTPWd7lw0FMRNN9CnGpsBNHsMvZ1jnNtU280kPmNBlwwmHxsWawT1qmjm4beoKwqijAy56puvnqxsAJWftbalxl70ihJmj4aeICHGjxvDg6de5gOAlPG+9/XagENPAkdioo+75hTiUkDQaXl2FB0Ioj613qKXUBJSF4NmSyeuANbLzfOkH3pzd3z81eh9BaiMPKA8G0anDHVMe9s5PzzsmAVtDkoSOtLktp0Au9OoCMqENXeuWRRfAH6fEHbVq0hfVxLnJ6rpj3eWV9UefZPKe1LiLzEfPN+u1lDNWuTejrkt9Siyb2IiNZjQpHK0cHDp8dHmO/mX3LGkzDxzK0SahLElYyPzZhDHPWguLi5Pvkp4WcJB7QnTNTbLav2RYEdtiW0Y8pOIw9um834rom6ppX1RTeImLAg/4YaxxHsqWdHuMKmcDSF6J2c9thU9tUwTs5Krflp4eyQdGZyGm8ULn/v/XWEHB/LKmf3wrlFPf/hq2Sd4QXqHHcLzhhudkLqtOa8veXgggfW6s9Ja+1ZW5eeax65292XMRO29znx8X0mAeMkmRzLf9x2akIo+ZaLDvTGqHQh9tpDxsFYWlBdkALc0mrkgsPwhC0jCczDmeoeWds8SjyFxiF6VOaCmGKKvR8z9+8ws/jNzlTuav4pXCWMZy/e3L+6Zp+RcbjtWZuJGCGDbN1Pou7W5mFMpmSVJprSZLqJcMMjPqOHc+2FonwU9q2bpBnGIZzrTibINjlGHpt6bAvjlWFGOdReRRXyeMNSchOJSvng78nmZqAU67E9o4zosQZsTzqUcJx7R2iGWsnFJPIRZKekmpD9ppABRqcvZ+aps6VN3yY1RW7PF3eTonAdHTfPNtNDUrOuAUKqcDDykhS/SJuQfAYxYnIdattnmYOa5jqkakmMD6kBtpgkOXa2yVpCw0vTaHUcb6gZ4xdzeDLyHdSIXK5gMDS0PHbEfesvQjwFX79LdPPfvKuy1xhBn3Q2loklVuxMKQedDQN2YaFTb+GjRQwRomRUfQ6FLs9y7acrjtvN8UgVvQTWue64gxeXsHyhRInmvL6OQEaFW1bmvTUDltlahbxeHqyTmtBdMf304YQu0HeTBut4yQJUz1Ts2wqXG8xiKuH1Zrs20huGhFWVrnoWPIpBDwccYXD5yC7ilL72C0qcxCaRV70byIIt2cqLLM5WGGBy2Ub0fqqk04ip0ksL7Y+nDTf+3+Mc/1/DhrLyyvLs9nVZ9gh4ZR4CBWoxtZPLUcreqZYdCoEvqgWDN44siV+qD1565AZ0WRsdHWN5Sl2Wwzq6c8bbZX1jrzrjKzBVvaxriuUeuWjV1mZTnLp+yzkXvcFliotb+/8PIbb/3v/8cnr9+8b/UGo9GgPxh6q/2hpOmGoZuUMduLjHfW570WumjBGTVaJfjg+97hnklU3LcmjSVZlgZi93Jw1et02ufvjv/9KmIvOc/uSgtvvMhGQVF9q0/Bt3XzkWeWkUA6iRiy/TVNDYxeA/z7+A0y1zj1LeQ11Si8AG4Ln1bgkC5qfaK4TKN5RJ+WOl0rVFZh/jpcC4W8u3nv/PTs7Lw3z+oGLsXoWganyrBXZHqvKg4IUkkhhEQ3LkZel3CyaaknNXG+dYundk/kMJ0H9r7h3lTj6n5aGtP3HwSMoEpcgo7sQCIZb3ajq7DIgJLNt32xmEt0iAuRodIespCnHoQuvz9q4RydjtAOAmABa8/UhfrwYQu4cAUXPRXoT72TtJrN2V5HKvbrZCXSu5aMDXY9oYnm5u64eLDB1s6wlMNCCpRxrr5Vr1peVzcLI1JpXIHgXGbJaHEgIcN4OAFTlo4rqvwGqPhygFxDCCxBKjqViyM8M2JYpGviIsZJM1FDaPxzY8VvHYLj3Bjsm78wS2gqaxozh69vslBg2X+BjMiC58G3Rz0sHWwINzWhHtlpWbmPA6v5YEfpomM2NGZVEtRjZ6msUsSFAeLMSeKnVuGtBlo+jXEkvIb2+1RamMDSPtrNfGGHDszAfLgSKVS3D0Imi+pU0xmv/wOvHuuLRirZMOLM+lgaZ2/D/6Q7HYwQNkMbs/RN6afx958NFiZKitWMNluD9yD58EbdD2Q3ItZI9o0CDeFBe9BZthbUoiI74dAa3YCMWgNE8IeWuJS4q531e6WBIDsGt33p01Xs5eyQZfpvnmTm96WcCOSrtwo3B+oldHKpUJi1tJWGqL0KlJnfYA0gwHdGoF0joZr7PYw9KFHRXskQxkp6Uy7q+4MaLgCzW505EPZlcjwfqATCNwBuvx1Z3e/q3b3RaTd7RFzMpQA4ZgkzxHN51W2vCzgswIBU3C/QHEuC8HeIqDOhEUg+/CQvixCSL/SjKFQ4l3YcIrDMJ2YvbjiEMIdlJn/MIVLWHDGBd1VEzJi1F4G6x4Dm1Bf6XBCChv6zfjdnrm2oXIPmIPjUdCVHiI5rGcghTiYMi1Afr4wuYWxmvZaEiiaQeaD3evai0SOwWE3jdV/ew85j4L+GmmzU7Slzg+5YzpEAaXTwyt7zvO6xozVCt/3m5pj1lY24pXmQ/dJhXpgCCLCT/ifNNh9ve5j9AqvKJiLN7md/vQgSB80yW4xEYLNd9jDlunHPlpFtia5rIkwVGVa5ad9dF/36c0PW2hizOcY8UbV3lKQzKBUe7NMtQBzG3MDHQhp2mBBC8kq0iuT9/pqo0fJgjJKFQsmncaoQjK27l2c7jJvwONfpYtmaeKCTtI/uxdf/1/v//JNplEw/NE68SL+TdY7vLeXAMhfGvNGDeS9D0F0/zPtBrn15Tv/oGgyhF38B2/yxQ24r3Tde/HfkfCkUvndm+vTu3GFsHac4sg6KrXG92aHRynY8J9fhO/syKcsZbnm8A+jrPGUbV+jOljRGl6a6NUMnx7nD9KpvDTV08FCMD8fE6dB0bbnp6OtgIrBANTwGFYvpyCeN/bOggESxh5GQOhoAe+TNsQuhXS50odjlUBeBZ2nqIrIsYV0kmsW+i8y8UN+ezTkPHgsB8MuVLgSoOdOFgnJ2dBGAno2TiJpJhLSvfSmQ2+d2UUAxLV1UsE5YFw3co9hFB1uPuxjg6GAXE+x1INbDlHSxwVWGwsHD0O8tF5IBlTSLqdLEaooqjaLCbCZnQ3ptqvrCJu2cmsPk5lC7kMmMCqHL6DXvOgsi3UQGkqU6eTCjpg4TEQy4WtvdGo2qtB2CDtFLtc6UtCd2VtajbqJK5uS+Ilk5clU1OY5SbvKQCukiW7RTEfBBDe9Qowt1Sq8WOUlqY1CbN9Ta0s10QTlsu+cSytQ2+qNDdCJFrgq7KvMT9N0q6GNnqOqe6S8nRr3Sq11RNbjZYua2nBlqVSt2Gj1zl2QyumUVAwlqfVkLz80ipmaY5k4Imp6b7f5a0cnMVNWDFl72mQQKsxWkG89vlQf5n3/m8pX3vwRVAyDclaBwVY4D5DrIQoywRXC8Ymqyy264yQwPX4Hrbrvj7jlLv/RCNUS+cF+h2xaxl304+J7j2UzXu+OxIve4UXWFGt/yYiQ07Fu9JjE9zIJqZjZIqCUf8dYzhR7tcF+daaZzUz1niOdA/fp0mwE302wdZuml3RFi/SCOV5mlJPJ52xxEdJ4t9cbvnCD9bK0TSudiLZ7H9H9dUGSHhJARCpziP2hAeGgsHTT7INoCzw4uGoCFTJEuVIQGDEwZKkFg40KHAxzE3ycuO8RhjnCU7ezgDGchoY8207KV41LGXc8XQRjFSZrlRVnVjWy7fhineVlP58v19nDfHj1+8vTZ8xcvX72G0DMwMoXzmVnMYoi9nCppqGkJ4eG9D3ZIKZUUJmtoiYIJ5VKZhEvDhxGGGW2UMQYnIpHq+17+YG681OMtK/dVEJP8gWCosqo6HJlcU1sXrV+DmWCcpnnRN302GW/G7I7OOWX8sweEYATFcILBZLE5XB6fpARCkVgilckVSpVao9XpI+wDVAEyMiZnn4E2mswWq83ucLrcHq8P4Z1uiJaZlTl110GsB/+/b+Mycrd7sfx8+FZ/3b7/AXcO0qSPJn2uTz3K3bub/y919BNYeEB7G7nHTps4EMmpfT5ybVWIK9A5Yjd1p94fgzuaGj1F5VekJMLH0M1uqd81GQYZs/9Rc911CzcwTP8W1qbH1E1JKTW+oeM/+2axmHcV9iHpZ7XUl5hhqNkjOUxkBk3bLQglYgFHcvLxsaBA53CEPdHb5ayb+uUY+flIDXzy39pBS/7oncTGctM46ojCBipSUlCKiGywlD8C1IqXfG6GbpKuodrHZqMHakhOHkR057UfcQkO62nWgJOJSsFWU3J5EYpxfPsT1W3MqWOtE9fnTRhs646C7PNgjY6qmT5E8oWtOd2RoV5LCTSlTrconDL4XAwCHCz5Dba3EEPRXKtXoV5i0a1euMmQiJEFPyGtfuZe7fr0Zbokvi3FZUEtW5jkDZTsjqeNMEmP0GhHIAebWLI8ZnGgia0pxKiY3tnc+9ve3e/t+ePD4+Ngnvjd4tF+L5QO5+20VzPhQV0mU+Cm2jWOpj02jub+9ZdYLeq9x6thclypyo5c/e/Zcz17SvMnX4O/BUP/hotqu56yoKUZ6FY1LuwtoAj1W77b4ybhFBgK1DJmBaqjRyxhoEB/mK9aoR43abIbcgjZ4RGTFiFCZBsS7WXk0uRhrgLNlKqK7gyPIlHisyKmD2lxPA0pot4nCglkU5GS+DsJD4rCE4YGgWAcrAMCgWa1HcSGxiLhUZoYyxnvQLxQQN95DGBjGt/vlPwO62wyTOQbcOXi2BxHO/3QmhtiHPyOxTg6dklMDRF0vJ5J6BBVIK534FNq3WVzDmBcUJ5huKLes2MfsRYLQBNZVKBU7iXVIwjitJwWNmmSjkVYxK74+1N6VMxCp15AtbT4NrYmpyDp2kmGiGgBH6MKLipYKFYF9QuwxqJyDhOfKFJw+jxdI43fJB/nEFXxM06n/u7YQ7HirMtJ10rVytTjUJuq1VpxleBx0dZApgQqoKeVpDhx7KtaXGn9woiLue8dszpMJB+tKT4lJVYExEehGRnEF6QqtivJ/EhiRUMF3C9JYGrkvF7EkJy44tJwzW+/VXC0GTvijbIighgQWs//OoIQZdMJDhau2qxpYdM3D38mPIKf7/993wEAAA==) format('woff2');}
+:root{--stone-050:#e9e6ea;--stone-200:#c6c0cb;--stone-300:#a8a1ae;--stone-400:#8a8291;--stone-500:#78707f;--stone-800:#3a3243;--stone-900:#241628;--teal-400:#72b7b2;--teal-600:#49817d;--red-400:#f77d8b;--red-500:#ee5570;--red-600:#c74f63;--sans:'Inter',system-ui,-apple-system,sans-serif;--mono:'JetBrains Mono',ui-monospace,'SF Mono',monospace;}
+.lbl{font-family:var(--mono);font-weight:400;font-size:11px;letter-spacing:.11em;fill:var(--stone-400);}
+.lbl-b{font-family:var(--mono);font-weight:500;font-size:11px;letter-spacing:.13em;}
+.ttl{font-family:var(--sans);font-weight:600;fill:var(--stone-900);}
+.ref{font-family:var(--mono);font-weight:400;fill:var(--stone-800);}
+.refm{font-family:var(--mono);font-weight:400;fill:var(--stone-500);}
+.tk-stone{fill:var(--stone-500);}
+.node{fill:#fff;stroke:var(--stone-200);stroke-width:1;}
+.node-al{fill:#fff;stroke:var(--teal-400);stroke-width:1.5;}
+.node-rl{fill:#fff;stroke:var(--red-400);stroke-width:1.5;}
+.pill{fill:var(--stone-050);stroke:var(--stone-200);stroke-width:1;}
+.edge{fill:none;stroke:var(--stone-400);stroke-width:1.5;}
+.edge-teal{fill:none;stroke:var(--teal-400);stroke-width:2;}
+.edge-red{fill:none;stroke:var(--red-500);stroke-width:2;}
+</style><rect x="0" y="0" width="1200" height="520" fill="#ffffff"/>
+      <defs>
+        <linearGradient id="beam" x1="0" y1="0" x2="0" y2="1">
+          <stop offset="0%" stop-color="#ffb471"/><stop offset="50%" stop-color="#f0546c"/>
+          <stop offset="100%" stop-color="#a43189"/>
+        </linearGradient>
+        <filter id="soft" x="-20%" y="-20%" width="140%" height="140%">
+          <feDropShadow dx="0" dy="2" stdDeviation="4" flood-color="#170d1c" flood-opacity="0.10"/>
+        </filter>
+        <filter id="glow" x="-120%" y="-30%" width="340%" height="160%">
+          <feGaussianBlur stdDeviation="9" result="b"/><feMerge><feMergeNode in="b"/></feMerge>
+        </filter>
+        <marker id="aS" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
+          <path d="M0 0 L10 5 L0 10 z" fill="#8a8291"/></marker>
+        <marker id="aT" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7.5" markerHeight="7.5" orient="auto-start-reverse">
+          <path d="M0 0 L10 5 L0 10 z" fill="#72b7b2"/></marker>
+        <marker id="aR" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7.5" markerHeight="7.5" orient="auto-start-reverse">
+          <path d="M0 0 L10 5 L0 10 z" fill="#ee5570"/></marker>
+        <marker id="aM" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7.5" markerHeight="7.5" orient="auto-start-reverse">
+          <path d="M0 0 L10 5 L0 10 z" fill="#d98324"/></marker>
+        <symbol id="saturn" viewBox="0 0 401 400">
+          <path d="M320.612 205.244C319.572 224.724 313.726 244.153 303.773 260.943C287.101 289.073 259.17 311.044 223.667 317.706C205.943 320.887 193.052 320.484 178.575 318.263C168.131 315.938 161.556 307.454 168.569 297.371C177.161 285.01 189.34 276.888 201.496 268.765C236.953 245.07 274.616 225.265 312.627 206.073C316.877 203.931 320.911 199.692 320.612 205.244Z" fill="#A43189"/>
+          <path d="M345.829 159.79C354.759 152.726 363.384 143.651 369.495 133.929L369.505 133.922L369.516 133.915C376.241 123.209 372.422 113.542 360.102 110.612C345.937 107.241 333.928 108.599 319.431 110.612C315.901 111.102 315 111.863 313.793 112.626C311.347 114.17 311.077 118.884 314.599 119.471C321.043 119.874 342.154 118.432 347.217 120.679C361.643 127.084 322.169 148.406 316.982 152.534C313.87 155.006 312.378 154.71 310.628 150.817C296.9 120.297 274.545 98.6558 243.304 86.3682C223.725 78.6704 203.553 76.9081 182.714 79.5419C171.484 80.9606 162.674 84.0449 152.357 88.0643C148.954 89.3897 144.453 91.6475 141.323 93.4464C133.986 97.6545 127.233 102.375 121.087 107.633C115.734 112.213 118.878 120.412 125.892 121.07L255.04 133.195C260.773 133.733 263.604 140.427 260 144.915L187.969 237.018C185.349 240.28 188.694 245.659 192.579 244.105C221.883 232.344 250.371 218.072 278.578 203.889C302.1 192.061 325.235 176.079 345.829 159.79Z" fill="#F0546C"/>
+          <path fill-rule="evenodd" clip-rule="evenodd" d="M211.673 167.658C216.271 162.733 212.222 154.751 205.531 155.552L88.5438 169.563C85.0053 169.987 82.0607 172.537 81.3465 176.028C76.8475 198.02 78.6423 220.167 87.1071 242.335C90.277 250.64 90.4756 250.879 81.9187 251.931C80.8029 252.068 79.6849 252.22 78.5651 252.372C72.1137 253.246 65.6018 254.129 59.1107 252.286C43.4203 247.817 67.553 232.954 69.3751 226.603C70.7205 221.913 64.346 220.156 60.3605 222.971C47.5893 231.99 35.4307 242.515 27.8912 256.433C26.2801 259.655 26.4794 263.685 27.0855 265.863C31.5498 281.902 66.1127 278.991 77.4998 276.946C92.4207 274.267 103.194 273.294 117.691 268.865C121.645 267.656 121.718 267.255 127.758 261.031C158.363 232.623 186.37 193.89 211.673 167.658Z" fill="#FFB471"/>
+        </symbol>
+      </defs>
+
+      <!-- LEFT: human delegates authority to the agent (icon + aligned text block) -->
+      <rect class="node" x="70" y="70" width="200" height="84" rx="12" filter="url(#soft)"/>
+      <circle cx="100" cy="106" r="8" fill="none" stroke="#3a3243" stroke-width="2"/>
+      <path d="M86 130 a15 15 0 0 1 28 0" fill="none" stroke="#3a3243" stroke-width="2"/>
+      <text class="lbl" x="126" y="108">HUMAN OPERATOR</text>
+      <text class="ttl" x="126" y="130" font-size="15">Alice</text>
+
+      <rect class="node" x="70" y="252" width="200" height="84" rx="12" filter="url(#soft)"/>
+      <rect x="86" y="284" width="28" height="24" rx="6" fill="none" stroke="#3a3243" stroke-width="2"/>
+      <circle cx="94" cy="296" r="2.2" fill="#3a3243"/><circle cx="106" cy="296" r="2.2" fill="#3a3243"/>
+      <path d="M100 284 V276" stroke="#3a3243" stroke-width="2"/><circle cx="100" cy="274" r="1.8" fill="#3a3243"/>
+      <text class="lbl" x="126" y="290">DEVOPS AGENT</text>
+      <text class="ttl" x="126" y="312" font-size="15">acts for Alice</text>
+
+      <!-- delegation edge : label knocks out the line, no collision -->
+      <path class="edge" d="M170 154 V252" marker-end="url(#aS)"/>
+      <rect x="128" y="190" width="84" height="24" rx="6" fill="#fff"/>
+      <text class="lbl-b" x="170" y="206" text-anchor="middle" fill="#6a4fe0">DELEGATES</text>
+
+      <!-- the action -> SpiceDB : PERMISSION CHECK labels the arrow -->
+      <path class="edge" d="M270 300 Q430 300 520 274 Q572 254 590 250" marker-end="url(#aS)"/>
+      <text class="lbl" x="418" y="274" text-anchor="middle">PERMISSION CHECK</text>
+
+      <!-- BEAM (vertical) : the SpiceDB authorization layer -->
+      <text class="lbl" x="574" y="50">SPICEDB</text>
+      <rect x="595" y="58" width="11" height="404" rx="5.5" fill="url(#beam)" filter="url(#glow)" opacity="0.55"/>
+      <rect x="597" y="58" width="7" height="404" rx="3.5" fill="url(#beam)"/>
+      <circle cx="600" cy="250" r="46" fill="#170d1c" stroke="#3a3243" stroke-width="1.5"/>
+      <use href="#saturn" x="572" y="222" width="56" height="56"/>
+      <rect x="516" y="392" width="168" height="30" rx="15" fill="#fff" stroke="#c6c0cb" stroke-width="1"/>
+      <text class="lbl-b" x="600" y="411" text-anchor="middle" fill="#a5318a">AUTHORIZATION LAYER</text>
+
+      <!-- fan to the three verdicts -->
+      <path class="edge-teal" d="M648 236 Q706 220 706 150 Q706 108 800 108" marker-end="url(#aT)"/>
+      <path class="edge" d="M648 250 H800" stroke="#d98324" stroke-width="2" marker-end="url(#aM)"/>
+      <path class="edge-red" d="M648 264 Q706 280 706 350 Q706 392 800 392" marker-end="url(#aR)"/>
+
+      <!-- ALLOWED -->
+      <rect class="node-al" x="800" y="66" width="350" height="84" rx="12" filter="url(#soft)"/>
+      <path d="M824 102 l6 7 l12 -15" fill="none" stroke="#49817d" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round"/>
+      <text class="ttl" x="852" y="106" font-size="16" fill="#49817d">ALLOWED</text>
+      <text class="refm" x="852" y="130" font-size="12.5">the agent has this permission</text>
+
+      <!-- NEEDS APPROVAL -->
+      <rect class="node" x="800" y="208" width="350" height="84" rx="12" stroke="#f2a35c" stroke-width="1.5" filter="url(#soft)"/>
+      <rect x="822" y="238" width="4.5" height="15" rx="1.5" fill="#c07d2a"/><rect x="831" y="238" width="4.5" height="15" rx="1.5" fill="#c07d2a"/>
+      <text class="ttl" x="852" y="251" font-size="16" fill="#a86a24">NEEDS APPROVAL</text>
+      <text class="refm" x="852" y="275" font-size="12.5">only its human has this permission</text>
+
+      <!-- BLOCKED -->
+      <rect class="node-rl" x="800" y="350" width="350" height="84" rx="12" filter="url(#soft)"/>
+      <path d="M822 380 l13 13 M835 380 l-13 13" fill="none" stroke="#c74f63" stroke-width="2.4" stroke-linecap="round"/>
+      <text class="ttl" x="852" y="392" font-size="16" fill="#c74f63">BLOCKED</text>
+      <text class="refm" x="852" y="416" font-size="12.5">no one has this permission</text>
+    </svg>
\ No newline at end of file

From abcf053bb7fe663c0b1383ffbde446eda6f03949 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Tue, 1 Sep 2026 11:46:19 +0200
Subject: [PATCH 20/27] docs(workshop): tighten intro + next-steps (ReBAC
 framing, AuthZed Cloud/Dedicated, resources)

---
 delegated-agent-authorization/0-setup.md     |  11 +-
 delegated-agent-authorization/5-nextsteps.md | 112 +++++--------------
 2 files changed, 28 insertions(+), 95 deletions(-)

diff --git a/delegated-agent-authorization/0-setup.md b/delegated-agent-authorization/0-setup.md
index fb0ad5e..de3b973 100644
--- a/delegated-agent-authorization/0-setup.md
+++ b/delegated-agent-authorization/0-setup.md
@@ -4,13 +4,13 @@ In this workshop you build a DevOps deploy Agent, then gate every action it take
 delegated, fine-grained authorization: scoped grants, time-bound windows, instant
 revocation, and a permission hierarchy where revoking a base grant cascades to everything that
 depends on it. The purpose of the workshop is to understand why fine-grained authorization is required for AI Agents, 
-and how it can be implemented. 
+and how it can be implemented using ReBAC. 
 
 The `starter/` folder in this repo is stubbed on purpose: the plumbing (MCP
 extension, docker-compose, the seed script, the web UI) is already there, and you'll
 write the schema and the decision engine yourself across the parts to learn each of the concepts.
 
-![What you'll build: every agent action goes through a SpiceDB permission check, decided ALLOWED, NEEDS_APPROVAL, or BLOCKED](/delegated-agent-authorization/images/fig1-permission-check.svg)
+![Architecture diagram of the project](/delegated-agent-authorization/images/fig1-permission-check.svg)
 
 ## Two ways to drive the agent
 
@@ -40,10 +40,6 @@ cp .env.example .env
 `.env` holds the SpiceDB connection details the app itself needs: endpoint, and preshared-token,
 and which agent identity the deploy bot acts as. 
 
-Note: You can run this workshop without the need for a LLM key. The LLM key only comes into play later, and only if you use the
-goose path (see [Install goose](#install-goose-and-register-the-extension) below). The web UI you
-drive every part from (introduced in Part 1) needs no LLM at all.
-
 2. Start the infrastructure:
 
 ```bash
@@ -90,8 +86,7 @@ step above if they don't.
 
 ## Install goose and register the extension
 
-Installing goose is optional for this workshop. Every part runs through a web UI that needs
-neither goose nor an LLM key. Install goose if you want to drive the agent with natural language
+Installing goose is optional for this workshop. Install goose if you want to drive the agent with natural language
 ("Deploy checkout to staging") and watch its tool calls resolve through SpiceDB live.
 
 If you do want the goose path:
diff --git a/delegated-agent-authorization/5-nextsteps.md b/delegated-agent-authorization/5-nextsteps.md
index 7763304..d18a9a9 100644
--- a/delegated-agent-authorization/5-nextsteps.md
+++ b/delegated-agent-authorization/5-nextsteps.md
@@ -1,23 +1,21 @@
 # Next Steps
 
-Four parts ago the agent could destroy production on a whim. Now every mutating call it
+We started the project with an agent that could destroy production on a whim. Now every call it
 makes resolves through a relationship graph: delegated authority, a three-way decision, expiring
-grants, and a hierarchy that suspends dependents automatically. That's the whole mechanism. What's
-left is zooming out — how the same shape holds up once "one agent, two environments" becomes "many
-agents, many resources, a real platform team on the other end of the pager."
+grants, and a hierarchy that suspends dependents automatically. This is what Authorization in the world of AI looks like.
+What's left is scaling this — how the same shape holds up once you scale to many
+agents across many resources.
 
 ---
 
 ## One schema, not one authorization system per resource
 
 Nothing about `schema.zed` is specific to deploy agents. `agent { relation delegator: user }` is
-the entire idea of delegation, expressed once, as a graph edge: not a column on a `deploys` table,
-not a special case in a `DeployService.deploy()` method, not something a second microservice
-re-derives on its own. Add a new resource type to the platform — a database, a feature-flag
-service, a CI pipeline — and it either reuses `direct_deployer` / `agent_deployer` / `gated_by`
-directly or extends the same pattern by a line or two. Add a new agent and it's one `delegator`
-edge. Nobody stands up a tenth bespoke permission system because the platform grew a tenth
-resource type; the graph just gains one more kind of node.
+the entire idea of delegation, expressed once, as a graph edge: not a column on a `deploys` table or a separate microservice
+that re-derives on its own. If you add a new resource type to the platform such as a database or a CI pipeline, you can reuse `direct_deployer` / `agent_deployer` / `gated_by` directly or extend the same pattern by a line or two. 
+
+If you add a new agent it's just one `delegator` edge. You don't have to create a new permission system because the platform added new
+resource types. The graph just gains one more kind of node.
 
 That's the payoff of modeling authority as relationships instead of scattering `if user.role ==
 "admin"` checks through the codebase: the schema is the single place authority is defined, and
@@ -25,7 +23,7 @@ every service that needs an answer asks the same graph the same kind of question
 
 ## `CheckBulkPermissions` — asking about many resources at once
 
-`decide()` in this workshop asks one question at a time: can this agent do *this* thing to *this*
+The `decide()` method in this workshop asks one question at a time: can this agent do *this* thing to *this*
 environment. That's the right shape for a mutating call: `deploy` and `destroy` each act on one
 resource. But an agent with a bigger surface area often needs a different question, one worth
 asking before it decides what to do next or before a UI renders a list of options: *which of
@@ -35,87 +33,27 @@ Looping a `CheckPermission` call per resource works, but it's N round trips to a
 question, and nothing guarantees they're all evaluated against the same snapshot of the graph.
 SpiceDB's `CheckBulkPermissions` RPC takes a batch of `(resource, permission, subject)` tuples and
 answers all of them in a single call, against one consistent read. `deploybot`'s
-`list_environments` — deliberately left ungated in this workshop — is exactly the tool that would
+`list_environments` (deliberately left ungated in this workshop) is exactly the tool that would
 reach for this at scale: instead of "list every environment" as an unchecked read, it becomes "of
 these N environments, which does this agent hold `view` on," answered in one round trip instead of
-N. (If you don't already have the candidate list, and want *every* resource a subject can reach
+N. 
+
+Note: If you don't already have the candidate list, and want *every* resource a subject can reach
 rather than a filter over a known set, `LookupResources` is the streaming counterpart to reach for
-instead.)
-
-## On-behalf-of vs. advisory enforcement
-
-Every check in this workshop is **on-behalf-of, blocking enforcement**. `decide()`'s answer isn't
-a suggestion; it's the gate itself: `deploybot_server.py` calls it *before* touching
-`infra_state.json`, and an `ALLOWED`/`NEEDS_APPROVAL`/`BLOCKED` verdict is the only way anything
-happens. The agent never gets to act first and ask forgiveness later.
-
-That's the right default for anything that mutates state, but it's not the only mode worth
-knowing. **Advisory enforcement** is when a check informs a decision without being the gate on
-it — logged for audit, surfaced to a human reviewer, used to rank or filter results — while the
-actual authority to act sits somewhere else. This workshop's own `list_environments` is an
-advisory-shaped tool by design (its code comment says so directly: *"UNGATED in this workshop"*):
-reads are lower stakes than a destroy, so it was left open to keep the parts focused on the
-mutating path. A real platform team draws that line deliberately, tool by tool, action class by
-action class — not by defaulting everything to advisory because blocking enforcement takes more
-wiring.
-
-## Where this workshop deliberately stopped short
-
-Two things were left ungated on purpose, to keep every part's diff small and centered on one
-new idea at a time:
-
-- `list_environments` has no permission check. Every environment in `infra_state.json` is
-  visible to every agent, always. A production version gates it behind a `view` permission and
-  filters the listing to what the caller can actually see — exactly the `CheckBulkPermissions`
-  shape described above.
-- Revocation has no permission check. `revoke.py` — the helper behind the web UI's **Revoke**
-  buttons — deletes a delegation without checking who's asking, so anyone who can reach the UI can
-  pull any agent's access on any environment. A production version gates revocation behind a
-  `manage` permission, so only an environment's own operators can pull an agent's access.
-
-The [full reference solution](https://github.com/sohanmaheshwar/goose-spicedb-delegation) does
-both. Its schema adds two permissions this workshop never defines:
-
-```zed
-permission view   = direct_deployer + approver + destroyer + agent_deploy
-permission manage = direct_deployer
-```
-
-`view` includes `agent_deploy` deliberately — an agent that's lost its deploy autonomy (staging
-revoked, cascade in effect) also loses visibility into the environment it can no longer touch, so
-the same `gated_by` cascade from Part 4 hides a suspended environment from `list_environments`
-as a side effect, with no extra code. `revoke.py` in the solution checks `manage` before it deletes
-anything:
-
-```python
-if not await check(client, "user", revoker, "manage", "environment", environment):
-    print(f"❌ Refused: user:{revoker} may not manage environment:{environment} (revocation requires an env operator)")
-    return 1
-```
-
-Same pattern as everything you built in this workshop — one more permission, one more `check()`
-call, no new architecture.
+instead.
 
 ## Scaling ReBAC with SpiceDB
 
-SpiceDB is an open-source implementation of the model Google described in its 2019
-[Zanzibar paper](https://research.google/pubs/pub48190/) — the system that has authorized Google
-Drive, Docs, and Calendar at global scale for years. The graph-walk you used for `gated_by` and
-`delegator` in this workshop is the same primitive Zanzibar uses for Drive's folder-sharing
-inheritance; deploy agents and shared documents turn out to be the same authorization problem
-wearing different resource names.
-
-Everything here ran against a single local `spicedb serve` container with a Postgres datastore.
-That's fine for a workshop, not how you'd run this for a real platform. In production, SpiceDB is
-typically deployed via the
-[SpiceDB Operator](https://authzed.com/docs/spicedb/ops/operator) on Kubernetes, which manages
-the cluster, datastore migrations, and rolling upgrades as a `SpiceDBCluster` resource instead of
-a docker-compose file you manage by hand. If you want to go from "SpiceDB on my laptop" to "SpiceDB
-as a platform dependency," that's the next thing worth spending 90 minutes on — and more self-guided
-workshops, including this one, live at
-[`github.com/authzed/workshops`](https://github.com/authzed/workshops).
+The SpiceDB you've been running is in-memory via Docker Compose. This works for a workshop or a proof of concept, but not for production, where you want a durable datastore and a deployment you can lean on. You've got three ways to get there:
+
+- **SpiceDB, self-hosted (open source)** — run it yourself. You have full control, and it runs on your infrastructure and ops. Works if you're happy managing the database and have specific deployment requirements.
+- **[AuthZed Cloud](https://authzed.com/products/authzed-cloud)** — managed, self-service, pay-as-you-go SpiceDB. Provision a permissions system on demand and get enterprise features like audit logging without running anything yourself. The easy on-ramp for startups and growing teams.
+- **[AuthZed Dedicated](https://authzed.com/products/authzed-dedicated)** — a fully private, single-tenant deployment in the cloud provider and regions you choose, sold annually. For enterprises that need dedicated infrastructure and geographic or compliance guarantees while offloading the ops.
 
 ---
 
-That's the whole arc: one schema, one `decide()`, and a graph that scales by adding relationships
-instead of adding code.
+## Resources
+
+- **SpiceDB documentation**: [authzed.com/docs](https://authzed.com/docs)
+- **AuthZed Cloud**: [authzed.com/products/authzed-cloud](https://authzed.com/products/authzed-cloud)
+- **Full reference implementation**: [Source Code here](https://github.com/sohanmaheshwar/goose-spicedb-delegation)

From daf7077250511b0eccdc5a397d50b429a7753409 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Tue, 1 Sep 2026 11:46:19 +0200
Subject: [PATCH 21/27] chore(workshop): drop internal planning/spec docs from
 the workshop contribution

---
 ...026-08-04-delegated-agent-authorization.md | 620 ------------------
 ...ted-agent-authorization-workshop-design.md | 194 ------
 2 files changed, 814 deletions(-)
 delete mode 100644 docs/superpowers/plans/2026-08-04-delegated-agent-authorization.md
 delete mode 100644 docs/superpowers/specs/2026-08-04-delegated-agent-authorization-workshop-design.md

diff --git a/docs/superpowers/plans/2026-08-04-delegated-agent-authorization.md b/docs/superpowers/plans/2026-08-04-delegated-agent-authorization.md
deleted file mode 100644
index 22e034e..0000000
--- a/docs/superpowers/plans/2026-08-04-delegated-agent-authorization.md
+++ /dev/null
@@ -1,620 +0,0 @@
-# Delegated Authorization for AI Agents — Workshop Implementation Plan
-
-> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
-
-**Goal:** Build a self-guided, 90-minute hands-on workshop where attendees add delegated, fine-grained authorization (SpiceDB/ReBAC) to a goose DevOps deploy agent — learning scoped delegation, expiring grants, revocation, and hierarchical/cascading permissions.
-
-**Architecture:** A `starter/` app (goose MCP extension + web UI + SpiceDB via Docker) with two pieces stubbed — `schema.zed` and `authz.decide()`. Four checkpoint markdown files walk attendees through *run → watch it fail → implement → re-run → why*, growing the schema and implementing the decision engine. Provided plumbing is copied (with modifications) from the tested solution repo; the exact fill-in code lives in the checkpoints.
-
-**Tech Stack:** Python 3.10+, goose (MCP), SpiceDB (Docker Compose), FastAPI web UI, `authzed` async client, pytest-style `verify.py`.
-
-**Spec:** `docs/superpowers/specs/2026-08-04-delegated-agent-authorization-workshop-design.md`
-
-**Solution source (tested, on disk):** `/Users/sohan/code-samples/goose-spicedb-delegation/` — the finished reference. Provided files are copied from here with the modifications each task specifies.
-
-## Global Constraints
-
-- **Location:** everything under `delegated-agent-authorization/` in the `authzed/workshops` repo, on branch `workshop/delegated-agent-authorization`.
-- **SpiceDB token:** `devtoken` everywhere (docker-compose `SPICEDB_GRPC_PRESHARED_KEY`, `.env.example` `SPICEDB_TOKEN`, `spicedb_client` default). This differs from the solution repo's `somerandomkeyhere` — change it on copy.
-- **SpiceDB image/flags:** `authzed/spicedb:latest`, `serve --enable-experimental-relationship-expiration`, `SPICEDB_GRPC_NO_TLS=true`, endpoint `localhost:50051`, postgres datastore.
-- **Python 3.10+.** Provided modules keep the solution's async `authzed.api.v1.Client` patterns (all calls awaited).
-- **Agent identity:** `agent:goose_alice`, delegator `user:alice`.
-- **Tools exposed by the extension (trimmed for teaching):** `list_environments`, `deploy`, `destroy`. (The solution also has `rollback`; omit it here to reduce surface — note this in Next Steps.)
-- **`decide()` signature (workshop, simpler than the solution):** `async def decide(client, agent_id, permission, environment_id) -> AuthzResult` — no `action` parameter.
-- **`revoke.py` is an ungated operator CLI in the workshop** (no `manage`/`view` permissions — those are solution-only hardening). Call this out in Next Steps as a production follow-up.
-- **`list_environments` is ungated** in the workshop (no `view` permission). Next-Steps follow-up.
-- **Build-time:** only one SpiceDB can bind `localhost:50051`. Before testing, ensure no other local SpiceDB (e.g. the solution repo's) is running: `docker ps --filter publish=50051`.
-- **Checkpoint stub convention:** stubbed files carry a `WORKSHOP STUB` docstring and `# TODO(Checkpoint N):` markers, matching the reference workshop.
-- **Match the reference workshop's tone/structure** for all markdown: read `../agentic-rag-authorization/{0-setup,1-agentic-rag,2-secure-it,3-nextsteps}.md` before authoring. Declarative headings; each checkpoint ends with a `## Completion Milestone` checkbox list; both a goose path and a deterministic (`verify.py` + web UI) path.
-
----
-
-### Task 1: Scaffold folder, provided plumbing, CP1 stubs, and verify.py
-
-**Files:**
-- Create dir: `delegated-agent-authorization/starter/`
-- Copy (with mods below) from solution → `starter/`: `docker-compose.yml`, `spicedb_client.py`, `relationships.py`, `deploybot_server.py`, `web.py`, `static/index.html`, `requirements.txt`, `.env.example`, `goose-extension.md`
-- Create: `starter/schema.zed` (CP1 stub), `starter/authz.py` (provided helpers + `decide()` stub), `starter/bootstrap.py`, `starter/approve.py`, `starter/revoke.py`, `starter/scripts/verify.py`, `starter/.devcontainer/devcontainer.json`
-
-**Interfaces:**
-- Produces (provided, used by later tasks and the extension):
-  - `authz.check(client, sub_type, sub_id, permission, res_type, res_id) -> bool`
-  - `authz.read_delegator(client, agent_id) -> str | None`
-  - `authz.expiry_from_now(minutes) -> Timestamp`
-  - `authz.Decision` (str Enum ALLOWED/NEEDS_APPROVAL/BLOCKED), `authz.AuthzResult(decision, reason)`
-  - `authz.decide(client, agent_id, permission, environment_id) -> AuthzResult` (STUB in CP1)
-  - `bootstrap.write_schema(client)`, `bootstrap.seed(client, window_minutes=60)`, `bootstrap.AGENT_ID="goose_alice"`
-  - `deploybot_server.do_list_environments/do_deploy/do_destroy`, `STATE_PATH`, `AGENT_ID`
-  - `spicedb_client.make_client()`
-
-- [ ] **Step 1: Create the folder and copy provided files with modifications**
-
-Copy these from `/Users/sohan/code-samples/goose-spicedb-delegation/` into `starter/`, applying mods:
-- `spicedb_client.py` — change token default `somerandomkeyhere` → `devtoken`.
-- `relationships.py` — copy verbatim (`rel(...)`, `agent_deployer_filter(...)`).
-- `docker-compose.yml` — copy; set `SPICEDB_GRPC_PRESHARED_KEY: "${SPICEDB_TOKEN:-devtoken}"`; keep `serve --enable-experimental-relationship-expiration`.
-- `deploybot_server.py` — copy, then: remove the `do_rollback`/`rollback` tool and its wrapper; remove the `check`-based gating in `do_list_environments` (make it ungated — just list all envs); ensure imports are `from authz import Decision, decide` (drop `check`); each mutating tool calls `decide(make_client(), AGENT_ID, "deploy"|"destroy", environment)` and mutates only on ALLOWED (keep the solution's `_decide_and_mutate` helper but drop the `action=` argument to match the workshop `decide()` signature).
-- `web.py` — copy, then in `/api/state` compute `effective = await check(client, "agent", AGENT_ID, "deploy", environment)` (NOT `agent_deploy` — `deploy` routes through the cascade automatically once CP4 rewires it, and exists from CP2). Keep the delegation/expiry reads. Remove any `agent_deploy` references.
-- `static/index.html` — copy verbatim (includes the walking-goose indicator and authority bar).
-- `requirements.txt` — copy (authzed, grpcio, mcp, fastapi, uvicorn, python-dotenv, pytest, pytest-asyncio).
-- `.env.example` — set `SPICEDB_TOKEN=devtoken`, `SPICEDB_ENDPOINT=localhost:50051`, `AGENT_SUBJECT=agent:goose_alice`.
-- `goose-extension.md` — copy; update the absolute-path examples to `.../delegated-agent-authorization/starter/...`.
-
-- [ ] **Step 2: Write `starter/schema.zed` (CP1 stub)**
-
-```zed
-// WORKSHOP STUB — you will build this schema up across Checkpoints 2–4.
-// It defines the object types but grants the agent nothing. Combined with the
-// authz.decide() stub, the deploy agent runs UNGATED in Checkpoint 1.
-// TODO(Checkpoint 2): model delegated authorization here.
-
-definition user {}
-
-definition agent {
-    relation delegator: user
-}
-
-definition environment {}
-```
-
-- [ ] **Step 3: Write `starter/authz.py` (provided helpers + `decide()` stub)**
-
-```python
-"""authz.py — SpiceDB helpers (provided) + the decision engine (you implement)."""
-from __future__ import annotations
-
-from dataclasses import dataclass
-from datetime import datetime, timedelta, timezone
-from enum import Enum
-
-from google.protobuf.timestamp_pb2 import Timestamp
-from authzed.api.v1 import (
-    CheckPermissionRequest,
-    CheckPermissionResponse,
-    Consistency,
-    ObjectReference,
-    ReadRelationshipsRequest,
-    RelationshipFilter,
-    SubjectReference,
-)
-
-
-class Decision(str, Enum):
-    ALLOWED = "ALLOWED"
-    NEEDS_APPROVAL = "NEEDS_APPROVAL"
-    BLOCKED = "BLOCKED"
-
-
-@dataclass
-class AuthzResult:
-    decision: Decision
-    reason: str
-
-
-def expiry_from_now(minutes: int) -> Timestamp:
-    """A protobuf Timestamp `minutes` from now, for a relationship's optional_expires_at."""
-    ts = Timestamp()
-    ts.FromDatetime(datetime.now(timezone.utc) + timedelta(minutes=minutes))
-    return ts
-
-
-async def check(client, sub_type, sub_id, permission, res_type, res_id) -> bool:
-    """Does `subject` have `permission` on `resource`? A single SpiceDB CheckPermission."""
-    resp = await client.CheckPermission(
-        CheckPermissionRequest(
-            consistency=Consistency(fully_consistent=True),
-            resource=ObjectReference(object_type=res_type, object_id=res_id),
-            permission=permission,
-            subject=SubjectReference(
-                object=ObjectReference(object_type=sub_type, object_id=sub_id)
-            ),
-        )
-    )
-    return resp.permissionship == CheckPermissionResponse.PERMISSIONSHIP_HAS_PERMISSION
-
-
-async def read_delegator(client, agent_id) -> str | None:
-    """The user this agent acts for (agent:<id>#delegator), or None."""
-    req = ReadRelationshipsRequest(
-        consistency=Consistency(fully_consistent=True),
-        relationship_filter=RelationshipFilter(
-            resource_type="agent",
-            optional_resource_id=agent_id,
-            optional_relation="delegator",
-        ),
-    )
-    async for resp in client.ReadRelationships(req):
-        return resp.relationship.subject.object.object_id
-    return None
-
-
-async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
-    # WORKSHOP STUB — Checkpoint 1.
-    # Returns ALLOWED for everything WITHOUT consulting SpiceDB. This is exactly why
-    # the agent over-reaches in Checkpoint 1. You implement the real, SpiceDB-backed
-    # three-way decision in Checkpoint 2.
-    # TODO(Checkpoint 2): replace this stub.
-    return AuthzResult(Decision.ALLOWED, "no authorization configured (workshop stub)")
-```
-
-- [ ] **Step 4: Write `starter/bootstrap.py`**
-
-Copy the solution's `bootstrap.py` structure, but the seed is the CP2 set with NO expiration and NO gated_by yet (those are added by CP3/CP4 checkpoints):
-
-```python
-"""bootstrap.py — write the schema and seed the delegation graph."""
-import argparse
-import asyncio
-from pathlib import Path
-
-from authzed.api.v1 import (
-    DeleteRelationshipsRequest,
-    WriteRelationshipsRequest,
-    WriteSchemaRequest,
-)
-
-from relationships import agent_deployer_filter, rel
-from spicedb_client import make_client
-
-SCHEMA_PATH = Path(__file__).parent / "schema.zed"
-AGENT_ID = "goose_alice"
-
-
-async def write_schema(client) -> None:
-    await client.WriteSchema(WriteSchemaRequest(schema=SCHEMA_PATH.read_text()))
-
-
-async def _reset_agent_grants(client) -> None:
-    await client.DeleteRelationships(
-        DeleteRelationshipsRequest(relationship_filter=agent_deployer_filter(AGENT_ID))
-    )
-
-
-async def seed(client, window_minutes: int = 60) -> None:
-    await _reset_agent_grants(client)
-    updates = [
-        rel("environment", "staging", "direct_deployer", "user", "alice"),
-        rel("environment", "production", "direct_deployer", "user", "alice"),
-        rel("environment", "production", "approver", "user", "alice"),
-        rel("environment", "staging", "destroyer", "user", "sre_admin"),
-        rel("environment", "production", "destroyer", "user", "sre_admin"),
-        rel("agent", AGENT_ID, "delegator", "user", "alice"),
-        # Checkpoint 2: staging-only delegation (no expiration yet).
-        rel("environment", "staging", "agent_deployer", "agent", AGENT_ID),
-    ]
-    await client.WriteRelationships(WriteRelationshipsRequest(updates=updates))
-
-
-async def main() -> None:
-    parser = argparse.ArgumentParser(description="Bootstrap the delegated-agent-authorization workshop.")
-    parser.add_argument("--window-minutes", type=int, default=60,
-                        help="Minutes the agent's staging delegation stays valid (Checkpoint 3+).")
-    args = parser.parse_args()
-    client = make_client()
-    print("Writing schema...")
-    await write_schema(client)
-    print(f"Seeding delegation graph (window = {args.window_minutes} min)...")
-    await seed(client, window_minutes=args.window_minutes)
-    print("Done.")
-
-
-if __name__ == "__main__":
-    asyncio.run(main())
-```
-
-Note: `seed()` ignores `window_minutes` until Checkpoint 3 (added there). `_reset_agent_grants` makes reseeding idempotent.
-
-- [ ] **Step 5: Write `starter/approve.py` (CP2 version — no expiry) and `starter/revoke.py` (ungated)**
-
-`approve.py` (CP2 — writes an `agent_deployer` grant with NO expiration; Checkpoint 3 upgrades it):
-```python
-"""approve.py — human-in-the-loop: grant the agent deploy on an environment."""
-import argparse
-import asyncio
-
-from authzed.api.v1 import WriteRelationshipsRequest
-
-from authz import check, read_delegator
-from relationships import rel
-from spicedb_client import make_client
-
-
-async def approve(approver: str, environment: str, agent_id: str, minutes: int) -> int:
-    client = make_client()
-    if not await check(client, "user", approver, "approve", "environment", environment):
-        print(f"❌ Refused: user:{approver} is not an approver on environment:{environment}")
-        return 1
-    delegator = await read_delegator(client, agent_id)
-    if not (delegator and await check(client, "user", delegator, "deploy", "environment", environment)):
-        who = f"user:{delegator}" if delegator else "(no delegator)"
-        print(f"❌ Refused: agent:{agent_id}'s delegator {who} may not deploy environment:{environment}")
-        return 1
-    update = rel("environment", environment, "agent_deployer", "agent", agent_id)
-    await client.WriteRelationships(WriteRelationshipsRequest(updates=[update]))
-    print(f"✅ Approved: agent:{agent_id} may deploy environment:{environment}")
-    return 0
-
-
-if __name__ == "__main__":
-    p = argparse.ArgumentParser(description="Approve an agent deploy grant.")
-    p.add_argument("--approver", default="alice")
-    p.add_argument("--env", default="production")
-    p.add_argument("--agent", default="goose_alice")
-    p.add_argument("--minutes", type=int, default=10)
-    a = p.parse_args()
-    raise SystemExit(asyncio.run(approve(a.approver, a.env, a.agent, a.minutes)))
-```
-
-`revoke.py` (ungated operator CLI, unchanged across checkpoints):
-```python
-"""revoke.py — delete an agent's deploy grant on an environment (operator CLI)."""
-import argparse
-import asyncio
-
-from authzed.api.v1 import DeleteRelationshipsRequest
-
-from relationships import agent_deployer_filter
-from spicedb_client import make_client
-
-
-async def revoke(environment: str, agent_id: str) -> int:
-    client = make_client()
-    await client.DeleteRelationships(
-        DeleteRelationshipsRequest(
-            relationship_filter=agent_deployer_filter(agent_id, environment)
-        )
-    )
-    print(f"✅ Revoked: agent:{agent_id} agent_deployer on environment:{environment}")
-    return 0
-
-
-if __name__ == "__main__":
-    p = argparse.ArgumentParser(description="Revoke an agent deploy grant.")
-    p.add_argument("--env", default="staging")
-    p.add_argument("--agent", default="goose_alice")
-    a = p.parse_args()
-    raise SystemExit(asyncio.run(revoke(a.env, a.agent)))
-```
-
-- [ ] **Step 6: Write `starter/scripts/verify.py` (per-checkpoint deterministic verifier)**
-
-```python
-"""verify.py — deterministic checks for the current checkpoint. No LLM needed.
-
-Usage: python scripts/verify.py --checkpoint N
-Run from the starter/ directory with SpiceDB up.
-"""
-import argparse
-import asyncio
-import sys
-
-from authz import Decision, decide
-import bootstrap
-from approve import approve
-from revoke import revoke
-from spicedb_client import make_client
-
-AGENT = "goose_alice"
-
-
-def _ok(label, got, want):
-    mark = "✅" if got == want else "❌"
-    print(f"  {mark} {label}: got {got}, want {want}")
-    return got == want
-
-
-async def checkpoint_1():
-    # The stub decides ALLOWED for everything — the over-reach.
-    r = await decide(make_client(), AGENT, "destroy", "production")
-    return _ok("stub allows destroy production (over-reach)", r.decision, Decision.ALLOWED)
-
-
-async def checkpoint_2(client):
-    await bootstrap.write_schema(client)
-    await bootstrap.seed(client)
-    passed = True
-    passed &= _ok("agent deploy staging", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.ALLOWED)
-    passed &= _ok("agent deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.NEEDS_APPROVAL)
-    passed &= _ok("agent destroy production", (await decide(client, AGENT, "destroy", "production")).decision, Decision.BLOCKED)
-    await approve("alice", "production", AGENT, 10)
-    passed &= _ok("after approve: deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.ALLOWED)
-    return passed
-
-
-async def checkpoint_3(client):
-    # Expired window -> staging autonomy gone (falls back to NEEDS_APPROVAL).
-    await bootstrap.write_schema(client)
-    await bootstrap.seed(client, window_minutes=0)
-    passed = _ok("expired staging grant", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.NEEDS_APPROVAL)
-    # Revocation on a fresh window.
-    await bootstrap.seed(client, window_minutes=60)
-    await revoke("staging", AGENT)
-    passed &= _ok("after revoke: deploy staging", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.NEEDS_APPROVAL)
-    return passed
-
-
-async def checkpoint_4(client):
-    await bootstrap.write_schema(client)
-    await bootstrap.seed(client, window_minutes=60)
-    await approve("alice", "production", AGENT, 10)
-    passed = _ok("with both grants: deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.ALLOWED)
-    await revoke("staging", AGENT)  # revoke the BASE
-    passed &= _ok("cascade: deploy staging", (await decide(client, AGENT, "deploy", "staging")).decision, Decision.NEEDS_APPROVAL)
-    passed &= _ok("cascade: deploy production", (await decide(client, AGENT, "deploy", "production")).decision, Decision.NEEDS_APPROVAL)
-    return passed
-
-
-async def main(n):
-    print(f"Verifying Checkpoint {n}...")
-    if n == 1:
-        passed = await checkpoint_1()
-    else:
-        client = make_client()
-        passed = await {2: checkpoint_2, 3: checkpoint_3, 4: checkpoint_4}[n](client)
-    print("PASS ✅" if passed else "FAIL ❌")
-    return 0 if passed else 1
-
-
-if __name__ == "__main__":
-    p = argparse.ArgumentParser()
-    p.add_argument("--checkpoint", type=int, required=True, choices=[1, 2, 3, 4])
-    raise SystemExit(asyncio.run(main(p.parse_args().checkpoint)))
-```
-
-- [ ] **Step 7: Write `starter/.devcontainer/devcontainer.json`**
-
-```json
-{
-  "name": "delegated-agent-authorization",
-  "image": "mcr.microsoft.com/devcontainers/python:3.12",
-  "features": { "ghcr.io/devcontainers/features/docker-in-docker:2": {} },
-  "postCreateCommand": "pip install -r requirements.txt && docker compose up -d",
-  "forwardPorts": [8000, 50051]
-}
-```
-
-- [ ] **Step 8: Smoke test — infra up + CP1 over-reach**
-
-Run from `starter/` (ensure nothing else holds :50051):
-```bash
-python -m venv .venv && source .venv/bin/activate && pip install -r requirements.txt
-docker compose up -d --wait
-python -c "import deploybot_server, web, authz, bootstrap, approve, revoke"   # imports resolve
-python scripts/verify.py --checkpoint 1
-```
-Expected: imports succeed; verify prints `✅ stub allows destroy production (over-reach)` and `PASS ✅`.
-
-- [ ] **Step 9: Commit**
-
-```bash
-cd ~/authzed-branches/workshops
-git add delegated-agent-authorization/starter
-git commit -m "feat(workshop): starter scaffolding, provided plumbing, CP1 stubs, verify.py"
-```
-
----
-
-### Task 2: `0-setup.md`
-
-**Files:** Create `delegated-agent-authorization/0-setup.md`
-
-- [ ] **Step 1: Author the setup doc** — model it on `../agentic-rag-authorization/0-setup.md`. Cover, in this order:
-  1. One-paragraph framing: build a goose deploy agent, then add delegated authorization with SpiceDB; the `starter/` is stubbed on purpose.
-  2. Get the code: `git clone https://github.com/authzed/workshops.git` → `cd workshops/delegated-agent-authorization/starter`.
-  3. Option A — local Docker: `cp .env.example .env`, add an LLM key for goose (note: only needed for the goose path; the `verify.py`/web-UI path needs no LLM), `docker compose up -d` (brings up postgres + SpiceDB with the expiration flag on `devtoken`), venv + `pip install -r requirements.txt`.
-  4. Option B — Codespaces: the `.devcontainer/` runs compose + installs deps on create.
-  5. Install goose and register the deploy-bot extension: reference `goose-extension.md` (absolute paths to `.venv/bin/python` and `deploybot_server.py`, env `SPICEDB_ENDPOINT`/`SPICEDB_TOKEN=devtoken`/`AGENT_SUBJECT=agent:goose_alice`).
-  6. `## Completion Milestone: Setup` checklist: repo cloned; infra up (Docker or Codespaces); `.env` has an LLM key (goose path); extension registered in goose.
-  7. Ends: `Next: [Checkpoint 1 — Run the agent](1-run-the-agent.md)`.
-
-- [ ] **Step 2: Verify** — from a clean read, the commands are copy-pasteable and consistent with Task 1's files (token `devtoken`, port 50051, paths). Confirm `docker compose up -d --wait` succeeds and goose config keys match `goose-extension.md`.
-
-- [ ] **Step 3: Commit** `docs(workshop): 0-setup`.
-
----
-
-### Task 3: `1-run-the-agent.md` (Checkpoint 1 — watch it over-reach)
-
-**Files:** Create `delegated-agent-authorization/1-run-the-agent.md`
-
-- [ ] **Step 1: Author the checkpoint** — model on `../agentic-rag-authorization/1-agentic-rag.md`. Cover:
-  1. The flow: goose calls the deploy-bot MCP extension; every tool routes through `authz.decide()` before acting.
-  2. Show the `decide()` stub (quote the `WORKSHOP STUB` block from `authz.py`) and explain: it returns ALLOWED without consulting SpiceDB.
-  3. **Watch it over-reach (goose path):** in a `goose session`, ask *"Deploy checkout to production"*, then *"Tear down the production environment."* Both execute — the agent has no authorization boundary.
-  4. **Deterministic path:** `python scripts/verify.py --checkpoint 1` → shows the stub allows `destroy production`.
-  5. Why: an agent runs with its host's ambient authority; with no authorization boundary, it can do anything the credentials can. Putting the rule in the prompt is not enough — a prompt can be bypassed.
-  6. `## Completion Milestone: Checkpoint 1` — ran the agent; reproduced the over-reach via goose and/or `verify.py`; can explain why ambient authority is the problem.
-  7. `Next: [Checkpoint 2 — Delegated authorization](2-delegated-authorization.md)`.
-
-- [ ] **Step 2: Verify** — the quoted stub matches `authz.py` exactly; `verify.py --checkpoint 1` output matches what the doc claims.
-
-- [ ] **Step 3: Commit** `docs(workshop): CP1 run-the-agent`.
-
----
-
-### Task 4: `2-delegated-authorization.md` (Checkpoint 2 — the core)
-
-**Files:** Create `delegated-agent-authorization/2-delegated-authorization.md`
-
-**Interfaces:** the fill-in code here must reproduce the CP2 state that `verify.py --checkpoint 2` asserts (staging ALLOWED, prod NEEDS_APPROVAL, destroy BLOCKED, post-approve prod ALLOWED).
-
-- [ ] **Step 1: Author the checkpoint** — model on `../agentic-rag-authorization/2-secure-it.md`. Cover:
-  1. **Concepts (inline):** ReBAC vs. RBAC; Google Zanzibar; why the decision must be a deterministic check, not the prompt.
-  2. **Write the schema** — attendee replaces `schema.zed` with (this exact block):
-     ```zed
-     definition user {}
-     definition agent { relation delegator: user }
-     definition environment {
-         relation direct_deployer: user
-         relation agent_deployer: agent
-         relation approver: user
-         relation destroyer: user
-         permission deploy  = direct_deployer + agent_deployer
-         permission approve = approver
-         permission destroy = destroyer
-     }
-     ```
-     Explain each relation/permission and the delegation idea (`agent.delegator`).
-  3. **Seed it:** `python bootstrap.py` (writes schema + relationships: alice deploys both envs + approves prod; sre_admin is the only destroyer; the agent is delegated staging-only).
-  4. **Implement `decide()`** — attendee replaces the stub with (this exact block):
-     ```python
-     async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
-         if await check(client, "agent", agent_id, permission, "environment", environment_id):
-             return AuthzResult(Decision.ALLOWED,
-                 f"agent:{agent_id} holds delegated '{permission}' on environment:{environment_id}")
-         delegator = await read_delegator(client, agent_id)
-         if delegator and await check(client, "user", delegator, permission, "environment", environment_id):
-             return AuthzResult(Decision.NEEDS_APPROVAL,
-                 f"agent:{agent_id} lacks '{permission}'; delegator user:{delegator} holds it — human approval required")
-         return AuthzResult(Decision.BLOCKED,
-             f"neither agent:{agent_id} nor its delegator may '{permission}' environment:{environment_id}")
-     ```
-     Explain the three-way logic: agent's own grant → ALLOWED; else the human it acts for could → NEEDS APPROVAL; else BLOCKED.
-  5. **See it (both paths):** start the web UI (`python web.py`, open `http://127.0.0.1:8000`) — deploy staging ✅, deploy prod ⏸, destroy 🚫; run `python approve.py --approver alice --env production` then retry prod → ✅. And in goose, the same prompts. Deterministic: `python scripts/verify.py --checkpoint 2` → `PASS ✅`.
-  6. Why the check (not the prompt) is the boundary — deterministic, unbypassable, the agent only ever gets an answer SpiceDB computed.
-  7. `## Completion Milestone: Checkpoint 2` — wrote the schema; seeded; implemented `decide()`; `verify.py --checkpoint 2` passes; saw the three-way decision in the UI and/or goose; can explain ReBAC.
-  8. `Next: [Checkpoint 3 — Time-bound and revocable](3-time-bound-and-revocable.md)`.
-
-- [ ] **Step 2: Verify the fill-ins reach the CP2 state** — from `starter/`, apply the schema + `decide()` blocks from the doc, then:
-  ```bash
-  python scripts/verify.py --checkpoint 2
-  ```
-  Expected `PASS ✅`. (Restore the stubs afterward so `starter/` ships stubbed: `git checkout starter/schema.zed starter/authz.py`.)
-
-- [ ] **Step 3: Commit** `docs(workshop): CP2 delegated-authorization`.
-
----
-
-### Task 5: `3-time-bound-and-revocable.md` (Checkpoint 3)
-
-**Files:** Create `delegated-agent-authorization/3-time-bound-and-revocable.md`
-
-**Interfaces:** fill-ins must reach the CP3 state `verify.py --checkpoint 3` asserts (window 0 → NEEDS_APPROVAL; revoke → NEEDS_APPROVAL). Requires the schema `agent_deployer: agent with expiration`, `seed()`/`approve.py` writing `optional_expires_at`.
-
-- [ ] **Step 1: Author the checkpoint.** Cover:
-  1. Concept: temporary access — incident windows. SpiceDB's built-in relationship expiration (preferred over a caveat; evaluated server-side; garbage-collected).
-  2. **Schema edit:** add `use expiration` at the top and change the relation to `relation agent_deployer: agent with expiration`. (Show the exact diff.)
-  3. **Update the seed** — in `bootstrap.py`, change the staging grant line to carry an expiry:
-     ```python
-     from authz import expiry_from_now
-     # ...
-     rel("environment", "staging", "agent_deployer", "agent", AGENT_ID,
-         expires_at=expiry_from_now(window_minutes)),
-     ```
-  4. **Update `approve.py`** — write the grant with an expiry:
-     ```python
-     from authz import check, read_delegator, expiry_from_now
-     # ...
-     update = rel("environment", environment, "agent_deployer", "agent", agent_id,
-                  expires_at=expiry_from_now(minutes))
-     ```
-  5. **See expiry without waiting:** `python bootstrap.py --window-minutes 0` seeds an already-expired staging grant → the agent's autonomous staging deploy drops to NEEDS APPROVAL. Then **revocation:** `python revoke.py --env staging` → same effect, instantly. Both visible in the web UI (grant disappears / countdown) and via `python scripts/verify.py --checkpoint 3`.
-  6. Why contingent evaluation beats a cron job that deletes grants.
-  7. `## Completion Milestone: Checkpoint 3` — added expiration to schema + seed + approve; demoed the window and revoke; `verify.py --checkpoint 3` passes.
-  8. `Next: [Checkpoint 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md)`.
-
-- [ ] **Step 2: Verify the fill-ins** — apply CP2 fill-ins + CP3 edits, then `python scripts/verify.py --checkpoint 3` → `PASS ✅`. Restore stubs after (`git checkout starter/`).
-
-- [ ] **Step 3: Commit** `docs(workshop): CP3 time-bound-and-revocable`.
-
----
-
-### Task 6: `4-relationship-based-hierarchy.md` (Checkpoint 4 — the payoff)
-
-**Files:** Create `delegated-agent-authorization/4-relationship-based-hierarchy.md`
-
-**Interfaces:** fill-ins must reach the CP4 state `verify.py --checkpoint 4` asserts (both grants → prod ALLOWED; revoke staging → staging AND production NEEDS_APPROVAL — the cascade). Requires `gated_by`, `agent_deploy = agent_deployer & gated_by->agent_deployer`, `deploy = direct_deployer + agent_deploy`, and gated_by seed.
-
-- [ ] **Step 1: Author the checkpoint.** Cover:
-  1. Concept: hierarchical/contingent authority — production autonomy should depend on staging autonomy. RBAC can't express this without a role-per-combination explosion.
-  2. **Schema edit** (show exact additions):
-     ```zed
-     // inside definition environment:
-     relation gated_by: environment
-     permission agent_deploy = agent_deployer & gated_by->agent_deployer
-     permission deploy = direct_deployer + agent_deploy
-     ```
-     Explain the intersection + arrow: the agent may deploy here only if it holds this env's grant AND the gating env's grant. Staging gates itself (base); production is gated by staging.
-  3. **Seed gated_by** — add to `bootstrap.seed()`:
-     ```python
-     rel("environment", "staging", "gated_by", "environment", "staging"),
-     rel("environment", "production", "gated_by", "environment", "staging"),
-     ```
-  4. **See the cascade:** re-seed; `python approve.py --approver alice --env production` (agent now deploys both). Then `python revoke.py --env staging` — production autonomy suspends automatically, no second delete. Web UI shows production as a dashed *suspended* grant. `python scripts/verify.py --checkpoint 4` → `PASS ✅`.
-  5. Why: it's contingent *evaluation*, not a delete — so it's suspend-not-erase (re-granting staging revives production while its window lasts). This is the ReBAC superpower.
-  6. `## Completion Milestone: Checkpoint 4` — added `gated_by` + `agent_deploy`; seeded the hierarchy; demoed the staging→production cascade; `verify.py --checkpoint 4` passes; can explain why RBAC can't do this.
-  7. `Next: [Next steps](5-nextsteps.md)`.
-
-- [ ] **Step 2: Verify the fill-ins** — apply CP2+CP3+CP4 edits, then `python scripts/verify.py --checkpoint 4` → `PASS ✅`. Confirm the resulting schema matches the tested solution's `schema.zed` behavior. Restore stubs after (`git checkout starter/`).
-
-- [ ] **Step 3: Commit** `docs(workshop): CP4 relationship-based-hierarchy`.
-
----
-
-### Task 7: `README.md`, `5-nextsteps.md`, and full end-to-end validation
-
-**Files:** Create `delegated-agent-authorization/README.md`, `delegated-agent-authorization/5-nextsteps.md`
-
-- [ ] **Step 1: Author `README.md`** — model on `../agentic-rag-authorization/README.md`. Include: the title + abstract (from the conference listing); "Why this matters" (agents run with credentials that touch everything); "What you'll build" (bulleted); prerequisites (Docker/Codespaces, Python 3.10+, goose + an LLM key for the goose path); the **90-minute module map** with the per-checkpoint timing from the spec (Setup 15 · CP1 10 · CP2 25 · CP3 15 · CP4 20 · Next Steps 5); a link to the full reference solution `https://github.com/sohanmaheshwar/goose-spicedb-delegation`; and the ordered module links. End with "Let's get started with [Setup](0-setup.md)."
-
-- [ ] **Step 2: Author `5-nextsteps.md`.** Cover: modeling authority once as relationships for a whole platform; `CheckBulk` for "which of these N resources may this agent touch"; on-behalf-of vs. advisory enforcement; production hardening the workshop deliberately skipped (gate `revoke`/admin actions behind a `manage` permission; gate `list_environments` behind a `view` permission — point to the solution repo which does both); scaling ReBAC with SpiceDB (Zanzibar lineage, Kubernetes — link the other AuthZed workshop). Keep it a short zoom-out.
-
-- [ ] **Step 3: Full end-to-end validation (the integration test).** From a fresh `starter/` (stubs in place), walk the entire workshop in order, applying each checkpoint's fill-in code from the markdown and running its verifier:
-  ```bash
-  cd delegated-agent-authorization/starter
-  docker compose up -d --wait
-  python scripts/verify.py --checkpoint 1            # stub over-reach: PASS
-  # apply CP2 schema + decide() from 2-delegated-authorization.md
-  python scripts/verify.py --checkpoint 2            # PASS
-  # apply CP3 edits from 3-time-bound-and-revocable.md
-  python scripts/verify.py --checkpoint 3            # PASS
-  # apply CP4 edits from 4-relationship-based-hierarchy.md
-  python scripts/verify.py --checkpoint 4            # PASS
-  git checkout schema.zed authz.py bootstrap.py approve.py   # restore ship-state stubs
-  ```
-  All four must PASS. This proves the checkpoints' embedded code is correct and complete. Fix any checkpoint whose fill-ins don't reach its verifier state.
-
-- [ ] **Step 4: Confirm `starter/` ships stubbed** — `git status` clean; `schema.zed` and `authz.decide()` are the CP1 stubs; `bootstrap.py`/`approve.py` are the CP2 versions (no expiry).
-
-- [ ] **Step 5: Commit** `docs(workshop): README, next steps, end-to-end validated`.
-
----
-
-## Self-Review
-
-**Spec coverage:**
-- Folder/structure → Task 1 + doc tasks. ✓
-- Guided-implement (schema + decide) → CP2 (Task 4), grown in CP3/CP4 (Tasks 5/6); everything else provided in Task 1. ✓
-- goose headline + deterministic verifier → both paths in every checkpoint; `verify.py` (Task 1) + web UI (copied Task 1). ✓
-- CP1 over-reach → Task 3 + `decide()` stub + `verify.py --checkpoint 1`. ✓
-- Delegation / 3-way → CP2 (Task 4). ✓
-- Time-bound + revoke → CP3 (Task 5). ✓
-- ReBAC hierarchy/cascade → CP4 (Task 6). ✓
-- Setup (Docker + Codespaces) → Task 2 + devcontainer (Task 1). ✓
-- README + module map + timing + next steps → Task 7. ✓
-- Prereqs, non-goals (no manage/view/rollback; revoke ungated) → Global Constraints + Next Steps follow-ups. ✓
-- Success criteria (clean clone → all checkpoints pass) → Task 7 Step 3 end-to-end validation. ✓
-
-**Placeholder scan:** All code blocks are complete and exact. `# TODO(Checkpoint N):` markers are intentional workshop-stub content, not plan placeholders. Doc-authoring steps specify exact embedded code + the reference file to match for tone (not "write prose").
-
-**Type consistency:** `decide(client, agent_id, permission, environment_id)` (no `action`) is consistent across authz.py, deploybot_server.py (Task 1 mod drops `action=`), verify.py, and the CP2 fill-in. `check`/`read_delegator`/`expiry_from_now`/`rel`/`agent_deployer_filter` signatures match the solution's and are used consistently. `deploy` (not `agent_deploy`) is the permission checked by web.py `/api/state` and verify.py — works CP2→CP4 because CP4 rewires `deploy` through `agent_deploy`.
diff --git a/docs/superpowers/specs/2026-08-04-delegated-agent-authorization-workshop-design.md b/docs/superpowers/specs/2026-08-04-delegated-agent-authorization-workshop-design.md
deleted file mode 100644
index 18c1c8f..0000000
--- a/docs/superpowers/specs/2026-08-04-delegated-agent-authorization-workshop-design.md
+++ /dev/null
@@ -1,194 +0,0 @@
-# Delegated Authorization for AI Agents — Workshop Design
-
-**Date:** 2026-08-04
-**Status:** Approved design, ready for implementation plan
-**Folder:** `delegated-agent-authorization/` (in `authzed/workshops`)
-**Branch:** `workshop/delegated-agent-authorization`
-
-## What this is
-
-A self-guided, hands-on workshop that teaches technical attendees how to add
-**delegated, fine-grained authorization** to AI agents. Attendees build a DevOps
-deploy agent on **goose** (the open-source agent from the Agentic AI Foundation) and
-gate its every action with **SpiceDB** using **Relationship-Based Access Control
-(ReBAC)**. By the end they understand scoped delegation, time-bound (expiring) grants,
-instant revocation, and hierarchical permissions where revoking a base grant cascades
-to dependents — something role-based systems can't express cleanly.
-
-Delivered first at a conference (Fri Sep 11, 2026, JST), then published to
-`authzed/workshops`.
-
-## Audience, duration, learning goals
-
-- **Audience:** technical — AI engineers and programmers. Comfortable with a terminal,
-  Python, Docker. No prior authorization background assumed.
-- **Duration:** 90 minutes, self-guided (works both live and after the fact).
-- **Learning goals:** by the end, an attendee can explain and has hands-on built:
-  1. **Delegated authorization** — an agent acts on a human's behalf with a scoped
-     subset of their authority; decisions resolve to ALLOWED / NEEDS APPROVAL / BLOCKED.
-  2. **Time-bound expiration** — grants that expire on their own (incident windows),
-     plus instant revocation.
-  3. **ReBAC / hierarchy** — relationship- and hierarchy-aware permissions, incl. a
-     cascade (revoking staging autonomy suspends production autonomy automatically).
-
-## Format (follows the reference workshop)
-
-Matches `agentic-rag-authorization`: a `starter/` app with intentionally-stubbed
-authorization pieces, checkpoint markdown files that go *run it → watch it fail →
-implement the fix → re-run → why this is the right design*, each ending in a
-**Completion Milestone** checklist, plus a setup doc (local Docker **and** a Codespaces
-devcontainer) and a web UI to see decisions live.
-
-**Pedagogy — guided implement:** attendees write the two pedagogically valuable things
-themselves from `# TODO(Checkpoint N):` stubs — **the SpiceDB schema** (grown across
-CP2→CP4) and **the `decide()` decision engine** (CP2). Everything else is provided
-plumbing: the goose MCP extension, docker-compose, seed harness, approve/revoke scripts,
-web UI, devcontainer. The exact code-to-write is embedded in each checkpoint (the
-reference's own pattern). The complete reference solution is the published
-`github.com/sohanmaheshwar/goose-spicedb-delegation` repo, linked from the workshop.
-
-**Two ways to see every checkpoint:** goose is the headline — attendees register the
-MCP extension and talk to it in natural language ("Deploy checkout to production"). The
-**web UI** + `python scripts/verify.py` are the deterministic verifier, so every
-checkpoint is confirmable in a room without depending on an LLM key. The deterministic
-path never needs an LLM.
-
-## Artifact structure
-
-```
-delegated-agent-authorization/
-  README.md                          # overview, "what you'll build", prereqs, 90-min module map, solution link
-  0-setup.md                         # Docker + Codespaces devcontainer, register goose extension, seed, verify
-  1-run-the-agent.md                 # CP1: run the UNGATED agent, watch it over-reach
-  2-delegated-authorization.md       # CP2: write delegation schema + implement decide() (3-way); ReBAC concepts
-  3-time-bound-and-revocable.md      # CP3: expiring grants (incident window) + instant revoke
-  4-relationship-based-hierarchy.md  # CP4: gated_by cascade — revoke staging suspends prod
-  5-nextsteps.md                     # scale: ReBAC in prod, CheckBulk, on-behalf-of, real platform teams
-  starter/
-    docker-compose.yml               # postgres + spicedb (+ expiration flag)
-    schema.zed                       # STUB — grown by learners across CP2→CP4
-    authz.py                         # decide() + helpers STUB — implemented in CP2
-    bootstrap.py                     # seed harness (grant-writing evolves with the schema)
-    deploybot_server.py              # goose MCP extension — provided plumbing; calls decide()
-    spicedb_client.py                # provided
-    relationships.py                 # provided TOUCH/filter helpers
-    approve.py, revoke.py            # provided lifecycle scripts
-    web.py, static/index.html        # provided web UI (chat + authority bar + decision states)
-    scripts/verify.py                # per-checkpoint deterministic verifier
-    requirements.txt, .env.example
-    goose-extension.md               # how to register the extension in goose
-    .devcontainer/devcontainer.json  # Codespaces
-  images/                            # authority-chain + decision-flow diagrams
-```
-
-## The checkpoint arc (the schema grows as they learn)
-
-Each checkpoint adds exactly one concept by editing the schema and re-running. The
-naive → fix → why loop drives every one.
-
-### CP1 — Run it, watch it over-reach (~10 min)
-`decide()` is a stub returning ALLOWED for everything (clear `# TODO(Checkpoint 2)`
-docstring warning, mirroring the reference). Attendees register the extension, talk to
-goose, and watch it deploy to production and tear down environments with no guardrail —
-all green in the web UI. Takeaway: an agent runs with its host's ambient authority; with
-no authorization boundary it can do anything the credentials can.
-
-### CP2 — Delegated authorization (~25 min, includes ReBAC concepts)
-Attendees **write `schema.zed`**:
-```zed
-definition user {}
-definition agent { relation delegator: user }
-definition environment {
-    relation direct_deployer: user
-    relation agent_deployer: agent
-    relation approver: user
-    relation destroyer: user
-    permission deploy  = direct_deployer + agent_deployer
-    permission approve = approver
-    permission destroy = destroyer
-}
-```
-and **implement `decide()`**: check the agent for the permission → ALLOWED; else read the
-agent's `delegator` and check the delegator → NEEDS APPROVAL (a human could authorize);
-else BLOCKED. Seed grants the agent staging-only deploy. Results: staging ✅, production
-⏸ (with the `approve.py` human-in-the-loop flow), destroy 🚫. ReBAC and the Google
-Zanzibar model are taught inline here (relationships, not flat roles; why the decision
-lives in a deterministic check, not the prompt).
-
-### CP3 — Time-bound & revocable (~15 min)
-Attendees add expiration to the schema (`use expiration`;
-`agent_deployer: agent with expiration`) and grants carry `optional_expires_at`.
-Demonstrate the incident window and — because it's contingent evaluation — show expiry
-without waiting (`bootstrap.py --window-minutes 0`), then instant `revoke.py`. Note this
-uses SpiceDB's built-in relationship expiration (preferred over a caveat for expiry).
-
-### CP4 — Relationship-based hierarchy (~20 min)
-Attendees add the cascade to the schema:
-```zed
-relation gated_by: environment          // production -> staging; staging -> itself
-permission agent_deploy = agent_deployer & gated_by->agent_deployer
-permission deploy = direct_deployer + agent_deploy
-```
-Production autonomy becomes contingent on staging autonomy. Revoke staging → production
-`agent_deploy` evaluates false automatically, no second delete. This is the payoff: the
-thing RBAC can't express cleanly. The web UI shows the suspended production grant as a
-dashed chip.
-
-### 5 — Next steps (~5 min)
-How this maps to a real platform team: modeling authority once as relationships,
-`CheckBulk` for "which of these N resources may this agent touch", on-behalf-of vs.
-advisory enforcement, and scaling ReBAC with SpiceDB (Zanzibar lineage). Links to the
-full solution repo and SpiceDB docs.
-
-## Verification
-
-- `starter/scripts/verify.py` asserts the expected decision matrix for the **current**
-  checkpoint (so a learner confirms their schema/`decide()` is correct before moving on),
-  mirroring the reference's `verify_permissions.py`. It runs against live SpiceDB, no LLM.
-- The web UI shows each decision (ALLOWED / NEEDS APPROVAL / BLOCKED) and the live
-  authority state (delegation chain + expiry countdown).
-- goose provides the natural-language "for real" path.
-
-## Prerequisites (stated in README/setup)
-
-- Docker (or a GitHub Codespace via the provided devcontainer)
-- Python 3.10+
-- goose installed, plus an API key for any LLM goose supports (only needed for the
-  goose path; the deterministic verifier + web UI need no LLM)
-
-## Decisions & defaults
-
-- **Language:** Python (matches the demo and the authzed/langchain workshop stack).
-- **SpiceDB:** local via Docker Compose, `authzed/spicedb:latest`, insecure preshared key
-  (`somerandomkeyhere` or `devtoken`), expiration enabled via
-  `--enable-experimental-relationship-expiration`.
-- **Solution source:** adapt the tested `goose-spicedb-delegation` repo — the `starter/`
-  is that code with `schema.zed` and `authz.decide()` stubbed; checkpoints contain the
-  exact code to fill in.
-- **Provided vs. implemented:** implemented by learner = schema + `decide()`; provided =
-  everything else.
-
-## Non-goals
-
-- Not a goose internals or prompt-engineering workshop.
-- Not production deployment of SpiceDB (Kubernetes/Operator) — that's a different
-  workshop; touched only in Next Steps.
-- No cloud accounts or paid services beyond an optional LLM key.
-- Not multi-agent fleets (mentioned in Next Steps only).
-
-## To verify at build time
-
-- Exact goose custom-extension config (config.yaml stanza / `goose configure`) — reuse
-  the demo's verified `goose-extension.md`.
-- Codespaces devcontainer that runs `docker compose up -d` + installs deps on create.
-- `scripts/verify.py` output format and the per-checkpoint assertions matching each
-  schema state.
-
-## Success criteria
-
-- A learner starting from a clean clone completes setup, then all four checkpoints, with
-  `scripts/verify.py` passing at each, on Docker or Codespaces.
-- CP1 visibly over-reaches; CP2 produces the three-way decision; CP3 shows expiry +
-  revoke; CP4 shows the staging→production cascade.
-- The goose path and the web-UI/CLI path both demonstrate each checkpoint's behavior.
-- Total content paces to ~90 minutes.

From de94ff214803b42e5e617683e13f8813ab4005dd Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Tue, 1 Sep 2026 11:47:21 +0200
Subject: [PATCH 22/27] docs(workshop): tighten Part 1 prose

---
 delegated-agent-authorization/1-run-the-agent.md | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/delegated-agent-authorization/1-run-the-agent.md b/delegated-agent-authorization/1-run-the-agent.md
index 9bb47f2..50fad3f 100644
--- a/delegated-agent-authorization/1-run-the-agent.md
+++ b/delegated-agent-authorization/1-run-the-agent.md
@@ -5,19 +5,13 @@ never be allowed to do. For example: this agent can tear down production servers
 
 ---
 
-## The flow — goose calls deploybot
+## The backend
 
 `deploybot_server.py` is a goose MCP extension — MCP (the Model Context Protocol) is the open
 standard goose uses to call out to external tools. It exposes three tools:
 
 - **`list_environments`** — lists every environment and the service versions deployed to it.
-  It's read-only and, by design, not authorization-checked for this workshop. The code says so
-  directly:
-
-  ```python
-  # UNGATED in this workshop: list_environments is not authorization-checked.
-  ```
-
+  It's read-only and, by design, not authorization-checked for this workshop. 
 - **`deploy(service, environment)`** — deploys a service to an environment.
 - **`destroy(environment)`** — tears down an entire environment. Its own docstring says
   *"Destructive; requires elevated authority."* No rollback tool exists; destroy is a one-way
@@ -25,7 +19,7 @@ standard goose uses to call out to external tools. It exposes three tools:
 
 `deploy` and `destroy` are mutating, and both are gated: before either touches anything, it calls
 `authz.decide()` to get a ruling, and only proceeds on `ALLOWED`. That's the boundary this
-workshop is about. In Part 1, the boundary is a stub that never says no.
+workshop is about. 
 
 ---
 

From 61346055196c8f2c13fcd9066535686f4c8ef614 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Tue, 1 Sep 2026 12:45:03 +0200
Subject: [PATCH 23/27] docs(workshop): step-by-step goose configure
 walkthrough for the deploybot extension

Replace the ambiguous 'follow goose-extension.md' step with an explicit
goose configure prompt-by-prompt flow: the absolute command path (venv
python + deploybot_server.py) and the three env vars.
---
 delegated-agent-authorization/0-setup.md | 40 +++++++++++++++++++++---
 1 file changed, 35 insertions(+), 5 deletions(-)

diff --git a/delegated-agent-authorization/0-setup.md b/delegated-agent-authorization/0-setup.md
index de3b973..53b583f 100644
--- a/delegated-agent-authorization/0-setup.md
+++ b/delegated-agent-authorization/0-setup.md
@@ -95,11 +95,41 @@ If you do want the goose path:
    project's own install instructions, then run `goose configure` to pick an LLM provider and set
    its API key — this is where the "LLM key" lives, in goose's own config, not in this project's
    `.env`.
-2. Register the `deploybot` MCP extension so goose can call into this repo's deploy tools. Follow
-   `goose-extension.md` — it walks through editing `~/.config/goose/config.yaml` (or running
-   `goose configure` interactively) with **absolute paths** to this repo's `.venv/bin/python` and
-   `deploybot_server.py`, plus three env vars the extension needs to reach SpiceDB:
-   `SPICEDB_ENDPOINT=localhost:50051`, `SPICEDB_TOKEN=devtoken`, `AGENT_SUBJECT=agent:goose_alice`.
+2. Register the `deploybot` MCP extension so goose can call this repo's deploy tools. goose launches
+   `deploybot_server.py` with your virtualenv's Python, so it needs the **absolute path** to both.
+   From `starter/`, print that path once:
+
+   ```bash
+   pwd
+   ```
+
+   Then run `goose configure` and answer the prompts (exact wording varies slightly by goose
+   version):
+
+   - **What would you like to configure?** → `Add Extension`
+   - **What type of extension would you like to add?** → `Command-line Extension`
+   - **What would you like to call this extension?** → `deploybot`
+   - **What command should be run?** → your venv Python and the server script, both as absolute
+     paths — take the `pwd` output above and append `/.venv/bin/python` and `/deploybot_server.py`:
+
+     ```
+     /ABSOLUTE/PATH/to/starter/.venv/bin/python /ABSOLUTE/PATH/to/starter/deploybot_server.py
+     ```
+
+   - **Please set the timeout for this tool (in secs):** → `300`
+   - **Would you like to add a description?** → `No`
+   - **Would you like to add environment variables?** → `Yes`, then add these three (goose asks for
+     a name, then a value, then "add another?" after each):
+
+     | Name | Value |
+     | --- | --- |
+     | `SPICEDB_ENDPOINT` | `localhost:50051` |
+     | `SPICEDB_TOKEN` | `devtoken` |
+     | `AGENT_SUBJECT` | `agent:goose_alice` |
+
+   `AGENT_SUBJECT` pins the agent's identity: every authorization check goose triggers runs as
+   `agent:goose_alice`. goose writes all of this into `~/.config/goose/config.yaml` — see
+   `goose-extension.md` for the equivalent YAML if you'd rather edit it by hand.
 
 `goose-extension.md` also has a manual verification checklist for once goose is wired up. Worth
 skimming now, but there's nothing to verify yet: SpiceDB has no authorization schema until

From be46af16aa459621f6dd18aef900591f14b235cf Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Tue, 1 Sep 2026 12:51:16 +0200
Subject: [PATCH 24/27] docs(workshop): re-apply goose configure walkthrough
 (lost in a local overwrite)

---
 delegated-agent-authorization/0-setup.md | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/delegated-agent-authorization/0-setup.md b/delegated-agent-authorization/0-setup.md
index 53b583f..48f5d99 100644
--- a/delegated-agent-authorization/0-setup.md
+++ b/delegated-agent-authorization/0-setup.md
@@ -1,7 +1,6 @@
 # Introduction
 
-In this workshop you build a DevOps deploy Agent, then gate every action it takes with
-delegated, fine-grained authorization: scoped grants, time-bound windows, instant
+In this workshop you will build a DevOps deploy Agent with fine-grained authorization: scoped grants, time-bound windows, instant
 revocation, and a permission hierarchy where revoking a base grant cascades to everything that
 depends on it. The purpose of the workshop is to understand why fine-grained authorization is required for AI Agents, 
 and how it can be implemented using ReBAC. 
@@ -14,7 +13,7 @@ write the schema and the decision engine yourself across the parts to learn each
 
 ## Two ways to drive the agent
 
-You can complete every part in this workshop with just the web UI — no LLM key, no goose
+As a reminder, you can complete every part in this workshop with just the web UI — no LLM key, no goose
 install required. That's the primary path, and it's all you need. 
 
 Each part page also ends with an optional *drive it with goose* step: the same requests in natural language, through a real

From 036f62f05c8ae6f277e09ac3f05ddd9302e3e3b4 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Tue, 1 Sep 2026 16:17:04 +0200
Subject: [PATCH 25/27] docs(workshop): add FIG.02 relationship graph to Part 2

Export the Part 2 relationship graph (Sandworm style, playground-style
layout, embedded JetBrains Mono) as a self-contained SVG under images/, and
embed it at the end of the 'Permissions are a graph, not a table' section.
---
 .../2-delegated-authorization.md              | 48 +++++++++++------
 .../images/fig2-relationship-graph.svg        | 51 +++++++++++++++++++
 2 files changed, 83 insertions(+), 16 deletions(-)
 create mode 100644 delegated-agent-authorization/images/fig2-relationship-graph.svg

diff --git a/delegated-agent-authorization/2-delegated-authorization.md b/delegated-agent-authorization/2-delegated-authorization.md
index 1508859..47dec73 100644
--- a/delegated-agent-authorization/2-delegated-authorization.md
+++ b/delegated-agent-authorization/2-delegated-authorization.md
@@ -3,8 +3,11 @@
 Part 1 ended with `authz.decide()` returning `ALLOWED` for everything, so
 the agent could destroy production on request. In this section, we replace the stub with the real thing — a
 SpiceDB schema that models *who an agent acts for*, and a `decide()` that turns a permission
-question into one of three honest answers: the agent can do this, a human needs to say yes
-first, or nobody involved is allowed to do this at all.
+question into one of three answers: 
+
+- the agent can do this
+- a human needs to say yes first 
+- nobody involved is allowed to do this at all.
 
 ---
 
@@ -20,11 +23,14 @@ SpiceDB stores access relationships as a graph, where nodes represent entities (
 
 > Is this **actor** allowed to perform this **action** on this **resource**?
 
+Here's the graph you'll build in this part — objects joined by the relations you'll write, with the agent's delegated grant on `staging` highlighted:
+
+![Relationship graph](/delegated-agent-authorization/images/fig2-relationship-graph.svg)
 ---
 
 ## Write the schema
 
-In SpiceDB parlance, this actor and this resource are both Objects and this action is a Permission or Relation. Any usecase can be represented by using a schema that defines the different objects and the relations between them.
+In SpiceDB parlance, this actor and this resource are both Objects and this action is a Permission or Relation. Any usecase can be represented by using a schema that defines the different objects and the relations between them. 
 
 Open `schema.zed`. Right now it's the Part 1 stub — `environment` has no relations or
 permissions at all, so there's nothing for `decide()` to consult even if it wanted to. Replace the
@@ -50,10 +56,9 @@ Before walking through it, two bits of SpiceDB syntax. A `relation name: type` l
 relation whose *subjects* are of that type — `agent_deployer: agent` reads as "an `agent` may be
 wired up as an `agent_deployer` here," not "`agent_deployer` is an agent." And a **relation** differs
 from a **permission**: a relation is a stored fact you write into the graph (an edge), while a
-permission is computed from relations on every check (with `+`, and later `&` and `->`) — never
-stored.
+permission is computed from relations on every check (with `+`, and later `&` and `->`).
 
-Walking it:
+Let's go through each line:
 
 - `user` is an empty definition. Humans don't need relations of their own here; they're
   subjects that other things point to.
@@ -84,7 +89,7 @@ actually has them.
 
 In a ReBAC system, whenever there's a change to the state of a system (ex: something has been created, updated or deleted), a new relationship is written. Since we're starting the workshop with few assumptions, we will write those relationships to SpiceDB. These are the relationships that are defined in `bootstrap.py`:
 
-Note that each relationship write is just a simple API call. 
+Note that each relationship write is just a simple API call. Run:
 
 ```bash
 python bootstrap.py
@@ -117,15 +122,27 @@ with the real three-way decision:
 
 ```python
 async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
+    # 1. Agent holds the permission directly → autonomous action allowed
     if await check(client, "agent", agent_id, permission, "environment", environment_id):
-        return AuthzResult(Decision.ALLOWED,
-            f"agent:{agent_id} holds delegated '{permission}' on environment:{environment_id}")
+        return AuthzResult(
+            Decision.ALLOWED,
+            f"agent:{agent_id} holds delegated '{permission}' on environment:{environment_id}"
+        )
+
+    # 2. Agent lacks permission — check if the delegator (human) could do it
     delegator = await read_delegator(client, agent_id)
     if delegator and await check(client, "user", delegator, permission, "environment", environment_id):
-        return AuthzResult(Decision.NEEDS_APPROVAL,
-            f"agent:{agent_id} lacks '{permission}'; delegator user:{delegator} holds it — human approval required")
-    return AuthzResult(Decision.BLOCKED,
-        f"neither agent:{agent_id} nor its delegator may '{permission}' environment:{environment_id}")
+        return AuthzResult(
+            Decision.NEEDS_APPROVAL,
+            f"agent:{agent_id} lacks '{permission}'; "
+            f"delegator user:{delegator} holds it — human approval required"
+        )
+
+    # 3. Neither agent nor delegator may perform this action
+    return AuthzResult(
+        Decision.BLOCKED,
+        f"neither agent:{agent_id} nor its delegator may '{permission}' environment:{environment_id}"
+    )
 ```
 
 `check()` and `read_delegator()` are already provided at the top of `authz.py` — one wraps
@@ -215,9 +232,8 @@ web UI calls, gated by the same `decide()`.
 
 ## Why the check — not the prompt — is the boundary
 
-Nothing in this part told the agent, in English, "you may deploy staging but not
-production, and never destroy anything." There's no system-prompt instruction to argue with or talk
-around. The agent's tool call runs through `deploybot_server._decide_and_mutate`, which calls `decide()` before it ever touches
+Notice that there's no system-prompt instruction that says "you may deploy staging but not
+production, and never destroy anything." The agent's tool call runs through `deploybot_server._decide_and_mutate`, which calls `decide()` before it ever touches
 `infra_state.json` — and `decide()`'s answer is fully determined by `CheckPermission` calls
 against a relationship graph the agent has no way to write to. Ask the same question a thousand
 different ways, through goose or the web UI or a hand-written script, and you will get the same
diff --git a/delegated-agent-authorization/images/fig2-relationship-graph.svg b/delegated-agent-authorization/images/fig2-relationship-graph.svg
new file mode 100644
index 0000000..1249c13
--- /dev/null
+++ b/delegated-agent-authorization/images/fig2-relationship-graph.svg
@@ -0,0 +1,51 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 1120 720" role="img" aria-label="Relationship graph: user:alice, agent:goose_alice, environment:production, environment:staging"><style>
+@font-face{font-family:'JetBrains Mono';font-style:normal;font-weight:400;font-display:swap;src:url(data:font/woff2;base64,d09GMgABAAAAAJ4gABMAAAABfCAAAJ2tAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoFfG4dOHIGacj9IVkFSiUwGYD9TVEFUgWInJgCFIi9qEQgKgdw4gawuC4YWADCCojABNgIkA4waBCAFiUwHowxbsF9xAU9mXL3crao0IYAoCrjzg+5wHjkVbcuCccwS2DiAgXoOZP//n5pUZMw03LTdmDAEARTPJXggPcuQWjEmkjXItGcLM2nuSMRCXt5ylWlbhNmErM42b9XRjSLwriYzp+dkSilsP2a7vJEQOVEnljweZkZY5RXso5cGenEqyCjgX7HAXc4ctuPJ9HAXaT842yHTZLqsy1zWrbwrSMNJJ/arHcL/VIONfi9b8fOs/ipY81101Io8q0dCOERHaXQjuN/j0kXaJwIyNdzch9lwLZ13fvJZPiPYd002hQatB9VO9Qg3kmpo//N14OD8h1RdxkrnvFAQzTl7HyNAsEDN8FJ1amoOT99+v/tmv1lIaOQQKqURm2aIENWbmEaxaDa788bnf74798CjPMZ4PMbjsT7G7hB5PGQMGSMdQcTuWkklHTKsSBBJR3ifNA2pFQkhFRlh7NrQH2F92DD6Sa1Nw/ukPrvKWENq37+piAQbUglpsEFE0lRCSKUHuK3bqDQLjAxeMSPQ/ohEvyPRNwdseNLNfygUguIABElICAkZJEDIWpe7jMsmlyOBcGYAiUCAMHVD69hovxPHArX2Ozbfat0dutu6v9iBY9GhXQuIh9/v25z71qSpIm5VulsiraWfKJFIIgUink3S6qBenRwUfGg9Tj9aewowwb+9w39irn3GSiY00dCJ1Dxxf5eJ3Tr3plpfFYBCKBIEKZGyZbvtTn9Dzu++t93LYd/dJNS7+XgJOUzyBPd0u4McqECR8P/T2fueZDhn7owxQDVSBdgBD3itBUuLn9hfaqzWTniXPwEmaRlrrMKj20KLT1kM/EdlHNNYuGqauQeGMIqW2JBwwCGG76W3/fX3ca93dEhJ7O2i8oIlNgBSD3EGvnL+3m5y+bcHRsEMNVLzf3P9e2cS3s3uQJIJ0QRo6W0+kq38qkJXVZGyZSV6anSFrDA4mDr/FSAdYYSWhNFBC+lb4/x/T4c/bpca5e3T6d/2gC5GlglZlodkW7Itr5EEiMV01cxxCysESXLCi3v7TWERUAAgBO7aWSlh+H78dK9eMBah4B/7rbudvdoClgpaq2LBK96rudybur2vC34eucQOKVAGYUi4VlhEOJornFmi0AE+cRFT4+vMbHL337IiWYWKgFWFrQIulJv51Pk1si2QRmEUZiSNwkgwAoQNDuB0m3J1odpQ1NcUXxabq+bS6+/aDSH7B/a8tjEO+PtjZw5zGv/jxA44bbPQ3X0EeL5VdvfB8fb/CYAXKIWQ7UiyNIIR/H2pWtf/AFL+ND1ewLFhb4BmllPgREy6S7I25HjMv393s7t/A0SjAUoNkBYbkDxuUpbdAGUZhEMRDZBmkpeikxxCnhQaoDwDUZpdSLJq6DQhemdjDKetPZxmbnPc4+7hNsc93HO83fdy2tt5D9c9XNb/1zTfFngArDuE8EPkN/XlGMpfJzrnNhfdwwwgcjkzK4iDXfHn/THXPkcjOmygA3flvE5x1XR2abeFoaql0m2VrmpPztAMSxR8lm6tcUjcCDqfQ6RIr/hZlQZXpSm9+uH75dKXWnID9DcGzh5TcCPpvC7S2T8JCutt+L5dfY8sp7OCgoMCcKz31/q3qllc4E5pOyRjyADGyLl/b1v8Xswm/6vr9Ei4pvsMTVXXdfWMmB20wgivGrTmOhuwplCiEdjNXjEsLr44QghfBaxNkPjgLe8gjqUEkdLHUiuIZnSLGVNwNL97fG5YUztcmeZGxnTgQBGITJXY8fhq21vG5iNDPHayDfzPWHuHx+9fbW7tbsdVSUlKSoqAgPAw9m8PYRHs/j+qpjCEEi6Em2giViwRpxBRRFGihDJEOeWICmoQtdQi6mhCtNSKaKMj0VlnoqsexGefiR9+kJomn6XmKWKpdSpY6pEWlvpFxEJAHhaQAYQDLwswgD66Tpo5LEDoGzHZAMG3FUhCmAMOAIgXDwFuwmVmipwuUwVPmytd2uHBBnCjR7MVwIWGMII4MVokGRDF6fB3AXxCDrcrlNCLRwGAfmMXPVJ8qOhXtglj2S+s6avGSFvJoy2C/PFLJ4Dxhsh9hWXIanFPVKwA9ACJJJFaV36GqQMgf+no0BzA/sN8yAWBPK86vlMorRM6qv0A5LfpeQEQbCG0AATdAoxtCgwFKfj0CJpiRZnyqxxw+xxmgKM1sBi3GzUPUl6dNJoXGjDXF7NWGafaM7YblIkqdAAWiuN+lBa5NA/ccXSUuA3J+a1jd0DNjxJfojE1kfnUbwgsSI2XSr/LH+WP9hfwF/QX8xf3V/BX9Nfy1/E38jf2Nx9qwQOujIegE14IWTKizoAyUAziE7lBxzWlQp7fA6UqkgPxTyFr7Z5DAX8pFufyeNT0JoGfZlnKP/xQmuExO9P1kVby4Q1yrL3YruKYwseqpJT84m/plAJXtS9xRSzsnt8Grs3IO9COHY2vtOlC/LXGbTuQ83LseWU8CZnvx43bEKdFLoXWCv7W0K7cqEkKwajj33ix44OHICFCJZBIEsmlFi5KrDjpZZZNLnnkV0hRJZRWVgWVVVVdLfU00EgzLbXWVgedddVDH/0MMMgQw40yxngTTTHdLHPMt9gyK6yyxnqbbLPDLnsddMQxJ51xzgWXXXPLXfc99NgzL7zxzkdffPfL34CRTN2wlMf9IEqLqmn7aTlfH7bHT5+/fE3PCGVh41ACg/Mo40PwC6pUrRnf9jK7xvbUds922eaz2Qhftp6w7hX2rwxgeWy5Y+mwVFvGmX8zQ+Y89BZ6Aq1BHabHpjumi6Yyk4XSi8anxqtG1ChhjwyfGI4adhky9P/op+irkZ+Qp8i9XboAmYbUwX/Ag+HjvRqeAafDb+lauiW6WfAEkqFGSxAOSSC29rh2i/ZdzXPNHU1Eg3/n1OfVO4YXppapvlZ9otKoiv5hKc8qD8PHG1YyFEcVaxUj5MeWO7XkETnOkmRDsu9kS2RN0iHpU+k9KS6FIbZkt2St+C/xd9+WuEPcNCQPiegP0dei5aK2lORSuKQv2otEun1OvgifRVL2B7+cVk/4qfsdsP5dw+vYypMwJaS3o0vgr9bCfBumZL41D04n09GPNekmNeTmxr1xg/ugH9U3asPBEBpcA+MGUdjs4/1U7+8ZwqN3s0t0wY4laLWh1nXz8kg+M8wZ9Ul5iWG52W+sje7D8Q/qbU++pR6oqlWhGqqM8eCB8u9LwVvDpfXxWSoV7RSNYqLwFEKU9mYqX8sNOZYruNlsM9NmykvuvXjjON1LvenIepJ0kto7IfEmd16E43Z8XKYpxv7IRdtRkidUd4vfy4epcC2gfF0YCjaDFaeUzb2aFPOzJCG7ymYt+hE/6LOutDy/5/SA+/NF2B13h2mJn/FDPsL1rMQyzMDkl+/T+K9KqPIySr9Poj9fpwhGZJdKuZfeHEoKrXH77uqb/mrzWr6WXWTq2Vk7Kw9E5b+ysbu3cYsohZVeJUt68XDuzNFpmiRybcTGnMEl07pSfUeHuvikbNtsNU0X7SiFM5xBTD3YntXZqqkd3KoWPqu2yrUSVZxSahVoFdpnwrgRNkazmKk/gwcHI71j+xo10i/Mek5o3vZlONzy/Jw4hgzh3JxceIn0/XLUlrTko5BY84LC30abup9cK1q/AzsTFYY3YnjHU19fQrrTk970pT8DGVRvTwrh/YfQxVtWTHUDEDwStWAwr8QBMChr8HXzA1VUQ+fOiUAVVK/+C1elOjWpTV3q02Dl7mx0UkMsD5ZuPL2d5c0YNJgb4+3B0FSzvdLpp12bOqSBM42T52XwiouDlFa7UYPUe6m7gHDY44sZy2MTVd2n/2CWumNnWGQ4XEhmKcVouEits9jaTGPWR719BrswoNP2TUyxuoqJpItclssX/U/oZPywpvb0AFb/XMt3O7JTTxk5hQvcnaroG6bY5tLe+Rp2FP1/Uh+ZZ0PTFP1SvgcvgXSe8wVW0b9e2hT27LbQwCtB9yPpt9FIj4/xn7AJRTfb+CGqj6IPXXybro+iLanAQiOaBTm0wFedLVqj1xmeznc5xEe2SdUfToxwzVr7AbEtNXONaN6Vw5uQjnkzziJRZgcKvSF2u75l3oQo9RUjGoY7qs/nTz+dLOT7xwEjkADGhfDyv7pyXz/jSG5boqSfCJ8MoyYuKfqyb1rQCnyaXXJ4zE7SvB1jCUKjhW55Z+X+lgx9R7Ckodmo0yjkqKHiTP/BWymAVQJ1FbBT9voK/+UZpQ/o2V9np7j49Yhap2a+vMde+HetnUNn+M+cbTJnUZ+svxENIUdZR2Lm4cHbdSRDrVRHWW3e1sfCDU0bG5DdD8L/dxnVq8+5CoahybYu0x7uN1fv6z3kKNXpBmTJyeF1ElP/DfjYCBBEK/NqK5Y5wc1WlJK4G9HuywG3KpuLC3wdq2AYAcjMSETi+HqtJzP8uFg1hhdQ177bogmzfvkgGMl10eXEQ43JSSO4KDqeYfX/MVaA92zllctqYbeqO9BL8FqqTA3IHJPDKy2MYYwV4LjlIZrD5jnW6znYk1ht1GnvuIMkzhjHXAEWj6gh3EYJ5j6oaEucUjLzerUu6gRq7NCGsDoBHR3KCSNoUYjBxnHHmAGN25JFAUbkSqIOIHMqToxKTb87vCg74xhjBtRjiUEOOu0IaAdiJqwbdRqiOwoPnXGOOQPcHWGiWEEGuh84YQs+maQVerV0agPEd9Au+CcBHbrlpBFoEAxCscYYB9Rsfp8EsuPyuBbAk5RPGJBh0x2ee2GsY4wDshZ8RBCTgxFNgGQCi1GnjbuDdM7YxhwH2EZAK8oSgI8wtG2WJki8r1e7Rg0A/s6Qm1h2jSbaqBnyr/Hj7TXg2o+T/pydEAGYfUSjR3hudduZfgRA01ZtQAa6dNsBfj2CiEtKoa+JIHIRJtU+F9Edz2ruOVvfYRyfeU5SkbJR4NqzJgpkkdZl8WGs2rWpbiLk1iNzE4G0ZhvRjMnamkEBI+PYBGYXuroIvps75iLQNNeMaOju8Lm4QGboGOeiVKDnOd2zCDrh6Qb0jJ3DtKanifFqPdQr9BhvehwGdnqIAh71GE8uKnWMpYxo+7DErK6rZwtS3CqhZyyuoS781mn0pWPKbmBeBmVNJ6PTAmVTT1L8z2QYZTNAqcV2FzbJ+/5c5A404MnDrG2LX3JcwCfx8WrXrejhZfcTkNpcnvjZAVCWZkFU4FPvyQJqYy5bzYYsl8aY45FqNPsnsNmtyTSPYMcadelxR6+2QN3hEdiZ+8adBHRbXU6Cs1z00IhhjtnBlhzdFKJRkngcKG48ZVVy6tRj+rXENrpzbY8KIqRN2L7W9XjkM40LH1cAHkZH19UNpRqPmrhG7EalOj0qw7h7S9fFg2IxfD8ioHvgC/O5zfesgsZcwu1oNBbuM6oUtzDu2Pu4KqdGPeaOLnFb3Rnn74MEdLeo/BMc8TuG25IXAFcoVsdlLt2GWoEybJV8GxAP5WnL6tUqqTNcLPObgAHdpV8W8MZMj4N+8+Pgzxhy6VqigoqFPV9fiEclU71e7SZ1jGFufl1mQDcEZQGvM+lTKdQW55UOg/oolmFl3NriKCzu5XNl2IbTT4sBvvY0qBRdbIPzQyP0iytbUjU792dy+JVcFNKslsrzMTAuz0bI+VGRwH0AyGI7IYl0V45Xy6QWuIR3kPw6SFwS6RXeL0M8QZ1XoF2fen8RtP1SbjKU6SEPDxkH+9oFpJknpnAAvkwyTdLh3JpDHAHbEMayRowqrgiBmo9z0oKxZkak3PRqhjN+FqSTZ/ns2RZH1Hdkwg9DcJAZrkDiJYFcTp3gVSCC2yN0DCun6Jhui/VqvdRHyFuprT42sJODsoBtwV4GinR/Krvf00JAorZdJAc3uWuntIPm7Pp2/BR9WZuOvAlkcWptBT7NC1lvByxIrXx/eRbQxDhdywHtcF1HE7Qtmex0nRuPOdU2GiubZClRu9ZRwDW5dyjC7fGUkn0jW1xUphQJop2fKGPK0qvdoDZQF3nTnDCwq59RwL1zMdpQvYKcqKNpNr8KpOGyirnP1n5S0yVSxtUjRhXmNHPlREqt0KaZmh5skBpDgKmQaqYVFBKCogYKKDxlwLiqphGm+XlVQEA34bKA1W76VMqVClshTEa2rkp/Djg3zp0mDYPKOwB5Oofr1dziaZBjYvMmntGoX5MoYOb1DrA0MZ4y65W0MOvqCfa8e43c0esWI7U+zUHSmGpXtmbMsEjFmSxXupWylhUgXcDTif723BQg5YtOYdNivB5+BGBXRnxaCtTRIcrFYK6bObJQRkP2loVjPf0YpZgqaeS8EgOYxukORvJgyg5gKp0G9WrSPA1TmNbSUHpszFk9Jws47NlTt6VqHFjYU2WiAk1gPS4qTOlpPK25eozKjAthqjhyIiVLsFJFSQ+2Ox5DiIGdRg8V1JhwbIynG4hQo1PDMK5v6FH0xTSqHyew65/JAo5iL+WJyNoDPm2Z8sp3zAD+YamdXhmn4S9WwPjUMLnZ4LKNitpdYeIN/ZC3Br10AL+x+NBzwyAAEjvTU4XULOXy090ZrgJBQ7yaRSAdx6ck/cTCyaiHHvqRFvIwDvH1dyA6WzKwgw6l2H9K8jx7C78C5dQMyAw6bABfMUfQycIgABAfdijXEvcyvE2/rt2My093YP+PCDj82juWCfVNCA1QfRas18GuT5g0AhNMcCcKisIVwN+23Ci7B3VkAB8wraP2h0EAimaqnQ3IRUWOqm2lo/JjzKJIWtmQ76rKuiUPod+hwJN80ajTeGRNpgCDdQFyWb5oKLQ2itAbjAcu8us3KPjDyCkd0ZfMqa1RsSHKWqRftC/La9D8mvkh9Ob8GTz0CqPF5Zv6JfIVhk/gdh5lT+kvSseBcZpC6uD4lKTnGJo5NdBDz9JQHq9WTf0UqYi3dIFdyqbAnEB0/TspCRDCWbsWsPN4UoXL+f4ofCcnOeehxxgcLsnoR0juMz4lH0aSBC+N/hd1vUBpFnMn4mMA4EF8AV3H1vfRkZh8HeBC60M14xKjrTA+YWozz34Ry5OVeIWFdtnWYrqL3uvqbn0XrS/V5E4UhfP2qhXJG5usVcfuL+Ei8LWakNnYrW4Liosd5ragnY2NYRayk2KsAVnW5fBYvlo30Rr4PW3sITfYeaXCAG6iwyETg0o4gBupc43Xw0wAO1+Qbl4+WxWwUDsoCKmsp2ejYGLJ/R70pfRGabdLXZMkwbHREF1N7UkYFw3oq2hOeTk5UrJryhSEFAnTY4GIK/ArJJqkDUbpMtqgC2z6Mho8BQOJGo1H1gO1k4npW/d7WtVo+tguoIAuouWgkVnRpAvDliwgO1HWF9BQmHR17wSi6kfd4mSRQldXIODhYq0IzJvmnPk14+60oahXGT6dGCadg/SinuF0YhB0NkmH/ubvndA4eeY+gtQ774dFAHZlTM6UuHwgmNFkraJQOGtXgU2oWl8rPC0SuHO8XR4GnUJThBuwuYdOpubJeLUO6pNwLbwpNxjYuf0U8Mhc80Yxy/OvI2zWOVzKA2HaXzd0HM0AwjXt0/HUKOt1jvo4+N7bQr8P/I6n5CQYOr36KZeeVTaW1w9wnw3ldBT1rgt5+ii4ZRjSr4SjL3XbINRuVLIeNCrWMfjgadrgNI5PSTqM2pBZmx46lGr1MI5V9EGwLFsysGPbFJBzuTbqru0PREP7P7x69gHvuxYm/xFhMvC3dww+eJLtzGjioT2ojI6e6d2gVWY7KQH0gOETuE2fsbfUlpoO3EsSNGYzM+1EWXKZVu8EdaVM0Ri/cchaJoA1F+/5pVBYfkttF17HB812wUgcM6KBbo3LYcG3wovMgezbeLfeehAsF2/orSDrKV5sQCbzkuMZv4j9s4l+yUpxyl+hU7aItYkYXgUaRhEFUdtYTuJh4S/8Lka1GDE1ERZ8A7uoLQtBiPb4WFQCifJ/o0DQmCF6Kj03wk60C3CbKHnajIKZo4d4DABsUr8OFFwU1xsR4QyfJ+gugIF0z9wIdopEKhy8nGiwNlJATp/HUIJlcXLEdx5aj3zMRQy9DhFgtulBCzthAwQ5bLjtsIQerD4T8vIcFXCeD3K/t59yaf814Sog5Ii0BlnrCZIFMAjTTwcAku1OdMVYIvdfQJEUhX2LJApnY+pbGvVUDjHZIr5QqZDyPU6bFnlX4BUQQjiiuyGkVcj0oA9tUKeVw0zFVbngQK9EsJso/vgGdsGGLCB12y9lal8BWXVQbBT4Ah8tQ7qXg2HnoeUp3RqPMelloOR5gCGgI01ZiECWS/mPCClCy/uNe/DdipHJlnhoCdI+R1b1YpAo4xO0NoNcdqJTf/08pnVAdFaEaCGSghMuvRBEmIR9glIhjDN2H5UbsqwLbOvz6zag/IF15j8r/b51RhIYRWNJgOYj6Udks4mT5qVEUa/WQj0PiTZFPY+dFGApCxwJvHwzslf7zpgx+IWghxsrzhrNKeKUyFonSnNSvFrGOX49pxBnizWniZivuirsZ8w5/gKhK+rbW4iNkVf1qjSIuCd7eXpoKMX8YZyX0YMQ7uQleWI/CBhIx2wek0UsZQE9PD1DBeDyJyEnn2HRD4Gy3ZVBUD+iZQiq9XrrvqGY+gNPAqDr/IoTcNvjmIGfY5JHOZcv2vMDG62VwAYXftS6L6gHEce5W7oH/mhyV99EbTbU8PLtANhpDHLRDe03el+/3i0aeyM/9qLzWovdmBVrJEIYcmJOi7DTJxFs0IfnyDvNipPsfYaRJgejoGkQN/R5X94BwPsKu+k9wvyeZVUG9hNrRqkTQdGZAd0JezmZow3IdkQON4ewqViqj0uCbbKcI9urqrrFKdDtsOVD1nIz0Zf8W49tvmROC41WGqL8NHuCq0CsGqr1DCvP8SlJrRDH2crQQy1J5IZxVlI3w4qxJQM7K0QBOX3lY4/wfnFky+A8daO6dLQazBoGBTfOJBIIWu4sLlqYv6AByDZlyofZYS6+M5D1jfoq8TBiHrpe3ZFmPitv2oQttOYK1cHfghm5ZJBZNfsXTb+tPafFAjduraNgo0x8lutjBusd4W/dW/CW3Ngjs2khudKjGgnLx3Z9CFQDnw5r2BpVqh56Z96ZM/K6GhbGpJ450Uwto8BbXfcP0r5AAeanu+KH8kO49sdPterLlZa2uDDzI8PYjZsVa18avBWpMnmGYZwh1hUwY3ODjYDODMkCGqQso/rT57GUNJg6y0lUBvfQsVNdBlOYWJlYgoIPk31um5lNsqyzTEkRKcuk6OeeXYCULZtSJfKWGdclBUnfNKxLM0nK4czyhqHP6zOhIJ4REzKEVAjeyYwJDxUNeZVXHQO6EESdaG1m2tKHgRTPDhjt1N2ywPRJlm2XyHyFCLxhCMfinOKsQLngVtAxXk5Fyk9ci7/VVikd5c25zPlqtdS5OAYylTGgOzrlPgLlctmbZXbrPrRsDMBR8pjOIyZA2WAPodOsOkHZicVlnOrW2Tic7GiVaiegO5TkJKjlqsGIwcfs4JAY7fOVoTIFH/uMVToqc0qXcUrVZAr7zj5W7hEhDcLw5ftQ+eRqkEMP+KwseLxsRUoHXckHGj2UluiMjHPaOhVOhS0Z2Dk5CsjpceRs8eP/RQG3W0y0erTcCE3CPQoAklFQwbl3QLdJ0wsv0Cf2Q4Avh6fDE5uF0tbMIsEvVM1Mh2hpU4XLl/Xm95qJjxkAh2gBowQQ3IFMJ6ztS286yvt9N8F+YTVjHOMc+xmLiSpOsB06MXFi5HZUUqmx8ii0X3rGfuOcpeUrF3vuexzthUFgUDSOCRwHEj7rZGQBjziPguCKVJQx9xGOY/R9Tr2NbglfvQvxSIVbLi5S/VCeJhxaXkm/wkrjSt95BwB23oSdqUAROIKMLeKhyHSoyTis1RHYaeZYjqhfS2SBMS899QKyRnUSFeaEWgdxatExheHgcSjfhk2/6z4Q7dAbfLl968Zpkveny2+C705AQBHYWLHU52y9E0/7gcjV2BrWo/IrCHLgT9lmPiswMyiXlmcTtmhkixAuhcBJwmZZRKHg5MTKOGi2wc2FrL+tTlm5LoqEvfL71wg8UilGox97GtbEe0CQj48C4dAAzhHccYcCh/vWaWUw0kNB8315zzhQ60BY8kdBoke0XaPytALd3MTsq6X9p5sPtbPSRD6hYiMVG3kSYG+GKrVmhgLSvk/GmUkdAJXMm8ixBHZKk0KsjRCOoxT5MC4ouxw+JQfgh10xKw/JDMA37Z7InFbip8EHCs6WjMq1mwJy+vxlK//3jqFH0YZlRSke8sLO4BSh9oTCYp7oWgX4kjQlTXDbuOmWNYHtXz5I5R5ngdMWMHKHnXcg0+5rOFavM8bdBKdmrwLRC7yda+gZjk9JcoU9nPUkPeQytE3L5PSYdoYeZMousNPHKCCnxz/UzUx6v1GHONms94iHHGEdOV2gHaAzGZ+gtUlkb/+HWp4T70qe8AFX0B6yPiXJDtZo1uL0kG2yrMM4Ddc20FxsycBOs1NATn+R1fKK/2gZoImtBsgKZt2pdW0FjXxWLQYZaiupLxIgAeqxU1Nifa4W+ui3T2Tfeeeg8uDn7pr7TuNGWA1AtVoVVxZSZ9zaolCV5x1F106MSP5U/yaWJXOqabQkpZLYSJmVU1lT0YX8Q+zht6dWyfs8PuO4UDZuNNhApoWRkGqlJrNkTNRjRNq0UNwzFqKR2iHslOiSzc3Hxb+hSNkO2QMZw+BsKHRoC2Q0NMhdZIdWtBHwKZM0c4I+kK/A5QfK8rkO7zsBj9AIBvzriuDuG5SBIxbJiA/d7xCq+cDOM4iG0AAdYNtp6GSs5xrUcRzcAz6sMmNec1KBDKDTaiwVSH+otaPtUFvrAVWYsgvsUI4Cci5lmdPdDe+BdX5ko2x4eokXKKqipFNoARPQ2kCjvJMS1h0gC+MTLGzqePnsb3LeEHlk0qobFJFV+KQJDTqFsVvz1FH90cc9NdRXn/uLpIkdi9OkDjXq8LpRF4mEY41op+QgXEdtP7AQ0FL+H7BohpeD/g5QzsI8qULlOcC1KtD9i+DOrrkrYhdhaMT8TwZO6czncuSUwrT3mE6DHdLKBAegZEx6eeaAKBb5SBmKabLaGmWsQaUgMuRlGcy1MRJATAsYKQLXHMi0IqDBTN6xL0t3Lt0p8Schw9WoOr6eLRRlxB0DnMwwkgJYGxO7DqLmRK0XzLTmdtU4iXsbxoydMhNnjiUPLoXmaLjTKkHDqYi8cCzqFHLcPX9FH2uIUg021Ia37CqSP7QCqsbhVCS/qqreJ8W7iuQ7V5894xSr3ZCXDQzsBIVVsr89OMYTJasfOOerPgdyQX6ZXfCQM3wWwi2WQTvAJLbsAjsGUJr9BnwAyV0/fiAlyPbhDPnArf1mFLUJvWl5aFVbM0FBBVWKVBBsctZa5HZk0N5ITRl257B6+aHxucYNYNi2bR1e94+KDm5YYHD/rwUb2MEBTnCBD7jBF/zAHzwQAIEIQjBC4EUowpAACZEIiZEESZEMyZECKZEKqZEG4YhAJKIQjRjEIi3ikA7pkQEZkQmZkQVZkQ3ZkQM5kQu5kQd5kQ/5UQDxKIhCKIwiKIpiKI4SKIlSKI0yKItyKI8KqIhKqIwqqIpqqI4aqIlaqI06qIt6qI8GaIhGaIwmaIpmaI4WaIlWaI02aIt2aI8O6IhO6Iwu6Ipu6I4e6Ile6I0+6It+6I8BGIhBGIwhGIphGI4RGIlRGI0xGItxGI8JmIhJmIwpmIppmI4ZmIlZmI05mIt5mI8FWIhFWIwlWIplWI4VWIlVWI01WIt1WI8N2IhN2Iwt2Ipt2I4d2Ild2I092It92I8DOIhDOIwjOIpjOI4TOIlTOI0zOItzOI8LuIhLuIwruIpruI4buIlbuI07uIt7uI8HeIhHeIwneIpneI4XeIlXeI03eIt3eI8P+IhP+Iwv+Ipv+I4f+Ilf+I0/+It/+C8CCRlkIRuyIwdyIhfyQW7ki/yQP/KgABRIQRRMIeSlUAqjBJSQElFiSkJJKRklpxSUklJRakpD4RRBkRRF0RRDsZSW4igdpacMlJEyUWbKQlkpG2WnHJSTclFuykN5KR/lpwIUTwWpEBWmIlSUilFxKkElqRSVpjJUlspReapAFakSVaYqVJWqUXWqQTWpFtWmOlSX6lF9akANqRE1pibUlJpRc2pBLakVtaY21JbaUXvqQB2pE3WmLtSVulF36kE9qRf1pj7Ul/pRfxpAA2kQDaYhNJSG0XAaQSMJCCbAr04VYTO1srDjzKiSlKZ0H6F6MkdzvAGfL0ipNge3Aq48pY7zwvrg/f+l4qccrD8oHqH5n3uAiSwHICU7qtH94I2yUDjT/VaLLgL48UtS4tTi+xMpt3Ia6WaUedYxABJNIDBNHBLjJ/wE1mY4oCBi9CFf4gQUEZEprEV+DxnQkFOsRT+7rA5T4DngrwGDgIL2c4AQi/xOcIAk6NmLI49Z15fX3e+/XxpWV/fVXwMAwMV3SIF88ppG3F5CEyf0QRWH6T+hC1+hgAXveOI75wL5NvKRU77oAxcLQiASLhK+gTLRbpSL8lAB+i6qRLFiveS9NV3OVgzelc7/MgYAC1BnT/0w+wDDckBQCORHvIayUc77JUPfT+mq+x+cAHiqbsK/V1pJYCPw78LNYsCD50q8Lf2KQMi//+m6vu+HR8jPICA/qOURQHPc1zTvZmpClsK/Lr030SYzfA1Jbjaba57pfhlrsTFmGmd8gH/+6woN4cYXfwLwChUmgaSSSS6FlFKLFSed9DLIKJvscsgpt4VmWRQiy1Mtj8KKKKaEssopr4LqaqqltjrqaaaFllppo61OOuuiqx7mR8mCoHwwyWffffEjzFDVISx6WhcCS8JWt3CDMMzw1IQkX6am0VC9rDfKSKNN4cBgw4UdJz74ESJQkGBJJJRIYh5SiZRGuGgR/oiSVSaZZZFLWq0VkFc+BeUXr5CiyiiplNKqqaSyKoqrq5H6Gmiiob8a66id9jroprnuYjRNfsqtsdYKq6y2koBABuHlxL1CDZosl7AG5FsvwrC7SwY4EfCR1aG4AbdsgSH5yq5+YcBPjhWzQf5yxjDkuQj/l8rEqELY8u7euCH5ImL2wJ4cVulc0cL8v58mq0/s5REWPaj05d2Y2QbXyQ+qB9PHEuQZQpiEsaEx01E3Xk1wYLWpBttjkpIfSLqyr1lMKEi2JAdOIxPiQO4lJx7GRm+3Jhs9zWbb/f4VJLEdpMexRLqSuX4btsugA1fCjMYVRHWk+3K6zChJRpnFygcJ+0EMBXulUYyDQlKiA7lQ5NFBBw6vsgAo5MuKrGnJUCq9trTEgawqz3IxXdnLiVRd/h5Wmq5E9eArGmyWdWIm36F4v17WJUCChG2RrG4lZ0O2dVNvfmbRH1HWnVkMK3wjfrTVsjrapi5CXbMxmMb9oTA7WCqQSeM1nJyUrGszC5kVAy/h5bpsDeKXLdTnecOKwQTScCNOtY/qLPSWPDfA45eyv0+EZc4Hr0gxCjOt7yNPV0MNpPYjrcmqbYpFf9ZYKZ160BEkQXfGuVvY8Y/aM3riu95NDau4uLN0QFS2utVtE53vkRFYKwVUu1WnC3PPg8kwXNg+M166nFtGZk8bIugUamzznriNbQEq7FH6U14OWNk+I6pt4RUJJeXspNRPkXRU44I3Tu/MxaiOSd6oZ31SdR6eZ7LaOCN6RHKwG0Sl2WDQiQCzznVoXh+3qj9CV9e/bDX+YzNI2FQQ/VHKPWZ+KU8Uf8q6mB2Y097HPvQIK3QAu6HjRhsL+hQJAgkPJDl1V75AFp0WqPnM5Hc/vuhooy17knYoGIwO29038dP+p45Y1Z2L2g2wVpunohwrjPTSEzrcvfl4BEiW8TgCSWITrDHm+zcdsKIaFCOblMTIG3OvmaoTWDCIyJ558JERvvDAyApWJDKga2mCYsjHKiN4jgC1LlEH4jAy/FBmplxxhje7ynrafyLMNVFf3TLINnqmG+flZO8UVLIi0s/UQGbplqQlaLr8SUrepnRJBKvLT+aksVsJa7SCRXwpQuqtE54vLV6J04LQAXQnQ3tlP4Ck58k2vlyfJnNhim8Amk1YNKrHWxcjGOIK1wml4wwbPQKmwUAWGWBkAUp70bW+FWd6+1vt3i3QM0UOwQQ9IvUFbWwr3aJ3mhrmRolBoRtBHWbKVLO25NRi2mmrtw1Bwyeja6q0LgXQ2APPkaxoRJFpUzVEwWnVpgyCvZHABIurW2JW2OULoLKM5CMrNAGRFh+XRMzYD6VtENSazmxuqgRHnZb1YtK4VY+MS/K6WnUJZoIeLXSLIJEFadyckooDGZEvvBXMQhaWf4MGQjkHdnSf2gtTcjFu5jv4BJaRESxuA6Ie7dcci3EvZDU7i8cdaXP+YzA7QuwZuNC3/gtAEurIzb1V+EYo+ILBM4VcKoGhxDDMozw7cdNKZil5AOKjqfUdNcteEtAaJkzOAGPNKw+ESe6PGvqi1LOCFHUiND+loHryuCatveyVuPki1oesyQagZSqI+avKllJVufm3JGkORly+aD7VTeZDG0tY15fOFsu0hGFKxKyhEV2IIUdAZ0TjN68rshO3id934lJAEESbToOACSDi3YSpKz0uJ+msawO1rWI6Q4sm7SlCkR9uo8a2gn1RxFgojWiMBk1Jt+7tbr8Pb0Evok3Aq91O30x2eIrFvCQ7C3SL+jTHjTJCzRrgMfQgnMfj2CeDMNq4XmWEfMNoIDDMYl8ybCeCWJvTzhVAt28kzfU3r0ArNVx+G5o8tLWrHtV3WAK0ikJ1jcuuN9TaM5LOaWcKrckYk9PsQJvA7sNPObzWfSqwrKyVAOTXj+gwx2yfZk1whrPkYQygwZCNqWI1ScXC7YtBBDGpB/5PpY6+WUyA2pULrty5RS9P50galOPdxQY0d1JBrNB1Ua1i2XiyZZcZ1Y5VzQZXzWpWRfr2kbUAe76K4T818lCQ3mrzjgLxLcZwogYNv3RFq0oy9ImDgiGENp2DERWtOTlHatuIFruhiZiCFjN4VGFewK/WSqcGbqaLxcy0uAySNY2NakONohSNV5VB+eRQeddXqlAbdqYrh7f1iX4Ow7ZmFP2pq2C3VXSRlemWTZUMqumKPrPYcIAu6k3C2JdOcd1IVOI86YTSM7Afl8Ug1U4HDLH+16DQOk/Nupn5CX/VlujatbZoNqd77NXT3DhhUIsZFa6cGB+4JQ+9abPpuGJseiRCv522Bq7sogA+CftO6E4SWDg1EE9vEjTDGCtDS7leo0uNnbG+MgzvBXM1vzMZZC1db3cbZ+06YW6zG/qRZDcXo/n4I+ROK+tVV/oSsHKT/aRXqPo4za29cWK9Ra+bru2J1axvMGnyOy23VfNZlnsHSfcZn4txsaIwQE2q0u08st86aCODR+93FkZLEaa5uz1sGQTUlRyKNV7CrsYIeGn70FUTbgLmY07GIc74BS76yKUFS1xmdn1Ihav8uwxup86Paz432W+rRznox140zlaKtwHUg/hm7S4kufhKMU5ORhjqC/3j1kgOD29lbi6EPHKNvCKZU/cebsVj7qkqpnsGG0RBLbKOL63yfWTu3xrz45Er4pCavWGaet8YpyEfW+ciuuhNqexs60mRJCuigOigN1ykgp4b5TlddvyiSYLBki7blrfqPN7CiBU1CX9ORR1jSiiAKYVeItJJ97Izw8reUUPxFQo1KvZUq53HWLrcWvzxkY0vk3FNNm1runt40gXCiJpuW9IM17AwuTXzy09byJt8/7uGZDq95JFjW5CVBhe1M+O5sAQljqqkqCtbI54hnLYiDvlctWpCAhlHUDkpg1nHuGrHOX7cskstCzTGpQ6jEbg15GeKFLvVbZ5NdV8XBYThiMs0vzcWJ2jGnNCe3pUGHK8XUYN6YWcjXCThL6sFU7/JxTxyRZrLVQqX2VsC02KT3bTB9s6lX3LTHkl9yb5stu7Na+jNvainWGg5gok6+QVJV8/YvpwCLZ8a+JNPVLTKDP9G/JJn0Mf0c30VTw+shmTidz/E4firrH8I1cQyUH6/YByl3NdrDUg/SAykACnrrAflnfUFSb31ZScbRCnFSFlzaW206dWhaEgAsMbRRRJd6xjsNib3krMvG/eiNi9Y3qk6V0+tv/XYNcU1J/qCCL/V1NgUMGOhMwTDWQWNSD2yR0tz5JGXBKKaPV6eh7V56mfpw6IAXaI+TaavINRMFnRTKFd2zIkOOsQa4CVRSlmy4IkQTzP9sURMfF9oNqV5MfqpuT8ku0PjxBgJmTBis13e1CiZ3yYYTPw83fCzQFcTF0nFvsIMFhOdEuL6oKCzht+SpLVd1lXL6DPrUgvWFy1Cy/Uakb2AsB/ZTh5hNxn88TCHDeSEHXX9WBNWSzgH3TI3ZXH7dC7pIAVu6LLsmqfNx7PrD2ywebxB0lW83ZKsQmsZ108MhTEdi2VpkpZkcRcFWaFQzSqFG+7WDdUnI4QGUFAHwUYNReB3rtBOLcOM5bkS3sETnNJz6STDaGHHOb1mDAHSlrymadZbQ/25ZRUIGm3yyAU+vG7e6kb6HLD6wC/T4rb54+ZXB0vb+ifM8XfqePz9tvpBCkpboj+vgiLJ2kcfaUPWmavkDfPwilTw4iwoQYQyhDwvSONeJB05zSovOZkrbD320T5qCt+ofLeLaCEPbx3z45lrSJ/RsYdnlmpAfRarzk6oACe3AdYLuy5u8Fdrkgc2t0kthU++ekMnTq76OR7VaHFVq50kWFL8XckSjqJRcTilv6YUMCTPMH+Wg1iy0og6D2eKSZm9mKvUBFHwSQJwe+fiGCArTRQSH1EiZR5p/5HWVUiVB1e0bzirQTlccD4r4NmxWBbKicgKM5+T4tcp1QKjVIqEZG7M45Ir4nm0kBdQ3E3Sk3ZzZBcYzTCpw6qcSUrkUkBTdZC+WRSczCjAVJhjIFstvR6SUKwNKxyzsRFDgR1LvIjFhmJVxUys8tZwm8KMqV4TcZFUnFaL6zNNOp3SEI9KdPEy3ln7nZgyL1d5mcW8BDmbHdiUJIzU2VzOVPisopXQ1SPHi6ipx2nGBrlvN+R3Psmd7+J5dryFNVvRMNt7uPL54nfv4h1CBj39FEmTcBVyVmCbqVG8u2pWT8Zc/3xecLcFhjqiVbxDbF5hEQoT6Y+zCcd9hWbFBGkgFy2S7HN23FOs5e+KQsds5crKHMES1igXdES9VMZIm28oB5UuOZPSnldNlwDxm0XnUwIdfeHgAV9drJWTB6y1bvHw9rmlMDu76zARU5DUz4reeo3FLxYbOFvBjsjP8Qewen+yXEmzxi32gxhTNxLOQXPuhxsJKLDt0/Hx/r+fGE5hrB11qlLifpG7miaER3fUV8rzpYoYYk8LI//ZVSCQqdEo465q2pZsfn46NFoX2RriA+/NkQ+rN84TnzJXSwtunYy/8Qei9idzF2R9KAjDiqSdVmkPCDpE73Nrc4TXZHyu1FWowvQ5aL6+EVbPAX5rSjsKVb011dZm85FGNY2RVAcPprOoY0VzXt6tT+8E27jN82NK0Wp/qWaT+MruU2GSkrROfAKJBmREgW9N/lrdPug7OHlyldeWK/83/dfcE3jw0f8nvJ3uPT30nBqq7jp7HSvv4aeOvXyH0+sNBv669R/2xjBQuv0/VDo0OvKr6z/PtXmcq9IJ77QpQKD/87yWcIUo3+rgYGNXegqLvGpIPClUbFiIdegsepXGYtN1lExT6bVSKaJVTQcCkr5SKAkiNr0kUCnU60MicQAhIFivVusRyA7pZ7KzIQIWB+WfvoGbN1zQjN0p42+LGEGlY3V7KZmBFMuSzlf39vefMddIFVUGpkFRbeqYq11hvc2qZyLheR8GpJ19ov3TkvyfKiP9u3D7Y66bO9KOg9DDg3jZzxpcZWwHGJBhw1r8h/1sOAP9hGJQQQwLYYMYiOLrZOvwRb+8Qco4On1qDWFALTDMX8YNxw/hpKSaGVOBv59QNvYqqvuCZ2fV7nFHcdDeTyyx4cDRP83+7SFaMTy00jw4rd9HKrjQTJqSXC+f2hia1oiSahLbElqFJJDSP+PrlonxlhFY3qby/hlftWSO3MpZmwCfpA8KRYwHRIEg3RDQ7UhEsATB1JAeskEhq1bpLgQKAIfyJMPD510fFcXzI1rx9wvzvKo2dZ7HPOBi5pcbmAkYCT/yfAO+YegITsISGHe/JLl4f4nbxH/xAm+Q1v+tICyRhfSIrNI+dMZVBZ2r1KhFC6Fm9SpA9BPdG/WVQmmFZtLUxvDGvviNKgSWK/Q65Ubw3sH6w+viz1MN1RJppWLqpSFjGYxVEmxFDxuUYcuU84+m1ahVC0OoRQ2WBYK1hyHg73/sl/8/0QM6myOKpG3Q1XdJp8oWL1EYUJXaYFIsAQKSpUYgr0gh5DadQYdq5QVFyOlqmi0Da7CqJWWhYqSyvR74CBmsUatguahQgNwI51gyXDGbRl4REYLhocv4IH55KeCTahpaqlKJVI3KpNWoTZpUIrW6vhn8cPJBYPbrjxV8Mtk438ezXk86/QDESh+UySgToPwx1BslLAMloKWwSqwpKfkDExQU3PugVcvKsEtHjTKp2XoW4N5svVhb13J/Dpuwsee03Q9frLo5vbbjxRy23c6a0/kSDCs8vJy+kn/iVmbm4xMr+IGHlxWAl7AUGvHthKWwFAd/k8rDPoczXO7dKxdfVAgRrp5IQttLy0OxKs8sX3TsD55+kwyF3TpRyX8Lhfyip2APDdLaYQ2EW1CbreB3ZnYu1auzODQc5S56PD1CYmEOr23V11GWk0Z3U706lwNhZS2gx9Nz0QwHvZMVteSk0jTU3ONxS+1sR26Ohg3sJKPboktPjRL9RE9cR3o6hFsNpeFYqDcYjrU4lYgB7oYRg1IOm6BuCDYBAUlfLZQGkW69NFAt1IfaJ48oJ/JghUJt0kPrIZNBrYCVTGJEeftk8MVggkgTU/m+jxrjkViwNxSOlRrdVig9Pa6jh+gnoqnpOreF5VToGCKhV8Hi5zPgkYy1csVkg0FSHZTpqDf/bBijPO2DiR12bLrcXF13bo0RixY7W85JVsCosq5GaXLBDhdSwICf8KFZQdgb8ElIpVgS1HXDkgAw5MEOwFVl0vbLqVEr+SVCJBmnYBw9C4FNkBYxIdQE8GpdD94TQtw2Sy/emzOa+vNH+KOtoOcgfog3mYvGhVPHaD40GbxVTcEpwaqY1+AyacaMv12hshFed15eC/xRBOlROFAb9L9GfdG0PMSJmkqrJvvaiDo1BMsUsAkOAi/+8by9ePyd4zjwHCudCxn12v89x+HEqumtk0Gon1hfv/1x7YmEUznR7b80/Aoai80sjknw/Uk8Tccoox/CgZ7t0qfeL0rgSYQG6D0ep4jFkyic8I7SnYxPsylPGbssO5lPs7P7GLuAn03QoP5AYMjzE/UhSwyrfSEslOhrkIjMJYhLjSDwajhk1So9IHBaUHi8YdIHDQfTLNlK3W3rHS6N3qjtJt2gMZYB6tYeWgTHaAZnmfUvm9Nr4OavBfGTQD7XQM1s3V9H2Jocskvp3Wq3KOS6C8bFg6VmVEeOhv2XS9L9o+0/MQydxOjmnZ50zFia4BZjaXVjqFdXMAkTKp6SKeVn/K6EAcA+BCHPmGV7nhHP1m3vF+neg0WWu63G0srjQ1WNOPqcm5OG6oMQtK/NbF90QjZc4SAc5TWNgVwiC4GMKqWKv1qRExUGxlg74UcKeFJVHvPlveBRWEqJBbUFsCDbFbJuIyqG8tniZ2zGO7uto3wpmN3iqCyrBv4MSOwPimA4xJPgGhHPWcJ/p/BlRSsNhCSIHldoTKhKZUS0BSU8BWSSqobLEUSVAerMJXaTYTO+eTOx+Uv8S4NO040DHinU2lIVJIKQzihXwEZobaWqvQW8Psryz2ztyS6Gs1dOa53UNQezy1mYbCGrety4eSzNwjIN+Ob9OaJY6JjECqtmq9fn5Ey3a2cD0Ufk48n1jXvqr8g5V+pje6LHR13QqJ96rP66RfHdrGnHwJGD2N1rhMg7pZVndbqz2PTSqjEPgCDEMwvwVYRypgkHUy7KRy7P5NHI0lyR6YpQ+g3v41XxhVYOp1M4mTuZfGlCRlY251jOqMJXNgsA/7TklQATvJKchuRUMRVjEVwk4JNeXgoSOasleofG4uh1rWXq8Uepf6DEZV8DFP+qzI4DKfhF7adrIrtmzV6yAwd+/9ffzRUHC7R6kwq2mHVEHKKojIgN+so3KotAyEyb89hJJw7oJH316OdBaI1GLWQwqyThITFAdqLvEBefT3x0elRkamulRCcLhCVg00bbCvr+au457pujxC6QT6ponURyErYhuQ6qT5oheMg4Gy4Q8Wvm4PkjflqcFNikOh+obgqbq1pbQAEJrVMpo6icFh04zo58ZhfxEWq+plwumIyimrNGhbpgp2clHIfPC4KTxMXpjcTZS75/5vLloSySlqsRNODIqyzqExjyi1/IZC+LuUWG+ZWFrjxzUF8xrS7i0qKQlF9o2hUqcrHNFTqF0D2Jr9MhQYdCZ/bhXO308wuMPBmqA6fIY7WvrMZkVtbVqkzsHVRnnnd0gJovrZuWwvN5M8tclWgoWgeD95aW984ILc9gb2IyN7HREYjLCRudDoSZb7a9E+yHAWWZ0WWHTcyNLOZSJnMGk2bw+z6A37imNGXrnWYIdtkBEXmg8/WAGp5uZHIzqCLqzaFJM2plCn6Aopxri/zi5N51GTERZa1o2ney9D13UZPGm9YgGliLNJUKuwdVooNr0UNY50HTotPj2is0Nz8qMXVg5z33PyqTUqDJcubQnFnDPaPSlBi0RXRfXo+nyg1KgcCknPGfKkvmk9jPWZwbbPYNDusa2LXBJZs3Vwb4G1n/ZzD+z2Jfhu0vs3Y+pMGe7NEcZe7GXPpeejrzS13wipbxVRaadSYj80C77YE1kZXfLwGj/pSXzaif8RgqekgeT3YmjTpgSlPJ4LdjnemLYFhCJ1RLFVIoOmo6FaJkC6ng1q1DItiGqtX84wHp9HaiNRJFSK8UEB5pW1Rzs4ZFS/eYa0TyIKwsKveI50WJSssRtcqmn2euH2cp/xeJwSCRGvRmCXq9VKI3gL50s1Dq/EgCP2Tn/pKMludQcbbQy5u+ze/08JTMkC+UOeUwbvh72WXUJxP0kiX/si3/Fs47InP+RKC1I7FCd6K7MHYBlOZd8iJVzEvVSNOioB3rObrHreKkHuazENhiGeL9IV4LDoRf1p42rmBsvbGur9qybVFsUoZ3KOARd7r6nKLOID4EaqZXwGMCuKjT2ecSdwY8Q15/xsKYZVt137qtN8DdcrWHzbcxSTvzgkgT1oQE86zOtwpOdSFWKCCTD6UjYZMDTtD1OWfSk5Mi0AaBJwYnfVKXkJQdVojrYGteB9wUZPJtC4Pr5ft/xTaP3oyBdeVn56/7QZcBBoPieqATO2RgPgyow/YBO1CZjSYDJij+ghRs1eocoq/0xYv9wuTK62t/S258f1uCX3VAUfJvrtaLY4kYJwn+OtKUFVz7/o4ELDM5sWjs7qDxwKibKVVE8k2Vsw5xUf113VXdyetAQS62HdvAOhizDJ/BQgCElNadn6qqf85+wY6e+YG5MTcIA8x828R7jWDIM30ntrODMOQuVMtchi2TzDSCZkYkeBw7njo5uEYfn4y92WA8awnrgKW8S0Of6j+9LP9Nv6etJEHgdOSP2I/aRziljN8khh8KUGbuVSwlgfFxDrmR17WcJzAy2XCBxquhe+mURlVXB1BL+f1ux9qJtljffmI/MMb2z8U4ozn6Q5HeoNyOnToHyFKtM+ogUyMOzEVWfMCOIGf6DkE4fkwBUi5dzx3dOjc7STpHHLgXKW1lWItt03Y+nlXzevdOXBsxNiZGZHmnWHkf5nmLdYrJH8kOnUKnMh++epZrBuI/97Rhu2u2p2BIy0HCmFOxPWiOw4ySN9AKy7tmobtLOn5Fc4PZgm7ZK+4uMBt9/4DffngCXbfylFPVXOyD19gJTLTyDXWtbPUxC60NH+XB37JzfyWh0/KpOMsDyCGdvk6s/0tK12Uk8CmwrYEYClDSlfk/+qCeg30gYbt9GGlWQ6ADWfK+7EdOXFzJT9Z1LfUEPvW7+b79gyT1jdCZGPz3EDtmP2FbHs/qHUx0Hu+wEHO5sTXhiNLNJv13O3FsrpFBA8hc/gElzmXy1XupSbF59tR584nLsozp9d67alnFQ3Kv1To3i0adM15b88j98ThqeYZX0OU6vSrUILFaG6SqaoO2KFAqXxMhDokQs1WPlNhMqMus07x14UJakU5cp+24S4WyKUJq+ih09uAFG4k391qzZHzKhRMZ9DfjgbI6s670zGPu4y9W2Qhi4zECN+eqQbQF4Nm6iWDiUWRakDqeqKzVGQVcF7AT2Ad/hksN/uKy1PPCsJzv1l5+ZP7AX3ZVb2x5yRU9Ef85aD+lq8ht1+/tkzvY6xDO9pe+tk+6ielFS/dgdOzz11FfYNrVSWCAoJ7q/F6sohJgnso3fDzAIju0tVeoYUnwfig9cuAeIe3mJrfOTZ5YfknqAxu3Yy2YCJQP0jHEmTjj+tMnoB2I2BcmEokL7YAStivsILML0kDMuWqTh+6HqrKyQBMtpynm8XyFl/5GykEn/u71/lBeHgvQdEOlpddx/MXvOTlJL+I8QMfaQWGzKTtYrKN82Af+UZDaNT+QWF8X5yWEB8reer/bbZ+w6trSxAWa+XhiuBa4CUHyxamODrcGeF1DedL8O4mTijvp7v6Y2ppyPIEv16EngI5WDXHdiDvCMS692iMoUKQoayS8Ro1cYzLruO8h70XAwdUZzVq5YHqJxhRJtwTskbZ0bhYf+vhzV7ZSjIcK9HrzShJ7RoVEiFqu+kOaA127oKQv5jMseZ1t2LVirA4D6hT7gP2bdfbssqer3041nHFxDjv3se9sg80DzOUf5wrGiuUrVzIbMiri3bMFYbZ9pf3mzcZg27Rp61HAsxE7iB14HS4UeGBRkBxhB9KO1ToJoOiHj7xs8dGHKICHULUZVbGU6L0/0zNnU1DvbgA1q+c4o+sVCE7fmjcdu34LXKVHF3oOL3Q3x7V/kq+8M78tDiQf6yciGgUM6ZSwJvJorTLaEBLAEw2u+LhZkbHJu8GY/5/7fbE9XvdDsw6Z9twKISOiRwwIXoR+wPWDSHT/GqEDBsIAAKdyqtHJ2y6e2Bpl/Eb/NXpyK77PlJwtzkgC5qT38Clp8miNQlQdJM7+xyowHvN2osZ5Pg8Bz51h8jhiKlXMcdAsz2aytxUjxhLHDIexBCnexrkzkWRKUH7TaeHIiHB7nSdS3xZA7fH5N6okzYKGfG6HYIagAzyj4f5yZ6dUZimKvqKY84oLzBhbpvLkF9qlBHXm/3Io8z3kLGv+vu/Qt4MtF6f0hKEya2XQxfiufPXVp18NOrnfgaFjg966gANz1vm92LvEu9i7IHujzMdWGDtDc/7PoynPcvKKsialGlNKfSql1R1JpMTeltrqyoI0V6OLBIca53No4i42vehBRSo6xu3VqiwuTeL5v3vFJTGiegx+99ogk9nHto65e6OPwd6dAfgxR5ta12Dptuga2tQOZ+sGtTYTaiqKhF5lt1LoqRBoNEwmOlC8SgnsURghyTxJMBUKwzwKoQAyBVDmsU0GFERyrtnJ511Kl26DVr/h7Qq7dy6sCLbJXhYXv5TJlp+Vkb8k+4dMBtpaZRFRvMguW1yH5U52LqNS6530ySV18q/SJkpGld7iUmvE9FruzVJKHjftK8C/YMBdCMIZg9E9EdidUZSfxuOn5XNH8kUjgZgsuJEGYygGVwuHLniJjgpBGACp4RyyLP79y1ZV9P/UkjbyxX8oAvuTuHf8SyvNOg9YLvMpz11rK50+78Eery9Laws2PvN93qarY/S78bHoGN4mR1D5yR8KH5aMx55snMAyRK1HSIqkk/ufvQd7iAGfx0B07MR2Tgf6AWYJMaysAtIlS2X8+S4PwxbD2ums0q7V1mdz809KHZOMyMaWTdkBr+yL2MXpSdOQAShWeolulRG4S7w1gjfWnU4JRNasrfGfHm8M4tUe1oaNHijqmckz8PlyO7GdPRgbjsaGxX/XLwoDmay/F98vhRiHQt7Fn0t7ABA4MMtc4flT3oKf7ZkGpzSy7R7B7s7/p3UuKeknXWqY25b20gWXsprl+/FAQg/NK7UlvZEFv/6I/fir7zwvnCaoRk3ciOViNXPeQJL+mlKpUoSv5aH9SvqGfkC5rkYZ63RxpHCh6khJLOXGYQgggw3QuIHASwrg9NxF1845H784cIpXv8hHB5ifnqQ5/ziAnaU4F36u42H1i3VRjMeE5iPKsO7gOqysOs0vbWVEF4UxFuT6miwsskmEfspBcr+QMbZnG3arZrsSi5HTQC92N6jBWub+zLBNUhhsAIIvmIzOG8oL6ZVEC7u6o6A123XEq/cTnmUlVj5LeLXDVzUQqTpPDIyw+CwGWYOc+uiinqKl9B7W/ffejv5mvZALiMbxlF0a+gn76XJn3YtgUGaS8iyGpYYqkIq5x+rOYTH88a2ajc0Sz5KcHATyASbDEaQDe7ASklvK1Pzs1uHKSrthFFyRz9JXh3iFx/FlleAq6wplGLiiU9x7eSj6nPXcj2qPuCa90oWfVNj1EvG71pODYAjLxVZi5zCixV5Q3hxWEfT5dfXwSztu72XI3+0erbp43icV5WlvB+PwxgjeShgqaltOj/fXrF0TCYDpnrqpmqa/oBadJivjG06PVdvXrJ2sPj2h1hZEFKua8aYSIr3U6Xzvrl0e3unxsc5ZxCww8mf+heYslPx9wH7QzBuVufPxAX96VeL71gx3vQ27v/NG+/sQIPtnb7QxOMHdgGqe3ULNQqZrop6QJMpNJZLedGscf+fwATmP/LB2dSiK1V0ZEp8fxmKwmjgGIZzyZeM2/4a0dJ9S/gu2jiv1jOJ11ZMNVNjld6sSk+6ayqpHHXuU1+U2IEaIhOSee69T9MQeBpoSPbkuI/FaLVaPySEl91TzQL0mv1A7Cqd/AeASBBsrt5N2c7Hdk04c480Ubb+4J7oo+oL1ohlg2/usZ1vSqykB3Guv8zzf7O+llc49ygahcGaS55Bl38RNCLx5InAz4n7EcfuHn43sfsm/Yr3iaIq2ehRhTVCJDothRd2yE6cCL1kv21itDbJHjJqQO0tLZ7GUsouvlCe8uuicn5plZex+kJ7ZQeF6uSrUos7RW8qEbXQvw2bl1+xQJfXz9SdZU//3DCz79C8PzOgSbhEZpAw89crut7KeSNtsn1kav4QkxdJz0RT1PKvGGceHs+xZbNKjO5jw4HhGFutYYbn606oEDZ9DYs+9UNLMCzdxmzgxXgv31v4CSaeqqk4lXf+s9fo2/SxG//0VNDtUtGfjNzXf/KWeAeGH+R3L1I2UnMl0jVdTwIZNzCLe8mX8RjK9nJaQqr9JN+WBqbLt1J6ILAUyq6C8yKewWgvErFdl9/b88tItJoXof9tZdr6VXyYqM1iDfGSTNk2wuW5wive/p1PZJ9d/nnodFWWxWUrZvesB737LS2k2q7heLqUrIz2n16Xg1HQsqGSx42npOxOS3/reuHgvCxB8tsz1wEne96y04vs7UzNfkfMeZx/Hd4XeOTvLvQQ2z3jwiePJ3bfstXhx1aWAZ1PKIezZtIE1BzIybuycPcB8nSWwWzZemwapuVQag0pl0OLkv4824C/JdRuH5+biryA34C5o64rEusDt3mhXVVMXmLZgWVdpV1fY7XQ5AT8kQyCx2OOyvtRDAdnZcZRrcd0+AFC9lObZPGV8ClCkIbTC8VzXOebNz0UcmLPODttB3DftVko6iiFR9nMmPaEd8O8oz3z9PW+uFsg6JjQ+kLqGd2UHUgLvYvvEL95F09SPWZZyF2LmDMsfy/kBki424P+bwMVWYwoustRf4YVjHJP+2W1m+2mzI5hgAyM7iZkeMf2ivtuNZtGOc9MBnO2MzHycTjBvz9jMEmV2ujPOzN++TP2Lp2mmmZuusxnzZMiQIcNiiy22eG/zKzDqX1H9McVJ81P4nJLklI4lRVUpxvwkDgrvlPvDCsq2qDEwjAWsUA4dFL41PlLzbr+VOwdNMGICE7wEqnR3bJ6JRUxw51g7NbQ6Tqava4S5C3VAeMsy8wXEhsdMA2zpxDwQ8LSkS+HyKJz/JsZYNRy94fz8N8LaMpjMw4z3enMnAXqkGtHbZc+ZAO5f6Arh3ArhAWqbXMIU3dfFrz2Qw/3vhqnxbv4ksv4bqYKnTjwQZ8HuxlLy622QXy/Hx+vIaBtO1i88M9xuC6NtjwXwuvntf1TUgvtXhU9usGj9xjXG/oi5E3b+If/kYJzOHluvTXrPxUbIaK694Qt8XxusotlonDfeKb5DN8ZiTjqbsYmf1msBvn7WsQCbg4vBtddH6c9HURo/PTMsD8CpyZsPvfrqw3Xzcbne8KN3g8u+x/GL0kkwwBQ4fFigZJaNLuj8IQDbWI3o3fWJggnlVF2qIlWsSlSpKlOVqkk1qxbVqtpVh7kTdd7nAtONfxnTzchzzXn2m7sIYOuxcwH2P6/2RU0B+0t94PfyNoifBvgPBs8TMgNmSh7ZTbffT3wYgzxoquRYoOL59QuJ/YAUdSUPJ61OMHCjTJkoBaPchWO5nA+YXX6/6RQwHQ3tggAT4jEjuGESDXnAbPApZciuylRuNQyvAaVJsdumKvvpaIwzU5hOgQkaT5Kv6pgBCEqfh4h0Rjv+10AH/iZqwqC7JJgb8fBWVMN7cRY2sp4vuRcd4xTYGN0f9shR5fPjxTZw7+khPoE2sMUvAGhB1fJZEmuixv3shaXZKwTkh90P4YTt4XoS3uH0AoURsUI7CFWUwwZKaLQ3x1lox4LpMo6hR0ldhri1g3A1ewudrqtryCgsAiqT4TMIeo9jiIAnb+xCx0EJLRNLhNT2pKTbR2A6eMrukNzaEFbplEIzB85TifXlkEII8pgSlOM8Seo40ek9oLMM4UtHgyPSh4NcAe4cYANMh/c765OsSMwFLJfZeMsxD2j9vZLv3F51Wg2aOis7fOn2wxFnjoP8CDw6wAZohPfOQyJHxPzDHuxsSA1PEPZ8AykTBZS+YCza/F+cQDQhFQOnMiF1VvEhprgcbwgR1RZGwlq4Cj9JlC3sJHsor+Sz/JUpgpEUumS3ll9z9xMaiqcslJPyVrPFEvE7qUnRyWH5OuWhI1KtqV41T61QG9W5NJsiTFelm9OL9Lf0KAWjEqksqqrVs0ctmRacPehQenHuhLuUu517kruwb1HCYmy+33t/Ge/jS/yMX/CnhLxVPiOXyPfkn2r1jLKqT42oRer04zuFpwozT3+EPz/IX+bBS0W3kQkSJV+QVfKA7FPmZR11Ug/9hP6O/pcJGAH2BTvk11/r4xFe4mfumPulm/MuXfnQ+5n3tXfO/vq/8H/j/9E/bOUzUzLVmc2ZpyYmTmRMlEw8nhWXdSnrjSxuljirOmtV1iDZQK4gN5M7yYvI68g7yUfIH5Kvk78mvyH/SRlBYVMkFDOFoEyjLKdso/RR+infZadmu7Kbs7dkP6caqBXU+dQV1GfUN9R/aUk0Bo1Cy6MV0uQ0Pe2bHGoOO0eQo8jR50zJ6cs5n3Mt5z5dRTfSH9EHcytyf2E4GZeZKuatPGfeH6zbbA57GnuQ/TMnlVPMqeCEOYs4/+Hs5Bx58Kr6gxvm3s5X56/O/zj/ev7T/O9543gYL8xbwjvAu8ofx6fzYf5M/pM7/z5RUFNwq+BV4YrCz4pyiqYUrSnqLTpWdKHotsBTTBXCwg+EV4W/iUpFdaI20RLRB6Jbon/FE8Ql4qnivyVUiVWySHJXSpUKpCbpdOke6c8ynswvWyA7L7squy37V66Wm+QN8s3yXfIr8h8UYxTvKDAFoTikdKjiVDdUXtVC1WV1ifpbjVOzVDOgTda+qy3TLtAe1Q5A6RAV0kK1UAv0p24XvBA+CP+MaJHn+lb9C8MHhqeGn4xUo9JoNnqNUeNy4xXjfeNwhmSym7ymoKnW1GKaaZpn6jKtNZ0z3TA9NL1Gx6MStBV9B92NfoReQ++gX6HP0dfoH+Y4cxwMzr8RAm6xTUzQByXgAQB+FvW9uvZ+Z9eucwQRV75tgFD8uJ2wpL1alL50QH9lOym7l2UB8mkWV75PAAofnvzt7b+9L8NYgAKqrjVBg3ZSjkDE05kVBbSQ1saYAyIcwleCwFx980RPbhf29cS+p7Vu58HWr0DN4c8HNfVqXAnbe/KwWCgPgbmPm3c+B+MxOPuffjQI8QgJwFTmjRbsrohNS5QRQh6v62UkPBydRX7cGpyOsPeiAKmzo1QupqZyxfFpmaPX3HTe8FAxmRI4iQLl31sVQqE42iqpFyHL4oAxIg6fmqh4QIvze9qiM3Km70aqrGztnoxqaf/gwX5oDnzAd2hzyhQV6utGTN7azyS62Oxl5pOQSN6CT20nCqwJO5S59a3nDNty30lPETWAq0FXGBIohLzrSjA3P+90vgb4dNGw/kaS6Ff7RLqU1HFviLkSb9tp/a3QKhtQgIs4rmQsm20jiieJibylc1fSq2Ya4x7exhdErQZJJNSi9qvruBIRpGYUYLTys4Cv8xDsVWiJZXAEJ743YXRz4lsrqsFUL9G73FrEEIMd+cEWnhm9aXIVR2JhktaPljaLIFu1SguswKpwaFkPJD+heyD1IZ0cKUL0hL2UKQNiaxcRjiHlT5+gGPbJllfNulc9O7YnXFmAfzGi1GKdk3KB4TpavzyR1g84gMOs+qdy07w9Eg+Uaru4uRxr7vWAjdhpRS8zOarH/bXeldix/+A3IN5U6oc/pS7Fu817X65oYCJmSirVpqoGXt6tTD5//BSsXFc5SdrwN9u/gTAQ3uyAAHZfjK48KZttoS8rFaRv1whqfMQZ4GpovbjrJDA/1r9NqVy0+ZvxbYdPoMpcS9XuzuHO7it4z9AC5c8P7jy+c5Chx7NYCf0fqLBA6y6s/v8D4Su/AfGa0L2Iit/yFfjq60xjowRp9ocMKo7wy/aY8Z88uFiORDxfUm3KXtk8W948/TxIrxxuG9w6mO+W7lElZc0XS0uR9JdAiop1ANLyhjCzBvaOO0y7XRoLISnA9xzNW+xYvfDDOKhc/edWB/3LAoVFhzbLYb2vT9YXUBE1ywXmZDcfZFfYA1M3H4uXeA5Mgi9yawoLw9haHGJKRfrEEX8mLwuC7FAD12qwNAQ7Fcqdf3jFySLsdc8fBJt8X+aFC8zrH31/zLJ78+3wzwdksuA4ea1Ph9URIvngutXDDQj3J3ZKE1mlCIrx9ifi1aWY4X/1+923/1kZAFPgl1QY313XKxuRQ/7sZDy5rx7YLYhwZ2ffgC9e0nv2PzrsB10sb1H48EHjdGJMIpHoVm3TGawn/wNA9PyZRlVFT+bS/G7xSO9iyamC/5oBVeWeBX7/pmU9yEceuMvKMFH2LadtFtJjTauGut5n+L+JndWLmp6FA/vDBNLGjWKyDrEcSzD6PhRD/jitxRtAhGWDAnXtCG76hBvCDj17syrKEAugwKcX7KJmdASJrf76LuyG0aUOySXH7sRDPcVlocY1IBon9GaoZDxQFKKyDMfe7y3fdxL4mWI3gndU54bxiNS6A7OEyc1F+oPemhzxB8Zd9dvoYf+HXjE0QmYnNnAxB5bwfjchEJXISMRe3OVOhwmyUHWey8ukHbpxveIeeCdrWtImCxvKsfy4tf05uCP92+O8aCvSfA12sWGCzOi6Tiv1E8E+z25EOti3nwi1iZn6MUh1ccS5lqsLvzwwiSL/IomXWLn/XPXk1SRpbHIkMsD4EJ1mAmyxLSgdoXBNwaXsFCjgWnhuORX4CrsmQhgj6IDhN5eDq/ViVDP0cVb282Qi8zUMHNBJhnkf1/Iv5QoLk+/ocG6cCv830kJABITV2Q+8iEpo5xTdbAl3A+3mRrzgEGLciNZNS0xRspMVijWrbggmrDVF+LCNcH3CoQR5+R2C+wNj5uMV59ktIlBF3c31GEj+PxRCmS1RiwRmJQnREFIzFESVsQYcuq447FtSLOs76loEO7Bzji3rOjpkxEEJP116Fbi5eGLoY2vgqRorZd56C4MAXKoXPKoY/zC8+aqOCDn+NfxM6oDlhD1/ZSLSKSM6wesAkdv3WlsiJEKS54mgOfefG3nhTxGShto3cgqko/yYL8P/0rfoyGN42By7A0E0SPK00ulRQDDyrJKQxCWPIDJIhsQDbbw+KU1n0qVlTnyEnM7L9ydP4heLI+eXsZ3Plsjp8k0Zw1Yp5sO1wM5aJS8lHc3hAPtJyBYeEG9aO1Lc2brhaWyoqsIBHdGzQmKx34NGHPplPmmA5atwfT79F4u/SA6MwdiqhDAzNODmhV2gA6+wzVgiU7hHUqxYghivqeQboP0BC3hQpQqsF2brUYd6hPDHqulW9Qs0QKMwnFuDJSGxxekjBwR26pmoYEU8/TYs0Q90LTU04Zs9vnoa5/E/20t0hq/NhVkQ/HrfI+g6UYZimhodblMCSSYPoR51dei0xBSsOcBeqcMRO/Py0e5XJvRvH7jGxOfNveXw6UzlaK7E/TKlBIggC3fVcJSMnOR7Az525sQj63N8bv2R5fzXb5fC3H75vbExPvnbm6sW9JvGWKvNe7ZdpHJmh4c8/pzrymIYPBUScKtyv1etmWegW2XZaTu17N44lL3PSlaBzLr/fljFP8x9TEDyawsC06oz3dU/rXbXc8BWveh2Wp3OmR4YgMFuU43RFzOXQGo6GXV8ju0ZWNWcYA/MKnmYf37qQJDj/6gx9hTdRf5hyVWsvIDN4m6RK9suhAjr6Sdi/3Za/fcLcHDYYf+nfy5/Mjn7bR+AL352B2JwROvQtE0FFLnwUrA/sE1TSnpQdA37QUDk0mHgFdCimzZ7SC/9JoQnfPCohdRhGVmhm9zCZ8Mvzr1Xk76D02lBIIr8X8Dvm1JIxOP9gOfFbdkD1epeNvUn/r0hXr29U23dcsQ6N+wGA5XGjS0srKuvdk7NpGBXg994BrAEFuTqGUUKbIZNz0u1H19NU27nskRHoUhOBCRKwddBfGUm2goB74ZkN6nMDBmi4YZr1hPiWrS50NxgFQIr/6Q1QyTVSRG8D6kJKnvf96pGBUSxmYMqJBHe1bNz2mJYbt+801FXXiaMSGQcG/kb2FnpZtYqo1VgUL7FZI2NbtoTiD3fYLiQkQNFcFMfrFg0YOhXpj+blktiLnQGhBDItp3i9vm0kUSTiatiD4ST2iydWUMXYR4ICcypnjg6Axe1SDy903dT/zzzawgGYdnevqWqycHmaDq3Hznmulwht6TUIQXvD15pm7lZXGEoGMuObVvRIYMkbtY1p9OBDwcE9wYziubHoT/Mw2oc0h5Ng8Ltm1BUhKdLQTGjVrwAbjGmps5wpcFxOYb9h3ONIFn9aLkgDDzBK728EYSNdDV5MWxTZdLoDGlaLZ2D0KuYRgRtPPS0WsWKrGTIsH4pi14k1yuyPw3vqkH2z2hqiac1TwL1EhlHlQrxrkWqYysdbIxRsKtnyIXc/OXT0vP8YomoV7JvjK1IlapuO6i5os34BvexOc61rkzeRDoXllz16naD2s/Hrc2zto2LIttNEgePY8QV9ZFzJ6sLSyvpXPa5zUxSFUUqP8VgrD28IcNrZKeywg4wfOgQ3PNNmliE9DQmH/mBnHJ08f6thYJcPNsLPWauZb1rsJAM+EXZbHMUwQ3S2i8gE3KylSAV2patdVU8t5CmVFMtn7H3b9jgpxohwz4V+TJslvBu+yqL245LQOzc+F5RyGy1wMOCjYe8Jh9P7dBFuMJRYReSrgqNfSlsDph7qqKxasc4xOKDm+oX0mMjSeraRUXOU/Duac7OC5+Va3HA2FcEp0tVcSCNy7v5Y7kdT6p38A1hFBKNv3uNY3kvdL2q5muFrQ4Z2BWoo2QJRwVP8UwtvuebfZozVBK3Q0vbRZaVxdqIbkIM53l/Uo2FQ4F1W1cxTmPBu7HdhV2HyE4Lp3gqjNG6vH2DtjV5pSWENtuCWSqGexubSWVxh1kfNRjtQzZA3B7Gb1EsK3Xkz2AO5o4GY8g1hssHpUIHIhMdLz3kjnSyCK4zO0330IPMnb3Gp6neEt+uAmXAdSVzviri7v8y3HjKG1qXKMO5xLSQBqmOM82/Ay6fgJAoIoZtJm0jWb7jHGJtzJlXnKiZVHxnVFTdzOmjpriYTGXko64CW6QjiwOr1JHr7MUGnm3w1xKm0kXO0E0d5K4YiZx0+bGtvdx0aPUxCEwqdyFqtjEmWqthP4AeXIO8g7jdyuPhBU9k7cOqkwWwAgttJEF28whxg0HZJgdh4rAI7IRN6bFuUMRGjth5G65GwymOVq2YBT7p0Y14bl7zXmNsGkTBVCidcq6WKRl+kklAFVXtWhyX8CX36wdgYq278FNbx33Xp2AVASlOYghx/+o4z8SfK0/hc8sYdEHXEZlLGikgu4eIeVmQ+tYMOx/UchzGz2NBHxNvFJzTV9RaQTkLi+t/+Qbbmsr+LlmBuq8YW4a5Ne3sMJYMsMNdm1LWOfUf9RXyHYg8cddecQf6SL8IUu+mzNZKX9jOStosMt59UJvMEE9wYjO16KEqOc5QKIVrj7JPz8w9CyuUMEE4RLZwqPlXtmxbNrd4tLwujL4qI9ETTjVJobNFCbDecWDHuCmiaMcfS9D0rdLCKZIajVC0rNPqMGBV1BgGsQ29OJLnNnYwBdrjkliVaMSFqlgsVHQ8liE2MqdPJaiIVvFOQdLJzH+UiASLmLl9Weimq+SbOOObKAs+4xwNZ3yarbgSroaarEs4IAgGhxi4IiRDgCpP4ctGDzU1VpR0PASu8TiUpZc3Kaozs37R2X18Oba3685g/GpjmOyFSXoGJG8UCiE8M1Hc3BMxNXZrYzMxWrMwcvrOYiRtbzv4U0kvFo8WC/4oW5g+LM/a8Q03Gwt8MK+Xo+D/S5aSigfeSx9OlHXw+WPQOuw7+qYFFWP1OtCO27WE+9h6ADwJJchZid3JBrwLf9ZqyUWmrVFiOTSSqxqExN0gB7zg8yaBqeaUbea5XkiFGVnMrCikPa+vWyb4rWLUcz63mfTQKfG4NWCc6t4XT0BGIU2kFCBvTppFIfe4N5Y1Bz8XToHifJIKpXnFmKkqtwUn8RJrpR4jDLUGp49noMDdsm+6V4pv2E/rslnLwpvts//G5L1KeWE5Djdnus2XGQBrpiDIyIslbcdtdmxaRofUNsoyq6FgtmqCrtIfur9iKp75KJlUN18XV6sdM1k8NaZfL7vzjUh1bWWHtGgLlJIP2IzRB3EUjyPXPfSjwTCmE/2Kw1POjaRQSM5KGjJKu5M9a6Fn/Tilefto6BxWC8SVLskj81EjDemIFcHSZhPKZ3Xj6YULQm4aqX6M6ukLPrXjYCdJXBuP3lQGZWrmKrhHCdzgDSkiOjgv24gucrLVEXvVVfoewb1FWetp2iAIaielmtYjxFxfvxTQM2xSx3V+sA3m8jpKn36sQd5ryfGwYTg1ymIuuNBjrjyOOwGdqhI6B4Kok6r44tUnO27m+3G1nhoPi9+sLsBDhaoiaTuebVx4PVwVMiDD++wBFVL+H3LTizJU2PPPSyrVGzI4fjwoT0zisZLH5yPruovIRQLRHsSvtICVxgdopleSKEJKVbUl2FCueR/1RUypPcuHiTis6Wof+FbhAOHVpNTJzflXgjuGF/RqhrAMWH2uK4dXR4k0m1HKOBo4mnwYT56fUsn5+71F2NLDziech1J3eJEoBamxVNFaYCErEg5O6diyRKEobdB7mLNIC6wo4c+yxtRm3FgiMVOLLpY+OFTj4IYextQ03ydjMy0roCMuLOtaGMurs6UIGrmqiSNDG3I4ZlFOeVxlor8vSCYpi/toBbbw2FkkthZTE3M02qWoyIyAd81+zoXjCVW5Xa/2+7DXEqCG1DZ6BgTn3Xgu+dIaNUb1MOzAiLFR90HOdw4n4JZNNpjjfdR+q0LLLP6pwJ83VoAryzAGpUgzeCAM1lxjJ+lqceDNr2zpYf9WvttQCet70V7O8AIrj9hrmAf1iy5YjP4o6ZXoAQ1N/XE52V+MKZTme9j8Iqu2U3n4rVjSG6LoROXfPqmerYtPad09pel/BC/wsjcwend9JOqWYX64NLMTIYv1abOklQBZHPeUrroa0jgXlPORZPsOVY2bgMBstfE/rQJUCElmW++ojI3vP5qOpoN7Ms/fjLzhKjKc/zMReaOkkD//V8L+65Wvxp271FZggxyiQSx9OljaKMpAddukO6Bk7iyCLyFBss3tlcMdEzeVHRKbhKw3CIj14RnXASH+ezvyfi2BWaaFr6pFwuPCQ8ud5YceyUGmk7/qipdit3Uq0AEdPTaqtxvqDIKLZo+9g2hP8YgJ5sXv4tAghw9MymD46mn2BO1ekG4RGsdHXoksgjZ0twc+AP9IX9/H1b9/AD77FYg377zaY1j8mq/AT1+/gkgcxjiGBbVwOrEyGmSEAAiKxKHmwePRBJIjZOyFyuXUwtRAioURigA5TibCRw0t4MqH5RmYOR47Nt/P7A1Cj7AhiLsBCOPj4FDQ9ppHPSEJZRkgOoSyJwcqq7LybwCJ2Do5tWMCNjwKVGuhb7Topdaj9xUzDYh0FXBNoTdYL+/xAUJdCe8QEgkWjqPfx8Qgw8AegUoyrvonBp9Mvg16gSKQguNvOBWUm4HI4WhGLTepyOchFfs+mwFRIQXSOusZL8SDgJ1nK0WGz42AiXag0xh5jO7WVP1PEaDzOJ+NC7L4K6D0QZHiTi5Eh+/gEDJ374Lx+ZP7rx+w4sspoYFgoEqAkycOu7MzNq+OV8YVH8gG7kYuAFqX9uCF0Dy3rHQvm/3ffnIC/wdK/S5R/gu49C3vnC8DW86DXQG4OmYzyh+n5kDTeKuvXXI4xYCd6PHfV2Yixe9DtZjXJYNAM0NTTbRTd/hq0pwN7PhmyIb85kG9PmA8B/JqUk7/IcPY4zyaonv+7j1tifPI4xQi5X5INRrwB39rU9BhUIc7O2y9kAzqXoLC1hIxynAU2lz5tOgHpDDLzheVe3PyxVpu9ghTmvvehutNfVKD9+msU+o3cqazgV7EI1MzSrUThkiHyG2caFvYBPfuXkctf98XzNfR6nEO8IkYrJ6AhtiEIFpdYnfA90Ylf7JInwveRZQOn1MaiO+oILZifpqzruPwOQgEYb2dKZmFazMp3FImhLH6u6uijdkxTdcDN8dXlBPR+t7AaZQpv1dWIXfWtqnqCkIWqZSrHXij0Eaiw2+kXXqL7DzZtXa9OOFxHNAiWom5bDOWdcKBSO//rzwsVYvPzwQje2+aJkSiVvEg0El+e1L2WQOutghRaHDyTB+im7pFCJMHiyZtljLQeE+E8VgfYzmUoZjRvLx5WRqGOAwIHrYDS+JBvNp2rkQ98S0r4G+em9gNqWsPYPSuWrkl1EpdBnmIhXbOxwKsJuKCJFDBKmCvzVHYx2WxR9kS3xLfHxk86ZmX3WbOVFG+wj168/59/O/rAtW4mk3XKIYVzufaBed0GN+GnKlALoA/W65sM/uwhRkXw1Rl/e1iSZuvFs4a4w1IXdlU97KMyViJluADxOJQ16bqDQ5wLYxgQlYRZZQ7BOkaftQZtsn1iYj6km1JT1gIToN/78Nm+A9IiaAZ8FEc5g9bQdLUKPLVqrFZplje7lFXr0PZjksWRFaB9XzFEncS7kfBTU5pwwWXxZ2rqmS+ANBvDfckE/v2XCXp3kDWQVShhmUKF7I1cwKu52vw/VVTazSfExCoeLoQCMJszrk4M8HBRwtCsQ9Ciequzy3dsu6Zrmsa/IJ5l82QGZ3gcEq3xvFqCP9WAlwmIviiKE+6vXyCz+ClbvF2+odIN0P7BhoEjuCIItu4TLwkmOJ8qVtTWi3CD/6cWgq9sXFd+Rn4VoTATqk6nSzGmpNkzINFeSq5NE4VldPdrOpOpbaSwLSYku5592lKuVMierSPbQbB7gm4GbVJpDxPJbxruZqx7z2Yyiwl0LwJDvGqFLQX7eK7u3w2OVQOlK58wXnN/DtPjY8NLKSeMlOpinlCiNxcnGzUFBU7vkgPqUobqYABBSienE3v2gseLuGbaYwCDGkFNgTO2TysalPLOysGNbRyKg3essqw7hVv+t53QhklZBMXp9ZVI24EqXOqk4OyiTidKTOXeZDeYXT+4dKCHk2vUSctwpJeusJmm6ZXXw294tkujJESx5jS9EnFMKpVSnYmDaDcdWT5KO/hNEdOn4YhhZ5rL9mlRHfu5vilvUE+uIBHNgtIjZaZx7IF47mmzRBrHojYCoKoFqkL1BXm5teXx7d9f89JgR6TkLovV6VeJXe9HRMT+85kLJqAHutWAhk4hD/QD6Kw8JTJ8QygD0YCacKSXaErYmtjtFoLhCS6oxsvAr0ymdxxV8jcKmZSFiR/fTLVTbJSKFuBxCz0pywe7VWPdI1Pn5x1JeFtvpoh1hXdr6KvW2QH5sz6BvMadgmIAbEmAE2DXMV7lcqQNZV3vVqpj9ebavqlFXYcVaZVq8NUNxJiZQUsFFriYfi2Pt2j2DQB+y1ChijkevNMMQ+ID81XmhAQAnzwlC9H6cm4Akw1twzbvYjCw05oG56KIxaMGRb6Uh9ypwc+8EoqjK55ueQsTDQQenpqe8HYEEXhw4Y5WtIYmNOwHRN6sD69KvnAViyGIeEmKsQBx5Op2OWQrEPN320Ws9MYmu/i0XX3ON3KrVBqOs7A9jdNorBpnI5yYTQt4v8L+CVjtlRxm6Hz9NwHpvnI90AhELZM0qDbVIXtPvb2c5RLjMshJ19Q3W8Zh0GUd8L7vqT4uL9rlreDV1w5R3bPZEoZyM3/MNmu719OcfMmVAz42RlFqp17WgM4TqB9lrkdeVoLQZnwCRRG3OhE1RnnzEMcaSbEJ44fdsiVNREUWjLIleE0+zZsKIVDlld4o26OHQ9Vz94gKl9f07La0EiiEj30ZthNtS8jRtVaa42jgL2/a9+I3Fi6rDUEQBAeYiSkB/4hnr9Wm7lfkX7KV7g1xmjhEr83g0sBe4ma90D5YjQqKQZRmOzpWO6xommI+FE2XGaR0zc1XMJDeGJK4jcjRpHHBIHkLN3w9+JMQNcUkEpCpFZkSnQSrYAIRGsFFD2+FZugjbTZvaMJb3dg3JLK/ZZm849kTraDgOAOJV6qVAgLIZgkBVNYoQ1a9/Km4/PH9Uh3pnjabpQPH696JSRrkKXj7pdhF2C/V/Ty+YseCq0Rm4kWr0fjJ2JKM1ZxzDYPXHMGnTNk6/s7w50m2N0OkLDtDvQpjLYzaPS4rLQxqCrPGC+ftbgBubLWi6vaB4OJlVNw+6FYzK5oRDGSPArVv5rrWklVLNn54hsbrqS0O2rM2aOF6gQInHw7Hp29DlxOB2+N67YSZpeV0vNqlpd7qnZJkZ2zxB5OjfWBpVx0ayf/NXKuczocRyK0QvMeAdDl7SsttLoe+vG8PFUMuWB2JGp/x3ldjlvSjB/0KuuRoSNNEskF7mow/HKRuJkcQ8F7zqPDOtmUoFDaGOuLM4FiW36zIC0NFgz0KZYjkSZJr2ipC4oM/HK6li8eVZOhE0R73OVNqMF7PNQzD71KNknC341SudtvQC5bgAmY5UiqtR4OO52KezO66yxirAvXWicJbdj3RBpBUutY3VnKtNGw/XWkFVWGTDB6gj96S/TBpGw/9jjxcVPMQ1lrPrB7YVslsSu+bsl+lYiVe7Ew4bkwC+7lddb8gPtRnClTtWPdLBrr8mNto496J/73PzD4OChthH3iWOWL7ahgDiUqzLxCqRRvt6HYMhV7VMRMsqNYFfxXHKXmD03D0IHFvU0FrLLtkXlZnhOiq460ML15uCdJzduwXh5jZT/lUwGuQFDiUnDEDQ+kGHjESi50MZvYGtDTKDKJFDX1g7woOyk2m+eVpYdxwQkEYr1NCMdeHFGqtYvmpx7FGb9waBNqwW+0KOdCYzo/LihEpa4dPJQRU94Mm86haKNQs/JgzlzZpG6a1aPC80NEuEFQeBQ1KgXA/JRPr6RlkbmDfeILMZsVtfy58ksVG5ZmPxxl8QRRR1WhZG4idM+2FzNdr0vcBbiII0EBR4VhO79izmbuA/aB4jSAD17uBpwDuKejpbguPmjkmXKtO9G4xS68B1i34IJ3Dv2H7ZV5+6zvelFXNmbHA+mPN1ojcVmouuZQYbUbng+le8Qfy78Pw3kO5yb8Ub7VdgpgYAYwrQQIyoh+tx4cX8l+Glbg443m7+4nrv4TcICzJH9s+kObP8bRoevD+/33pdvVFfS34b/cfuHm6KJrvhJ8ScwtTrY8vOObkGC6hun3Hj5cWkXffvQv4RdvPreC0rbp1xZ47CXIhUt2XAZ7wJX8mry4P6vE/p9c7ouOLHeX2fuP+jWJ/5N8SfmqFEc8wAGtl93nRfHOD9eVeSxVe7/nWn8lq/8yHK4qLhL8bn5XUUeKuduckDFa/UbgqZpyjfNncTRTQeDWPsbdmg0EViAP2tpii1fiMu73f5N3IXMRVe4GBqD7hkpHu9l+h/HZedl94yyPiwzYSqvFhSrODv9KpvFP6npF5P7NyMjWkZkZce/W7T29tPe3H8pZHwV+kQMN0STmb6wM6d8R5bXIveZ1r5RV/VQf3rkFSMfbtnXDMHH/9p2dH+8PC6kHbsihRRJv6Kw9/rSg+zXtzl3TZWpVMYucxeWTqrElUvxMDUoGgm/3fn52OLJ0yWIMW9i5bMVhqUR6fduhkydOHt553LnRd6pvhx7p4xdkmVHniv46sHYx97WIuWxejoM/a4kfYw8EBqlYuftkTjfHlTmawVVaBsGVLADWBA//ANWPcsjPH0VGyOJrQxzC+x+g+s+X/qY/efgXcHDz7rhV4lisIICAkcRoUedTA+0oVUb1OjMuOqWmugFLKFJTuzlDvT8UBNhYznlPUWXNUDhnoRX4Pi0Ou6oqhah8S3TTDj1ItVY07RY4Pehw8N8CrQKDos2qiEsViVHodC42nLhF2wjiWaKQeuROPMmykhJlmbjb0ca0NPJJqIcEHNEsRg2GEyGoCr4/dTHWbgUKGAn46IvvC1BZHC7OpaCISxaI0UDNehMirCo5Q+XCs6Zddjl8hc7mkXwfrtfimyn/4OUG7Ib5yXLDBKxlcmFnfA77Vt3sIMiVNhsb7ynN5+3gk7SD8T1jH6xbeOG98kU8eFnAa9rXEE08GhQu19qFSkVthSqzwRnOYaulsLV7b3iNGvy1w+S44x71qElu07YLUlWj/Nbu7xT8wCPvnXyrdGX/u15vRARkIHuwr5oM4TkbLOpxTH2B7Dg/J5TFRhUqAE+oy0s915if/KQbQQVX5+TBb8sYVsCyBq1It2piZS/rVTk9dvuulqncVCXfdWi98cNQ6Mp2RnePc1vtuQmJIptq+9PWwJTPow35afdi0mqfxg0VOOg+qU9Y8+DwnX00d4UvEAW8I37RsGoUI3ox4epdOEtp6vdGj23Y+OyUAgSn/NEGGQjWRiDm8Va/96dx65DYE2D7xFqNFCVOgpTmRtgO/36TXdOZlo7k8z4T2+F8WEPQvBzjR4uyBaiRprtCRIm4Ret5dx+7e34Glhd+Y5SbiZP4Mqi9erMHFgdiDGVQ+WewAIv7gHOeY22Zc1LtSQImdwJWPSQ9Q3uR9ZIJ2mnPInlJDxffCrjWeo0bvX20iNnXdSgndOCh1w0hcRKo4Vvi1eDCPPHjonCIJznSsze5erE+YbmL5u8F3OBtZ8lQciufOteRWSeBJH2VLVv8FgNNwGQj4PhW4HjajXNsnBtmp8NmWcyRKYy1cJyJIEzqRiO5XjO3zVrAXQD7IogGuvQG+AOs246ABzOGVMig7g0bPmBhz8dv1bCakKiv3SLQPznBjN6E3Yo0IWAWVken13zf7F19e6Ir6vbpgbdmh0lkaKv5QfXhJIQi+6GghnZgNeqP/xVL132FoHVZN67AZUhR7v/UNoCvnuEYQfjYAiOouHg4dIR3nYEJW+VrdIGUTYNWrfo300n0QqP1t7ZiKDjKWlJH604eOzM86mCO+tFSEj0CPuJzVWOW843EIpfMBm0Fns7fwTFXESn48RFnV5PBRSoKGwJm5TGbdsUXLkhsjtYPxeCzFlQtDRu1QcigKF5sY0A7ByNirYmPQdODJj4+o0PVqXqssEMQ9SCc4zvLqxnAVL62cW3ZtNpUX8hgWXxpzVZq8Uy/s5w4Ec4axT7ZKNQm1qJEOwhEIXvOHTcv0FGcWRlGy3HaWgQJKf3I6oKG6yO/JtnInBki5tbTvM22GfDc3DtL0/V9yqi+3znkB5kM0i09PQRbPF/V1jztE0m9EgPdRNSmN9lpq61MpBjEtMestPuu5ORYh4G21MdJj6dfxx2+iZotT/kxLcZpjTpZwx+cvHyEW0Md1J0Tmoi18VnQJm+JuUrxt1VgWdPp2oG60jWXjd2Oz+KW2hqKSBZW7Gh3112jW0FOToAlDkqh1GMIXbWF2KoaEHLufXeuQlnbqhb5rWvMiD81XbWmmo8wA4UYFZXKzUxk01lWNemfFZ21ERbFF7HhSrPiroaRBuyqLGPycCgELH0SxcbfTrBxLU2JQWGUN8poXoWwKRLU85SpUBZH0dC8LEybBhvMa4tXdb+VoZmu3If0vOcWj//3Svbnc+mslCLma5yddHExlfXlDBsFWphHRxMRzt0jn9W8ybE5Ek1OfY4TAKkLUONHwPnAPJmPzOnzrgfMGllj/mko+kUvIJvxpEAWGE3bMud+v12GjS25jh0h4SalJlmiH8brOoHWGVxCjbBEYu3ryBAJk5RqHRAxiBGXwzWejPWaT491CtyYEjpFcFMbUYYotECbTymkWEJ5ftPlNyFtBqMNQCIKIsA8Kh9TdKFNpOz0hnwKH5zSOsX1zWAjAdLR/Sj15Nf+j7bVps820cWVehZntMT93eRao6vPzZbTJs6fNGbwOTq7MF+I/v6x6Kh/1DIHbSFKBhs9QJktZsJN+GdezBttygmdm/DdbIT7zAv3UV9aMA8huIzQCG/JkjHUaoI4SKcQ724WsyG3I1NK2HfG9s/WqYXAFOQ7nd3uyK5anueK23dQvvoVaJb72QJnwhgeKIZrlmZFUdmybkRnDHu2gdWsR/gxIAmo/mpfnftA1Lm6R5l5FmfXsEL0okb3aJwe+seVsiL+m1M0rf9M9MDUWdaiDYC6T10iWXTzMd1NypWXbPV1HCm2EWf+vhXa3fU26WF1+7sDfWp4jIRVED6ySHD9DYbfe+RRBjyAwR8KeG33LcEx3ri5t3ujbmAXOluP0SvXvy70nCz2yhDvMxTW4t+6hmv22tWs6HT1ZBB8SkCM8G9NMO+RmArQBu08KtWmTBPnQiD3Ng5sng/Xy4OtaEw1Z/WT/QpYwDIyN5NmvoHzW6rI1uDMq/BHcHf9oOUqluALfrdku6RvZfDybNeBymwbgDOe0OStWy+sxnkhf3ArBv6z8kr++A1IKyUu1EDwX4rzkGvN3q+5hNzfch2C5I8uOX3a1Imy0jhRhsA699ZPaFRrn9OgsCqv+GqKMYMkkkPMXayIJkIgSEOolOhqRWmY9pywp2Dmviy7HFm1kqoiRKSpUlEyb12BcTZ6cJRAkFYVCekAZEVmhxIo8rgKcp75z415LfBcxtzro6RD7PHoxsAa8fw0Uhqw5v3dkokEc6oCUTeW6gQjnyvsokJSzmrpkVLD/VaBFb0RTadHQWimdUc2o26vGuuTQRtcfdBRURQrZL1frhUHwi1RdHkv3KHM6z/8VRY8RRpGioCW+WJleTM+SrZ4Hu6yFxdPboziXU6sOLYQKHw4fnCz3KS40/Ml+0AOZNuXXU2yoHSWbUjrKQ7Bj13NVw9yy3SGyZJoHM5P8DD2oc1nFYpH1rmbm7feHtYZETQRPWrrVbogG2STFNjoBgxe03XIaXWZzPeq0rnZNFGtAvzjGuuzAvIzpCEjPVRrFtnh/VqsxRwVyzecysYlXvrsnPM9xoP3YvgHA+s/6GyNp2gy5skruzpEnZiD6mv0IpHuasBvmndAcSy8TBX9QOHVWVt2ZyPcCI1Pt3Izhx1OD3XQW2kw0U2jwhsBdMOrxfki53cKvFkOFJbhlhbEsxNxUaWWGYEMnWv5OYUL3QrGpjShENw203TgfNJC5MhLsiuxI+k+8gjgYdshBEHNcHFDkueI+xTQnM3cmGT6i5xZOkBXe4QSdaUaosP9YjCH8/2sL+MRrC9F+iT78AxeiFf74nl/frDMD5fiN/NZeVPYnQxnGL3eF9nAzQL7eZV5Tv+/re9Offl0JdlfOgR61YvTtPG92fr/30KEHRLwoRZiWqg4ih+fso00BOq7bF/WxcO6cEQuDF4Loamdg7QOQppGfVc3Vu4+26TUjwzJNLIfXPUe9yhB1L3zfZ2+XB1/dHqohko+297bXLY8NTgP3Kz/ZF4eiX/rTFSp1zbTElS1pMlYBMWr+CKfbKwLVPd0K3xsIpX8ybXn9ODib12sJen8UuLc1/QPrkMU+YhfJKCIFDcYgyJZ6FJtFqvB/ADK15fQ3gbl4f76rXqBnovmazf3wN7mJ8ICfPQlttEzg0UbqzwkZYjRt3WWMyU3wgGXlEUPbuSdFRkiEYaa8xV2IxBTXPqjE9BZZomml5SPwqHCjNb2ggseihRa9dJysYkYqQcWoiPlLO6H21AFvhVj8ZnAz4fnbFTD2cz8Rj/2UWFtHncrIp3u1RBiu1JEsGchViHUnuEfZz6mQtHXrJpvxL76xA6Dgh04WFPI1+Ay4KWgiTebmVFpLU4eg73YuEFB0ELq9Cp1wqV4ZeLPciwMr3x9ka4tZ8x49UpadGqCd7tdbrqlzkyal+qDgpmgGGWMhmtKRxf7OViEADNDMKezjuEQLMNZCBJugwUtguKkGqR2zQVVokuhpiZ8biTlhOScvhN+5S87vzAV3erJe3hNvxRN5o5byFGcBUfqO+bLINEeVVAGRdrEqmUy6+MaRKDQ8MQ4gbA3JbIhBuF3MGkcFopQ5E7QCc19dItqkSPA1HNhhOh3igpd5UkzV15OwDSyuweiYRJCYpDbsqjVgFLpsdrJKouMMwxRxwE+s1vC7GHmcMIwHGabG7N04H1jy2Y6rcYwNUA6S61UeQ+m7Kx6Jvt+m/FCZzaSThaH/AJczeWlGHiXTiDizV5GAQg4vmBVqiLWdGcMBvTkJdguqur9e8RwCFg8jxIWjgR4rzYZ4GLR2yAXFQ7BlWNghJdpg1FGhh0PYz4dezqrncDO46x4NLL0VS3vJ4tKabtRq0Hb27gspZsk5UNsiioWqOuK7g0p4SDu1GbYAhDylkNWuoW7N9DSzVGtAUuy3T4tai9O01OT6trnmXa+0L14u+bqVzdlQe/YdPVIrbtF9lY2Wp47P46sQPmmyEXvGuMr7f9QJrohf5jDnoUeyDLzaq9b4VcaWZ2AZTAfLxY4SqIU1jOO1teyKwxrhVAsV9ywXg8fZQNYB+satffN1Je/Yyv+iCPIpolpOoqQlTLFrJG0q/COf5LZ4m4Bte1FxVYiD96bTjo8PRZ1JeodWPX5YaAxq2+SVDB6xE7CsOllS7cIdqdaVptO5Kk6nmrMNcdD4Op08Epp7WwfHKkT+5xuhVSY81DZupEwrdpW+lhRd3A55buDwnmeBi1CdV0bo1J3To9Y9IeVB72cIyz006YaUaE0iJJIYxKc3LVhRKQX+cxJqVSxoTQR4QJJojwtChSX6k5BNGl0NgQ716kWxYuitFCmSyo1dySVwEtcOHCvZe/adlIoW1pwNBAia2vHEfEaMCiYfFjMkJAClRCLshlcodiaKdLp1Vn39QGx4v5KACD3ljEzdy1sGeqhhTVLja8IiChRqH01PxOdLPl1/i2rvgxav4CHPXZZXUN9cshF9gc+jwMaUSaASSxy3Gh2UY3Ll4mrqtg4GCri96agPCe8NAAIkDWQZDaOCgMWBYq5RDMhVmMTwO8NQ2/PuAfJLCEvrC+RUjTd7RCw3uMSSIjIHqm5EtlUqVK9CoSLYF3ocal9tFoTSN0kEWo1CiFawq59+497L6Q3Pq8qpoTmzAEjA3rOWiheYUEsUXB7XxyiYsyTYw3qjh5eo5vsplNMWSoURMJIMF/wGlIHacX/e+Ob0Em7gF6OAvH/e33SpCPwENdYZcrRu5QSC4d+6QIZxYKxZ4CRj6tsKKWXQsm9KIIsdmK2dGD8ADz5UFQDp5NHd0R/Tzc86d9o0pNAOzSed3TG2+dtYvZx2yyp8JXTW9Ln8Uays4/z9pufT9CazmY3/YF9lG5ncBYu59oH2Sl8zOuR54V1J/eIn2KuFtk2eP1ZV/7syPivqFlaORbMVMnp68KHoknEzQedhT6q/MdVpdkKImN128KndPpwfrFkoTmqpHBdD0PclFazVnd9XclmLJvH64/omfBpM2PioSdi3HZeVaoukDCejMYLAKCa3J9buNpebFSdzLM11bav6hU36mLP70SzcFS/KNS3OaQ1qmbqLzBhu/JNUVpdzCKk7JvR9OKd+Rf6LLhMQhi788qn/rTGHVdn+42/U0w8EhUVqISa3FAMS3Ug6kiiaaaqvuDnY8MY9z3L7UxeKaM21Pqb5htRbCZ1rN7AX+tHMRWIJwhP3cLdG8MD8KBikDG5nucLtKpGAx5PuaFV2lvA6k921FqN65Gv0IEtG1+/UB9B5JuGOuKN+W63pP2SN7trqPPYU9SBPLGyUVGgOhetATEjtP2MisENkx+uWJ1X1dwlsLlHN6Em26QeguErFl2C5at9sP/Vb/cBAhMwPGMN+Qp/1qzGcGGlNS+DnYjE6PObhkJWeQirGvF7Hb9dGcRLjH9F9KbVhGft1CY0dJ1Z0iUB7Vvksyqi6UQsC3jP+OMpFWkTtDRASoGxImOAawjxNAvZOt+Zb/y2KvzAe9Ay3DlUVYGlEc0+2N8b4eiSUl3p9wj9R2AKpmxUb2kjFHZxPtN20+cO7/LBNuiZ3k1BdbRQjMZpj5H4JqXt9o5JsoxpfVHzrZ8cgIcVK0VC9Tdw2W+FPcAyzb58pYQIJg19Qw+KYJQYwbAhrnsNWaEqKas499Vkrf7HGGfZ75qMkKZ/XHYho7p1if+TSFdMkKABmiDAxLMfgD3YszFDal/d64t9xbc9wItJH3YYMJY8WZyhIEPodz7LYuqc2j/u9d9cqfrkieHOvuaVV15+pBsceyPS4b3oIqD/5+fmTk2f/9sLCuO/udZ3Fd20ie7H2EF7TBSt3+kQ99AvY4GrkKm1DcQTtNwtCrc3OBGtHJuIcO7S5lqkJYIynnl3No5pJh7RTkFq58L4DvCmaVrZczXOTcaY10AffSsiP6hHEqh/t8f4UTrko7GiqdUnIHdKZD1Wh0jRw//0N+Isr8ecsmXnZYDtVC5QOUhMsBg1IuWPB62WLdkvPVqoZMPuxcHFBagi1ac6hwLtyh2j4+OLl+Fu43hZj8DGmK1Ft6Ir4kxe05W0Al1iQlyRioJ5KyV9q2Uf2DoecUVTza+lFSHT1uJKXoEz8UgA/lHEGHdqEF1Afcak5U2vI5KEaZB9z8ZlTeDknsV5qgDdySB+VvXV6YDdzwc47ImBYdetzTpE8ZZuiwWQ2kEBbokT5YEofiqsQG1zXn+N52EG8ZYqoHXQHPwah+CxJaJC88lyAV+FegbsnaYyyDa7Dci1RmyLEFwjg7etZN8EDxDO4v5gXFa5e6lY6/lULThXwfUiiDM05x6ysxBCdYcrv8G3hVXPp2qhu26LY+jcGj0Zz5493FHdyev4FFAKlFu5OvRYwm9E1t44HEkPAPikkO5FSOcoKUgfZgh9bJmfCINM0by4PoRhQ0l7TGHYsxl97HFs9ieEz1/HDwEQEEix4Rnb/Nu6nSXXu01MGxAuU/1U8pIZ4bT48AMIcZaK2Y+ODM+Nd1hBFQxbGj5TvRquS2jAFmx9CZImZx8xTgDMmEAYRiVDAwKERHgfNV6zhWEL+xfe3onuD74ENiExjHo8Bo5UuSymEsqNO7U7qKoBjuQTnvrRIZf0OIQIeuaMrN5rH28lfeyhR01/1FvBGNmcY0kvlWPE2/VMFpPBLIv01KtAeUq58ez8+6JoodmtkaNnTp85tudW9T6JNKZ06KGL0RK4gJSACzh+noka2Rw2i80NlOcf1g08Dp1aw03p+EW5CBIixEkTC56+t71p/sLgDqfS7Lfl8GNy2Jrtq0dDS1d1rHKpxfsPW0swBb1GFWO/05RIb4mAp5svEVhNP9AGJCpf2Jf2TrOEz4us75yMdX1y8t+fqDwsIAIBU/5n4O7MPl2+gnGLNJfa0npKo/mR91+M9V9M8j+kEX0V6XQYi/w4+221OmTnqqN9pH6RxQKrNq67RFZT1i2gy2K1xbaw/Uc9w5vTNax+6MgVENuRrvOAq3RUpaTx5MnPxuZ3HDFRBCZ+jfnA1Ks5y9t/1HPzT4Oz+/G3p2t2acxMERi6QySMvgZV5i/Iwu5TnpbLTLdjIJdxVwEJJHSX2imwf+VpqN8pi//YHSIGewuHcfAemLrBld4g/uOXfBXEXHGzoswrL/D/w9Fq64T+zamK5cmky26G/3U5ihrkyV/XMlqWPlpC9pcDvqM3kWJUviwFY/YR4wuGbXQXwjuIHas32eFVqwLd+PWSlFdW0Tn2MDHx0HZtLR6ifcEcZQtfMNjjuk8xikGL+8V2BSwmb7+dtVkvrXbw4282L/vZV9GK6VP/5LhC4Z8RQDViPzBhuPbKSL7e8Qmu3D861DQpjc5XDYeI4yJpKbvmEyIsAKabaqm22Zi2w4ia7EfDqs2dzp5IOJL2DAvqBLjZAWBUNaRBDsthRcu3nj4KKj5Ugh9lVUdZhJZwAOlyoVe/s+clhvBurHD18mLoRLJDV5IOzoSK0fsJJWBuVdecHidh3gtooDOYkxZ5y23j9eXATK3D+34nKz/S/cJ7e2KGHu61IhGQbBGMq69LsYhS12lmHJQFlTgPaTDOz4TNxxvS0FYfo62cOxUy2Id2PzNAe/UsmbVCQYT5297L3GVemNLwfPJL2cGPsYvq+Qx5Zftg0NeXiPg3Kt3JLvPUT//R6Oy1FUPDrvaRi8zr+mIrom7pxNLdEC9q3Aec3Dky776KsIjjYML0nlKxiv5N3PEDkVXvKR5s7+D8+wlmIW0WEzDqNdJUXfGtYiU+ueI85hWYgZlvVBXvqu7wjariPuY7wBM8HcsxXrqOgi4e++rMjcXaNK/YQpY6eTsNGaXlrwb8kXC8CxZUZ7Sa6OV3S5v9THXck5iCvCQ0+1Gjnmp9k8eDmcKPjFHWqAP9PXAGS4Nt8L949BG0/j4lDUTQ0ZogqpNmfh3i0uxGO3MLYonExnKaaG0Pbp2AybxnHnAkMCwiZ3pR0f37M8oDSDO52FvAQlGy+HoiaazTGt5NnBx1PsJF3O+2dOvQiaeLbVoWv7oeOH7aqKHNd3O27UmRQ1TAc579U1s1N7ML4InjTc/8x5O/bqvzb1uyjN0kHbqdkqzs4/VOZ3M4IPqqFn2eOs7PZ8GmqEIGq2JLloQONuk8FMNeFaeenZmcezFHh8sN6nh+bbPdGwHmRZ0j6gSW7AYBbfMk0GTlgZe5TRy8OFainRJl+fPH/XnRZr3Gj9UoxzGyojdx6GMwW5PH5lC0KGg6r0uvjtWV2Vqz++mMywPVm40UbzwlK4tR1DwBLSHuDZNxfc6w3qV4E3n2dxhodX4OfJtSMDpdIeJYoWbQa+/ElD8cdlqN9jaH3Z3QLTowE8Lx+fdKwC8R44iwYaOvnhlIxgcc1sSY/Xybizflom1KIOID++qsAitwAmcqxyvOuf8ZDYeVYrDSBFDpneOCKgdVF1RN6EAURLH9l2khzu27nAvjSA3ZDPsEVBcK9v7QqUDnPmlCro3Py6T5N2oduN20AmEiUPYRJyg0vPFEk19/3AGraLkEdNIjfpVP2bjSVzRGYVh75IklxIMd0BOcQkISfcvFh3uVIkoZVdhiHcnR/JzRuz6QbCMGDGo9YHiVpbZigNiLMqT5izb35JfPPF/v8ELJ/JKqL8PQtIiNdPZBohmeyCDI4L4kqoBP+GJC9pufKybRL45RuSc1uT8YsYah4y+1lZIfI/E0Iif3tdIkxW9YQZi/kaYn5DLC9uu/f/XVc3lnTyuT1hWv8CQhAp3W8R4foHeMf3SvNi+H2VdR10dhcyC1pxUg8vFxxYV/hj8Fm/9+8ddLrx8AwBYsUjQIYmcp5oR3gPHUZwZWsaFDSvYQDGu/jG+QmNHYrxIV4FOgdl2kf/l/cSwe/7e0ulJP6iurhQ3tOiaDbUFga0G+Kk3ybjXBydu1HEn20//4V2v82XfnNiwz2PMJSmAFyVaD+vmmo/Er9rNRnyPjSeJHFQF4rDlU+efWiB/eifvsfyVMlZiCYvE1joZCq6d8hrv297KmPts9ZvOjTgbd0ONrzYk7EwUmZnnn3PhsARA4kdXawYtbCP+tY4naajk5dfL8GG3MoxF7XTe0CdiBq8VAnBsok1Wi364QOiNkc0wrcMWMeIPE0lGxJYs0XbUVXlrL054sdeZn260GjzByMINS8MFhRBmJRJm1xUTvl275aaqcDyX2WKPdefQ5p9sN9hT9crGWmkKqMnC+tMmgbWjbYVW1c9R3LN7bjNvZbpDo3IXYD2EYxB6udyFYcdCGaPmoHXWO7XiJjaVlSyJlyRXlQpffuWahtAzNysmMYhwEGarTPWd7lw0FMRNN9CnGpsBNHsMvZ1jnNtU280kPmNBlwwmHxsWawT1qmjm4beoKwqijAy56puvnqxsAJWftbalxl70ihJmj4aeICHGjxvDg6de5gOAlPG+9/XagENPAkdioo+75hTiUkDQaXl2FB0Ioj613qKXUBJSF4NmSyeuANbLzfOkH3pzd3z81eh9BaiMPKA8G0anDHVMe9s5PzzsmAVtDkoSOtLktp0Au9OoCMqENXeuWRRfAH6fEHbVq0hfVxLnJ6rpj3eWV9UefZPKe1LiLzEfPN+u1lDNWuTejrkt9Siyb2IiNZjQpHK0cHDp8dHmO/mX3LGkzDxzK0SahLElYyPzZhDHPWguLi5Pvkp4WcJB7QnTNTbLav2RYEdtiW0Y8pOIw9um834rom6ppX1RTeImLAg/4YaxxHsqWdHuMKmcDSF6J2c9thU9tUwTs5Krflp4eyQdGZyGm8ULn/v/XWEHB/LKmf3wrlFPf/hq2Sd4QXqHHcLzhhudkLqtOa8veXgggfW6s9Ja+1ZW5eeax65292XMRO29znx8X0mAeMkmRzLf9x2akIo+ZaLDvTGqHQh9tpDxsFYWlBdkALc0mrkgsPwhC0jCczDmeoeWds8SjyFxiF6VOaCmGKKvR8z9+8ws/jNzlTuav4pXCWMZy/e3L+6Zp+RcbjtWZuJGCGDbN1Pou7W5mFMpmSVJprSZLqJcMMjPqOHc+2FonwU9q2bpBnGIZzrTibINjlGHpt6bAvjlWFGOdReRRXyeMNSchOJSvng78nmZqAU67E9o4zosQZsTzqUcJx7R2iGWsnFJPIRZKekmpD9ppABRqcvZ+aps6VN3yY1RW7PF3eTonAdHTfPNtNDUrOuAUKqcDDykhS/SJuQfAYxYnIdattnmYOa5jqkakmMD6kBtpgkOXa2yVpCw0vTaHUcb6gZ4xdzeDLyHdSIXK5gMDS0PHbEfesvQjwFX79LdPPfvKuy1xhBn3Q2loklVuxMKQedDQN2YaFTb+GjRQwRomRUfQ6FLs9y7acrjtvN8UgVvQTWue64gxeXsHyhRInmvL6OQEaFW1bmvTUDltlahbxeHqyTmtBdMf304YQu0HeTBut4yQJUz1Ts2wqXG8xiKuH1Zrs20huGhFWVrnoWPIpBDwccYXD5yC7ilL72C0qcxCaRV70byIIt2cqLLM5WGGBy2Ub0fqqk04ip0ksL7Y+nDTf+3+Mc/1/DhrLyyvLs9nVZ9gh4ZR4CBWoxtZPLUcreqZYdCoEvqgWDN44siV+qD1565AZ0WRsdHWN5Sl2Wwzq6c8bbZX1jrzrjKzBVvaxriuUeuWjV1mZTnLp+yzkXvcFliotb+/8PIbb/3v/8cnr9+8b/UGo9GgPxh6q/2hpOmGoZuUMduLjHfW570WumjBGTVaJfjg+97hnklU3LcmjSVZlgZi93Jw1et02ufvjv/9KmIvOc/uSgtvvMhGQVF9q0/Bt3XzkWeWkUA6iRiy/TVNDYxeA/z7+A0y1zj1LeQ11Si8AG4Ln1bgkC5qfaK4TKN5RJ+WOl0rVFZh/jpcC4W8u3nv/PTs7Lw3z+oGLsXoWganyrBXZHqvKg4IUkkhhEQ3LkZel3CyaaknNXG+dYundk/kMJ0H9r7h3lTj6n5aGtP3HwSMoEpcgo7sQCIZb3ajq7DIgJLNt32xmEt0iAuRodIespCnHoQuvz9q4RydjtAOAmABa8/UhfrwYQu4cAUXPRXoT72TtJrN2V5HKvbrZCXSu5aMDXY9oYnm5u64eLDB1s6wlMNCCpRxrr5Vr1peVzcLI1JpXIHgXGbJaHEgIcN4OAFTlo4rqvwGqPhygFxDCCxBKjqViyM8M2JYpGviIsZJM1FDaPxzY8VvHYLj3Bjsm78wS2gqaxozh69vslBg2X+BjMiC58G3Rz0sHWwINzWhHtlpWbmPA6v5YEfpomM2NGZVEtRjZ6msUsSFAeLMSeKnVuGtBlo+jXEkvIb2+1RamMDSPtrNfGGHDszAfLgSKVS3D0Imi+pU0xmv/wOvHuuLRirZMOLM+lgaZ2/D/6Q7HYwQNkMbs/RN6afx958NFiZKitWMNluD9yD58EbdD2Q3ItZI9o0CDeFBe9BZthbUoiI74dAa3YCMWgNE8IeWuJS4q531e6WBIDsGt33p01Xs5eyQZfpvnmTm96WcCOSrtwo3B+oldHKpUJi1tJWGqL0KlJnfYA0gwHdGoF0joZr7PYw9KFHRXskQxkp6Uy7q+4MaLgCzW505EPZlcjwfqATCNwBuvx1Z3e/q3b3RaTd7RFzMpQA4ZgkzxHN51W2vCzgswIBU3C/QHEuC8HeIqDOhEUg+/CQvixCSL/SjKFQ4l3YcIrDMJ2YvbjiEMIdlJn/MIVLWHDGBd1VEzJi1F4G6x4Dm1Bf6XBCChv6zfjdnrm2oXIPmIPjUdCVHiI5rGcghTiYMi1Afr4wuYWxmvZaEiiaQeaD3evai0SOwWE3jdV/ew85j4L+GmmzU7Slzg+5YzpEAaXTwyt7zvO6xozVCt/3m5pj1lY24pXmQ/dJhXpgCCLCT/ifNNh9ve5j9AqvKJiLN7md/vQgSB80yW4xEYLNd9jDlunHPlpFtia5rIkwVGVa5ad9dF/36c0PW2hizOcY8UbV3lKQzKBUe7NMtQBzG3MDHQhp2mBBC8kq0iuT9/pqo0fJgjJKFQsmncaoQjK27l2c7jJvwONfpYtmaeKCTtI/uxdf/1/v//JNplEw/NE68SL+TdY7vLeXAMhfGvNGDeS9D0F0/zPtBrn15Tv/oGgyhF38B2/yxQ24r3Tde/HfkfCkUvndm+vTu3GFsHac4sg6KrXG92aHRynY8J9fhO/syKcsZbnm8A+jrPGUbV+jOljRGl6a6NUMnx7nD9KpvDTV08FCMD8fE6dB0bbnp6OtgIrBANTwGFYvpyCeN/bOggESxh5GQOhoAe+TNsQuhXS50odjlUBeBZ2nqIrIsYV0kmsW+i8y8UN+ezTkPHgsB8MuVLgSoOdOFgnJ2dBGAno2TiJpJhLSvfSmQ2+d2UUAxLV1UsE5YFw3co9hFB1uPuxjg6GAXE+x1INbDlHSxwVWGwsHD0O8tF5IBlTSLqdLEaooqjaLCbCZnQ3ptqvrCJu2cmsPk5lC7kMmMCqHL6DXvOgsi3UQGkqU6eTCjpg4TEQy4WtvdGo2qtB2CDtFLtc6UtCd2VtajbqJK5uS+Ilk5clU1OY5SbvKQCukiW7RTEfBBDe9Qowt1Sq8WOUlqY1CbN9Ta0s10QTlsu+cSytQ2+qNDdCJFrgq7KvMT9N0q6GNnqOqe6S8nRr3Sq11RNbjZYua2nBlqVSt2Gj1zl2QyumUVAwlqfVkLz80ipmaY5k4Imp6b7f5a0cnMVNWDFl72mQQKsxWkG89vlQf5n3/m8pX3vwRVAyDclaBwVY4D5DrIQoywRXC8Ymqyy264yQwPX4Hrbrvj7jlLv/RCNUS+cF+h2xaxl304+J7j2UzXu+OxIve4UXWFGt/yYiQ07Fu9JjE9zIJqZjZIqCUf8dYzhR7tcF+daaZzUz1niOdA/fp0mwE302wdZuml3RFi/SCOV5mlJPJ52xxEdJ4t9cbvnCD9bK0TSudiLZ7H9H9dUGSHhJARCpziP2hAeGgsHTT7INoCzw4uGoCFTJEuVIQGDEwZKkFg40KHAxzE3ycuO8RhjnCU7ezgDGchoY8207KV41LGXc8XQRjFSZrlRVnVjWy7fhineVlP58v19nDfHj1+8vTZ8xcvX72G0DMwMoXzmVnMYoi9nCppqGkJ4eG9D3ZIKZUUJmtoiYIJ5VKZhEvDhxGGGW2UMQYnIpHq+17+YG681OMtK/dVEJP8gWCosqo6HJlcU1sXrV+DmWCcpnnRN302GW/G7I7OOWX8sweEYATFcILBZLE5XB6fpARCkVgilckVSpVao9XpI+wDVAEyMiZnn4E2mswWq83ucLrcHq8P4Z1uiJaZlTl110GsB/+/b+Mycrd7sfx8+FZ/3b7/AXcO0qSPJn2uTz3K3bub/y919BNYeEB7G7nHTps4EMmpfT5ybVWIK9A5Yjd1p94fgzuaGj1F5VekJMLH0M1uqd81GQYZs/9Rc911CzcwTP8W1qbH1E1JKTW+oeM/+2axmHcV9iHpZ7XUl5hhqNkjOUxkBk3bLQglYgFHcvLxsaBA53CEPdHb5ayb+uUY+flIDXzy39pBS/7oncTGctM46ojCBipSUlCKiGywlD8C1IqXfG6GbpKuodrHZqMHakhOHkR057UfcQkO62nWgJOJSsFWU3J5EYpxfPsT1W3MqWOtE9fnTRhs646C7PNgjY6qmT5E8oWtOd2RoV5LCTSlTrconDL4XAwCHCz5Dba3EEPRXKtXoV5i0a1euMmQiJEFPyGtfuZe7fr0Zbokvi3FZUEtW5jkDZTsjqeNMEmP0GhHIAebWLI8ZnGgia0pxKiY3tnc+9ve3e/t+ePD4+Ngnvjd4tF+L5QO5+20VzPhQV0mU+Cm2jWOpj02jub+9ZdYLeq9x6thclypyo5c/e/Zcz17SvMnX4O/BUP/hotqu56yoKUZ6FY1LuwtoAj1W77b4ybhFBgK1DJmBaqjRyxhoEB/mK9aoR43abIbcgjZ4RGTFiFCZBsS7WXk0uRhrgLNlKqK7gyPIlHisyKmD2lxPA0pot4nCglkU5GS+DsJD4rCE4YGgWAcrAMCgWa1HcSGxiLhUZoYyxnvQLxQQN95DGBjGt/vlPwO62wyTOQbcOXi2BxHO/3QmhtiHPyOxTg6dklMDRF0vJ5J6BBVIK534FNq3WVzDmBcUJ5huKLes2MfsRYLQBNZVKBU7iXVIwjitJwWNmmSjkVYxK74+1N6VMxCp15AtbT4NrYmpyDp2kmGiGgBH6MKLipYKFYF9QuwxqJyDhOfKFJw+jxdI43fJB/nEFXxM06n/u7YQ7HirMtJ10rVytTjUJuq1VpxleBx0dZApgQqoKeVpDhx7KtaXGn9woiLue8dszpMJB+tKT4lJVYExEehGRnEF6QqtivJ/EhiRUMF3C9JYGrkvF7EkJy44tJwzW+/VXC0GTvijbIighgQWs//OoIQZdMJDhau2qxpYdM3D38mPIKf7/993wEAAA==) format('woff2');}
+@font-face{font-family:'JetBrains Mono';font-style:normal;font-weight:500;font-display:swap;src:url(data:font/woff2;base64,d09GMgABAAAAAJ4gABMAAAABfCAAAJ2tAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGoFfG4dOHIGacj9IVkFSiUwGYD9TVEFUgWInJgCFIi9qEQgKgdw4gawuC4YWADCCojABNgIkA4waBCAFiUwHowxbsF9xAU9mXL3crao0IYAoCrjzg+5wHjkVbcuCccwS2DiAgXoOZP//n5pUZMw03LTdmDAEARTPJXggPcuQWjEmkjXItGcLM2nuSMRCXt5ylWlbhNmErM42b9XRjSLwriYzp+dkSilsP2a7vJEQOVEnljweZkZY5RXso5cGenEqyCjgX7HAXc4ctuPJ9HAXaT842yHTZLqsy1zWrbwrSMNJJ/arHcL/VIONfi9b8fOs/ipY81101Io8q0dCOERHaXQjuN/j0kXaJwIyNdzch9lwLZ13fvJZPiPYd002hQatB9VO9Qg3kmpo//N14OD8h1RdxkrnvFAQzTl7HyNAsEDN8FJ1amoOT99+v/tmv1lIaOQQKqURm2aIENWbmEaxaDa788bnf74798CjPMZ4PMbjsT7G7hB5PGQMGSMdQcTuWkklHTKsSBBJR3ifNA2pFQkhFRlh7NrQH2F92DD6Sa1Nw/ukPrvKWENq37+piAQbUglpsEFE0lRCSKUHuK3bqDQLjAxeMSPQ/ohEvyPRNwdseNLNfygUguIABElICAkZJEDIWpe7jMsmlyOBcGYAiUCAMHVD69hovxPHArX2Ozbfat0dutu6v9iBY9GhXQuIh9/v25z71qSpIm5VulsiraWfKJFIIgUink3S6qBenRwUfGg9Tj9aewowwb+9w39irn3GSiY00dCJ1Dxxf5eJ3Tr3plpfFYBCKBIEKZGyZbvtTn9Dzu++t93LYd/dJNS7+XgJOUzyBPd0u4McqECR8P/T2fueZDhn7owxQDVSBdgBD3itBUuLn9hfaqzWTniXPwEmaRlrrMKj20KLT1kM/EdlHNNYuGqauQeGMIqW2JBwwCGG76W3/fX3ca93dEhJ7O2i8oIlNgBSD3EGvnL+3m5y+bcHRsEMNVLzf3P9e2cS3s3uQJIJ0QRo6W0+kq38qkJXVZGyZSV6anSFrDA4mDr/FSAdYYSWhNFBC+lb4/x/T4c/bpca5e3T6d/2gC5GlglZlodkW7Itr5EEiMV01cxxCysESXLCi3v7TWERUAAgBO7aWSlh+H78dK9eMBah4B/7rbudvdoClgpaq2LBK96rudybur2vC34eucQOKVAGYUi4VlhEOJornFmi0AE+cRFT4+vMbHL337IiWYWKgFWFrQIulJv51Pk1si2QRmEUZiSNwkgwAoQNDuB0m3J1odpQ1NcUXxabq+bS6+/aDSH7B/a8tjEO+PtjZw5zGv/jxA44bbPQ3X0EeL5VdvfB8fb/CYAXKIWQ7UiyNIIR/H2pWtf/AFL+ND1ewLFhb4BmllPgREy6S7I25HjMv393s7t/A0SjAUoNkBYbkDxuUpbdAGUZhEMRDZBmkpeikxxCnhQaoDwDUZpdSLJq6DQhemdjDKetPZxmbnPc4+7hNsc93HO83fdy2tt5D9c9XNb/1zTfFngArDuE8EPkN/XlGMpfJzrnNhfdwwwgcjkzK4iDXfHn/THXPkcjOmygA3flvE5x1XR2abeFoaql0m2VrmpPztAMSxR8lm6tcUjcCDqfQ6RIr/hZlQZXpSm9+uH75dKXWnID9DcGzh5TcCPpvC7S2T8JCutt+L5dfY8sp7OCgoMCcKz31/q3qllc4E5pOyRjyADGyLl/b1v8Xswm/6vr9Ei4pvsMTVXXdfWMmB20wgivGrTmOhuwplCiEdjNXjEsLr44QghfBaxNkPjgLe8gjqUEkdLHUiuIZnSLGVNwNL97fG5YUztcmeZGxnTgQBGITJXY8fhq21vG5iNDPHayDfzPWHuHx+9fbW7tbsdVSUlKSoqAgPAw9m8PYRHs/j+qpjCEEi6Em2giViwRpxBRRFGihDJEOeWICmoQtdQi6mhCtNSKaKMj0VlnoqsexGefiR9+kJomn6XmKWKpdSpY6pEWlvpFxEJAHhaQAYQDLwswgD66Tpo5LEDoGzHZAMG3FUhCmAMOAIgXDwFuwmVmipwuUwVPmytd2uHBBnCjR7MVwIWGMII4MVokGRDF6fB3AXxCDrcrlNCLRwGAfmMXPVJ8qOhXtglj2S+s6avGSFvJoy2C/PFLJ4Dxhsh9hWXIanFPVKwA9ACJJJFaV36GqQMgf+no0BzA/sN8yAWBPK86vlMorRM6qv0A5LfpeQEQbCG0AATdAoxtCgwFKfj0CJpiRZnyqxxw+xxmgKM1sBi3GzUPUl6dNJoXGjDXF7NWGafaM7YblIkqdAAWiuN+lBa5NA/ccXSUuA3J+a1jd0DNjxJfojE1kfnUbwgsSI2XSr/LH+WP9hfwF/QX8xf3V/BX9Nfy1/E38jf2Nx9qwQOujIegE14IWTKizoAyUAziE7lBxzWlQp7fA6UqkgPxTyFr7Z5DAX8pFufyeNT0JoGfZlnKP/xQmuExO9P1kVby4Q1yrL3YruKYwseqpJT84m/plAJXtS9xRSzsnt8Grs3IO9COHY2vtOlC/LXGbTuQ83LseWU8CZnvx43bEKdFLoXWCv7W0K7cqEkKwajj33ix44OHICFCJZBIEsmlFi5KrDjpZZZNLnnkV0hRJZRWVgWVVVVdLfU00EgzLbXWVgedddVDH/0MMMgQw40yxngTTTHdLHPMt9gyK6yyxnqbbLPDLnsddMQxJ51xzgWXXXPLXfc99NgzL7zxzkdffPfL34CRTN2wlMf9IEqLqmn7aTlfH7bHT5+/fE3PCGVh41ACg/Mo40PwC6pUrRnf9jK7xvbUds922eaz2Qhftp6w7hX2rwxgeWy5Y+mwVFvGmX8zQ+Y89BZ6Aq1BHabHpjumi6Yyk4XSi8anxqtG1ChhjwyfGI4adhky9P/op+irkZ+Qp8i9XboAmYbUwX/Ag+HjvRqeAafDb+lauiW6WfAEkqFGSxAOSSC29rh2i/ZdzXPNHU1Eg3/n1OfVO4YXppapvlZ9otKoiv5hKc8qD8PHG1YyFEcVaxUj5MeWO7XkETnOkmRDsu9kS2RN0iHpU+k9KS6FIbZkt2St+C/xd9+WuEPcNCQPiegP0dei5aK2lORSuKQv2otEun1OvgifRVL2B7+cVk/4qfsdsP5dw+vYypMwJaS3o0vgr9bCfBumZL41D04n09GPNekmNeTmxr1xg/ugH9U3asPBEBpcA+MGUdjs4/1U7+8ZwqN3s0t0wY4laLWh1nXz8kg+M8wZ9Ul5iWG52W+sje7D8Q/qbU++pR6oqlWhGqqM8eCB8u9LwVvDpfXxWSoV7RSNYqLwFEKU9mYqX8sNOZYruNlsM9NmykvuvXjjON1LvenIepJ0kto7IfEmd16E43Z8XKYpxv7IRdtRkidUd4vfy4epcC2gfF0YCjaDFaeUzb2aFPOzJCG7ymYt+hE/6LOutDy/5/SA+/NF2B13h2mJn/FDPsL1rMQyzMDkl+/T+K9KqPIySr9Poj9fpwhGZJdKuZfeHEoKrXH77uqb/mrzWr6WXWTq2Vk7Kw9E5b+ysbu3cYsohZVeJUt68XDuzNFpmiRybcTGnMEl07pSfUeHuvikbNtsNU0X7SiFM5xBTD3YntXZqqkd3KoWPqu2yrUSVZxSahVoFdpnwrgRNkazmKk/gwcHI71j+xo10i/Mek5o3vZlONzy/Jw4hgzh3JxceIn0/XLUlrTko5BY84LC30abup9cK1q/AzsTFYY3YnjHU19fQrrTk970pT8DGVRvTwrh/YfQxVtWTHUDEDwStWAwr8QBMChr8HXzA1VUQ+fOiUAVVK/+C1elOjWpTV3q02Dl7mx0UkMsD5ZuPL2d5c0YNJgb4+3B0FSzvdLpp12bOqSBM42T52XwiouDlFa7UYPUe6m7gHDY44sZy2MTVd2n/2CWumNnWGQ4XEhmKcVouEits9jaTGPWR719BrswoNP2TUyxuoqJpItclssX/U/oZPywpvb0AFb/XMt3O7JTTxk5hQvcnaroG6bY5tLe+Rp2FP1/Uh+ZZ0PTFP1SvgcvgXSe8wVW0b9e2hT27LbQwCtB9yPpt9FIj4/xn7AJRTfb+CGqj6IPXXybro+iLanAQiOaBTm0wFedLVqj1xmeznc5xEe2SdUfToxwzVr7AbEtNXONaN6Vw5uQjnkzziJRZgcKvSF2u75l3oQo9RUjGoY7qs/nTz+dLOT7xwEjkADGhfDyv7pyXz/jSG5boqSfCJ8MoyYuKfqyb1rQCnyaXXJ4zE7SvB1jCUKjhW55Z+X+lgx9R7Ckodmo0yjkqKHiTP/BWymAVQJ1FbBT9voK/+UZpQ/o2V9np7j49Yhap2a+vMde+HetnUNn+M+cbTJnUZ+svxENIUdZR2Lm4cHbdSRDrVRHWW3e1sfCDU0bG5DdD8L/dxnVq8+5CoahybYu0x7uN1fv6z3kKNXpBmTJyeF1ElP/DfjYCBBEK/NqK5Y5wc1WlJK4G9HuywG3KpuLC3wdq2AYAcjMSETi+HqtJzP8uFg1hhdQ177bogmzfvkgGMl10eXEQ43JSSO4KDqeYfX/MVaA92zllctqYbeqO9BL8FqqTA3IHJPDKy2MYYwV4LjlIZrD5jnW6znYk1ht1GnvuIMkzhjHXAEWj6gh3EYJ5j6oaEucUjLzerUu6gRq7NCGsDoBHR3KCSNoUYjBxnHHmAGN25JFAUbkSqIOIHMqToxKTb87vCg74xhjBtRjiUEOOu0IaAdiJqwbdRqiOwoPnXGOOQPcHWGiWEEGuh84YQs+maQVerV0agPEd9Au+CcBHbrlpBFoEAxCscYYB9Rsfp8EsuPyuBbAk5RPGJBh0x2ee2GsY4wDshZ8RBCTgxFNgGQCi1GnjbuDdM7YxhwH2EZAK8oSgI8wtG2WJki8r1e7Rg0A/s6Qm1h2jSbaqBnyr/Hj7TXg2o+T/pydEAGYfUSjR3hudduZfgRA01ZtQAa6dNsBfj2CiEtKoa+JIHIRJtU+F9Edz2ruOVvfYRyfeU5SkbJR4NqzJgpkkdZl8WGs2rWpbiLk1iNzE4G0ZhvRjMnamkEBI+PYBGYXuroIvps75iLQNNeMaOju8Lm4QGboGOeiVKDnOd2zCDrh6Qb0jJ3DtKanifFqPdQr9BhvehwGdnqIAh71GE8uKnWMpYxo+7DErK6rZwtS3CqhZyyuoS781mn0pWPKbmBeBmVNJ6PTAmVTT1L8z2QYZTNAqcV2FzbJ+/5c5A404MnDrG2LX3JcwCfx8WrXrejhZfcTkNpcnvjZAVCWZkFU4FPvyQJqYy5bzYYsl8aY45FqNPsnsNmtyTSPYMcadelxR6+2QN3hEdiZ+8adBHRbXU6Cs1z00IhhjtnBlhzdFKJRkngcKG48ZVVy6tRj+rXENrpzbY8KIqRN2L7W9XjkM40LH1cAHkZH19UNpRqPmrhG7EalOj0qw7h7S9fFg2IxfD8ioHvgC/O5zfesgsZcwu1oNBbuM6oUtzDu2Pu4KqdGPeaOLnFb3Rnn74MEdLeo/BMc8TuG25IXAFcoVsdlLt2GWoEybJV8GxAP5WnL6tUqqTNcLPObgAHdpV8W8MZMj4N+8+Pgzxhy6VqigoqFPV9fiEclU71e7SZ1jGFufl1mQDcEZQGvM+lTKdQW55UOg/oolmFl3NriKCzu5XNl2IbTT4sBvvY0qBRdbIPzQyP0iytbUjU792dy+JVcFNKslsrzMTAuz0bI+VGRwH0AyGI7IYl0V45Xy6QWuIR3kPw6SFwS6RXeL0M8QZ1XoF2fen8RtP1SbjKU6SEPDxkH+9oFpJknpnAAvkwyTdLh3JpDHAHbEMayRowqrgiBmo9z0oKxZkak3PRqhjN+FqSTZ/ns2RZH1Hdkwg9DcJAZrkDiJYFcTp3gVSCC2yN0DCun6Jhui/VqvdRHyFuprT42sJODsoBtwV4GinR/Krvf00JAorZdJAc3uWuntIPm7Pp2/BR9WZuOvAlkcWptBT7NC1lvByxIrXx/eRbQxDhdywHtcF1HE7Qtmex0nRuPOdU2GiubZClRu9ZRwDW5dyjC7fGUkn0jW1xUphQJop2fKGPK0qvdoDZQF3nTnDCwq59RwL1zMdpQvYKcqKNpNr8KpOGyirnP1n5S0yVSxtUjRhXmNHPlREqt0KaZmh5skBpDgKmQaqYVFBKCogYKKDxlwLiqphGm+XlVQEA34bKA1W76VMqVClshTEa2rkp/Djg3zp0mDYPKOwB5Oofr1dziaZBjYvMmntGoX5MoYOb1DrA0MZ4y65W0MOvqCfa8e43c0esWI7U+zUHSmGpXtmbMsEjFmSxXupWylhUgXcDTif723BQg5YtOYdNivB5+BGBXRnxaCtTRIcrFYK6bObJQRkP2loVjPf0YpZgqaeS8EgOYxukORvJgyg5gKp0G9WrSPA1TmNbSUHpszFk9Jws47NlTt6VqHFjYU2WiAk1gPS4qTOlpPK25eozKjAthqjhyIiVLsFJFSQ+2Ox5DiIGdRg8V1JhwbIynG4hQo1PDMK5v6FH0xTSqHyew65/JAo5iL+WJyNoDPm2Z8sp3zAD+YamdXhmn4S9WwPjUMLnZ4LKNitpdYeIN/ZC3Br10AL+x+NBzwyAAEjvTU4XULOXy090ZrgJBQ7yaRSAdx6ck/cTCyaiHHvqRFvIwDvH1dyA6WzKwgw6l2H9K8jx7C78C5dQMyAw6bABfMUfQycIgABAfdijXEvcyvE2/rt2My093YP+PCDj82juWCfVNCA1QfRas18GuT5g0AhNMcCcKisIVwN+23Ci7B3VkAB8wraP2h0EAimaqnQ3IRUWOqm2lo/JjzKJIWtmQ76rKuiUPod+hwJN80ajTeGRNpgCDdQFyWb5oKLQ2itAbjAcu8us3KPjDyCkd0ZfMqa1RsSHKWqRftC/La9D8mvkh9Ob8GTz0CqPF5Zv6JfIVhk/gdh5lT+kvSseBcZpC6uD4lKTnGJo5NdBDz9JQHq9WTf0UqYi3dIFdyqbAnEB0/TspCRDCWbsWsPN4UoXL+f4ofCcnOeehxxgcLsnoR0juMz4lH0aSBC+N/hd1vUBpFnMn4mMA4EF8AV3H1vfRkZh8HeBC60M14xKjrTA+YWozz34Ry5OVeIWFdtnWYrqL3uvqbn0XrS/V5E4UhfP2qhXJG5usVcfuL+Ei8LWakNnYrW4Liosd5ragnY2NYRayk2KsAVnW5fBYvlo30Rr4PW3sITfYeaXCAG6iwyETg0o4gBupc43Xw0wAO1+Qbl4+WxWwUDsoCKmsp2ejYGLJ/R70pfRGabdLXZMkwbHREF1N7UkYFw3oq2hOeTk5UrJryhSEFAnTY4GIK/ArJJqkDUbpMtqgC2z6Mho8BQOJGo1H1gO1k4npW/d7WtVo+tguoIAuouWgkVnRpAvDliwgO1HWF9BQmHR17wSi6kfd4mSRQldXIODhYq0IzJvmnPk14+60oahXGT6dGCadg/SinuF0YhB0NkmH/ubvndA4eeY+gtQ774dFAHZlTM6UuHwgmNFkraJQOGtXgU2oWl8rPC0SuHO8XR4GnUJThBuwuYdOpubJeLUO6pNwLbwpNxjYuf0U8Mhc80Yxy/OvI2zWOVzKA2HaXzd0HM0AwjXt0/HUKOt1jvo4+N7bQr8P/I6n5CQYOr36KZeeVTaW1w9wnw3ldBT1rgt5+ii4ZRjSr4SjL3XbINRuVLIeNCrWMfjgadrgNI5PSTqM2pBZmx46lGr1MI5V9EGwLFsysGPbFJBzuTbqru0PREP7P7x69gHvuxYm/xFhMvC3dww+eJLtzGjioT2ojI6e6d2gVWY7KQH0gOETuE2fsbfUlpoO3EsSNGYzM+1EWXKZVu8EdaVM0Ri/cchaJoA1F+/5pVBYfkttF17HB812wUgcM6KBbo3LYcG3wovMgezbeLfeehAsF2/orSDrKV5sQCbzkuMZv4j9s4l+yUpxyl+hU7aItYkYXgUaRhEFUdtYTuJh4S/8Lka1GDE1ERZ8A7uoLQtBiPb4WFQCifJ/o0DQmCF6Kj03wk60C3CbKHnajIKZo4d4DABsUr8OFFwU1xsR4QyfJ+gugIF0z9wIdopEKhy8nGiwNlJATp/HUIJlcXLEdx5aj3zMRQy9DhFgtulBCzthAwQ5bLjtsIQerD4T8vIcFXCeD3K/t59yaf814Sog5Ii0BlnrCZIFMAjTTwcAku1OdMVYIvdfQJEUhX2LJApnY+pbGvVUDjHZIr5QqZDyPU6bFnlX4BUQQjiiuyGkVcj0oA9tUKeVw0zFVbngQK9EsJso/vgGdsGGLCB12y9lal8BWXVQbBT4Ah8tQ7qXg2HnoeUp3RqPMelloOR5gCGgI01ZiECWS/mPCClCy/uNe/DdipHJlnhoCdI+R1b1YpAo4xO0NoNcdqJTf/08pnVAdFaEaCGSghMuvRBEmIR9glIhjDN2H5UbsqwLbOvz6zag/IF15j8r/b51RhIYRWNJgOYj6Udks4mT5qVEUa/WQj0PiTZFPY+dFGApCxwJvHwzslf7zpgx+IWghxsrzhrNKeKUyFonSnNSvFrGOX49pxBnizWniZivuirsZ8w5/gKhK+rbW4iNkVf1qjSIuCd7eXpoKMX8YZyX0YMQ7uQleWI/CBhIx2wek0UsZQE9PD1DBeDyJyEnn2HRD4Gy3ZVBUD+iZQiq9XrrvqGY+gNPAqDr/IoTcNvjmIGfY5JHOZcv2vMDG62VwAYXftS6L6gHEce5W7oH/mhyV99EbTbU8PLtANhpDHLRDe03el+/3i0aeyM/9qLzWovdmBVrJEIYcmJOi7DTJxFs0IfnyDvNipPsfYaRJgejoGkQN/R5X94BwPsKu+k9wvyeZVUG9hNrRqkTQdGZAd0JezmZow3IdkQON4ewqViqj0uCbbKcI9urqrrFKdDtsOVD1nIz0Zf8W49tvmROC41WGqL8NHuCq0CsGqr1DCvP8SlJrRDH2crQQy1J5IZxVlI3w4qxJQM7K0QBOX3lY4/wfnFky+A8daO6dLQazBoGBTfOJBIIWu4sLlqYv6AByDZlyofZYS6+M5D1jfoq8TBiHrpe3ZFmPitv2oQttOYK1cHfghm5ZJBZNfsXTb+tPafFAjduraNgo0x8lutjBusd4W/dW/CW3Ngjs2khudKjGgnLx3Z9CFQDnw5r2BpVqh56Z96ZM/K6GhbGpJ450Uwto8BbXfcP0r5AAeanu+KH8kO49sdPterLlZa2uDDzI8PYjZsVa18avBWpMnmGYZwh1hUwY3ODjYDODMkCGqQso/rT57GUNJg6y0lUBvfQsVNdBlOYWJlYgoIPk31um5lNsqyzTEkRKcuk6OeeXYCULZtSJfKWGdclBUnfNKxLM0nK4czyhqHP6zOhIJ4REzKEVAjeyYwJDxUNeZVXHQO6EESdaG1m2tKHgRTPDhjt1N2ywPRJlm2XyHyFCLxhCMfinOKsQLngVtAxXk5Fyk9ci7/VVikd5c25zPlqtdS5OAYylTGgOzrlPgLlctmbZXbrPrRsDMBR8pjOIyZA2WAPodOsOkHZicVlnOrW2Tic7GiVaiegO5TkJKjlqsGIwcfs4JAY7fOVoTIFH/uMVToqc0qXcUrVZAr7zj5W7hEhDcLw5ftQ+eRqkEMP+KwseLxsRUoHXckHGj2UluiMjHPaOhVOhS0Z2Dk5CsjpceRs8eP/RQG3W0y0erTcCE3CPQoAklFQwbl3QLdJ0wsv0Cf2Q4Avh6fDE5uF0tbMIsEvVM1Mh2hpU4XLl/Xm95qJjxkAh2gBowQQ3IFMJ6ztS286yvt9N8F+YTVjHOMc+xmLiSpOsB06MXFi5HZUUqmx8ii0X3rGfuOcpeUrF3vuexzthUFgUDSOCRwHEj7rZGQBjziPguCKVJQx9xGOY/R9Tr2NbglfvQvxSIVbLi5S/VCeJhxaXkm/wkrjSt95BwB23oSdqUAROIKMLeKhyHSoyTis1RHYaeZYjqhfS2SBMS899QKyRnUSFeaEWgdxatExheHgcSjfhk2/6z4Q7dAbfLl968Zpkveny2+C705AQBHYWLHU52y9E0/7gcjV2BrWo/IrCHLgT9lmPiswMyiXlmcTtmhkixAuhcBJwmZZRKHg5MTKOGi2wc2FrL+tTlm5LoqEvfL71wg8UilGox97GtbEe0CQj48C4dAAzhHccYcCh/vWaWUw0kNB8315zzhQ60BY8kdBoke0XaPytALd3MTsq6X9p5sPtbPSRD6hYiMVG3kSYG+GKrVmhgLSvk/GmUkdAJXMm8ixBHZKk0KsjRCOoxT5MC4ouxw+JQfgh10xKw/JDMA37Z7InFbip8EHCs6WjMq1mwJy+vxlK//3jqFH0YZlRSke8sLO4BSh9oTCYp7oWgX4kjQlTXDbuOmWNYHtXz5I5R5ngdMWMHKHnXcg0+5rOFavM8bdBKdmrwLRC7yda+gZjk9JcoU9nPUkPeQytE3L5PSYdoYeZMousNPHKCCnxz/UzUx6v1GHONms94iHHGEdOV2gHaAzGZ+gtUlkb/+HWp4T70qe8AFX0B6yPiXJDtZo1uL0kG2yrMM4Ddc20FxsycBOs1NATn+R1fKK/2gZoImtBsgKZt2pdW0FjXxWLQYZaiupLxIgAeqxU1Nifa4W+ui3T2Tfeeeg8uDn7pr7TuNGWA1AtVoVVxZSZ9zaolCV5x1F106MSP5U/yaWJXOqabQkpZLYSJmVU1lT0YX8Q+zht6dWyfs8PuO4UDZuNNhApoWRkGqlJrNkTNRjRNq0UNwzFqKR2iHslOiSzc3Hxb+hSNkO2QMZw+BsKHRoC2Q0NMhdZIdWtBHwKZM0c4I+kK/A5QfK8rkO7zsBj9AIBvzriuDuG5SBIxbJiA/d7xCq+cDOM4iG0AAdYNtp6GSs5xrUcRzcAz6sMmNec1KBDKDTaiwVSH+otaPtUFvrAVWYsgvsUI4Cci5lmdPdDe+BdX5ko2x4eokXKKqipFNoARPQ2kCjvJMS1h0gC+MTLGzqePnsb3LeEHlk0qobFJFV+KQJDTqFsVvz1FH90cc9NdRXn/uLpIkdi9OkDjXq8LpRF4mEY41op+QgXEdtP7AQ0FL+H7BohpeD/g5QzsI8qULlOcC1KtD9i+DOrrkrYhdhaMT8TwZO6czncuSUwrT3mE6DHdLKBAegZEx6eeaAKBb5SBmKabLaGmWsQaUgMuRlGcy1MRJATAsYKQLXHMi0IqDBTN6xL0t3Lt0p8Schw9WoOr6eLRRlxB0DnMwwkgJYGxO7DqLmRK0XzLTmdtU4iXsbxoydMhNnjiUPLoXmaLjTKkHDqYi8cCzqFHLcPX9FH2uIUg021Ia37CqSP7QCqsbhVCS/qqreJ8W7iuQ7V5894xSr3ZCXDQzsBIVVsr89OMYTJasfOOerPgdyQX6ZXfCQM3wWwi2WQTvAJLbsAjsGUJr9BnwAyV0/fiAlyPbhDPnArf1mFLUJvWl5aFVbM0FBBVWKVBBsctZa5HZk0N5ITRl257B6+aHxucYNYNi2bR1e94+KDm5YYHD/rwUb2MEBTnCBD7jBF/zAHzwQAIEIQjBC4EUowpAACZEIiZEESZEMyZECKZEKqZEG4YhAJKIQjRjEIi3ikA7pkQEZkQmZkQVZkQ3ZkQM5kQu5kQd5kQ/5UQDxKIhCKIwiKIpiKI4SKIlSKI0yKItyKI8KqIhKqIwqqIpqqI4aqIlaqI06qIt6qI8GaIhGaIwmaIpmaI4WaIlWaI02aIt2aI8O6IhO6Iwu6Ipu6I4e6Ile6I0+6It+6I8BGIhBGIwhGIphGI4RGIlRGI0xGItxGI8JmIhJmIwpmIppmI4ZmIlZmI05mIt5mI8FWIhFWIwlWIplWI4VWIlVWI01WIt1WI8N2IhN2Iwt2Ipt2I4d2Ild2I092It92I8DOIhDOIwjOIpjOI4TOIlTOI0zOItzOI8LuIhLuIwruIpruI4buIlbuI07uIt7uI8HeIhHeIwneIpneI4XeIlXeI03eIt3eI8P+IhP+Iwv+Ipv+I4f+Ilf+I0/+It/+C8CCRlkIRuyIwdyIhfyQW7ki/yQP/KgABRIQRRMIeSlUAqjBJSQElFiSkJJKRklpxSUklJRakpD4RRBkRRF0RRDsZSW4igdpacMlJEyUWbKQlkpG2WnHJSTclFuykN5KR/lpwIUTwWpEBWmIlSUilFxKkElqRSVpjJUlspReapAFakSVaYqVJWqUXWqQTWpFtWmOlSX6lF9akANqRE1pibUlJpRc2pBLakVtaY21JbaUXvqQB2pE3WmLtSVulF36kE9qRf1pj7Ul/pRfxpAA2kQDaYhNJSG0XAaQSMJCCbAr04VYTO1srDjzKiSlKZ0H6F6MkdzvAGfL0ipNge3Aq48pY7zwvrg/f+l4qccrD8oHqH5n3uAiSwHICU7qtH94I2yUDjT/VaLLgL48UtS4tTi+xMpt3Ia6WaUedYxABJNIDBNHBLjJ/wE1mY4oCBi9CFf4gQUEZEprEV+DxnQkFOsRT+7rA5T4DngrwGDgIL2c4AQi/xOcIAk6NmLI49Z15fX3e+/XxpWV/fVXwMAwMV3SIF88ppG3F5CEyf0QRWH6T+hC1+hgAXveOI75wL5NvKRU77oAxcLQiASLhK+gTLRbpSL8lAB+i6qRLFiveS9NV3OVgzelc7/MgYAC1BnT/0w+wDDckBQCORHvIayUc77JUPfT+mq+x+cAHiqbsK/V1pJYCPw78LNYsCD50q8Lf2KQMi//+m6vu+HR8jPICA/qOURQHPc1zTvZmpClsK/Lr030SYzfA1Jbjaba57pfhlrsTFmGmd8gH/+6woN4cYXfwLwChUmgaSSSS6FlFKLFSed9DLIKJvscsgpt4VmWRQiy1Mtj8KKKKaEssopr4LqaqqltjrqaaaFllppo61OOuuiqx7mR8mCoHwwyWffffEjzFDVISx6WhcCS8JWt3CDMMzw1IQkX6am0VC9rDfKSKNN4cBgw4UdJz74ESJQkGBJJJRIYh5SiZRGuGgR/oiSVSaZZZFLWq0VkFc+BeUXr5CiyiiplNKqqaSyKoqrq5H6Gmiiob8a66id9jroprnuYjRNfsqtsdYKq6y2koBABuHlxL1CDZosl7AG5FsvwrC7SwY4EfCR1aG4AbdsgSH5yq5+YcBPjhWzQf5yxjDkuQj/l8rEqELY8u7euCH5ImL2wJ4cVulc0cL8v58mq0/s5REWPaj05d2Y2QbXyQ+qB9PHEuQZQpiEsaEx01E3Xk1wYLWpBttjkpIfSLqyr1lMKEi2JAdOIxPiQO4lJx7GRm+3Jhs9zWbb/f4VJLEdpMexRLqSuX4btsugA1fCjMYVRHWk+3K6zChJRpnFygcJ+0EMBXulUYyDQlKiA7lQ5NFBBw6vsgAo5MuKrGnJUCq9trTEgawqz3IxXdnLiVRd/h5Wmq5E9eArGmyWdWIm36F4v17WJUCChG2RrG4lZ0O2dVNvfmbRH1HWnVkMK3wjfrTVsjrapi5CXbMxmMb9oTA7WCqQSeM1nJyUrGszC5kVAy/h5bpsDeKXLdTnecOKwQTScCNOtY/qLPSWPDfA45eyv0+EZc4Hr0gxCjOt7yNPV0MNpPYjrcmqbYpFf9ZYKZ160BEkQXfGuVvY8Y/aM3riu95NDau4uLN0QFS2utVtE53vkRFYKwVUu1WnC3PPg8kwXNg+M166nFtGZk8bIugUamzznriNbQEq7FH6U14OWNk+I6pt4RUJJeXspNRPkXRU44I3Tu/MxaiOSd6oZ31SdR6eZ7LaOCN6RHKwG0Sl2WDQiQCzznVoXh+3qj9CV9e/bDX+YzNI2FQQ/VHKPWZ+KU8Uf8q6mB2Y097HPvQIK3QAu6HjRhsL+hQJAgkPJDl1V75AFp0WqPnM5Hc/vuhooy17knYoGIwO29038dP+p45Y1Z2L2g2wVpunohwrjPTSEzrcvfl4BEiW8TgCSWITrDHm+zcdsKIaFCOblMTIG3OvmaoTWDCIyJ558JERvvDAyApWJDKga2mCYsjHKiN4jgC1LlEH4jAy/FBmplxxhje7ynrafyLMNVFf3TLINnqmG+flZO8UVLIi0s/UQGbplqQlaLr8SUrepnRJBKvLT+aksVsJa7SCRXwpQuqtE54vLV6J04LQAXQnQ3tlP4Ck58k2vlyfJnNhim8Amk1YNKrHWxcjGOIK1wml4wwbPQKmwUAWGWBkAUp70bW+FWd6+1vt3i3QM0UOwQQ9IvUFbWwr3aJ3mhrmRolBoRtBHWbKVLO25NRi2mmrtw1Bwyeja6q0LgXQ2APPkaxoRJFpUzVEwWnVpgyCvZHABIurW2JW2OULoLKM5CMrNAGRFh+XRMzYD6VtENSazmxuqgRHnZb1YtK4VY+MS/K6WnUJZoIeLXSLIJEFadyckooDGZEvvBXMQhaWf4MGQjkHdnSf2gtTcjFu5jv4BJaRESxuA6Ie7dcci3EvZDU7i8cdaXP+YzA7QuwZuNC3/gtAEurIzb1V+EYo+ILBM4VcKoGhxDDMozw7cdNKZil5AOKjqfUdNcteEtAaJkzOAGPNKw+ESe6PGvqi1LOCFHUiND+loHryuCatveyVuPki1oesyQagZSqI+avKllJVufm3JGkORly+aD7VTeZDG0tY15fOFsu0hGFKxKyhEV2IIUdAZ0TjN68rshO3id934lJAEESbToOACSDi3YSpKz0uJ+msawO1rWI6Q4sm7SlCkR9uo8a2gn1RxFgojWiMBk1Jt+7tbr8Pb0Evok3Aq91O30x2eIrFvCQ7C3SL+jTHjTJCzRrgMfQgnMfj2CeDMNq4XmWEfMNoIDDMYl8ybCeCWJvTzhVAt28kzfU3r0ArNVx+G5o8tLWrHtV3WAK0ikJ1jcuuN9TaM5LOaWcKrckYk9PsQJvA7sNPObzWfSqwrKyVAOTXj+gwx2yfZk1whrPkYQygwZCNqWI1ScXC7YtBBDGpB/5PpY6+WUyA2pULrty5RS9P50galOPdxQY0d1JBrNB1Ua1i2XiyZZcZ1Y5VzQZXzWpWRfr2kbUAe76K4T818lCQ3mrzjgLxLcZwogYNv3RFq0oy9ImDgiGENp2DERWtOTlHatuIFruhiZiCFjN4VGFewK/WSqcGbqaLxcy0uAySNY2NakONohSNV5VB+eRQeddXqlAbdqYrh7f1iX4Ow7ZmFP2pq2C3VXSRlemWTZUMqumKPrPYcIAu6k3C2JdOcd1IVOI86YTSM7Afl8Ug1U4HDLH+16DQOk/Nupn5CX/VlujatbZoNqd77NXT3DhhUIsZFa6cGB+4JQ+9abPpuGJseiRCv522Bq7sogA+CftO6E4SWDg1EE9vEjTDGCtDS7leo0uNnbG+MgzvBXM1vzMZZC1db3cbZ+06YW6zG/qRZDcXo/n4I+ROK+tVV/oSsHKT/aRXqPo4za29cWK9Ra+bru2J1axvMGnyOy23VfNZlnsHSfcZn4txsaIwQE2q0u08st86aCODR+93FkZLEaa5uz1sGQTUlRyKNV7CrsYIeGn70FUTbgLmY07GIc74BS76yKUFS1xmdn1Ihav8uwxup86Paz432W+rRznox140zlaKtwHUg/hm7S4kufhKMU5ORhjqC/3j1kgOD29lbi6EPHKNvCKZU/cebsVj7qkqpnsGG0RBLbKOL63yfWTu3xrz45Er4pCavWGaet8YpyEfW+ciuuhNqexs60mRJCuigOigN1ykgp4b5TlddvyiSYLBki7blrfqPN7CiBU1CX9ORR1jSiiAKYVeItJJ97Izw8reUUPxFQo1KvZUq53HWLrcWvzxkY0vk3FNNm1runt40gXCiJpuW9IM17AwuTXzy09byJt8/7uGZDq95JFjW5CVBhe1M+O5sAQljqqkqCtbI54hnLYiDvlctWpCAhlHUDkpg1nHuGrHOX7cskstCzTGpQ6jEbg15GeKFLvVbZ5NdV8XBYThiMs0vzcWJ2jGnNCe3pUGHK8XUYN6YWcjXCThL6sFU7/JxTxyRZrLVQqX2VsC02KT3bTB9s6lX3LTHkl9yb5stu7Na+jNvainWGg5gok6+QVJV8/YvpwCLZ8a+JNPVLTKDP9G/JJn0Mf0c30VTw+shmTidz/E4firrH8I1cQyUH6/YByl3NdrDUg/SAykACnrrAflnfUFSb31ZScbRCnFSFlzaW206dWhaEgAsMbRRRJd6xjsNib3krMvG/eiNi9Y3qk6V0+tv/XYNcU1J/qCCL/V1NgUMGOhMwTDWQWNSD2yR0tz5JGXBKKaPV6eh7V56mfpw6IAXaI+TaavINRMFnRTKFd2zIkOOsQa4CVRSlmy4IkQTzP9sURMfF9oNqV5MfqpuT8ku0PjxBgJmTBis13e1CiZ3yYYTPw83fCzQFcTF0nFvsIMFhOdEuL6oKCzht+SpLVd1lXL6DPrUgvWFy1Cy/Uakb2AsB/ZTh5hNxn88TCHDeSEHXX9WBNWSzgH3TI3ZXH7dC7pIAVu6LLsmqfNx7PrD2ywebxB0lW83ZKsQmsZ108MhTEdi2VpkpZkcRcFWaFQzSqFG+7WDdUnI4QGUFAHwUYNReB3rtBOLcOM5bkS3sETnNJz6STDaGHHOb1mDAHSlrymadZbQ/25ZRUIGm3yyAU+vG7e6kb6HLD6wC/T4rb54+ZXB0vb+ifM8XfqePz9tvpBCkpboj+vgiLJ2kcfaUPWmavkDfPwilTw4iwoQYQyhDwvSONeJB05zSovOZkrbD320T5qCt+ofLeLaCEPbx3z45lrSJ/RsYdnlmpAfRarzk6oACe3AdYLuy5u8Fdrkgc2t0kthU++ekMnTq76OR7VaHFVq50kWFL8XckSjqJRcTilv6YUMCTPMH+Wg1iy0og6D2eKSZm9mKvUBFHwSQJwe+fiGCArTRQSH1EiZR5p/5HWVUiVB1e0bzirQTlccD4r4NmxWBbKicgKM5+T4tcp1QKjVIqEZG7M45Ir4nm0kBdQ3E3Sk3ZzZBcYzTCpw6qcSUrkUkBTdZC+WRSczCjAVJhjIFstvR6SUKwNKxyzsRFDgR1LvIjFhmJVxUys8tZwm8KMqV4TcZFUnFaL6zNNOp3SEI9KdPEy3ln7nZgyL1d5mcW8BDmbHdiUJIzU2VzOVPisopXQ1SPHi6ipx2nGBrlvN+R3Psmd7+J5dryFNVvRMNt7uPL54nfv4h1CBj39FEmTcBVyVmCbqVG8u2pWT8Zc/3xecLcFhjqiVbxDbF5hEQoT6Y+zCcd9hWbFBGkgFy2S7HN23FOs5e+KQsds5crKHMES1igXdES9VMZIm28oB5UuOZPSnldNlwDxm0XnUwIdfeHgAV9drJWTB6y1bvHw9rmlMDu76zARU5DUz4reeo3FLxYbOFvBjsjP8Qewen+yXEmzxi32gxhTNxLOQXPuhxsJKLDt0/Hx/r+fGE5hrB11qlLifpG7miaER3fUV8rzpYoYYk8LI//ZVSCQqdEo465q2pZsfn46NFoX2RriA+/NkQ+rN84TnzJXSwtunYy/8Qei9idzF2R9KAjDiqSdVmkPCDpE73Nrc4TXZHyu1FWowvQ5aL6+EVbPAX5rSjsKVb011dZm85FGNY2RVAcPprOoY0VzXt6tT+8E27jN82NK0Wp/qWaT+MruU2GSkrROfAKJBmREgW9N/lrdPug7OHlyldeWK/83/dfcE3jw0f8nvJ3uPT30nBqq7jp7HSvv4aeOvXyH0+sNBv669R/2xjBQuv0/VDo0OvKr6z/PtXmcq9IJ77QpQKD/87yWcIUo3+rgYGNXegqLvGpIPClUbFiIdegsepXGYtN1lExT6bVSKaJVTQcCkr5SKAkiNr0kUCnU60MicQAhIFivVusRyA7pZ7KzIQIWB+WfvoGbN1zQjN0p42+LGEGlY3V7KZmBFMuSzlf39vefMddIFVUGpkFRbeqYq11hvc2qZyLheR8GpJ19ov3TkvyfKiP9u3D7Y66bO9KOg9DDg3jZzxpcZWwHGJBhw1r8h/1sOAP9hGJQQQwLYYMYiOLrZOvwRb+8Qco4On1qDWFALTDMX8YNxw/hpKSaGVOBv59QNvYqqvuCZ2fV7nFHcdDeTyyx4cDRP83+7SFaMTy00jw4rd9HKrjQTJqSXC+f2hia1oiSahLbElqFJJDSP+PrlonxlhFY3qby/hlftWSO3MpZmwCfpA8KRYwHRIEg3RDQ7UhEsATB1JAeskEhq1bpLgQKAIfyJMPD510fFcXzI1rx9wvzvKo2dZ7HPOBi5pcbmAkYCT/yfAO+YegITsISGHe/JLl4f4nbxH/xAm+Q1v+tICyRhfSIrNI+dMZVBZ2r1KhFC6Fm9SpA9BPdG/WVQmmFZtLUxvDGvviNKgSWK/Q65Ubw3sH6w+viz1MN1RJppWLqpSFjGYxVEmxFDxuUYcuU84+m1ahVC0OoRQ2WBYK1hyHg73/sl/8/0QM6myOKpG3Q1XdJp8oWL1EYUJXaYFIsAQKSpUYgr0gh5DadQYdq5QVFyOlqmi0Da7CqJWWhYqSyvR74CBmsUatguahQgNwI51gyXDGbRl4REYLhocv4IH55KeCTahpaqlKJVI3KpNWoTZpUIrW6vhn8cPJBYPbrjxV8Mtk438ezXk86/QDESh+UySgToPwx1BslLAMloKWwSqwpKfkDExQU3PugVcvKsEtHjTKp2XoW4N5svVhb13J/Dpuwsee03Q9frLo5vbbjxRy23c6a0/kSDCs8vJy+kn/iVmbm4xMr+IGHlxWAl7AUGvHthKWwFAd/k8rDPoczXO7dKxdfVAgRrp5IQttLy0OxKs8sX3TsD55+kwyF3TpRyX8Lhfyip2APDdLaYQ2EW1CbreB3ZnYu1auzODQc5S56PD1CYmEOr23V11GWk0Z3U706lwNhZS2gx9Nz0QwHvZMVteSk0jTU3ONxS+1sR26Ohg3sJKPboktPjRL9RE9cR3o6hFsNpeFYqDcYjrU4lYgB7oYRg1IOm6BuCDYBAUlfLZQGkW69NFAt1IfaJ48oJ/JghUJt0kPrIZNBrYCVTGJEeftk8MVggkgTU/m+jxrjkViwNxSOlRrdVig9Pa6jh+gnoqnpOreF5VToGCKhV8Hi5zPgkYy1csVkg0FSHZTpqDf/bBijPO2DiR12bLrcXF13bo0RixY7W85JVsCosq5GaXLBDhdSwICf8KFZQdgb8ElIpVgS1HXDkgAw5MEOwFVl0vbLqVEr+SVCJBmnYBw9C4FNkBYxIdQE8GpdD94TQtw2Sy/emzOa+vNH+KOtoOcgfog3mYvGhVPHaD40GbxVTcEpwaqY1+AyacaMv12hshFed15eC/xRBOlROFAb9L9GfdG0PMSJmkqrJvvaiDo1BMsUsAkOAi/+8by9ePyd4zjwHCudCxn12v89x+HEqumtk0Gon1hfv/1x7YmEUznR7b80/Aoai80sjknw/Uk8Tccoox/CgZ7t0qfeL0rgSYQG6D0ep4jFkyic8I7SnYxPsylPGbssO5lPs7P7GLuAn03QoP5AYMjzE/UhSwyrfSEslOhrkIjMJYhLjSDwajhk1So9IHBaUHi8YdIHDQfTLNlK3W3rHS6N3qjtJt2gMZYB6tYeWgTHaAZnmfUvm9Nr4OavBfGTQD7XQM1s3V9H2Jocskvp3Wq3KOS6C8bFg6VmVEeOhv2XS9L9o+0/MQydxOjmnZ50zFia4BZjaXVjqFdXMAkTKp6SKeVn/K6EAcA+BCHPmGV7nhHP1m3vF+neg0WWu63G0srjQ1WNOPqcm5OG6oMQtK/NbF90QjZc4SAc5TWNgVwiC4GMKqWKv1qRExUGxlg74UcKeFJVHvPlveBRWEqJBbUFsCDbFbJuIyqG8tniZ2zGO7uto3wpmN3iqCyrBv4MSOwPimA4xJPgGhHPWcJ/p/BlRSsNhCSIHldoTKhKZUS0BSU8BWSSqobLEUSVAerMJXaTYTO+eTOx+Uv8S4NO040DHinU2lIVJIKQzihXwEZobaWqvQW8Psryz2ztyS6Gs1dOa53UNQezy1mYbCGrety4eSzNwjIN+Ob9OaJY6JjECqtmq9fn5Ey3a2cD0Ufk48n1jXvqr8g5V+pje6LHR13QqJ96rP66RfHdrGnHwJGD2N1rhMg7pZVndbqz2PTSqjEPgCDEMwvwVYRypgkHUy7KRy7P5NHI0lyR6YpQ+g3v41XxhVYOp1M4mTuZfGlCRlY251jOqMJXNgsA/7TklQATvJKchuRUMRVjEVwk4JNeXgoSOasleofG4uh1rWXq8Uepf6DEZV8DFP+qzI4DKfhF7adrIrtmzV6yAwd+/9ffzRUHC7R6kwq2mHVEHKKojIgN+so3KotAyEyb89hJJw7oJH316OdBaI1GLWQwqyThITFAdqLvEBefT3x0elRkamulRCcLhCVg00bbCvr+au457pujxC6QT6ponURyErYhuQ6qT5oheMg4Gy4Q8Wvm4PkjflqcFNikOh+obgqbq1pbQAEJrVMpo6icFh04zo58ZhfxEWq+plwumIyimrNGhbpgp2clHIfPC4KTxMXpjcTZS75/5vLloSySlqsRNODIqyzqExjyi1/IZC+LuUWG+ZWFrjxzUF8xrS7i0qKQlF9o2hUqcrHNFTqF0D2Jr9MhQYdCZ/bhXO308wuMPBmqA6fIY7WvrMZkVtbVqkzsHVRnnnd0gJovrZuWwvN5M8tclWgoWgeD95aW984ILc9gb2IyN7HREYjLCRudDoSZb7a9E+yHAWWZ0WWHTcyNLOZSJnMGk2bw+z6A37imNGXrnWYIdtkBEXmg8/WAGp5uZHIzqCLqzaFJM2plCn6Aopxri/zi5N51GTERZa1o2ney9D13UZPGm9YgGliLNJUKuwdVooNr0UNY50HTotPj2is0Nz8qMXVg5z33PyqTUqDJcubQnFnDPaPSlBi0RXRfXo+nyg1KgcCknPGfKkvmk9jPWZwbbPYNDusa2LXBJZs3Vwb4G1n/ZzD+z2Jfhu0vs3Y+pMGe7NEcZe7GXPpeejrzS13wipbxVRaadSYj80C77YE1kZXfLwGj/pSXzaif8RgqekgeT3YmjTpgSlPJ4LdjnemLYFhCJ1RLFVIoOmo6FaJkC6ng1q1DItiGqtX84wHp9HaiNRJFSK8UEB5pW1Rzs4ZFS/eYa0TyIKwsKveI50WJSssRtcqmn2euH2cp/xeJwSCRGvRmCXq9VKI3gL50s1Dq/EgCP2Tn/pKMludQcbbQy5u+ze/08JTMkC+UOeUwbvh72WXUJxP0kiX/si3/Fs47InP+RKC1I7FCd6K7MHYBlOZd8iJVzEvVSNOioB3rObrHreKkHuazENhiGeL9IV4LDoRf1p42rmBsvbGur9qybVFsUoZ3KOARd7r6nKLOID4EaqZXwGMCuKjT2ecSdwY8Q15/xsKYZVt137qtN8DdcrWHzbcxSTvzgkgT1oQE86zOtwpOdSFWKCCTD6UjYZMDTtD1OWfSk5Mi0AaBJwYnfVKXkJQdVojrYGteB9wUZPJtC4Pr5ft/xTaP3oyBdeVn56/7QZcBBoPieqATO2RgPgyow/YBO1CZjSYDJij+ghRs1eocoq/0xYv9wuTK62t/S258f1uCX3VAUfJvrtaLY4kYJwn+OtKUFVz7/o4ELDM5sWjs7qDxwKibKVVE8k2Vsw5xUf113VXdyetAQS62HdvAOhizDJ/BQgCElNadn6qqf85+wY6e+YG5MTcIA8x828R7jWDIM30ntrODMOQuVMtchi2TzDSCZkYkeBw7njo5uEYfn4y92WA8awnrgKW8S0Of6j+9LP9Nv6etJEHgdOSP2I/aRziljN8khh8KUGbuVSwlgfFxDrmR17WcJzAy2XCBxquhe+mURlVXB1BL+f1ux9qJtljffmI/MMb2z8U4ozn6Q5HeoNyOnToHyFKtM+ogUyMOzEVWfMCOIGf6DkE4fkwBUi5dzx3dOjc7STpHHLgXKW1lWItt03Y+nlXzevdOXBsxNiZGZHmnWHkf5nmLdYrJH8kOnUKnMh++epZrBuI/97Rhu2u2p2BIy0HCmFOxPWiOw4ySN9AKy7tmobtLOn5Fc4PZgm7ZK+4uMBt9/4DffngCXbfylFPVXOyD19gJTLTyDXWtbPUxC60NH+XB37JzfyWh0/KpOMsDyCGdvk6s/0tK12Uk8CmwrYEYClDSlfk/+qCeg30gYbt9GGlWQ6ADWfK+7EdOXFzJT9Z1LfUEPvW7+b79gyT1jdCZGPz3EDtmP2FbHs/qHUx0Hu+wEHO5sTXhiNLNJv13O3FsrpFBA8hc/gElzmXy1XupSbF59tR584nLsozp9d67alnFQ3Kv1To3i0adM15b88j98ThqeYZX0OU6vSrUILFaG6SqaoO2KFAqXxMhDokQs1WPlNhMqMus07x14UJakU5cp+24S4WyKUJq+ih09uAFG4k391qzZHzKhRMZ9DfjgbI6s670zGPu4y9W2Qhi4zECN+eqQbQF4Nm6iWDiUWRakDqeqKzVGQVcF7AT2Ad/hksN/uKy1PPCsJzv1l5+ZP7AX3ZVb2x5yRU9Ef85aD+lq8ht1+/tkzvY6xDO9pe+tk+6ielFS/dgdOzz11FfYNrVSWCAoJ7q/F6sohJgnso3fDzAIju0tVeoYUnwfig9cuAeIe3mJrfOTZ5YfknqAxu3Yy2YCJQP0jHEmTjj+tMnoB2I2BcmEokL7YAStivsILML0kDMuWqTh+6HqrKyQBMtpynm8XyFl/5GykEn/u71/lBeHgvQdEOlpddx/MXvOTlJL+I8QMfaQWGzKTtYrKN82Af+UZDaNT+QWF8X5yWEB8reer/bbZ+w6trSxAWa+XhiuBa4CUHyxamODrcGeF1DedL8O4mTijvp7v6Y2ppyPIEv16EngI5WDXHdiDvCMS692iMoUKQoayS8Ro1cYzLruO8h70XAwdUZzVq5YHqJxhRJtwTskbZ0bhYf+vhzV7ZSjIcK9HrzShJ7RoVEiFqu+kOaA127oKQv5jMseZ1t2LVirA4D6hT7gP2bdfbssqer3041nHFxDjv3se9sg80DzOUf5wrGiuUrVzIbMiri3bMFYbZ9pf3mzcZg27Rp61HAsxE7iB14HS4UeGBRkBxhB9KO1ToJoOiHj7xs8dGHKICHULUZVbGU6L0/0zNnU1DvbgA1q+c4o+sVCE7fmjcdu34LXKVHF3oOL3Q3x7V/kq+8M78tDiQf6yciGgUM6ZSwJvJorTLaEBLAEw2u+LhZkbHJu8GY/5/7fbE9XvdDsw6Z9twKISOiRwwIXoR+wPWDSHT/GqEDBsIAAKdyqtHJ2y6e2Bpl/Eb/NXpyK77PlJwtzkgC5qT38Clp8miNQlQdJM7+xyowHvN2osZ5Pg8Bz51h8jhiKlXMcdAsz2aytxUjxhLHDIexBCnexrkzkWRKUH7TaeHIiHB7nSdS3xZA7fH5N6okzYKGfG6HYIagAzyj4f5yZ6dUZimKvqKY84oLzBhbpvLkF9qlBHXm/3Io8z3kLGv+vu/Qt4MtF6f0hKEya2XQxfiufPXVp18NOrnfgaFjg966gANz1vm92LvEu9i7IHujzMdWGDtDc/7PoynPcvKKsialGlNKfSql1R1JpMTeltrqyoI0V6OLBIca53No4i42vehBRSo6xu3VqiwuTeL5v3vFJTGiegx+99ogk9nHto65e6OPwd6dAfgxR5ta12Dptuga2tQOZ+sGtTYTaiqKhF5lt1LoqRBoNEwmOlC8SgnsURghyTxJMBUKwzwKoQAyBVDmsU0GFERyrtnJ511Kl26DVr/h7Qq7dy6sCLbJXhYXv5TJlp+Vkb8k+4dMBtpaZRFRvMguW1yH5U52LqNS6530ySV18q/SJkpGld7iUmvE9FruzVJKHjftK8C/YMBdCMIZg9E9EdidUZSfxuOn5XNH8kUjgZgsuJEGYygGVwuHLniJjgpBGACp4RyyLP79y1ZV9P/UkjbyxX8oAvuTuHf8SyvNOg9YLvMpz11rK50+78Eery9Laws2PvN93qarY/S78bHoGN4mR1D5yR8KH5aMx55snMAyRK1HSIqkk/ufvQd7iAGfx0B07MR2Tgf6AWYJMaysAtIlS2X8+S4PwxbD2ums0q7V1mdz809KHZOMyMaWTdkBr+yL2MXpSdOQAShWeolulRG4S7w1gjfWnU4JRNasrfGfHm8M4tUe1oaNHijqmckz8PlyO7GdPRgbjsaGxX/XLwoDmay/F98vhRiHQt7Fn0t7ABA4MMtc4flT3oKf7ZkGpzSy7R7B7s7/p3UuKeknXWqY25b20gWXsprl+/FAQg/NK7UlvZEFv/6I/fir7zwvnCaoRk3ciOViNXPeQJL+mlKpUoSv5aH9SvqGfkC5rkYZ63RxpHCh6khJLOXGYQgggw3QuIHASwrg9NxF1845H784cIpXv8hHB5ifnqQ5/ziAnaU4F36u42H1i3VRjMeE5iPKsO7gOqysOs0vbWVEF4UxFuT6miwsskmEfspBcr+QMbZnG3arZrsSi5HTQC92N6jBWub+zLBNUhhsAIIvmIzOG8oL6ZVEC7u6o6A123XEq/cTnmUlVj5LeLXDVzUQqTpPDIyw+CwGWYOc+uiinqKl9B7W/ffejv5mvZALiMbxlF0a+gn76XJn3YtgUGaS8iyGpYYqkIq5x+rOYTH88a2ajc0Sz5KcHATyASbDEaQDe7ASklvK1Pzs1uHKSrthFFyRz9JXh3iFx/FlleAq6wplGLiiU9x7eSj6nPXcj2qPuCa90oWfVNj1EvG71pODYAjLxVZi5zCixV5Q3hxWEfT5dfXwSztu72XI3+0erbp43icV5WlvB+PwxgjeShgqaltOj/fXrF0TCYDpnrqpmqa/oBadJivjG06PVdvXrJ2sPj2h1hZEFKua8aYSIr3U6Xzvrl0e3unxsc5ZxCww8mf+heYslPx9wH7QzBuVufPxAX96VeL71gx3vQ27v/NG+/sQIPtnb7QxOMHdgGqe3ULNQqZrop6QJMpNJZLedGscf+fwATmP/LB2dSiK1V0ZEp8fxmKwmjgGIZzyZeM2/4a0dJ9S/gu2jiv1jOJ11ZMNVNjld6sSk+6ayqpHHXuU1+U2IEaIhOSee69T9MQeBpoSPbkuI/FaLVaPySEl91TzQL0mv1A7Cqd/AeASBBsrt5N2c7Hdk04c480Ubb+4J7oo+oL1ohlg2/usZ1vSqykB3Guv8zzf7O+llc49ygahcGaS55Bl38RNCLx5InAz4n7EcfuHn43sfsm/Yr3iaIq2ehRhTVCJDothRd2yE6cCL1kv21itDbJHjJqQO0tLZ7GUsouvlCe8uuicn5plZex+kJ7ZQeF6uSrUos7RW8qEbXQvw2bl1+xQJfXz9SdZU//3DCz79C8PzOgSbhEZpAw89crut7KeSNtsn1kav4QkxdJz0RT1PKvGGceHs+xZbNKjO5jw4HhGFutYYbn606oEDZ9DYs+9UNLMCzdxmzgxXgv31v4CSaeqqk4lXf+s9fo2/SxG//0VNDtUtGfjNzXf/KWeAeGH+R3L1I2UnMl0jVdTwIZNzCLe8mX8RjK9nJaQqr9JN+WBqbLt1J6ILAUyq6C8yKewWgvErFdl9/b88tItJoXof9tZdr6VXyYqM1iDfGSTNk2wuW5wive/p1PZJ9d/nnodFWWxWUrZvesB737LS2k2q7heLqUrIz2n16Xg1HQsqGSx42npOxOS3/reuHgvCxB8tsz1wEne96y04vs7UzNfkfMeZx/Hd4XeOTvLvQQ2z3jwiePJ3bfstXhx1aWAZ1PKIezZtIE1BzIybuycPcB8nSWwWzZemwapuVQag0pl0OLkv4824C/JdRuH5+biryA34C5o64rEusDt3mhXVVMXmLZgWVdpV1fY7XQ5AT8kQyCx2OOyvtRDAdnZcZRrcd0+AFC9lObZPGV8ClCkIbTC8VzXOebNz0UcmLPODttB3DftVko6iiFR9nMmPaEd8O8oz3z9PW+uFsg6JjQ+kLqGd2UHUgLvYvvEL95F09SPWZZyF2LmDMsfy/kBki424P+bwMVWYwoustRf4YVjHJP+2W1m+2mzI5hgAyM7iZkeMf2ivtuNZtGOc9MBnO2MzHycTjBvz9jMEmV2ujPOzN++TP2Lp2mmmZuusxnzZMiQIcNiiy22eG/zKzDqX1H9McVJ81P4nJLklI4lRVUpxvwkDgrvlPvDCsq2qDEwjAWsUA4dFL41PlLzbr+VOwdNMGICE7wEqnR3bJ6JRUxw51g7NbQ6Tqava4S5C3VAeMsy8wXEhsdMA2zpxDwQ8LSkS+HyKJz/JsZYNRy94fz8N8LaMpjMw4z3enMnAXqkGtHbZc+ZAO5f6Arh3ArhAWqbXMIU3dfFrz2Qw/3vhqnxbv4ksv4bqYKnTjwQZ8HuxlLy622QXy/Hx+vIaBtO1i88M9xuC6NtjwXwuvntf1TUgvtXhU9usGj9xjXG/oi5E3b+If/kYJzOHluvTXrPxUbIaK694Qt8XxusotlonDfeKb5DN8ZiTjqbsYmf1msBvn7WsQCbg4vBtddH6c9HURo/PTMsD8CpyZsPvfrqw3Xzcbne8KN3g8u+x/GL0kkwwBQ4fFigZJaNLuj8IQDbWI3o3fWJggnlVF2qIlWsSlSpKlOVqkk1qxbVqtpVh7kTdd7nAtONfxnTzchzzXn2m7sIYOuxcwH2P6/2RU0B+0t94PfyNoifBvgPBs8TMgNmSh7ZTbffT3wYgzxoquRYoOL59QuJ/YAUdSUPJ61OMHCjTJkoBaPchWO5nA+YXX6/6RQwHQ3tggAT4jEjuGESDXnAbPApZciuylRuNQyvAaVJsdumKvvpaIwzU5hOgQkaT5Kv6pgBCEqfh4h0Rjv+10AH/iZqwqC7JJgb8fBWVMN7cRY2sp4vuRcd4xTYGN0f9shR5fPjxTZw7+khPoE2sMUvAGhB1fJZEmuixv3shaXZKwTkh90P4YTt4XoS3uH0AoURsUI7CFWUwwZKaLQ3x1lox4LpMo6hR0ldhri1g3A1ewudrqtryCgsAiqT4TMIeo9jiIAnb+xCx0EJLRNLhNT2pKTbR2A6eMrukNzaEFbplEIzB85TifXlkEII8pgSlOM8Seo40ek9oLMM4UtHgyPSh4NcAe4cYANMh/c765OsSMwFLJfZeMsxD2j9vZLv3F51Wg2aOis7fOn2wxFnjoP8CDw6wAZohPfOQyJHxPzDHuxsSA1PEPZ8AykTBZS+YCza/F+cQDQhFQOnMiF1VvEhprgcbwgR1RZGwlq4Cj9JlC3sJHsor+Sz/JUpgpEUumS3ll9z9xMaiqcslJPyVrPFEvE7qUnRyWH5OuWhI1KtqV41T61QG9W5NJsiTFelm9OL9Lf0KAWjEqksqqrVs0ctmRacPehQenHuhLuUu517kruwb1HCYmy+33t/Ge/jS/yMX/CnhLxVPiOXyPfkn2r1jLKqT42oRer04zuFpwozT3+EPz/IX+bBS0W3kQkSJV+QVfKA7FPmZR11Ug/9hP6O/pcJGAH2BTvk11/r4xFe4mfumPulm/MuXfnQ+5n3tXfO/vq/8H/j/9E/bOUzUzLVmc2ZpyYmTmRMlEw8nhWXdSnrjSxuljirOmtV1iDZQK4gN5M7yYvI68g7yUfIH5Kvk78mvyH/SRlBYVMkFDOFoEyjLKdso/RR+infZadmu7Kbs7dkP6caqBXU+dQV1GfUN9R/aUk0Bo1Cy6MV0uQ0Pe2bHGoOO0eQo8jR50zJ6cs5n3Mt5z5dRTfSH9EHcytyf2E4GZeZKuatPGfeH6zbbA57GnuQ/TMnlVPMqeCEOYs4/+Hs5Bx58Kr6gxvm3s5X56/O/zj/ev7T/O9543gYL8xbwjvAu8ofx6fzYf5M/pM7/z5RUFNwq+BV4YrCz4pyiqYUrSnqLTpWdKHotsBTTBXCwg+EV4W/iUpFdaI20RLRB6Jbon/FE8Ql4qnivyVUiVWySHJXSpUKpCbpdOke6c8ynswvWyA7L7squy37V66Wm+QN8s3yXfIr8h8UYxTvKDAFoTikdKjiVDdUXtVC1WV1ifpbjVOzVDOgTda+qy3TLtAe1Q5A6RAV0kK1UAv0p24XvBA+CP+MaJHn+lb9C8MHhqeGn4xUo9JoNnqNUeNy4xXjfeNwhmSym7ymoKnW1GKaaZpn6jKtNZ0z3TA9NL1Gx6MStBV9B92NfoReQ++gX6HP0dfoH+Y4cxwMzr8RAm6xTUzQByXgAQB+FvW9uvZ+Z9eucwQRV75tgFD8uJ2wpL1alL50QH9lOym7l2UB8mkWV75PAAofnvzt7b+9L8NYgAKqrjVBg3ZSjkDE05kVBbSQ1saYAyIcwleCwFx980RPbhf29cS+p7Vu58HWr0DN4c8HNfVqXAnbe/KwWCgPgbmPm3c+B+MxOPuffjQI8QgJwFTmjRbsrohNS5QRQh6v62UkPBydRX7cGpyOsPeiAKmzo1QupqZyxfFpmaPX3HTe8FAxmRI4iQLl31sVQqE42iqpFyHL4oAxIg6fmqh4QIvze9qiM3Km70aqrGztnoxqaf/gwX5oDnzAd2hzyhQV6utGTN7azyS62Oxl5pOQSN6CT20nCqwJO5S59a3nDNty30lPETWAq0FXGBIohLzrSjA3P+90vgb4dNGw/kaS6Ff7RLqU1HFviLkSb9tp/a3QKhtQgIs4rmQsm20jiieJibylc1fSq2Ya4x7exhdErQZJJNSi9qvruBIRpGYUYLTys4Cv8xDsVWiJZXAEJ743YXRz4lsrqsFUL9G73FrEEIMd+cEWnhm9aXIVR2JhktaPljaLIFu1SguswKpwaFkPJD+heyD1IZ0cKUL0hL2UKQNiaxcRjiHlT5+gGPbJllfNulc9O7YnXFmAfzGi1GKdk3KB4TpavzyR1g84gMOs+qdy07w9Eg+Uaru4uRxr7vWAjdhpRS8zOarH/bXeldix/+A3IN5U6oc/pS7Fu817X65oYCJmSirVpqoGXt6tTD5//BSsXFc5SdrwN9u/gTAQ3uyAAHZfjK48KZttoS8rFaRv1whqfMQZ4GpovbjrJDA/1r9NqVy0+ZvxbYdPoMpcS9XuzuHO7it4z9AC5c8P7jy+c5Chx7NYCf0fqLBA6y6s/v8D4Su/AfGa0L2Iit/yFfjq60xjowRp9ocMKo7wy/aY8Z88uFiORDxfUm3KXtk8W948/TxIrxxuG9w6mO+W7lElZc0XS0uR9JdAiop1ANLyhjCzBvaOO0y7XRoLISnA9xzNW+xYvfDDOKhc/edWB/3LAoVFhzbLYb2vT9YXUBE1ywXmZDcfZFfYA1M3H4uXeA5Mgi9yawoLw9haHGJKRfrEEX8mLwuC7FAD12qwNAQ7Fcqdf3jFySLsdc8fBJt8X+aFC8zrH31/zLJ78+3wzwdksuA4ea1Ph9URIvngutXDDQj3J3ZKE1mlCIrx9ifi1aWY4X/1+923/1kZAFPgl1QY313XKxuRQ/7sZDy5rx7YLYhwZ2ffgC9e0nv2PzrsB10sb1H48EHjdGJMIpHoVm3TGawn/wNA9PyZRlVFT+bS/G7xSO9iyamC/5oBVeWeBX7/pmU9yEceuMvKMFH2LadtFtJjTauGut5n+L+JndWLmp6FA/vDBNLGjWKyDrEcSzD6PhRD/jitxRtAhGWDAnXtCG76hBvCDj17syrKEAugwKcX7KJmdASJrf76LuyG0aUOySXH7sRDPcVlocY1IBon9GaoZDxQFKKyDMfe7y3fdxL4mWI3gndU54bxiNS6A7OEyc1F+oPemhzxB8Zd9dvoYf+HXjE0QmYnNnAxB5bwfjchEJXISMRe3OVOhwmyUHWey8ukHbpxveIeeCdrWtImCxvKsfy4tf05uCP92+O8aCvSfA12sWGCzOi6Tiv1E8E+z25EOti3nwi1iZn6MUh1ccS5lqsLvzwwiSL/IomXWLn/XPXk1SRpbHIkMsD4EJ1mAmyxLSgdoXBNwaXsFCjgWnhuORX4CrsmQhgj6IDhN5eDq/ViVDP0cVb282Qi8zUMHNBJhnkf1/Iv5QoLk+/ocG6cCv830kJABITV2Q+8iEpo5xTdbAl3A+3mRrzgEGLciNZNS0xRspMVijWrbggmrDVF+LCNcH3CoQR5+R2C+wNj5uMV59ktIlBF3c31GEj+PxRCmS1RiwRmJQnREFIzFESVsQYcuq447FtSLOs76loEO7Bzji3rOjpkxEEJP116Fbi5eGLoY2vgqRorZd56C4MAXKoXPKoY/zC8+aqOCDn+NfxM6oDlhD1/ZSLSKSM6wesAkdv3WlsiJEKS54mgOfefG3nhTxGShto3cgqko/yYL8P/0rfoyGN42By7A0E0SPK00ulRQDDyrJKQxCWPIDJIhsQDbbw+KU1n0qVlTnyEnM7L9ydP4heLI+eXsZ3Plsjp8k0Zw1Yp5sO1wM5aJS8lHc3hAPtJyBYeEG9aO1Lc2brhaWyoqsIBHdGzQmKx34NGHPplPmmA5atwfT79F4u/SA6MwdiqhDAzNODmhV2gA6+wzVgiU7hHUqxYghivqeQboP0BC3hQpQqsF2brUYd6hPDHqulW9Qs0QKMwnFuDJSGxxekjBwR26pmoYEU8/TYs0Q90LTU04Zs9vnoa5/E/20t0hq/NhVkQ/HrfI+g6UYZimhodblMCSSYPoR51dei0xBSsOcBeqcMRO/Py0e5XJvRvH7jGxOfNveXw6UzlaK7E/TKlBIggC3fVcJSMnOR7Az525sQj63N8bv2R5fzXb5fC3H75vbExPvnbm6sW9JvGWKvNe7ZdpHJmh4c8/pzrymIYPBUScKtyv1etmWegW2XZaTu17N44lL3PSlaBzLr/fljFP8x9TEDyawsC06oz3dU/rXbXc8BWveh2Wp3OmR4YgMFuU43RFzOXQGo6GXV8ju0ZWNWcYA/MKnmYf37qQJDj/6gx9hTdRf5hyVWsvIDN4m6RK9suhAjr6Sdi/3Za/fcLcHDYYf+nfy5/Mjn7bR+AL352B2JwROvQtE0FFLnwUrA/sE1TSnpQdA37QUDk0mHgFdCimzZ7SC/9JoQnfPCohdRhGVmhm9zCZ8Mvzr1Xk76D02lBIIr8X8Dvm1JIxOP9gOfFbdkD1epeNvUn/r0hXr29U23dcsQ6N+wGA5XGjS0srKuvdk7NpGBXg994BrAEFuTqGUUKbIZNz0u1H19NU27nskRHoUhOBCRKwddBfGUm2goB74ZkN6nMDBmi4YZr1hPiWrS50NxgFQIr/6Q1QyTVSRG8D6kJKnvf96pGBUSxmYMqJBHe1bNz2mJYbt+801FXXiaMSGQcG/kb2FnpZtYqo1VgUL7FZI2NbtoTiD3fYLiQkQNFcFMfrFg0YOhXpj+blktiLnQGhBDItp3i9vm0kUSTiatiD4ST2iydWUMXYR4ICcypnjg6Axe1SDy903dT/zzzawgGYdnevqWqycHmaDq3Hznmulwht6TUIQXvD15pm7lZXGEoGMuObVvRIYMkbtY1p9OBDwcE9wYziubHoT/Mw2oc0h5Ng8Ltm1BUhKdLQTGjVrwAbjGmps5wpcFxOYb9h3ONIFn9aLkgDDzBK728EYSNdDV5MWxTZdLoDGlaLZ2D0KuYRgRtPPS0WsWKrGTIsH4pi14k1yuyPw3vqkH2z2hqiac1TwL1EhlHlQrxrkWqYysdbIxRsKtnyIXc/OXT0vP8YomoV7JvjK1IlapuO6i5os34BvexOc61rkzeRDoXllz16naD2s/Hrc2zto2LIttNEgePY8QV9ZFzJ6sLSyvpXPa5zUxSFUUqP8VgrD28IcNrZKeywg4wfOgQ3PNNmliE9DQmH/mBnHJ08f6thYJcPNsLPWauZb1rsJAM+EXZbHMUwQ3S2i8gE3KylSAV2patdVU8t5CmVFMtn7H3b9jgpxohwz4V+TJslvBu+yqL245LQOzc+F5RyGy1wMOCjYe8Jh9P7dBFuMJRYReSrgqNfSlsDph7qqKxasc4xOKDm+oX0mMjSeraRUXOU/Duac7OC5+Va3HA2FcEp0tVcSCNy7v5Y7kdT6p38A1hFBKNv3uNY3kvdL2q5muFrQ4Z2BWoo2QJRwVP8UwtvuebfZozVBK3Q0vbRZaVxdqIbkIM53l/Uo2FQ4F1W1cxTmPBu7HdhV2HyE4Lp3gqjNG6vH2DtjV5pSWENtuCWSqGexubSWVxh1kfNRjtQzZA3B7Gb1EsK3Xkz2AO5o4GY8g1hssHpUIHIhMdLz3kjnSyCK4zO0330IPMnb3Gp6neEt+uAmXAdSVzviri7v8y3HjKG1qXKMO5xLSQBqmOM82/Ay6fgJAoIoZtJm0jWb7jHGJtzJlXnKiZVHxnVFTdzOmjpriYTGXko64CW6QjiwOr1JHr7MUGnm3w1xKm0kXO0E0d5K4YiZx0+bGtvdx0aPUxCEwqdyFqtjEmWqthP4AeXIO8g7jdyuPhBU9k7cOqkwWwAgttJEF28whxg0HZJgdh4rAI7IRN6bFuUMRGjth5G65GwymOVq2YBT7p0Y14bl7zXmNsGkTBVCidcq6WKRl+kklAFVXtWhyX8CX36wdgYq278FNbx33Xp2AVASlOYghx/+o4z8SfK0/hc8sYdEHXEZlLGikgu4eIeVmQ+tYMOx/UchzGz2NBHxNvFJzTV9RaQTkLi+t/+Qbbmsr+LlmBuq8YW4a5Ne3sMJYMsMNdm1LWOfUf9RXyHYg8cddecQf6SL8IUu+mzNZKX9jOStosMt59UJvMEE9wYjO16KEqOc5QKIVrj7JPz8w9CyuUMEE4RLZwqPlXtmxbNrd4tLwujL4qI9ETTjVJobNFCbDecWDHuCmiaMcfS9D0rdLCKZIajVC0rNPqMGBV1BgGsQ29OJLnNnYwBdrjkliVaMSFqlgsVHQ8liE2MqdPJaiIVvFOQdLJzH+UiASLmLl9Weimq+SbOOObKAs+4xwNZ3yarbgSroaarEs4IAgGhxi4IiRDgCpP4ctGDzU1VpR0PASu8TiUpZc3Kaozs37R2X18Oba3685g/GpjmOyFSXoGJG8UCiE8M1Hc3BMxNXZrYzMxWrMwcvrOYiRtbzv4U0kvFo8WC/4oW5g+LM/a8Q03Gwt8MK+Xo+D/S5aSigfeSx9OlHXw+WPQOuw7+qYFFWP1OtCO27WE+9h6ADwJJchZid3JBrwLf9ZqyUWmrVFiOTSSqxqExN0gB7zg8yaBqeaUbea5XkiFGVnMrCikPa+vWyb4rWLUcz63mfTQKfG4NWCc6t4XT0BGIU2kFCBvTppFIfe4N5Y1Bz8XToHifJIKpXnFmKkqtwUn8RJrpR4jDLUGp49noMDdsm+6V4pv2E/rslnLwpvts//G5L1KeWE5Djdnus2XGQBrpiDIyIslbcdtdmxaRofUNsoyq6FgtmqCrtIfur9iKp75KJlUN18XV6sdM1k8NaZfL7vzjUh1bWWHtGgLlJIP2IzRB3EUjyPXPfSjwTCmE/2Kw1POjaRQSM5KGjJKu5M9a6Fn/Tilefto6BxWC8SVLskj81EjDemIFcHSZhPKZ3Xj6YULQm4aqX6M6ukLPrXjYCdJXBuP3lQGZWrmKrhHCdzgDSkiOjgv24gucrLVEXvVVfoewb1FWetp2iAIaielmtYjxFxfvxTQM2xSx3V+sA3m8jpKn36sQd5ryfGwYTg1ymIuuNBjrjyOOwGdqhI6B4Kok6r44tUnO27m+3G1nhoPi9+sLsBDhaoiaTuebVx4PVwVMiDD++wBFVL+H3LTizJU2PPPSyrVGzI4fjwoT0zisZLH5yPruovIRQLRHsSvtICVxgdopleSKEJKVbUl2FCueR/1RUypPcuHiTis6Wof+FbhAOHVpNTJzflXgjuGF/RqhrAMWH2uK4dXR4k0m1HKOBo4mnwYT56fUsn5+71F2NLDziech1J3eJEoBamxVNFaYCErEg5O6diyRKEobdB7mLNIC6wo4c+yxtRm3FgiMVOLLpY+OFTj4IYextQ03ydjMy0roCMuLOtaGMurs6UIGrmqiSNDG3I4ZlFOeVxlor8vSCYpi/toBbbw2FkkthZTE3M02qWoyIyAd81+zoXjCVW5Xa/2+7DXEqCG1DZ6BgTn3Xgu+dIaNUb1MOzAiLFR90HOdw4n4JZNNpjjfdR+q0LLLP6pwJ83VoAryzAGpUgzeCAM1lxjJ+lqceDNr2zpYf9WvttQCet70V7O8AIrj9hrmAf1iy5YjP4o6ZXoAQ1N/XE52V+MKZTme9j8Iqu2U3n4rVjSG6LoROXfPqmerYtPad09pel/BC/wsjcwend9JOqWYX64NLMTIYv1abOklQBZHPeUrroa0jgXlPORZPsOVY2bgMBstfE/rQJUCElmW++ojI3vP5qOpoN7Ms/fjLzhKjKc/zMReaOkkD//V8L+65Wvxp271FZggxyiQSx9OljaKMpAddukO6Bk7iyCLyFBss3tlcMdEzeVHRKbhKw3CIj14RnXASH+ezvyfi2BWaaFr6pFwuPCQ8ud5YceyUGmk7/qipdit3Uq0AEdPTaqtxvqDIKLZo+9g2hP8YgJ5sXv4tAghw9MymD46mn2BO1ekG4RGsdHXoksgjZ0twc+AP9IX9/H1b9/AD77FYg377zaY1j8mq/AT1+/gkgcxjiGBbVwOrEyGmSEAAiKxKHmwePRBJIjZOyFyuXUwtRAioURigA5TibCRw0t4MqH5RmYOR47Nt/P7A1Cj7AhiLsBCOPj4FDQ9ppHPSEJZRkgOoSyJwcqq7LybwCJ2Do5tWMCNjwKVGuhb7Topdaj9xUzDYh0FXBNoTdYL+/xAUJdCe8QEgkWjqPfx8Qgw8AegUoyrvonBp9Mvg16gSKQguNvOBWUm4HI4WhGLTepyOchFfs+mwFRIQXSOusZL8SDgJ1nK0WGz42AiXag0xh5jO7WVP1PEaDzOJ+NC7L4K6D0QZHiTi5Eh+/gEDJ374Lx+ZP7rx+w4sspoYFgoEqAkycOu7MzNq+OV8YVH8gG7kYuAFqX9uCF0Dy3rHQvm/3ffnIC/wdK/S5R/gu49C3vnC8DW86DXQG4OmYzyh+n5kDTeKuvXXI4xYCd6PHfV2Yixe9DtZjXJYNAM0NTTbRTd/hq0pwN7PhmyIb85kG9PmA8B/JqUk7/IcPY4zyaonv+7j1tifPI4xQi5X5INRrwB39rU9BhUIc7O2y9kAzqXoLC1hIxynAU2lz5tOgHpDDLzheVe3PyxVpu9ghTmvvehutNfVKD9+msU+o3cqazgV7EI1MzSrUThkiHyG2caFvYBPfuXkctf98XzNfR6nEO8IkYrJ6AhtiEIFpdYnfA90Ylf7JInwveRZQOn1MaiO+oILZifpqzruPwOQgEYb2dKZmFazMp3FImhLH6u6uijdkxTdcDN8dXlBPR+t7AaZQpv1dWIXfWtqnqCkIWqZSrHXij0Eaiw2+kXXqL7DzZtXa9OOFxHNAiWom5bDOWdcKBSO//rzwsVYvPzwQje2+aJkSiVvEg0El+e1L2WQOutghRaHDyTB+im7pFCJMHiyZtljLQeE+E8VgfYzmUoZjRvLx5WRqGOAwIHrYDS+JBvNp2rkQ98S0r4G+em9gNqWsPYPSuWrkl1EpdBnmIhXbOxwKsJuKCJFDBKmCvzVHYx2WxR9kS3xLfHxk86ZmX3WbOVFG+wj168/59/O/rAtW4mk3XKIYVzufaBed0GN+GnKlALoA/W65sM/uwhRkXw1Rl/e1iSZuvFs4a4w1IXdlU97KMyViJluADxOJQ16bqDQ5wLYxgQlYRZZQ7BOkaftQZtsn1iYj6km1JT1gIToN/78Nm+A9IiaAZ8FEc5g9bQdLUKPLVqrFZplje7lFXr0PZjksWRFaB9XzFEncS7kfBTU5pwwWXxZ2rqmS+ANBvDfckE/v2XCXp3kDWQVShhmUKF7I1cwKu52vw/VVTazSfExCoeLoQCMJszrk4M8HBRwtCsQ9Ciequzy3dsu6Zrmsa/IJ5l82QGZ3gcEq3xvFqCP9WAlwmIviiKE+6vXyCz+ClbvF2+odIN0P7BhoEjuCIItu4TLwkmOJ8qVtTWi3CD/6cWgq9sXFd+Rn4VoTATqk6nSzGmpNkzINFeSq5NE4VldPdrOpOpbaSwLSYku5592lKuVMierSPbQbB7gm4GbVJpDxPJbxruZqx7z2Yyiwl0LwJDvGqFLQX7eK7u3w2OVQOlK58wXnN/DtPjY8NLKSeMlOpinlCiNxcnGzUFBU7vkgPqUobqYABBSienE3v2gseLuGbaYwCDGkFNgTO2TysalPLOysGNbRyKg3essqw7hVv+t53QhklZBMXp9ZVI24EqXOqk4OyiTidKTOXeZDeYXT+4dKCHk2vUSctwpJeusJmm6ZXXw294tkujJESx5jS9EnFMKpVSnYmDaDcdWT5KO/hNEdOn4YhhZ5rL9mlRHfu5vilvUE+uIBHNgtIjZaZx7IF47mmzRBrHojYCoKoFqkL1BXm5teXx7d9f89JgR6TkLovV6VeJXe9HRMT+85kLJqAHutWAhk4hD/QD6Kw8JTJ8QygD0YCacKSXaErYmtjtFoLhCS6oxsvAr0ymdxxV8jcKmZSFiR/fTLVTbJSKFuBxCz0pywe7VWPdI1Pn5x1JeFtvpoh1hXdr6KvW2QH5sz6BvMadgmIAbEmAE2DXMV7lcqQNZV3vVqpj9ebavqlFXYcVaZVq8NUNxJiZQUsFFriYfi2Pt2j2DQB+y1ChijkevNMMQ+ID81XmhAQAnzwlC9H6cm4Akw1twzbvYjCw05oG56KIxaMGRb6Uh9ypwc+8EoqjK55ueQsTDQQenpqe8HYEEXhw4Y5WtIYmNOwHRN6sD69KvnAViyGIeEmKsQBx5Op2OWQrEPN320Ws9MYmu/i0XX3ON3KrVBqOs7A9jdNorBpnI5yYTQt4v8L+CVjtlRxm6Hz9NwHpvnI90AhELZM0qDbVIXtPvb2c5RLjMshJ19Q3W8Zh0GUd8L7vqT4uL9rlreDV1w5R3bPZEoZyM3/MNmu719OcfMmVAz42RlFqp17WgM4TqB9lrkdeVoLQZnwCRRG3OhE1RnnzEMcaSbEJ44fdsiVNREUWjLIleE0+zZsKIVDlld4o26OHQ9Vz94gKl9f07La0EiiEj30ZthNtS8jRtVaa42jgL2/a9+I3Fi6rDUEQBAeYiSkB/4hnr9Wm7lfkX7KV7g1xmjhEr83g0sBe4ma90D5YjQqKQZRmOzpWO6xommI+FE2XGaR0zc1XMJDeGJK4jcjRpHHBIHkLN3w9+JMQNcUkEpCpFZkSnQSrYAIRGsFFD2+FZugjbTZvaMJb3dg3JLK/ZZm849kTraDgOAOJV6qVAgLIZgkBVNYoQ1a9/Km4/PH9Uh3pnjabpQPH696JSRrkKXj7pdhF2C/V/Ty+YseCq0Rm4kWr0fjJ2JKM1ZxzDYPXHMGnTNk6/s7w50m2N0OkLDtDvQpjLYzaPS4rLQxqCrPGC+ftbgBubLWi6vaB4OJlVNw+6FYzK5oRDGSPArVv5rrWklVLNn54hsbrqS0O2rM2aOF6gQInHw7Hp29DlxOB2+N67YSZpeV0vNqlpd7qnZJkZ2zxB5OjfWBpVx0ayf/NXKuczocRyK0QvMeAdDl7SsttLoe+vG8PFUMuWB2JGp/x3ldjlvSjB/0KuuRoSNNEskF7mow/HKRuJkcQ8F7zqPDOtmUoFDaGOuLM4FiW36zIC0NFgz0KZYjkSZJr2ipC4oM/HK6li8eVZOhE0R73OVNqMF7PNQzD71KNknC341SudtvQC5bgAmY5UiqtR4OO52KezO66yxirAvXWicJbdj3RBpBUutY3VnKtNGw/XWkFVWGTDB6gj96S/TBpGw/9jjxcVPMQ1lrPrB7YVslsSu+bsl+lYiVe7Ew4bkwC+7lddb8gPtRnClTtWPdLBrr8mNto496J/73PzD4OChthH3iWOWL7ahgDiUqzLxCqRRvt6HYMhV7VMRMsqNYFfxXHKXmD03D0IHFvU0FrLLtkXlZnhOiq460ML15uCdJzduwXh5jZT/lUwGuQFDiUnDEDQ+kGHjESi50MZvYGtDTKDKJFDX1g7woOyk2m+eVpYdxwQkEYr1NCMdeHFGqtYvmpx7FGb9waBNqwW+0KOdCYzo/LihEpa4dPJQRU94Mm86haKNQs/JgzlzZpG6a1aPC80NEuEFQeBQ1KgXA/JRPr6RlkbmDfeILMZsVtfy58ksVG5ZmPxxl8QRRR1WhZG4idM+2FzNdr0vcBbiII0EBR4VhO79izmbuA/aB4jSAD17uBpwDuKejpbguPmjkmXKtO9G4xS68B1i34IJ3Dv2H7ZV5+6zvelFXNmbHA+mPN1ojcVmouuZQYbUbng+le8Qfy78Pw3kO5yb8Ub7VdgpgYAYwrQQIyoh+tx4cX8l+Glbg443m7+4nrv4TcICzJH9s+kObP8bRoevD+/33pdvVFfS34b/cfuHm6KJrvhJ8ScwtTrY8vOObkGC6hun3Hj5cWkXffvQv4RdvPreC0rbp1xZ47CXIhUt2XAZ7wJX8mry4P6vE/p9c7ouOLHeX2fuP+jWJ/5N8SfmqFEc8wAGtl93nRfHOD9eVeSxVe7/nWn8lq/8yHK4qLhL8bn5XUUeKuduckDFa/UbgqZpyjfNncTRTQeDWPsbdmg0EViAP2tpii1fiMu73f5N3IXMRVe4GBqD7hkpHu9l+h/HZedl94yyPiwzYSqvFhSrODv9KpvFP6npF5P7NyMjWkZkZce/W7T29tPe3H8pZHwV+kQMN0STmb6wM6d8R5bXIveZ1r5RV/VQf3rkFSMfbtnXDMHH/9p2dH+8PC6kHbsihRRJv6Kw9/rSg+zXtzl3TZWpVMYucxeWTqrElUvxMDUoGgm/3fn52OLJ0yWIMW9i5bMVhqUR6fduhkydOHt553LnRd6pvhx7p4xdkmVHniv46sHYx97WIuWxejoM/a4kfYw8EBqlYuftkTjfHlTmawVVaBsGVLADWBA//ANWPcsjPH0VGyOJrQxzC+x+g+s+X/qY/efgXcHDz7rhV4lisIICAkcRoUedTA+0oVUb1OjMuOqWmugFLKFJTuzlDvT8UBNhYznlPUWXNUDhnoRX4Pi0Ou6oqhah8S3TTDj1ItVY07RY4Pehw8N8CrQKDos2qiEsViVHodC42nLhF2wjiWaKQeuROPMmykhJlmbjb0ca0NPJJqIcEHNEsRg2GEyGoCr4/dTHWbgUKGAn46IvvC1BZHC7OpaCISxaI0UDNehMirCo5Q+XCs6Zddjl8hc7mkXwfrtfimyn/4OUG7Ib5yXLDBKxlcmFnfA77Vt3sIMiVNhsb7ynN5+3gk7SD8T1jH6xbeOG98kU8eFnAa9rXEE08GhQu19qFSkVthSqzwRnOYaulsLV7b3iNGvy1w+S44x71qElu07YLUlWj/Nbu7xT8wCPvnXyrdGX/u15vRARkIHuwr5oM4TkbLOpxTH2B7Dg/J5TFRhUqAE+oy0s915if/KQbQQVX5+TBb8sYVsCyBq1It2piZS/rVTk9dvuulqncVCXfdWi98cNQ6Mp2RnePc1vtuQmJIptq+9PWwJTPow35afdi0mqfxg0VOOg+qU9Y8+DwnX00d4UvEAW8I37RsGoUI3ox4epdOEtp6vdGj23Y+OyUAgSn/NEGGQjWRiDm8Va/96dx65DYE2D7xFqNFCVOgpTmRtgO/36TXdOZlo7k8z4T2+F8WEPQvBzjR4uyBaiRprtCRIm4Ret5dx+7e34Glhd+Y5SbiZP4Mqi9erMHFgdiDGVQ+WewAIv7gHOeY22Zc1LtSQImdwJWPSQ9Q3uR9ZIJ2mnPInlJDxffCrjWeo0bvX20iNnXdSgndOCh1w0hcRKo4Vvi1eDCPPHjonCIJznSsze5erE+YbmL5u8F3OBtZ8lQciufOteRWSeBJH2VLVv8FgNNwGQj4PhW4HjajXNsnBtmp8NmWcyRKYy1cJyJIEzqRiO5XjO3zVrAXQD7IogGuvQG+AOs246ABzOGVMig7g0bPmBhz8dv1bCakKiv3SLQPznBjN6E3Yo0IWAWVken13zf7F19e6Ir6vbpgbdmh0lkaKv5QfXhJIQi+6GghnZgNeqP/xVL132FoHVZN67AZUhR7v/UNoCvnuEYQfjYAiOouHg4dIR3nYEJW+VrdIGUTYNWrfo300n0QqP1t7ZiKDjKWlJH604eOzM86mCO+tFSEj0CPuJzVWOW843EIpfMBm0Fns7fwTFXESn48RFnV5PBRSoKGwJm5TGbdsUXLkhsjtYPxeCzFlQtDRu1QcigKF5sY0A7ByNirYmPQdODJj4+o0PVqXqssEMQ9SCc4zvLqxnAVL62cW3ZtNpUX8hgWXxpzVZq8Uy/s5w4Ec4axT7ZKNQm1qJEOwhEIXvOHTcv0FGcWRlGy3HaWgQJKf3I6oKG6yO/JtnInBki5tbTvM22GfDc3DtL0/V9yqi+3znkB5kM0i09PQRbPF/V1jztE0m9EgPdRNSmN9lpq61MpBjEtMestPuu5ORYh4G21MdJj6dfxx2+iZotT/kxLcZpjTpZwx+cvHyEW0Md1J0Tmoi18VnQJm+JuUrxt1VgWdPp2oG60jWXjd2Oz+KW2hqKSBZW7Gh3112jW0FOToAlDkqh1GMIXbWF2KoaEHLufXeuQlnbqhb5rWvMiD81XbWmmo8wA4UYFZXKzUxk01lWNemfFZ21ERbFF7HhSrPiroaRBuyqLGPycCgELH0SxcbfTrBxLU2JQWGUN8poXoWwKRLU85SpUBZH0dC8LEybBhvMa4tXdb+VoZmu3If0vOcWj//3Svbnc+mslCLma5yddHExlfXlDBsFWphHRxMRzt0jn9W8ybE5Ek1OfY4TAKkLUONHwPnAPJmPzOnzrgfMGllj/mko+kUvIJvxpEAWGE3bMud+v12GjS25jh0h4SalJlmiH8brOoHWGVxCjbBEYu3ryBAJk5RqHRAxiBGXwzWejPWaT491CtyYEjpFcFMbUYYotECbTymkWEJ5ftPlNyFtBqMNQCIKIsA8Kh9TdKFNpOz0hnwKH5zSOsX1zWAjAdLR/Sj15Nf+j7bVps820cWVehZntMT93eRao6vPzZbTJs6fNGbwOTq7MF+I/v6x6Kh/1DIHbSFKBhs9QJktZsJN+GdezBttygmdm/DdbIT7zAv3UV9aMA8huIzQCG/JkjHUaoI4SKcQ724WsyG3I1NK2HfG9s/WqYXAFOQ7nd3uyK5anueK23dQvvoVaJb72QJnwhgeKIZrlmZFUdmybkRnDHu2gdWsR/gxIAmo/mpfnftA1Lm6R5l5FmfXsEL0okb3aJwe+seVsiL+m1M0rf9M9MDUWdaiDYC6T10iWXTzMd1NypWXbPV1HCm2EWf+vhXa3fU26WF1+7sDfWp4jIRVED6ySHD9DYbfe+RRBjyAwR8KeG33LcEx3ri5t3ujbmAXOluP0SvXvy70nCz2yhDvMxTW4t+6hmv22tWs6HT1ZBB8SkCM8G9NMO+RmArQBu08KtWmTBPnQiD3Ng5sng/Xy4OtaEw1Z/WT/QpYwDIyN5NmvoHzW6rI1uDMq/BHcHf9oOUqluALfrdku6RvZfDybNeBymwbgDOe0OStWy+sxnkhf3ArBv6z8kr++A1IKyUu1EDwX4rzkGvN3q+5hNzfch2C5I8uOX3a1Imy0jhRhsA699ZPaFRrn9OgsCqv+GqKMYMkkkPMXayIJkIgSEOolOhqRWmY9pywp2Dmviy7HFm1kqoiRKSpUlEyb12BcTZ6cJRAkFYVCekAZEVmhxIo8rgKcp75z415LfBcxtzro6RD7PHoxsAa8fw0Uhqw5v3dkokEc6oCUTeW6gQjnyvsokJSzmrpkVLD/VaBFb0RTadHQWimdUc2o26vGuuTQRtcfdBRURQrZL1frhUHwi1RdHkv3KHM6z/8VRY8RRpGioCW+WJleTM+SrZ4Hu6yFxdPboziXU6sOLYQKHw4fnCz3KS40/Ml+0AOZNuXXU2yoHSWbUjrKQ7Bj13NVw9yy3SGyZJoHM5P8DD2oc1nFYpH1rmbm7feHtYZETQRPWrrVbogG2STFNjoBgxe03XIaXWZzPeq0rnZNFGtAvzjGuuzAvIzpCEjPVRrFtnh/VqsxRwVyzecysYlXvrsnPM9xoP3YvgHA+s/6GyNp2gy5skruzpEnZiD6mv0IpHuasBvmndAcSy8TBX9QOHVWVt2ZyPcCI1Pt3Izhx1OD3XQW2kw0U2jwhsBdMOrxfki53cKvFkOFJbhlhbEsxNxUaWWGYEMnWv5OYUL3QrGpjShENw203TgfNJC5MhLsiuxI+k+8gjgYdshBEHNcHFDkueI+xTQnM3cmGT6i5xZOkBXe4QSdaUaosP9YjCH8/2sL+MRrC9F+iT78AxeiFf74nl/frDMD5fiN/NZeVPYnQxnGL3eF9nAzQL7eZV5Tv+/re9Offl0JdlfOgR61YvTtPG92fr/30KEHRLwoRZiWqg4ih+fso00BOq7bF/WxcO6cEQuDF4Loamdg7QOQppGfVc3Vu4+26TUjwzJNLIfXPUe9yhB1L3zfZ2+XB1/dHqohko+297bXLY8NTgP3Kz/ZF4eiX/rTFSp1zbTElS1pMlYBMWr+CKfbKwLVPd0K3xsIpX8ybXn9ODib12sJen8UuLc1/QPrkMU+YhfJKCIFDcYgyJZ6FJtFqvB/ADK15fQ3gbl4f76rXqBnovmazf3wN7mJ8ICfPQlttEzg0UbqzwkZYjRt3WWMyU3wgGXlEUPbuSdFRkiEYaa8xV2IxBTXPqjE9BZZomml5SPwqHCjNb2ggseihRa9dJysYkYqQcWoiPlLO6H21AFvhVj8ZnAz4fnbFTD2cz8Rj/2UWFtHncrIp3u1RBiu1JEsGchViHUnuEfZz6mQtHXrJpvxL76xA6Dgh04WFPI1+Ay4KWgiTebmVFpLU4eg73YuEFB0ELq9Cp1wqV4ZeLPciwMr3x9ka4tZ8x49UpadGqCd7tdbrqlzkyal+qDgpmgGGWMhmtKRxf7OViEADNDMKezjuEQLMNZCBJugwUtguKkGqR2zQVVokuhpiZ8biTlhOScvhN+5S87vzAV3erJe3hNvxRN5o5byFGcBUfqO+bLINEeVVAGRdrEqmUy6+MaRKDQ8MQ4gbA3JbIhBuF3MGkcFopQ5E7QCc19dItqkSPA1HNhhOh3igpd5UkzV15OwDSyuweiYRJCYpDbsqjVgFLpsdrJKouMMwxRxwE+s1vC7GHmcMIwHGabG7N04H1jy2Y6rcYwNUA6S61UeQ+m7Kx6Jvt+m/FCZzaSThaH/AJczeWlGHiXTiDizV5GAQg4vmBVqiLWdGcMBvTkJdguqur9e8RwCFg8jxIWjgR4rzYZ4GLR2yAXFQ7BlWNghJdpg1FGhh0PYz4dezqrncDO46x4NLL0VS3vJ4tKabtRq0Hb27gspZsk5UNsiioWqOuK7g0p4SDu1GbYAhDylkNWuoW7N9DSzVGtAUuy3T4tai9O01OT6trnmXa+0L14u+bqVzdlQe/YdPVIrbtF9lY2Wp47P46sQPmmyEXvGuMr7f9QJrohf5jDnoUeyDLzaq9b4VcaWZ2AZTAfLxY4SqIU1jOO1teyKwxrhVAsV9ywXg8fZQNYB+satffN1Je/Yyv+iCPIpolpOoqQlTLFrJG0q/COf5LZ4m4Bte1FxVYiD96bTjo8PRZ1JeodWPX5YaAxq2+SVDB6xE7CsOllS7cIdqdaVptO5Kk6nmrMNcdD4Op08Epp7WwfHKkT+5xuhVSY81DZupEwrdpW+lhRd3A55buDwnmeBi1CdV0bo1J3To9Y9IeVB72cIyz006YaUaE0iJJIYxKc3LVhRKQX+cxJqVSxoTQR4QJJojwtChSX6k5BNGl0NgQ716kWxYuitFCmSyo1dySVwEtcOHCvZe/adlIoW1pwNBAia2vHEfEaMCiYfFjMkJAClRCLshlcodiaKdLp1Vn39QGx4v5KACD3ljEzdy1sGeqhhTVLja8IiChRqH01PxOdLPl1/i2rvgxav4CHPXZZXUN9cshF9gc+jwMaUSaASSxy3Gh2UY3Ll4mrqtg4GCri96agPCe8NAAIkDWQZDaOCgMWBYq5RDMhVmMTwO8NQ2/PuAfJLCEvrC+RUjTd7RCw3uMSSIjIHqm5EtlUqVK9CoSLYF3ocal9tFoTSN0kEWo1CiFawq59+497L6Q3Pq8qpoTmzAEjA3rOWiheYUEsUXB7XxyiYsyTYw3qjh5eo5vsplNMWSoURMJIMF/wGlIHacX/e+Ob0Em7gF6OAvH/e33SpCPwENdYZcrRu5QSC4d+6QIZxYKxZ4CRj6tsKKWXQsm9KIIsdmK2dGD8ADz5UFQDp5NHd0R/Tzc86d9o0pNAOzSed3TG2+dtYvZx2yyp8JXTW9Ln8Uays4/z9pufT9CazmY3/YF9lG5ncBYu59oH2Sl8zOuR54V1J/eIn2KuFtk2eP1ZV/7syPivqFlaORbMVMnp68KHoknEzQedhT6q/MdVpdkKImN128KndPpwfrFkoTmqpHBdD0PclFazVnd9XclmLJvH64/omfBpM2PioSdi3HZeVaoukDCejMYLAKCa3J9buNpebFSdzLM11bav6hU36mLP70SzcFS/KNS3OaQ1qmbqLzBhu/JNUVpdzCKk7JvR9OKd+Rf6LLhMQhi788qn/rTGHVdn+42/U0w8EhUVqISa3FAMS3Ug6kiiaaaqvuDnY8MY9z3L7UxeKaM21Pqb5htRbCZ1rN7AX+tHMRWIJwhP3cLdG8MD8KBikDG5nucLtKpGAx5PuaFV2lvA6k921FqN65Gv0IEtG1+/UB9B5JuGOuKN+W63pP2SN7trqPPYU9SBPLGyUVGgOhetATEjtP2MisENkx+uWJ1X1dwlsLlHN6Em26QeguErFl2C5at9sP/Vb/cBAhMwPGMN+Qp/1qzGcGGlNS+DnYjE6PObhkJWeQirGvF7Hb9dGcRLjH9F9KbVhGft1CY0dJ1Z0iUB7Vvksyqi6UQsC3jP+OMpFWkTtDRASoGxImOAawjxNAvZOt+Zb/y2KvzAe9Ay3DlUVYGlEc0+2N8b4eiSUl3p9wj9R2AKpmxUb2kjFHZxPtN20+cO7/LBNuiZ3k1BdbRQjMZpj5H4JqXt9o5JsoxpfVHzrZ8cgIcVK0VC9Tdw2W+FPcAyzb58pYQIJg19Qw+KYJQYwbAhrnsNWaEqKas499Vkrf7HGGfZ75qMkKZ/XHYho7p1if+TSFdMkKABmiDAxLMfgD3YszFDal/d64t9xbc9wItJH3YYMJY8WZyhIEPodz7LYuqc2j/u9d9cqfrkieHOvuaVV15+pBsceyPS4b3oIqD/5+fmTk2f/9sLCuO/udZ3Fd20ie7H2EF7TBSt3+kQ99AvY4GrkKm1DcQTtNwtCrc3OBGtHJuIcO7S5lqkJYIynnl3No5pJh7RTkFq58L4DvCmaVrZczXOTcaY10AffSsiP6hHEqh/t8f4UTrko7GiqdUnIHdKZD1Wh0jRw//0N+Isr8ecsmXnZYDtVC5QOUhMsBg1IuWPB62WLdkvPVqoZMPuxcHFBagi1ac6hwLtyh2j4+OLl+Fu43hZj8DGmK1Ft6Ir4kxe05W0Al1iQlyRioJ5KyV9q2Uf2DoecUVTza+lFSHT1uJKXoEz8UgA/lHEGHdqEF1Afcak5U2vI5KEaZB9z8ZlTeDknsV5qgDdySB+VvXV6YDdzwc47ImBYdetzTpE8ZZuiwWQ2kEBbokT5YEofiqsQG1zXn+N52EG8ZYqoHXQHPwah+CxJaJC88lyAV+FegbsnaYyyDa7Dci1RmyLEFwjg7etZN8EDxDO4v5gXFa5e6lY6/lULThXwfUiiDM05x6ysxBCdYcrv8G3hVXPp2qhu26LY+jcGj0Zz5493FHdyev4FFAKlFu5OvRYwm9E1t44HEkPAPikkO5FSOcoKUgfZgh9bJmfCINM0by4PoRhQ0l7TGHYsxl97HFs9ieEz1/HDwEQEEix4Rnb/Nu6nSXXu01MGxAuU/1U8pIZ4bT48AMIcZaK2Y+ODM+Nd1hBFQxbGj5TvRquS2jAFmx9CZImZx8xTgDMmEAYRiVDAwKERHgfNV6zhWEL+xfe3onuD74ENiExjHo8Bo5UuSymEsqNO7U7qKoBjuQTnvrRIZf0OIQIeuaMrN5rH28lfeyhR01/1FvBGNmcY0kvlWPE2/VMFpPBLIv01KtAeUq58ez8+6JoodmtkaNnTp85tudW9T6JNKZ06KGL0RK4gJSACzh+noka2Rw2i80NlOcf1g08Dp1aw03p+EW5CBIixEkTC56+t71p/sLgDqfS7Lfl8GNy2Jrtq0dDS1d1rHKpxfsPW0swBb1GFWO/05RIb4mAp5svEVhNP9AGJCpf2Jf2TrOEz4us75yMdX1y8t+fqDwsIAIBU/5n4O7MPl2+gnGLNJfa0npKo/mR91+M9V9M8j+kEX0V6XQYi/w4+221OmTnqqN9pH6RxQKrNq67RFZT1i2gy2K1xbaw/Uc9w5vTNax+6MgVENuRrvOAq3RUpaTx5MnPxuZ3HDFRBCZ+jfnA1Ks5y9t/1HPzT4Oz+/G3p2t2acxMERi6QySMvgZV5i/Iwu5TnpbLTLdjIJdxVwEJJHSX2imwf+VpqN8pi//YHSIGewuHcfAemLrBld4g/uOXfBXEXHGzoswrL/D/w9Fq64T+zamK5cmky26G/3U5ihrkyV/XMlqWPlpC9pcDvqM3kWJUviwFY/YR4wuGbXQXwjuIHas32eFVqwLd+PWSlFdW0Tn2MDHx0HZtLR6ifcEcZQtfMNjjuk8xikGL+8V2BSwmb7+dtVkvrXbw4282L/vZV9GK6VP/5LhC4Z8RQDViPzBhuPbKSL7e8Qmu3D861DQpjc5XDYeI4yJpKbvmEyIsAKabaqm22Zi2w4ia7EfDqs2dzp5IOJL2DAvqBLjZAWBUNaRBDsthRcu3nj4KKj5Ugh9lVUdZhJZwAOlyoVe/s+clhvBurHD18mLoRLJDV5IOzoSK0fsJJWBuVdecHidh3gtooDOYkxZ5y23j9eXATK3D+34nKz/S/cJ7e2KGHu61IhGQbBGMq69LsYhS12lmHJQFlTgPaTDOz4TNxxvS0FYfo62cOxUy2Id2PzNAe/UsmbVCQYT5297L3GVemNLwfPJL2cGPsYvq+Qx5Zftg0NeXiPg3Kt3JLvPUT//R6Oy1FUPDrvaRi8zr+mIrom7pxNLdEC9q3Aec3Dky776KsIjjYML0nlKxiv5N3PEDkVXvKR5s7+D8+wlmIW0WEzDqNdJUXfGtYiU+ueI85hWYgZlvVBXvqu7wjariPuY7wBM8HcsxXrqOgi4e++rMjcXaNK/YQpY6eTsNGaXlrwb8kXC8CxZUZ7Sa6OV3S5v9THXck5iCvCQ0+1Gjnmp9k8eDmcKPjFHWqAP9PXAGS4Nt8L949BG0/j4lDUTQ0ZogqpNmfh3i0uxGO3MLYonExnKaaG0Pbp2AybxnHnAkMCwiZ3pR0f37M8oDSDO52FvAQlGy+HoiaazTGt5NnBx1PsJF3O+2dOvQiaeLbVoWv7oeOH7aqKHNd3O27UmRQ1TAc579U1s1N7ML4InjTc/8x5O/bqvzb1uyjN0kHbqdkqzs4/VOZ3M4IPqqFn2eOs7PZ8GmqEIGq2JLloQONuk8FMNeFaeenZmcezFHh8sN6nh+bbPdGwHmRZ0j6gSW7AYBbfMk0GTlgZe5TRy8OFainRJl+fPH/XnRZr3Gj9UoxzGyojdx6GMwW5PH5lC0KGg6r0uvjtWV2Vqz++mMywPVm40UbzwlK4tR1DwBLSHuDZNxfc6w3qV4E3n2dxhodX4OfJtSMDpdIeJYoWbQa+/ElD8cdlqN9jaH3Z3QLTowE8Lx+fdKwC8R44iwYaOvnhlIxgcc1sSY/Xybizflom1KIOID++qsAitwAmcqxyvOuf8ZDYeVYrDSBFDpneOCKgdVF1RN6EAURLH9l2khzu27nAvjSA3ZDPsEVBcK9v7QqUDnPmlCro3Py6T5N2oduN20AmEiUPYRJyg0vPFEk19/3AGraLkEdNIjfpVP2bjSVzRGYVh75IklxIMd0BOcQkISfcvFh3uVIkoZVdhiHcnR/JzRuz6QbCMGDGo9YHiVpbZigNiLMqT5izb35JfPPF/v8ELJ/JKqL8PQtIiNdPZBohmeyCDI4L4kqoBP+GJC9pufKybRL45RuSc1uT8YsYah4y+1lZIfI/E0Iif3tdIkxW9YQZi/kaYn5DLC9uu/f/XVc3lnTyuT1hWv8CQhAp3W8R4foHeMf3SvNi+H2VdR10dhcyC1pxUg8vFxxYV/hj8Fm/9+8ddLrx8AwBYsUjQIYmcp5oR3gPHUZwZWsaFDSvYQDGu/jG+QmNHYrxIV4FOgdl2kf/l/cSwe/7e0ulJP6iurhQ3tOiaDbUFga0G+Kk3ybjXBydu1HEn20//4V2v82XfnNiwz2PMJSmAFyVaD+vmmo/Er9rNRnyPjSeJHFQF4rDlU+efWiB/eifvsfyVMlZiCYvE1joZCq6d8hrv297KmPts9ZvOjTgbd0ONrzYk7EwUmZnnn3PhsARA4kdXawYtbCP+tY4naajk5dfL8GG3MoxF7XTe0CdiBq8VAnBsok1Wi364QOiNkc0wrcMWMeIPE0lGxJYs0XbUVXlrL054sdeZn260GjzByMINS8MFhRBmJRJm1xUTvl275aaqcDyX2WKPdefQ5p9sN9hT9crGWmkKqMnC+tMmgbWjbYVW1c9R3LN7bjNvZbpDo3IXYD2EYxB6udyFYcdCGaPmoHXWO7XiJjaVlSyJlyRXlQpffuWahtAzNysmMYhwEGarTPWd7lw0FMRNN9CnGpsBNHsMvZ1jnNtU280kPmNBlwwmHxsWawT1qmjm4beoKwqijAy56puvnqxsAJWftbalxl70ihJmj4aeICHGjxvDg6de5gOAlPG+9/XagENPAkdioo+75hTiUkDQaXl2FB0Ioj613qKXUBJSF4NmSyeuANbLzfOkH3pzd3z81eh9BaiMPKA8G0anDHVMe9s5PzzsmAVtDkoSOtLktp0Au9OoCMqENXeuWRRfAH6fEHbVq0hfVxLnJ6rpj3eWV9UefZPKe1LiLzEfPN+u1lDNWuTejrkt9Siyb2IiNZjQpHK0cHDp8dHmO/mX3LGkzDxzK0SahLElYyPzZhDHPWguLi5Pvkp4WcJB7QnTNTbLav2RYEdtiW0Y8pOIw9um834rom6ppX1RTeImLAg/4YaxxHsqWdHuMKmcDSF6J2c9thU9tUwTs5Krflp4eyQdGZyGm8ULn/v/XWEHB/LKmf3wrlFPf/hq2Sd4QXqHHcLzhhudkLqtOa8veXgggfW6s9Ja+1ZW5eeax65292XMRO29znx8X0mAeMkmRzLf9x2akIo+ZaLDvTGqHQh9tpDxsFYWlBdkALc0mrkgsPwhC0jCczDmeoeWds8SjyFxiF6VOaCmGKKvR8z9+8ws/jNzlTuav4pXCWMZy/e3L+6Zp+RcbjtWZuJGCGDbN1Pou7W5mFMpmSVJprSZLqJcMMjPqOHc+2FonwU9q2bpBnGIZzrTibINjlGHpt6bAvjlWFGOdReRRXyeMNSchOJSvng78nmZqAU67E9o4zosQZsTzqUcJx7R2iGWsnFJPIRZKekmpD9ppABRqcvZ+aps6VN3yY1RW7PF3eTonAdHTfPNtNDUrOuAUKqcDDykhS/SJuQfAYxYnIdattnmYOa5jqkakmMD6kBtpgkOXa2yVpCw0vTaHUcb6gZ4xdzeDLyHdSIXK5gMDS0PHbEfesvQjwFX79LdPPfvKuy1xhBn3Q2loklVuxMKQedDQN2YaFTb+GjRQwRomRUfQ6FLs9y7acrjtvN8UgVvQTWue64gxeXsHyhRInmvL6OQEaFW1bmvTUDltlahbxeHqyTmtBdMf304YQu0HeTBut4yQJUz1Ts2wqXG8xiKuH1Zrs20huGhFWVrnoWPIpBDwccYXD5yC7ilL72C0qcxCaRV70byIIt2cqLLM5WGGBy2Ub0fqqk04ip0ksL7Y+nDTf+3+Mc/1/DhrLyyvLs9nVZ9gh4ZR4CBWoxtZPLUcreqZYdCoEvqgWDN44siV+qD1565AZ0WRsdHWN5Sl2Wwzq6c8bbZX1jrzrjKzBVvaxriuUeuWjV1mZTnLp+yzkXvcFliotb+/8PIbb/3v/8cnr9+8b/UGo9GgPxh6q/2hpOmGoZuUMduLjHfW570WumjBGTVaJfjg+97hnklU3LcmjSVZlgZi93Jw1et02ufvjv/9KmIvOc/uSgtvvMhGQVF9q0/Bt3XzkWeWkUA6iRiy/TVNDYxeA/z7+A0y1zj1LeQ11Si8AG4Ln1bgkC5qfaK4TKN5RJ+WOl0rVFZh/jpcC4W8u3nv/PTs7Lw3z+oGLsXoWganyrBXZHqvKg4IUkkhhEQ3LkZel3CyaaknNXG+dYundk/kMJ0H9r7h3lTj6n5aGtP3HwSMoEpcgo7sQCIZb3ajq7DIgJLNt32xmEt0iAuRodIespCnHoQuvz9q4RydjtAOAmABa8/UhfrwYQu4cAUXPRXoT72TtJrN2V5HKvbrZCXSu5aMDXY9oYnm5u64eLDB1s6wlMNCCpRxrr5Vr1peVzcLI1JpXIHgXGbJaHEgIcN4OAFTlo4rqvwGqPhygFxDCCxBKjqViyM8M2JYpGviIsZJM1FDaPxzY8VvHYLj3Bjsm78wS2gqaxozh69vslBg2X+BjMiC58G3Rz0sHWwINzWhHtlpWbmPA6v5YEfpomM2NGZVEtRjZ6msUsSFAeLMSeKnVuGtBlo+jXEkvIb2+1RamMDSPtrNfGGHDszAfLgSKVS3D0Imi+pU0xmv/wOvHuuLRirZMOLM+lgaZ2/D/6Q7HYwQNkMbs/RN6afx958NFiZKitWMNluD9yD58EbdD2Q3ItZI9o0CDeFBe9BZthbUoiI74dAa3YCMWgNE8IeWuJS4q531e6WBIDsGt33p01Xs5eyQZfpvnmTm96WcCOSrtwo3B+oldHKpUJi1tJWGqL0KlJnfYA0gwHdGoF0joZr7PYw9KFHRXskQxkp6Uy7q+4MaLgCzW505EPZlcjwfqATCNwBuvx1Z3e/q3b3RaTd7RFzMpQA4ZgkzxHN51W2vCzgswIBU3C/QHEuC8HeIqDOhEUg+/CQvixCSL/SjKFQ4l3YcIrDMJ2YvbjiEMIdlJn/MIVLWHDGBd1VEzJi1F4G6x4Dm1Bf6XBCChv6zfjdnrm2oXIPmIPjUdCVHiI5rGcghTiYMi1Afr4wuYWxmvZaEiiaQeaD3evai0SOwWE3jdV/ew85j4L+GmmzU7Slzg+5YzpEAaXTwyt7zvO6xozVCt/3m5pj1lY24pXmQ/dJhXpgCCLCT/ifNNh9ve5j9AqvKJiLN7md/vQgSB80yW4xEYLNd9jDlunHPlpFtia5rIkwVGVa5ad9dF/36c0PW2hizOcY8UbV3lKQzKBUe7NMtQBzG3MDHQhp2mBBC8kq0iuT9/pqo0fJgjJKFQsmncaoQjK27l2c7jJvwONfpYtmaeKCTtI/uxdf/1/v//JNplEw/NE68SL+TdY7vLeXAMhfGvNGDeS9D0F0/zPtBrn15Tv/oGgyhF38B2/yxQ24r3Tde/HfkfCkUvndm+vTu3GFsHac4sg6KrXG92aHRynY8J9fhO/syKcsZbnm8A+jrPGUbV+jOljRGl6a6NUMnx7nD9KpvDTV08FCMD8fE6dB0bbnp6OtgIrBANTwGFYvpyCeN/bOggESxh5GQOhoAe+TNsQuhXS50odjlUBeBZ2nqIrIsYV0kmsW+i8y8UN+ezTkPHgsB8MuVLgSoOdOFgnJ2dBGAno2TiJpJhLSvfSmQ2+d2UUAxLV1UsE5YFw3co9hFB1uPuxjg6GAXE+x1INbDlHSxwVWGwsHD0O8tF5IBlTSLqdLEaooqjaLCbCZnQ3ptqvrCJu2cmsPk5lC7kMmMCqHL6DXvOgsi3UQGkqU6eTCjpg4TEQy4WtvdGo2qtB2CDtFLtc6UtCd2VtajbqJK5uS+Ilk5clU1OY5SbvKQCukiW7RTEfBBDe9Qowt1Sq8WOUlqY1CbN9Ta0s10QTlsu+cSytQ2+qNDdCJFrgq7KvMT9N0q6GNnqOqe6S8nRr3Sq11RNbjZYua2nBlqVSt2Gj1zl2QyumUVAwlqfVkLz80ipmaY5k4Imp6b7f5a0cnMVNWDFl72mQQKsxWkG89vlQf5n3/m8pX3vwRVAyDclaBwVY4D5DrIQoywRXC8Ymqyy264yQwPX4Hrbrvj7jlLv/RCNUS+cF+h2xaxl304+J7j2UzXu+OxIve4UXWFGt/yYiQ07Fu9JjE9zIJqZjZIqCUf8dYzhR7tcF+daaZzUz1niOdA/fp0mwE302wdZuml3RFi/SCOV5mlJPJ52xxEdJ4t9cbvnCD9bK0TSudiLZ7H9H9dUGSHhJARCpziP2hAeGgsHTT7INoCzw4uGoCFTJEuVIQGDEwZKkFg40KHAxzE3ycuO8RhjnCU7ezgDGchoY8207KV41LGXc8XQRjFSZrlRVnVjWy7fhineVlP58v19nDfHj1+8vTZ8xcvX72G0DMwMoXzmVnMYoi9nCppqGkJ4eG9D3ZIKZUUJmtoiYIJ5VKZhEvDhxGGGW2UMQYnIpHq+17+YG681OMtK/dVEJP8gWCosqo6HJlcU1sXrV+DmWCcpnnRN302GW/G7I7OOWX8sweEYATFcILBZLE5XB6fpARCkVgilckVSpVao9XpI+wDVAEyMiZnn4E2mswWq83ucLrcHq8P4Z1uiJaZlTl110GsB/+/b+Mycrd7sfx8+FZ/3b7/AXcO0qSPJn2uTz3K3bub/y919BNYeEB7G7nHTps4EMmpfT5ybVWIK9A5Yjd1p94fgzuaGj1F5VekJMLH0M1uqd81GQYZs/9Rc911CzcwTP8W1qbH1E1JKTW+oeM/+2axmHcV9iHpZ7XUl5hhqNkjOUxkBk3bLQglYgFHcvLxsaBA53CEPdHb5ayb+uUY+flIDXzy39pBS/7oncTGctM46ojCBipSUlCKiGywlD8C1IqXfG6GbpKuodrHZqMHakhOHkR057UfcQkO62nWgJOJSsFWU3J5EYpxfPsT1W3MqWOtE9fnTRhs646C7PNgjY6qmT5E8oWtOd2RoV5LCTSlTrconDL4XAwCHCz5Dba3EEPRXKtXoV5i0a1euMmQiJEFPyGtfuZe7fr0Zbokvi3FZUEtW5jkDZTsjqeNMEmP0GhHIAebWLI8ZnGgia0pxKiY3tnc+9ve3e/t+ePD4+Ngnvjd4tF+L5QO5+20VzPhQV0mU+Cm2jWOpj02jub+9ZdYLeq9x6thclypyo5c/e/Zcz17SvMnX4O/BUP/hotqu56yoKUZ6FY1LuwtoAj1W77b4ybhFBgK1DJmBaqjRyxhoEB/mK9aoR43abIbcgjZ4RGTFiFCZBsS7WXk0uRhrgLNlKqK7gyPIlHisyKmD2lxPA0pot4nCglkU5GS+DsJD4rCE4YGgWAcrAMCgWa1HcSGxiLhUZoYyxnvQLxQQN95DGBjGt/vlPwO62wyTOQbcOXi2BxHO/3QmhtiHPyOxTg6dklMDRF0vJ5J6BBVIK534FNq3WVzDmBcUJ5huKLes2MfsRYLQBNZVKBU7iXVIwjitJwWNmmSjkVYxK74+1N6VMxCp15AtbT4NrYmpyDp2kmGiGgBH6MKLipYKFYF9QuwxqJyDhOfKFJw+jxdI43fJB/nEFXxM06n/u7YQ7HirMtJ10rVytTjUJuq1VpxleBx0dZApgQqoKeVpDhx7KtaXGn9woiLue8dszpMJB+tKT4lJVYExEehGRnEF6QqtivJ/EhiRUMF3C9JYGrkvF7EkJy44tJwzW+/VXC0GTvijbIighgQWs//OoIQZdMJDhau2qxpYdM3D38mPIKf7/993wEAAA==) format('woff2');}
+:root{--stone-200:#c6c0cb;--stone-300:#a8a1ae;--stone-400:#8a8291;--stone-500:#78707f;--stone-800:#3a3243;--teal-400:#72b7b2;--teal-600:#49817d;--mono:'JetBrains Mono',ui-monospace,'SF Mono',monospace;}
+.lbl{font-family:var(--mono);font-weight:400;font-size:11px;letter-spacing:.11em;fill:var(--stone-400);}
+.lbl-b{font-family:var(--mono);font-weight:500;font-size:11px;letter-spacing:.13em;}
+.ref{font-family:var(--mono);font-weight:400;fill:var(--stone-800);}
+.tk-stone{fill:var(--stone-500);}
+.node{fill:#fff;stroke:var(--stone-200);stroke-width:1;}
+.edge{fill:none;stroke:var(--stone-400);stroke-width:1.5;}
+.edge-teal{fill:none;stroke:var(--teal-400);stroke-width:2;}
+</style><rect x="0" y="0" width="1120" height="720" fill="#ffffff"/>
+      <defs>
+        <marker id="bS" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
+          <path d="M0 0 L10 5 L0 10 z" fill="#8a8291"/></marker>
+        <marker id="bT" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7.5" markerHeight="7.5" orient="auto-start-reverse">
+          <path d="M0 0 L10 5 L0 10 z" fill="#72b7b2"/></marker>
+      </defs>
+
+      <!-- edges (under the nodes) : each points at the subject it references -->
+      <!-- agent:goose_alice delegator to user:alice -->
+      <path class="edge" d="M240 320 C240 232 624 178 886 146" marker-end="url(#bS)"/>
+      <!-- environment:production direct_deployer to user:alice -->
+      <path class="edge" d="M920 320 C920 250 930 188 934 146" marker-end="url(#bS)"/>
+      <!-- environment:staging agent_deployer to agent:goose_alice -->
+      <path class="edge-teal" d="M600 560 C600 496 382 468 246 412" marker-end="url(#bT)"/>
+
+      <!-- nodes -->
+      <rect class="node" x="760" y="56" width="300" height="88" rx="14" filter="url(#soft)"/>
+      <text x="910" y="106" text-anchor="middle" class="ref" font-size="15.5"><tspan class="tk-stone">user:</tspan>alice</text>
+      <rect class="node" x="80" y="320" width="320" height="88" rx="14" filter="url(#soft)"/>
+      <text x="240" y="370" text-anchor="middle" class="ref" font-size="15.5"><tspan class="tk-stone">agent:</tspan>goose_alice</text>
+      <rect class="node" x="760" y="320" width="320" height="88" rx="14" filter="url(#soft)"/>
+      <text x="920" y="370" text-anchor="middle" class="ref" font-size="15.5"><tspan class="tk-stone">environment:</tspan>production</text>
+      <rect class="node" x="430" y="560" width="340" height="88" rx="14" filter="url(#soft)"/>
+      <text x="600" y="610" text-anchor="middle" class="ref" font-size="15.5"><tspan class="tk-stone">environment:</tspan>staging</text>
+
+      <!-- junction dots -->
+      <circle cx="910" cy="56" r="3" fill="#a8a1ae"/>
+      <circle cx="888" cy="144" r="3" fill="#a8a1ae"/>
+      <circle cx="934" cy="144" r="3" fill="#a8a1ae"/>
+      <circle cx="240" cy="320" r="3" fill="#a8a1ae"/>
+      <circle cx="244" cy="408" r="3" fill="#a8a1ae"/>
+      <circle cx="920" cy="320" r="3" fill="#a8a1ae"/>
+      <circle cx="600" cy="560" r="3" fill="#a8a1ae"/>
+
+      <!-- edge labels -->
+      <text class="lbl" x="486" y="226">delegator</text>
+      <text class="lbl" x="948" y="238">direct_deployer</text>
+      <text class="lbl-b" x="360" y="500" fill="#49817d">agent_deployer</text>
+    </svg>
\ No newline at end of file

From ec43ee0c300ed486dfef3fb1a3f33c736c7f96b2 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Tue, 1 Sep 2026 16:26:59 +0200
Subject: [PATCH 26/27] docs(workshop): prose polish across setup, Part 1, Part
 3, Part 4, and README

---
 delegated-agent-authorization/0-setup.md      |   2 +-
 .../1-run-the-agent.md                        | 104 +++++++++---------
 .../3-time-bound-and-revocable.md             |  15 +--
 .../4-relationship-based-hierarchy.md         |   2 +-
 delegated-agent-authorization/README.md       |  30 ++---
 5 files changed, 65 insertions(+), 88 deletions(-)

diff --git a/delegated-agent-authorization/0-setup.md b/delegated-agent-authorization/0-setup.md
index 48f5d99..74476bc 100644
--- a/delegated-agent-authorization/0-setup.md
+++ b/delegated-agent-authorization/0-setup.md
@@ -83,7 +83,7 @@ Codespaces gets you most of the way there. It isn't zero-config: confirm `.venv`
 `docker compose ps` both look right before moving on, and fall back to the manual Dev Containers
 step above if they don't.
 
-## Install goose and register the extension
+## Install goose and register the extension (optional)
 
 Installing goose is optional for this workshop. Install goose if you want to drive the agent with natural language
 ("Deploy checkout to staging") and watch its tool calls resolve through SpiceDB live.
diff --git a/delegated-agent-authorization/1-run-the-agent.md b/delegated-agent-authorization/1-run-the-agent.md
index 50fad3f..9e7eedb 100644
--- a/delegated-agent-authorization/1-run-the-agent.md
+++ b/delegated-agent-authorization/1-run-the-agent.md
@@ -1,50 +1,11 @@
 # Part 1 — Run the Agent (and Watch It Over-Reach)
 
 In this section we'll get the deploy agent running, try a few actions and catch it doing something it should
-never be allowed to do. For example: this agent can tear down production servers since there are no checks to stop it from doing so.
+never be allowed to do. For example: this agent can tear down production servers since there are no permission checks to stop it from doing so.
 
 ---
 
-## The backend
-
-`deploybot_server.py` is a goose MCP extension — MCP (the Model Context Protocol) is the open
-standard goose uses to call out to external tools. It exposes three tools:
-
-- **`list_environments`** — lists every environment and the service versions deployed to it.
-  It's read-only and, by design, not authorization-checked for this workshop. 
-- **`deploy(service, environment)`** — deploys a service to an environment.
-- **`destroy(environment)`** — tears down an entire environment. Its own docstring says
-  *"Destructive; requires elevated authority."* No rollback tool exists; destroy is a one-way
-  door.
-
-`deploy` and `destroy` are mutating, and both are gated: before either touches anything, it calls
-`authz.decide()` to get a ruling, and only proceeds on `ALLOWED`. That's the boundary this
-workshop is about. 
-
----
-
-## `decide()` is a deliberate stub
-
-Open `authz.py`. `decide()` is the one function every mutating tool call goes through, and right
-now there are no permission checks. 
-
-```python
-async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
-    # WORKSHOP STUB — Part 1.
-    # Returns ALLOWED for everything. This is exactly why
-    # the agent over-reaches in Part 1. You implement the real, SpiceDB-backed
-    # three-way decision in Part 2.
-    # TODO(Part 2): replace this stub.
-    return AuthzResult(Decision.ALLOWED, "no authorization configured (workshop stub)")
-```
-
-It takes a `client` — a live connection to SpiceDB — and ignores it. Every argument that should
-matter (which agent, which permission, which environment) is ignored too. `decide()` always
-returns `ALLOWED`. This should obviously not be the case for any production Agent. 
-
----
-
-## Watch it over-reach
+## Going Live
 
 The web UI is how you drive the agent throughout this workshop. It needs no LLM key: it turns your
 text into the same tool calls goose would, and hands them to the same gated backend. From
@@ -61,20 +22,19 @@ Open `http://127.0.0.1:8000`. Type something reasonable into the request box (or
 The UI calls `deploy(service="checkout", environment="production")`. It comes back
 **✅ ALLOWED**, and the version bumps. So far so good.
 
-Now ask it to do something no agent should be able to decide on its own:
+Now ask it to do something the agent should **not** be able to decide on its own:
 
 > Tear down the production environment.
 
 The UI calls `destroy(environment="production")`. It comes back **✅ ALLOWED**, and production environment is
-gone. The tool's own docstring says destroying "requires elevated authority" — but that's
-just a comment for humans reading the code. Nothing enforces it. The stub doesn't look at
-`permission` or `environment_id` at all, so it can't tell a deploy from a destroy any more than it
+gone. The tool's own docstring says destroying "requires elevated authority" — but there's no permission check to enforce it. 
+The stub doesn't look at `permission` or `environment_id` at all, so it can't tell a deploy from a destroy any more than it
 can tell staging from production.
 
 Nothing about the *prompt* told the agent to be reckless. Nothing about the *user's* request was
 malicious: "deploy checkout to production" and "tear down the production environment" are both
 plausible things an operator might type into a chat window, adversarially or by mistake, or an
-agent might decide to do on its own mid-task. This is the consequence of no deterministic check before performing an action.
+agent might decide to do on its own mid-task. This is the consequence of a lack of permission checks before performing an action.
 
 ---
 
@@ -93,11 +53,50 @@ And type the following and see what happens:
 > Tear down the production environment.
 
 goose calls the identical `deploy` / `destroy` tools the web UI calls, gated by the identical
-stubbed `decide()`, so you get the identical **✅ ALLOWED** both times. Same bug, driven by a real
+stubbed `decide()`, so you get the identical **✅ ALLOWED** both times. Same error caused by a real
 LLM instead of the request box.
 
 ---
 
+## The backend
+
+In the backend, the agent calls deploybot. `deploybot_server.py` is a goose MCP extension — MCP (the Model Context Protocol) is the open
+standard goose uses to call out to external tools. It exposes three tools:
+
+- **`list_environments`** — lists every environment and the service versions deployed to it.
+  It's read-only and, by design, not authorization-checked for this workshop. 
+- **`deploy(service, environment)`** — deploys a service to an environment.
+- **`destroy(environment)`** — tears down an entire environment. Its own docstring says
+  *"Destructive; requires elevated authority."* No rollback tool exists; destroy is a one-way
+  door.
+
+`deploy` and `destroy` are mutating, and both are gated: before either touches anything, it calls
+`authz.decide()` to get a ruling, and only proceeds on `ALLOWED`. That's the boundary this
+workshop is about. 
+
+---
+
+## `decide()` is a deliberate stub
+
+Open `authz.py` and look for the `decide()` method. It's the one function every mutating tool call goes through, and right
+now there are no permission checks. 
+
+```python
+async def decide(client, agent_id, permission, environment_id) -> AuthzResult:
+    # WORKSHOP STUB — Part 1.
+    # Returns ALLOWED for everything. This is exactly why
+    # the agent over-reaches in Part 1. You implement the real, SpiceDB-backed
+    # three-way decision in Part 2.
+    # TODO(Part 2): replace this stub.
+    return AuthzResult(Decision.ALLOWED, "no authorization configured (workshop stub)")
+```
+
+It takes a `client` — a live connection to SpiceDB — and ignores it. Every argument that should
+matter (which agent, which permission, which environment) is ignored too. `decide()` always
+returns `ALLOWED`. This should obviously not be the case for any production Agent. 
+
+---
+
 ## Why this happens: ambient authority
 
 The agent process holds one set of credentials - the `SPICEDB_TOKEN` and `AGENT_SUBJECT` in its
@@ -108,16 +107,11 @@ concerned, there's no difference between "deploy a service" and "destroy product
 just tool calls that return `ALLOWED`.
 
 This is **ambient authority**: authority that comes along for free with the environment an agent
-runs in, rather than being granted for a specific act. It's the same failure mode as a script
-running with root because it happened to be launched by root — not because anyone decided it
-should have root.
+runs in, rather than being granted for a specific act.
 
 You might be tempted to fix this by editing the tool's docstring, or telling the agent in its
-system prompt "never destroy production without approval." This is an anti-pattern. The prompt is not
-a boundary as prompts are suggestions to a language model, not a control the system enforces. 
-An authorization boundary has to live *outside* the model's judgment,
-in code that runs whether or not the agent "remembers" the rule. That boundary is what Part 2
-builds.
+system prompt "never destroy production without approval." This is an anti-pattern. An authorization boundary has to live *outside* the model's judgment,
+in code that runs whether or not the agent "remembers" the rule. That boundary is what Part 2 builds.
 
 ---
 
diff --git a/delegated-agent-authorization/3-time-bound-and-revocable.md b/delegated-agent-authorization/3-time-bound-and-revocable.md
index bc8d57e..47f5b64 100644
--- a/delegated-agent-authorization/3-time-bound-and-revocable.md
+++ b/delegated-agent-authorization/3-time-bound-and-revocable.md
@@ -79,17 +79,14 @@ rel("environment", "staging", "agent_deployer", "agent", AGENT_ID,
 ```
 
 `rel()` (in `relationships.py`) already accepts an `expires_at` keyword and threads it into
-`optional_expires_at`. That plumbing was there from the start, waiting for the schema to allow it.
-Now every `bootstrap.py` run grants staging autonomy for exactly `window_minutes` from *now*, not
+`optional_expires_at`. Now every `bootstrap.py` run grants staging autonomy for exactly `window_minutes` from *now*, not
 forever.
 
 ---
 
 ## Update `approve.py`
 
-The human-in-the-loop path needs the same fix. `approve.py` already takes `--minutes`
-(default 10) and ignored it. Part 2's version wrote the grant with no expiry at all. Import
-`expiry_from_now` alongside the checks it already runs, and carry it into the write:
+The human-in-the-loop path needs the same fix. In `approve.py` import `expiry_from_now` alongside the checks it already runs, and carry it into the write:
 
 ```python
 # Add this import at the top of approve.py
@@ -101,8 +98,7 @@ update = rel("environment", environment, "agent_deployer", "agent", agent_id,
 ```
 
 Now clicking **Approve prod · 10m** in the web UI writes a grant that expires 10 minutes later on
-its own. No follow-up step, nothing to remember to undo. An approval that never expires was really
-a standing grant with extra steps; this makes "approved for now" mean what it says.
+its own. There's no follow-up step or a step to undo.
 
 ---
 
@@ -143,7 +139,7 @@ doesn't wait for a TTL; they click one button and the grant is gone on the very
 
 ## Drive it with goose (optional)
 
-If you're running the goose path, the same lever works in natural language. Click **Grant staging ·
+If you're running the goose path, it also works in natural language. Click **Grant staging ·
 30s** (or **Revoke staging**), then in a `goose session` ask it to "deploy checkout to staging."
 Before the window runs out, ✅ **ALLOWED**; after it expires — or once you've revoked —
 ⏸️ **NEEDS APPROVAL**. goose is calling the same gated `deploy` tool, so it sees exactly what the
@@ -164,8 +160,7 @@ about what "expired" means.
 Relationship expiration collapses that back to one as the expiry is evaluated *at check time*, inside the same call that's already asking "does this
 relationship exist and hold." An expired grant isn't cleaned up later. It was never a valid answer
 to begin with, the moment the clock passed `expires_at`. Garbage collection still runs in the
-background to reclaim storage, but it's a housekeeping detail, not part of the authorization
-decision. The boundary is exactly as tight as `CheckPermission` itself.
+background to reclaim storage.
 
 ---
 
diff --git a/delegated-agent-authorization/4-relationship-based-hierarchy.md b/delegated-agent-authorization/4-relationship-based-hierarchy.md
index 46e120c..eef48aa 100644
--- a/delegated-agent-authorization/4-relationship-based-hierarchy.md
+++ b/delegated-agent-authorization/4-relationship-based-hierarchy.md
@@ -13,7 +13,7 @@ staging's, enforced by the graph. ReBAC makes this pattern very straightforward.
 
 ## Contingent authority — why RBAC can't express this
 
-The policy you want is: "the agent may deploy production on its own only while it can also deploy
+The idea you want is: "the agent may deploy production on its own only while it can also deploy
 staging on its own." RBAC can only ever hear the first half of that sentence: "the agent has role
 X." What you actually need is "the agent has role X *and* a second, independent fact about a
 different resource currently holds." 
diff --git a/delegated-agent-authorization/README.md b/delegated-agent-authorization/README.md
index 7726912..1870f48 100644
--- a/delegated-agent-authorization/README.md
+++ b/delegated-agent-authorization/README.md
@@ -1,8 +1,7 @@
 # Delegated Authorization for AI Agents: Build an Agent with Fine-Grained Permissions
 
 DevOps and Platform teams now work with hundreds of AI Agents in their internal systems. These
-Agents usually run with credentials that can touch everything, including your production servers.
-This could lead to problems.
+Agents usually run with credentials that can touch everything, including your production servers, which is less than ideal.
 
 This workshop teaches you how to add delegated authorization to your AI Agents, at scale.
 
@@ -13,7 +12,9 @@ scoped delegation, expiring grants, instant revocation, and hierarchical permiss
 revoking staging access automatically suspends production too, something role-based systems
 can't express cleanly.
 
-It's self-guided and hands-on, and everything runs locally with open-source tooling.
+It's self-guided and hands-on, and everything runs locally with open-source tooling. Here's a high-level diagram of the workshop.
+
+![Architecture diagram of the project](/delegated-agent-authorization/images/fig1-permission-check.svg)
 
 ---
 
@@ -22,14 +23,14 @@ It's self-guided and hands-on, and everything runs locally with open-source tool
 An agent process holds one set of credentials, and every tool call it makes runs with the full
 weight of those credentials behind it — there's no built-in notion of *this specific action, for
 this specific reason, scoped to this specific window*. That's **ambient authority**: authority
-that comes along for free with the environment an agent runs in, rather than being granted for a
+that comes along with the environment an agent runs in, rather than being granted for a
 specific act. It's the same failure mode as a script running as root because it happened to be
 launched by root, not because anyone decided it should have root.
 
-The instinct to fix this in the system prompt — "never destroy production without approval" —
-doesn't hold up. A prompt is a suggestion to a language model, not a control the system enforces;
+The instinct to fix this in the prompt (example: "never destroy production without approval") but this is an anti-pattern. 
+A prompt is a suggestion to a language model, not a control that a system enforces;
 it lives in the same channel as everything else the model reads, which means it can be argued
-with, reworded around, or forgotten three turns into a longer conversation. An authorization
+with, reworded around, or bypassed via prompt injection. An authorization
 boundary has to live *outside* the model's judgment, in code that runs whether or not the agent
 "remembers" the rule. That's what this workshop builds: a decision that's fully determined by a
 relationship graph the agent has no way to write to, so the same question gets the same answer no
@@ -42,7 +43,7 @@ matter how many different ways — or how many different agents — ask it.
 - A SpiceDB [ReBAC](https://authzed.com/blog/exploring-rebac) schema
   that models delegation directly: an `agent` acts for a `user` through one relation, `delegator`
 - A three-way decision engine, `decide()`, that turns every mutating tool call into `ALLOWED`,
-  `NEEDS_APPROVAL`, or `BLOCKED` — never a silent yes
+  `NEEDS_APPROVAL`, or `BLOCKED`
 - Time-bound grants that expire on their own, for incident-style access windows, plus instant,
   on-demand revocation for when you need to pull a grant early
 - A relationship hierarchy (`gated_by`) where revoking one environment's autonomy automatically
@@ -61,19 +62,6 @@ matter how many different ways — or how many different agents — ask it.
 No prior authorization background is assumed. Comfort with a terminal, Python, and Docker is
 enough.
 
-## The 90-minute module map
-
-| Module | Time | What you do |
-| --- | --- | --- |
-| [Setup](0-setup.md) | 15 min | Bring up Docker (or Codespaces), install dependencies, optionally register the goose extension |
-| [Part 1 — Run the agent](1-run-the-agent.md) | 10 min | Run the agent ungated and watch it destroy production on request |
-| [Part 2 — Delegated authorization](2-delegated-authorization.md) | 25 min | Write the ReBAC schema and implement the three-way `decide()` |
-| [Part 3 — Time-bound and revocable](3-time-bound-and-revocable.md) | 15 min | Add expiring grants for incident windows, plus instant revocation |
-| [Part 4 — Relationship-based hierarchy](4-relationship-based-hierarchy.md) | 20 min | Make production's autonomy contingent on staging's, and watch the cascade |
-| [Next steps](5-nextsteps.md) | 5 min | Zoom out to a real platform: bulk checks, on-behalf-of enforcement, scaling ReBAC |
-
-That's 90 minutes end to end, self-guided — it works equally well live or self-paced afterward.
-
 ## The full reference solution
 
 Everything you write in this workshop — the schema, `decide()`, the part progression — is a

From 6adf207be4f60ad03d37040f0dfc78c277fceec5 Mon Sep 17 00:00:00 2001
From: Sohan Maheshwar <1119120+sohanmaheshwar@users.noreply.github.com>
Date: Tue, 1 Sep 2026 17:26:10 +0200
Subject: [PATCH 27/27] docs(workshop): remove SpiceDB logo from FIG.01
 authorization-layer beam

---
 .../images/fig1-permission-check.svg                      | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/delegated-agent-authorization/images/fig1-permission-check.svg b/delegated-agent-authorization/images/fig1-permission-check.svg
index 55ec864..d9e0d14 100644
--- a/delegated-agent-authorization/images/fig1-permission-check.svg
+++ b/delegated-agent-authorization/images/fig1-permission-check.svg
@@ -70,15 +70,13 @@
       <text class="lbl" x="574" y="50">SPICEDB</text>
       <rect x="595" y="58" width="11" height="404" rx="5.5" fill="url(#beam)" filter="url(#glow)" opacity="0.55"/>
       <rect x="597" y="58" width="7" height="404" rx="3.5" fill="url(#beam)"/>
-      <circle cx="600" cy="250" r="46" fill="#170d1c" stroke="#3a3243" stroke-width="1.5"/>
-      <use href="#saturn" x="572" y="222" width="56" height="56"/>
       <rect x="516" y="392" width="168" height="30" rx="15" fill="#fff" stroke="#c6c0cb" stroke-width="1"/>
       <text class="lbl-b" x="600" y="411" text-anchor="middle" fill="#a5318a">AUTHORIZATION LAYER</text>
 
       <!-- fan to the three verdicts -->
-      <path class="edge-teal" d="M648 236 Q706 220 706 150 Q706 108 800 108" marker-end="url(#aT)"/>
-      <path class="edge" d="M648 250 H800" stroke="#d98324" stroke-width="2" marker-end="url(#aM)"/>
-      <path class="edge-red" d="M648 264 Q706 280 706 350 Q706 392 800 392" marker-end="url(#aR)"/>
+      <path class="edge-teal" d="M608 236 Q706 220 706 150 Q706 108 800 108" marker-end="url(#aT)"/>
+      <path class="edge" d="M608 250 H800" stroke="#d98324" stroke-width="2" marker-end="url(#aM)"/>
+      <path class="edge-red" d="M608 264 Q706 280 706 350 Q706 392 800 392" marker-end="url(#aR)"/>
 
       <!-- ALLOWED -->
       <rect class="node-al" x="800" y="66" width="350" height="84" rx="12" filter="url(#soft)"/>