Epic: first-party exemplary agents → mature the platform → open to third parties (demand-gated)

Epic. Children, demand-gated (all deferred: no demand): #52 (sandboxed creator code — the
long pole) · #53 (curated publish + review) · #54 (automated pre-review safety scanning) ·
#55 (creator experience) · #56 (cost governance + abuse controls) · #57 (metering → payout-ready).
Gating prerequisite: #142 (trust gating before third parties may declare runtime/workflow
capabilities). Strategy constraint: #68 (focus bet — 10 external users on ONE runtime agent
before expanding).

Each child said only "part of the open-to-third-party program" in prose; they now name this
issue, and this issue names them.

Strategy (updated 2026-08-01)

Near-term the operator builds the agents himself — first-party, but exemplary / reference-quality so future creators can see them and build similar. The agents mature the platform and seed the eventual catalog + docs.

Operating principle: build every agent the creator way — as declarative data through the platform path (capability registry, tool catalog, surfaces), never bespoke platform code. Every place an agent forces a platform code change = the platform's next feature.

Sequencing: do the cheap data-driven foundation now (#51 / PR #59 + declarative schema + a "view/fork source" example gallery). Defer the expensive marketplace machine — Tier-2 sandbox (#52), review (#53/#54), payouts (#57) — until one/two agents prove people will PAY (billing is currently deferred; PAS is the paid launch). This epic stays the north star; its expensive parts are demand-gated.

Turn PAGS from "first-party agents + curated fleet" into a creator marketplace. Target architecture is in `docs/agent-platform-strategy.md`; concrete program plan in `docs/third-party-agents-plan.md`.

Owner decisions (2026-08-01)

Scope of first release: Tier-1 declarative config agents + Tier-2 sandboxed custom code.
Trust model: curated review — creators submit; every agent/version is reviewed before it's listed.
Monetization: free/beta first — open creation now; build payout plumbing behind a flag, launch payouts later.

The gate

Do not open publicly until the Tier-2 sandbox (#52) and cost governance (#56) are proven. Everything else can ship incrementally behind invite/curated.

Workstreams

[3P] Tier-1: declarative agent schema + open tool catalog + shared runtime #51 — Tier-1: declarative agent schema + open tool catalog + shared runtime
[3P] Tier-2: sandboxed creator code via Dynamic Workers (CRITICAL PATH) #52 — Tier-2: sandboxed creator code via Dynamic Workers (critical path)
[3P] Curated publish + review pipeline (submission → review → versioned listing) #53 — Curated publish + review pipeline
[3P] Automated pre-review safety scanning #54 — Automated pre-review safety scanning
[3P] Creator experience: onboarding + authoring UI + Coder flywheel #55 — Creator experience: onboarding + authoring UI + Coder flywheel
[3P] Cost governance & abuse controls (gates the public open) #56 — Cost governance & abuse controls (gates the public open)
[3P] Metering → payout-ready (payouts built behind a flag, launch deferred) #57 — Metering → payout-ready (payouts behind a flag)

Phasing

Phase 0 — foundation (partly in flight): admin access-control ([Admin] Foundation: access control gating + admin-action audit log #28), metering ([Admin][API] Meter platform-paid AI into the ledger (embeddings/summaries/translation) #44), usage/spend + kill switch ([Admin][UI] Usage & Spending dashboard (+ platform-AI kill switch) #39/[Admin][API] Runtime kill switch for platform-paid AI (platform_settings override) #46), moderation UI ([Admin][UI] Moderation controls + admin audit-log viewer #41). The safety net that must exist first.
Phase 1 — Tier-1 to invited creators: [3P] Tier-1: declarative agent schema + open tool catalog + shared runtime #51 + [3P] Curated publish + review pipeline (submission → review → versioned listing) #53 + [3P] Creator experience: onboarding + authoring UI + Coder flywheel #55 (config-only authoring, curated). Dogfood by migrating repo-chat onto the formal schema.
Phase 2 — Tier-2 code (the hard part): [3P] Tier-2: sandboxed creator code via Dynamic Workers (CRITICAL PATH) #52 + [3P] Automated pre-review safety scanning #54 + [3P] Cost governance & abuse controls (gates the public open) #56. Red-team the sandbox before any third party touches it.
Phase 3 — widen + monetize: loosen curation as guardrails mature; flip payouts ([3P] Metering → payout-ready (payouts built behind a flag, launch deferred) #57).

Prereqs already true

Tenant isolation, envelope crypto, SSRF guard, MCP scopes, per-instance DO isolation (see `SECURITY.md`) — the security floor Tier-2 builds on.

docs: program plan for opening PAGS to third-party agent creators (#58)

feat(agents): declarative tool catalog + per-agent tool allowlist (#51)

feat(repo-chat): declare tools as data — first exemplar of the creato…

feat(agents): formal declarative agent-definition schema (#51)

Platform-capability gaps surfaced by the lead-finder (2026-08-02) — the code-agent, configure-it-yourself story:

MCP: instance-scoped collection read/write (insert_record/query_records/list_collections) #91 — MCP: instance-scoped collection read/write (cheap win; unblocks external sweep → collection sync)
Triggers: let a cron/webhook trigger run a durable pipeline, not just the 4 canned actions #92 — Triggers: cron/webhook can run a durable pipeline, not just the 4 canned actions
Native config-parameterized deterministic-pipeline agents (the lead-finder shape) #93 — Native config-parameterized deterministic-pipeline agents (the lead-finder shape) — depends on [3P] Tier-2: sandboxed creator code via Dynamic Workers (CRITICAL PATH) #52/MCP: instance-scoped collection read/write (insert_record/query_records/list_collections) #91/Triggers: let a cron/webhook trigger run a durable pipeline, not just the 4 canned actions #92

Motivating bug (agent repo): ProAgentStore/small-business-website-lead-finder#1 — the sweep and the PAGS collection are two disconnected stores.

feat(agents): wire declarative capabilities through create + update (#…

Reconciliation (2026-08-03): the downstream tickets #52–#57 are DEMAND-GATED, not ready work. Per #68 ("Focus bet — 10 external users on ONE runtime agent before expanding"), the third-party marketplace build is deferred until a first-party agent proves paying demand. #52 (Tier-2 sandbox), #53/#54 (review pipeline), #55 (authoring UI), #56 (cost governance), #57 (payouts) should be treated as parked phase-2/3 scope, not an actionable backlog. Filing them in detail up front was premature; they stay open as the map, but nothing here is "ready" until #68's gate is met.

feat(coder2): declare the Coder as data — two templates, no bespoke c…

docs(api): make the OpenAPI spec state its own scope, and enforce it (#…

feat(agents): a browser agent that cannot click Pay is one you can po…

fix(capabilities): the Workflow picker is served from the table the p…

fix(agents): the Coders declare the pull-request tools #401 shipped, …

feat(tools): a tool the platform provides is reachable by someone, or…

fix(agents): publishing is the whole public gate, because the second …

fix(pipelines): fan_out says when it stopped at the page cap with a l…

Re-audit 2026-08-18: the gate is unchanged, Phase 1 is done, and the phasing is now wrong in one specific way

Read-only. Everything below is measured today against production or read on origin/main @ 6ceec4f.

The gate, re-measured

GET /v1/admin/usage/external?days=30, 2026-08-18:

{"externalUsers":0,"byAgent":[],"totals":{"calls":0,"valueMicros":0,"chargedMicros":0},
 "operator":{"users":1,"calls":6503,"valueMicros":10588090918,"chargedMicros":53553393},
 "operatorUnknown":false}

External users: still 0. Calls: still 0. Operator traffic has grown 2.3× since the 2026-08-06 reading (2,782 → 6,503 calls; $40.92 estimated → $53.55 actually charged). operatorUnknown:false, so this is a measurement and not a default — and it is a sounder measurement than the 08-06 one, because #438's SQL guard found and fixed a no such column: email that had been silently throwing inside operatorUserIds since the endpoint was written (0f274d2). The number the bet is scored against was read through a broken query when it was first quoted; it is not now.

So the demand gate holds, and the deferred: no demand labelling on #51–#57, #75 and #142 is still correct as of today. Nothing in this comment argues for un-gating anything.

Phase 1 is not "partly in flight" — it is done, and the epic's own workstream list no longer describes it

The body says "Phase 1 — Tier-1 to invited creators: #51 + #53 + #55 (config-only authoring, curated). Dogfood by migrating repo-chat onto the formal schema." Measured on main:

#51 checkbox	State
Formalize the declarative agent definition	done — `sanitizeDeclaredCapabilities` (`lib/agent-capabilities.ts:394`) + `sanitizeSettingsSchema` + `lintAgentClaims`, wired through create AND update (#141)
Open the capability vocabulary	mostly done — `TOOL_CATALOG` + `capabilities.tools` (#59); `CONNECTOR_CONSTRAINTS` (#404) now carries two keys (`terminal`, `tmux`, `lib/surface-options.ts:214,235`), not one; `AgentSurface` is still a closed union
Untrusted agents get only declarative surface types	enforced by deployment — `CUSTOM_SURFACES_ENABLED` unset in production; #186's fail-closed gate
Generalize `AgentDO` into the shared runtime	done in effect — six of the sixteen published agents declare `workflow:null` and run on `AGENT_LOOP`; `site-builder` and `portal-watch` are pure rows
Migrate `repo-chat` onto the formal schema	done — migration `0050`

And the vocabulary work #51's own 2026-08-03 comment handed to #84 has since landed: declarative connectors shipped (lib/connectors/manifest.ts, 307 lines, compileConnector + sanitizeConnectorManifest, #143/#145 both closed). A connector is now a reviewed JSON manifest.

What this means for the epic: the phase that was gated on readiness is finished, and the phases still gated on demand (#52–#57) are untouched. That is the correct outcome, but the body reads as though Phase 1 were in progress, which will mislead the next person who opens this epic to look for work.

The one place the plan is now wrong rather than merely stale

The body's Phase 2 is "#52 + #54 + #56. Red-team the sandbox before any third party touches it." Two things have happened since that change what #52 would have to sandbox:

The workflow enum question was reassessed and reversed. [coordination][deferred] Retire the workflow closed enum → declarative behavior #160's 2026-08-07 analysis established that workflow does not name a behaviour — it names which physical executor the platform must reach, and that the run may park itself mid-flight. workflows/pipeline-run.ts:90 is a linear walk with no back-edge and no step.sleep, so the declarative layer cannot express the three runtime brains at all. Its conclusion was "reframe, don't retire". That is a correct finding and it makes Tier-1 a permanently smaller box than this epic assumed: a Tier-1 creator can declare tools, connectors, pipelines, settings and behaviour, and can never declare a resumable machine-holding loop.
The trust primitive [browser][trust] Trust & permission model for browser agents (design prerequisite) #75 assumed it would have to build now exists in part. CONNECTOR_CONSTRAINTS is the creator-declared-ceiling / subscriber-binds-within-it mechanism, enforced server-side at runRegistryTool. [browser][trust] Trust & permission model for browser agents (design prerequisite) #75's own 2026-08-08 comment says this. But it covers two connectors, and github — which every Coder-family agent holds write tools on, across 16 App installations on this account — has no entry, so its repo argument is bounded by the prompt and nothing else.

So the honest Phase 2 is not "sandbox arbitrary creator code". It is: finish the ceiling vocabulary for the connectors that already have unbounded arguments, before anything untrusted declares them. That is #142's substance, it is cheap, it is useful to first-party agents today (0123's header names the missing github ceiling as the reason it would not grant the Operator GitHub), and it is a prerequisite Tier-2 cannot be red-teamed without.

What I would change in this epic, and what I would not

Not change: the demand gate, the deferred: no demand labels, or the decision to file #52–#57 as a map rather than a backlog. All three are working — they are why this board is not carrying seven phantom epics.

Change — three edits, none of which un-gates anything:

Mark Phase 1 complete in the body, with the pointers above. It is the single most misleading line in the epic today.
Move the connector-ceiling work out of Trust gating before third-party creators may declare runtime/workflow capabilities (gates #141) #142 and out of the deferred set. It is not marketplace work; it is a live gap on first-party agents that happens to also be a third-party prerequisite. Filed against the github connector specifically, it is a normal ticket that would be worth doing with zero external users.
Record [coordination][deferred] Retire the workflow closed enum → declarative behavior #160's reframing in this epic's Tier boundary. "Tier-1 = everything except a resumable executor-holding loop" is a sharper and more durable statement of what a config-only creator gets than "declarative config", and it is the line [3P] Tier-2: sandboxed creator code via Dynamic Workers (CRITICAL PATH) #52 has to defend.

Verified vs inferred

Verified: the production usage payload; manifest.ts, agent-capabilities.ts:394, surface-options.ts:214/235 on main; the closed states of #59/#61/#141/#143/#145/#84/#94; the published catalog (16 agents); migration 0050. Inferred: nothing load-bearing. Not attempted: I did not create, publish or modify any agent, and I set no label.

Correction to my comment above: I wrote "six of the sixteen published agents declare workflow:null" — that borrowed #160's denominator (seeded agents) and applied it to the published catalog. Measured directly just now against GET /v1/agents/my/agents: 11 of the 15 owner-owned published agents declare no workflow at all; 4 declare one (coder-repo, portal-watch, job-application-assistant, facebook-friend-confirmer). The point stands and is stronger than I put it — the shared runtime carries the large majority of the catalog.

fix(capabilities): a workflow that needs hands is refused without the…

fix(seed): the propagation guard watches every instance-copied config…

Epic — NOT-ADDRESSED by `49a1bacc`, which is one step inside it. Re-verified 2026-08-23, staying open.

Delivered-work audit. 49a1bacc names epic #58 and delivers a real slice — the Coder declared as data, two templates, no bespoke code — but this epic's gate is third-party creators, and the two things that gate them are unchanged:

The capability vocabulary is still closed. workers/api/src/lib/agent-capabilities.ts:101 + :486 still validate workflow against a closed AgentWorkflow enum, with :498/:500 handing out JOB_APPLY / CODING_SESSION. That is [coordination][deferred] Retire the workflow closed enum → declarative behavior #160, re-verified today.
Trust gating (Trust gating before third-party creators may declare runtime/workflow capabilities (gates #141) #142) and the tier-2 sandbox ([3P] Tier-2: sandboxed creator code via Dynamic Workers (CRITICAL PATH) #52) are both deferred: no demand — correctly, since GET /v1/admin/usage/external read live today returns externalUsers: 0 against 6,556 operator calls ([Strategy] Focus bet — 10 external users on ONE runtime agent before expanding #68).

The half of this epic that HAS been delivered is the platform-maturing half, and it is substantial: the connector/tool registry (#84–#99), declarative pipelines and the delivery outbox, capabilities.tools as an authoritative allowlist validated on create AND update (#141), capability constraints (#404/#441), write consent (#90), and three catalog agents built "the creator way" with no monorepo code. So the demand-gate, not the platform, is what this epic is now waiting on — which is exactly what its title says.

No action. Recorded so the next delivered-work audit does not re-open the question of whether 49a1bacc closed it.

Owner decision on 2026-10-14: retire/defer marketplace work for now. Do not start third-party marketplace expansion, creator-code sandbox, public creator submission/review, payout/metering, or related 3P launch work from this ticket set. Current focus is making first-party runtime agents and core PAGS flows work coherently for real users. Reopen/reactivate marketplace work only with a new explicit owner decision.

❓ The coder stopped on a question: Issue #58 is an open epic with no direct checkboxes. All sub-issues are either done (#51) or deferred (#52–57, #142). The only non-deferred code gap the audit calls out is a missing github connector ceiling in CONNECTOR_CONSTRAINTS (only terminal and tmux have entries). How should I proceed?

Options: Implement the github connector ceiling now; commit with 'closes #58' · Implement the github connector ceiling; but use 'refs #58' (don't close it) · Don't implement anything — close #58 with a comment only (no code change) · Skip #58 entirely — mark it failed/not-closeable and move on

Why it asks: Determines whether to write code and how to tag the commit message for #58.

Answer it on the run's card or with answer_instance_input. The run is parked until it is answered — answer any time; it continues from where it stopped.

Owner decision (Serge, 24 Oct 2026): skip all marketplace and payout work. The parked run for this issue was closed without changes; nothing was implemented. Issue stays deferred.

Auto-pickup flagged this issue for review (#1407). A run reported it done, but no delivered commit could be found for the run that finished it — labelled needs-human so it is not retried automatically; remove the label once it is confirmed resolved (or reopen the work) and it becomes eligible again.

Navigation Menu

Repository navigation

Epic: first-party exemplary agents → mature the platform → open to third parties (demand-gated) #58

Strategy (updated 2026-08-01)

Owner decisions (2026-08-01)

The gate

Workstreams

Phasing

Prereqs already true

Re-audit 2026-08-18: the gate is unchanged, Phase 1 is done, and the phasing is now wrong in one specific way

The gate, re-measured

Phase 1 is not "partly in flight" — it is done, and the epic's own workstream list no longer describes it

The one place the plan is now wrong rather than merely stale

What I would change in this epic, and what I would not

Verified vs inferred

Epic — NOT-ADDRESSED by `49a1bacc`, which is one step inside it. Re-verified 2026-08-23, staying open.

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Epic: first-party exemplary agents → mature the platform → open to third parties (demand-gated) #58

Description

Strategy (updated 2026-08-01)

Owner decisions (2026-08-01)

The gate

Workstreams

Phasing

Prereqs already true

Activity

serge-ivo commented on Aug 1, 2026

serge-ivo commented on Aug 3, 2026

serge-ivo commented on Aug 18, 2026

Re-audit 2026-08-18: the gate is unchanged, Phase 1 is done, and the phasing is now wrong in one specific way

The gate, re-measured

Phase 1 is not "partly in flight" — it is done, and the epic's own workstream list no longer describes it

The one place the plan is now wrong rather than merely stale

What I would change in this epic, and what I would not

Verified vs inferred

serge-ivo commented on Aug 18, 2026

serge-ivo commented on Aug 23, 2026

Epic — NOT-ADDRESSED by 49a1bacc, which is one step inside it. Re-verified 2026-08-23, staying open.

serge-ivo commented on Oct 14, 2026

proagentstore commented on Oct 23, 2026

proagentstore commented on Oct 23, 2026

proagentstore commented on Oct 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Epic — NOT-ADDRESSED by `49a1bacc`, which is one step inside it. Re-verified 2026-08-23, staying open.