Epic: first-party exemplary agents → mature the platform → open to third parties (demand-gated)

[serge-ivo]

Strategy (updated 2026-08-01)

Near-term the operator builds the agents himself — first-party, but exemplary / reference-quality so future creators can see them and build similar. The agents mature the platform and seed the eventual catalog + docs.

Operating principle: build every agent the creator way — as declarative data through the platform path (capability registry, tool catalog, surfaces), never bespoke platform code. Every place an agent forces a platform code change = the platform's next feature.

Sequencing: do the cheap data-driven foundation now (#51 / PR #59 + declarative schema + a "view/fork source" example gallery). Defer the expensive marketplace machine — Tier-2 sandbox (#52), review (#53/#54), payouts (#57) — until one/two agents prove people will PAY (billing is currently deferred; PAS is the paid launch). This epic stays the north star; its expensive parts are demand-gated.

---

Turn PAGS from "first-party agents + curated fleet" into a creator marketplace. Target architecture is in `docs/agent-platform-strategy.md`; concrete program plan in `docs/third-party-agents-plan.md`.

Owner decisions (2026-08-01)

• Scope of first release: Tier-1 declarative config agents + Tier-2 sandboxed custom code.
• Trust model: curated review — creators submit; every agent/version is reviewed before it's listed.
• Monetization: free/beta first — open creation now; build payout plumbing behind a flag, launch payouts later.

The gate

Do not open publicly until the Tier-2 sandbox (#52) and cost governance (#56) are proven. Everything else can ship incrementally behind invite/curated.

Workstreams

• [3P] Tier-1: declarative agent schema + open tool catalog + shared runtime #51 — Tier-1: declarative agent schema + open tool catalog + shared runtime
• [3P] Tier-2: sandboxed creator code via Dynamic Workers (CRITICAL PATH) #52 — Tier-2: sandboxed creator code via Dynamic Workers (critical path)
• [3P] Curated publish + review pipeline (submission → review → versioned listing) #53 — Curated publish + review pipeline
• [3P] Automated pre-review safety scanning #54 — Automated pre-review safety scanning
• [3P] Creator experience: onboarding + authoring UI + Coder flywheel #55 — Creator experience: onboarding + authoring UI + Coder flywheel
• [3P] Cost governance & abuse controls (gates the public open) #56 — Cost governance & abuse controls (gates the public open)
• [3P] Metering → payout-ready (payouts built behind a flag, launch deferred) #57 — Metering → payout-ready (payouts behind a flag)

Phasing

• Phase 0 — foundation (partly in flight): admin access-control ([Admin] Foundation: access control gating + admin-action audit log #28), metering ([Admin][API] Meter platform-paid AI into the ledger (embeddings/summaries/translation) #44), usage/spend + kill switch ([Admin][UI] Usage & Spending dashboard (+ platform-AI kill switch) #39/[Admin][API] Runtime kill switch for platform-paid AI (platform_settings override) #46), moderation UI ([Admin][UI] Moderation controls + admin audit-log viewer #41). The safety net that must exist first.
• Phase 1 — Tier-1 to invited creators: [3P] Tier-1: declarative agent schema + open tool catalog + shared runtime #51 + [3P] Curated publish + review pipeline (submission → review → versioned listing) #53 + [3P] Creator experience: onboarding + authoring UI + Coder flywheel #55 (config-only authoring, curated). Dogfood by migrating repo-chat onto the formal schema.
• Phase 2 — Tier-2 code (the hard part): [3P] Tier-2: sandboxed creator code via Dynamic Workers (CRITICAL PATH) #52 + [3P] Automated pre-review safety scanning #54 + [3P] Cost governance & abuse controls (gates the public open) #56. Red-team the sandbox before any third party touches it.
• Phase 3 — widen + monetize: loosen curation as guardrails mature; flip payouts ([3P] Metering → payout-ready (payouts built behind a flag, launch deferred) #57).

Prereqs already true

Tenant isolation, envelope crypto, SSRF guard, MCP scopes, per-instance DO isolation (see `SECURITY.md`) — the security floor Tier-2 builds on.