[browser][platform] Creator capability write-path API — gated on the trust model

[serge-ivo]

[browser][platform] Creator capability write-path API — gated on the trust model

Today no API lets a creator set config.capabilities (surfaces/runtime/workflow/tools) — POST/PUT /v1/agents don't touch it; only migrations do (agent-capabilities.ts resolves it read-only). This issue adds the write-path so agents become self-service. Blocked on the trust model.

Do

• PUT /v1/agents/:id/capabilities accepting a sanitized capabilities block (extend the existing sanitizeCapabilities/sanitizeSettingsSchema), allowlisting surfaces, tools, and runtime/workflow only to values the trust model permits for the creator's tier.
• Enforce the permission scope from the trust model (domain/action allowlists travel with the capability).
• Audit every capability change.

Acceptance

• A creator can declare a permitted agent type via API (within their tier), sanitized + audited.
• runtime:"browser" is grantable ONLY under the trust model's scoping/consent; ungated attempts are rejected.
• Tests for sanitize + gate + audit.

Part of the open-browser-agents epic. Depends on the trust-model issue. Pairs with #58.

[serge-ivo]

Premise is now stale. This says "Today no API lets a creator set config.capabilities — POST/PUT /v1/agents don't touch it; only migrations do". That was fixed by #141:

• workers/api/src/routes/agents.ts:350 — sanitizeDeclaredCapabilities(body.capabilities)
• :380 — lintAgentClaims({ description, capabilities: { runtime, workflow } })

So the write-path exists and validates. What remains unbuilt is the trust gating (#142), not the API.

Worth rescoping this to whatever is genuinely still missing (browser-specific capability grants?) or closing it in favour of #142 + #75 — otherwise it reads as blocking work that has already landed.

[serge-ivo]

Closing: the premise is no longer true. The creator capability write-path exists — routes/agents.ts:350 runs sanitizeDeclaredCapabilities(body.capabilities) on create and update, with lintAgentClaims at :380. That landed in #141.

What this issue was really protecting — that the write-path must not be exposed to non-operators without a trust model — is #142, which is still open and now the live gap (the path shipped, the gate did not). Tracking it there rather than in a ticket whose stated task is done.