Package
Export, share and install agents as portable archives.
What it does
An agent, its folder tree, config, knowledge and workflows are serialized into a single .agentpkg ZIP archive with a manifest, contributor list and provenance record. Installing one follows a three-step flow: Plan (inspect with zero writes), Review (verify a digest), Apply (write with a TOCTOU safety check). Three distribution modes ship: direct export to a file, private handoff links with an expiring share token, and a curated showcase gallery with verified proof-of-concept sample runs.
Why it matters
An agent you cannot move is an agent you do not own. Portable archives mean an agent can travel between accounts, tools and models without leaving its knowledge behind, and the plan-before-apply step means installing one is a decision, not a side effect.
How it works
Zero ID leakage across the package boundary
Internal UUIDs are re-minted with uuidv5 during serialization, so a package carries no account, tenant or folder identifiers from the source.
Three-step install with TOCTOU safety
Plan inspects with zero writes, Review verifies a digest, Apply checks the digest again before writing. A package that changed between review and apply is rejected.
Showcase carries verified sample runs
A workflow in the showcase gallery includes a redacted real run so someone can watch it work before installing it, and the verification is checked on display.
Questions
- What is in a package?
- The folder tree, every leaf document, the .context and .agent config files, workflows, and a manifest with contributor and provenance metadata. No credentials, no embeddings, no verification status.
- Can I share a package with someone on a different account?
- Yes. A private handoff link carries a time-expiring share token. The recipient installs it into their own account through the same plan-review-apply flow.
The rest of the bag
AccessControl
Per-document permissions that filter answers, not just pages.
Policy resolution is cached per session for speed; a permission change propagates on cache invalidation rather than instantly on every in-flight request.
Docs
A folder tree the agent reads, and a config file it obeys.
Extraction covers PDFs, spreadsheets and transcripts. Exotic binary formats are not parsed.
Events
A durable ledger of what agents did, and why.
The in-process event bus is a single-node emitter, not a distributed broker. The durable cross-agent record is a separate Postgres task ledger.
That was step 6 of 6: a reply leaves, and the trail stays. That is the whole path, from arrival to a replayable record.