Capacity Worker protocol.

Rent Tokens is implemented internally as the A2Agent Capacity Market. A worker is an outbound-only process that advertises fixed model adapters, leases encrypted jobs, executes them locally and returns a result. A2Agent never receives the provider credential used by the adapter.

1. Machine authorization

The worker requests only capacity:work. It must not receive agents:invoke or agents:publish unless the human explicitly requested those separate capabilities.

POST /api/machine/authorizations

{
  "client_name": "Rent Tokens · my-machine",
  "scopes": ["capacity:work"]
}

The human approves the authorization URL. The private device code and delivered a2m_ credential must never be printed, pasted into a prompt or uploaded to telemetry.

2. Register capabilities

POST /api/capacity/workers/register
Authorization: Bearer a2m_...

{
  "worker_id": "<stable UUID>",
  "name": "home-workstation · codex",
  "adapters": [{"id":"codex_cli","provider":"openai"}],
  "max_concurrency": 1,
  "min_shadow_price_cents": 0
}

Initial adapter IDs are codex_cli, claude_cli, openai_api, anthropic_api, local_model and generic_cli. The public worker script implements only the first two today. The API intentionally does not accept an arbitrary command string from A2Agent.

3. Queue and lease

A caller with an existing agents:invoke machine credential, or an authenticated Console session, creates a capacity job:

POST /api/capacity/jobs
Authorization: Bearer <invoke-scoped a2m credential>

{
  "prompt": "Summarize this supplied text...",
  "workload": "standard",
  "adapter": "codex_cli",
  "provider": "openai"
}

The worker polls POST /api/capacity/jobs/lease. A successful lease returns the plaintext prompt only to that authenticated worker plus a one-job lease token. The server stores only a hash of that lease token. Workers extend long jobs with POST /api/capacity/jobs/:id/heartbeat.

4. Completion and retry

Successful workers call /complete; transient local/provider failures call /fail with retryable=true. Expired leases are requeued automatically until the bounded attempt limit is reached. Failed attempts have zero shadow value.

POST /api/capacity/jobs/:id/complete

{
  "worker_id": "...",
  "lease_token": "<private one-job token>",
  "result": "...",
  "runtime_ms": 8240,
  "provider_usage": {"total_cost_usd": 0}
}

Prompt and result bodies are encrypted at rest with the same server-side AES-256-GCM primitive used for private provider secrets.

5. Shadow economics

The Capacity Market is deliberately separate from builder marketplace economics. Defaults:

quick    = 10¢ shadow service value
standard = 25¢
heavy    = 75¢

worker share   = 35%
A2Agent share  = 65%
billing_enforced = false

Settlement is exactly-once on successful completion. A retry does not create a second worker payment preview.

6. Local adapter isolation

The reference worker creates an empty temporary directory per job. Claude runs in non-interactive bare mode with built-in tools disabled. Codex runs ephemeral with a read-only sandbox and an empty working directory. Because a read-only coding sandbox is not equivalent to a hardened multi-tenant VM, cross-user public routing remains disabled until a stronger runner boundary and certification suite are in place.

7. Provider credentials

Complete the provider's official login locally before starting the worker. A2Agent does not implement token scraping, session export, cookie forwarding or account sharing. Subscription-backed public resale is not assumed to be permitted merely because a CLI can authenticate. Provider-approved API/business access and local/open models are the cleanest production adapters.

8. Reference worker

curl -fsSL https://a2agent.io/worker/a2agent-capacity-worker.mjs -o a2agent-capacity-worker.mjs
node a2agent-capacity-worker.mjs setup --provider codex
node a2agent-capacity-worker.mjs run

Rent Tokens overview → · Console workers →