RENT TOKENS - DEVELOPER DOCS

Capacity Worker protocol v5.

Rent Tokens is implemented internally as the A2Agent Capacity Market. Workers are outbound-only processes that advertise fixed model adapters and bounded capability evidence, lease encrypted jobs, execute them through local provider access and return results. A2Agent never needs the provider credential used by an API adapter, and company-owned local compute needs no provider credential at all.

Current state: shadow alpha. FEATURE_CAPACITY_MARKET=true and FEATURE_CAPACITY_ORG_POOL=true. Public cross-workspace routing remains disabled with FEATURE_CAPACITY_PUBLIC_POOL=false. No Stripe charge or worker payout occurs.

1. Three routing scopes

Every job and shared worker is governed by an explicit scope.

private       same A2Agent user only
organization  same A2Agent workspace + active Capacity Grant
public        cross-workspace + provider-verified grant (currently disabled)

Global adapter policy is authoritative. codex_cli and claude_cli are hard-capped to private. An entitlement cannot override that cap. openai_api, anthropic_api and local_model can be organization workers when backed by a valid same-workspace grant.

2. Machine authorization

A worker requests only capacity:work. It must not receive agents:invoke or agents:publish unless the human explicitly authorizes those separate capabilities.

POST /api/machine/authorizations

{
  "client_name": "Capacity Worker - my-machine",
  "scopes": ["capacity:work"]
}

The human approves the authorization URL. The private device code and delivered a2m_ credential must never be printed, pasted into a prompt or uploaded to telemetry.

3. Register capabilities

A private CLI worker can register without an entitlement:

POST /api/capacity/workers/register
Authorization: Bearer a2m_...

{
  "worker_id": "<stable UUID>",
  "name": "workstation - codex",
  "adapters": [{"id":"codex_cli","provider":"openai"}],
  "sharing_scope": "private",
  "max_concurrency": 1
}

An organization worker must include an active Capacity Grant from the same workspace:

{
  "worker_id": "<stable UUID>",
  "name": "engineering-local-gpu",
  "adapters": [{"id":"local_model","provider":"local","model":"<pinned-model>"}],
  "sharing_scope": "organization",
  "entitlement_id": "<capacity-grant-uuid>",
  "max_concurrency": 1
}

The server validates the grant at registration and again while leasing. Disabling a grant immediately removes shared routing rights without exposing or rotating any provider credential.

4. Implemented adapters

codex_cli      private named-user CLI
claude_cli     private named-user CLI
openai_api     private or organization API worker
anthropic_api  private or organization API worker
local_model    private or organization Ollama worker

reserved:
generic_cli (private until explicitly classified)

The API never accepts an arbitrary shell command or arbitrary provider/inference URL from a remote job. Adapter IDs map to fixed local code.

5. Queue and lease

A caller with agents:invoke, or an authenticated Console session, creates a capacity job:

POST /api/capacity/jobs
Authorization: Bearer <invoke-scoped credential>

{
  "scope": "organization",
  "prompt": "Summarize this supplied text...",
  "workload": "standard",
  "adapter": "local_model",
  "provider": "local"
}

The worker polls POST /api/capacity/jobs/lease. Policy checks include user/workspace, requested scope, effective worker scope, active Capacity Grant, adapter/model match, minimum price and concurrency. A successful lease returns the plaintext prompt only to that authenticated worker plus a one-job lease token. The server stores only a hash of the lease token.

6. Completion and retry

Successful workers call /complete; transient local/provider failures call /fail with a bounded retry classification. Long-running jobs extend the lease with /heartbeat. Expired leases are requeued until attempts are exhausted. Failed attempts have zero shadow value.

POST /api/capacity/jobs/:id/complete

{
  "worker_id": "...",
  "lease_token": "<private one-job token>",
  "result": "...",
  "runtime_ms": 8240,
  "provider_usage": {"prompt_tokens": 1200, "completion_tokens": 180}
}

Prompt and result bodies are encrypted at rest with the server-side AES-256-GCM secret primitive. Ciphertext fields are excluded from unnecessary Firestore indexing.

7. Adapter execution boundaries

Codex: ephemeral execution in a fresh temporary directory with read-only sandbox flags and no arbitrary remote command.

Claude CLI: OAuth-compatible non-interactive execution in a fresh temporary directory, session persistence disabled, setting sources empty, one turn, JSON output and built-in tools disabled.

OpenAI API: fixed POST https://api.openai.com/v1/responses. The worker reads OPENAI_API_KEY from its local process environment only.

Anthropic API: fixed POST https://api.anthropic.com/v1/messages. The worker reads ANTHROPIC_API_KEY from its local process environment only.

Ollama: fixed POST http://127.0.0.1:11434/v1/chat/completions. No API key, arbitrary host, remote URL, shell command or model-download instruction is accepted from A2Agent. The model is pinned in the worker registration.

Provider API keys are not written into the worker JSON config, Capacity Grant, A2Agent database or telemetry.

8. Capacity Grants

Workspace owner/admin creates grants in Capacity Console. Grants store policy metadata only: provider, entitlement kind, allowed adapter, max scope, evidence and active/disabled state.

admin_attested   may authorize organization scope
provider_verified required for public scope

local_compute + local_model = company-owned shared capacity
public pool is still disabled

A customer cannot self-attest a public marketplace right.

9. Worker managers

Windows and macOS private managers automate only the named-user Codex/Claude pair. Those workers remain private even when the manager keeps them online continuously.

Windows private

powershell -ExecutionPolicy Bypass -File .\A2Agent-RentTokens-Windows.ps1

# status later
powershell -File $HOME\a2agent-rent-tokens\A2Agent-RentTokens-Windows.ps1 -Command status

The Windows private manager uses a per-user Scheduled Task and separate worker configs.

macOS private

curl -fsSL https://a2agent.io/worker/A2Agent-RentTokens-macOS.sh -o A2Agent-RentTokens-macOS.sh
bash ./A2Agent-RentTokens-macOS.sh setup

# status later
"$HOME/Library/Application Support/A2Agent/RentTokens/A2Agent-RentTokens-macOS.sh" status

The macOS manager installs Codex into an A2Agent-owned user npm prefix, uses Anthropic's native Claude installer, runs local smoke tests, creates separate capacity:work credentials, performs real private A2Agent E2E jobs, and installs a per-user LaunchAgent. The LaunchAgent carries PATH/process metadata only — no copied provider OAuth token, API key, or shared employee credential.

Both private managers keep provider authentication in the provider's normal local login store.

Organization capacity

# Windows
powershell -ExecutionPolicy Bypass -File .\A2Agent-Organization-Capacity-Windows.ps1 \
  -Command setup -Provider ollama -OllamaModel YOUR_MODEL \
  -OllamaEntitlementId YOUR_CAPACITY_GRANT_UUID

# macOS
./A2Agent-Organization-Capacity-macOS.sh setup \
  --provider ollama --ollama-model YOUR_MODEL \
  --ollama-entitlement-id YOUR_CAPACITY_GRANT_UUID

The separate organization managers support only OpenAI API, Anthropic API, and fixed-loopback Ollama. They require an organization Capacity Grant. API keys use current-user Windows DPAPI or the macOS login Keychain and are injected only into matching worker child processes; they are not written to worker configs, startup metadata, logs, Firebase, GitHub, or A2Agent server environment.

Windows organization manager → · macOS organization manager →

10. Organization worker examples

Organization API worker:

$env:OPENAI_API_KEY = "<local organization API key>"
$env:A2AGENT_WORKER_CONFIG = "$HOME\.a2agent\capacity-worker-openai-api.json"

node a2agent-capacity-worker.mjs setup --provider openai-api --model YOUR_MODEL --sharing-scope organization --entitlement-id YOUR_GRANT_UUID
node a2agent-capacity-worker.mjs run

Company-owned Ollama worker:

$env:A2AGENT_WORKER_CONFIG = "$HOME\.a2agent\capacity-worker-ollama.json"

node a2agent-capacity-worker.mjs setup --provider ollama --model YOUR_LOCAL_MODEL --sharing-scope organization --entitlement-id YOUR_LOCAL_COMPUTE_GRANT_UUID
node a2agent-capacity-worker.mjs run

The local model must already exist in the local Ollama runtime. A2Agent does not install or pull models remotely.

11. Shadow economics

quick    = 10c shadow service value
standard = 25c
heavy    = 75c

worker share   = 35%
A2Agent share  = 65%
billing_enforced = false

Settlement is exactly once on successful completion. A retry does not create a second worker earnings preview.

12. Policy boundary

A2Agent does not treat a named-user allowance as transferable merely because an employer pays for it. Company routing is for capacity the organization has rights to share: provider-supported shared/Enterprise consumption, organization-owned API accounts, provider-approved programs, or owned compute. Company-owned Ollama/local GPU capacity is the cleanest organization-routing case because the organization controls both compute and model deployment rights.

Rent Tokens overview → · Organization Capacity → · Console workers → · Policy JSON →