# Plan 0001 — Agent Natives Builders Hackathon submission **Result — closed.** Internal track Runner-up, team `nolim`, mean score 66.63/100 across 8 judges (rank 12 of 22 teams overall; internal-track winner Climatico scored 73.25; overall event leader Showtonic scored 81) — verified live against `ic_hack_results`/`ic_hack_my_feedback`, not assumed. Full judge feedback (8 entries, including an organizer evidence audit) informed the three fixes shipped after judging closed: the AIsa decision's `NONE` branch was structurally unreachable (14/14 live episodes picked a goal — fixed in `src/signals.ts`), `/trigger` was an unauthenticated public endpoint with no spend cap (fixed with a KV-backed hourly rate limit in `src/ratelimit.ts`), and the now-permanently-blocked Cotal bridge script was removed as dead code (see row 7a). These could not change the score — judging was already final — but the code stayed live, so they were worth shipping for real rather than only noting in this doc. Nothing further is planned; the project is closed. **Live deployment (matches the actual submitted `ic_hack_submit` state — see [`docs/submission.md`](../submission.md) for the captured API response):** `demo_url` = `https://qte77.github.io/2026-08-26-AgentNativeHack-FT-CF-SF/` (landing page; the Worker itself is `https://agent-native-hack.cloudflare-driveway392.workers.dev` — `GET /trigger` runs one live episode, `GET /checkpoints` lists prior ones, `GET /.well-known/ai-agent.json` is the agent card, `POST /mcp` is the JSON-RPC surface). `agent_surface` = "MCP server". `repo_url` = `https://github.com/qte77/2026-08-26-AgentNativeHack-FT-CF-SF`. ## Architecture detail README.md and the landing page both carry only a minimal 6-box diagram now — this is the step-by-step version with file names, kept in exactly one place on purpose (a hand-synced copy of this same diagram is what caused README's and the landing page's copies to drift out of sync with each other earlier in the build). ``` Human, browser Agent, MCP client ──────────────► ──────────────► click "Run a live episode" POST /mcp (JSON-RPC) │ │ ▼ ▼ ┌───────────────────┐ ┌─────────────────────────────────┐ │ GitHub Pages │────►│ Cloudflare Worker │ │ docs/index.html │ │ index.ts (router) │ │ static, CORS fetch │ │ episode.ts (orchestrator) │ └───────────────────┘ └───┬─────┬─────┬─────┬─────────────┘ │ │ │ │ (1) signals.ts │ │ │ │ (4) execute.ts ┌─────────────────────────┘ │ │ │ │ read: Actions status, │ │ │ │ Dependabot, edit-hotspot │ │ │ ▼ │ │ ▼ ══════════════════════╗ │ │ ══════════════════════════╗ ║ GitHub REST API ║◄──────────────┘ │ ║ GitHub REST API (write) ║ ║ (real boundary #1) ║◄─────────────────────┼──║ - this repo ║ ══════════════════════╝ │ ║ - org2 (counterparty repo)║ (2) aisa.ts │ ══════════════════════════╝ ┌─────────────────────────────────────────┘ │ one metered chat/completions call (3) backlog.ts, on NONE: ▼ reads this repo's own plan.md ══════════════════════╗ for the next open row ║ AIsa api.aisa.one ║ (self-referential fallback) ║ (real boundary #2, ║ ║ real $ receipt) ║ ══════════════════════╝ (5) checkpoint.ts ┌─────────────────────────┐ │ Workers KV │ │ episode history │ │ /checkpoints, /replay │ └─────────────────────────┘ Cotal (closed, permanently blocked) — a Tenki sandbox had cotal installed and logged in, ready to publish episode summaries to hack.cotal.ai/graph, but `cotal send msg` was ACL-blocked on a mesh-operator grant that never came (see row 7a below). The one-off bridge script this used has been deleted - there is nothing left to run against a permission the account never got. ══════ = a real external system this build does not own (the "boundary") ``` ## Context Event: Agent Native Builders Hackathon, Aug 26-27, Cloudflare HQ SF (venue only — Cloudflare is **not** a sponsor; see [`docs/hackathon-brief.md`](../hackathon-brief.md) for the sponsor list and exact quote). **Submission deadline, owner-confirmed: today (2026-08-27) 3:00 PM PT / 10:00 PM UTC — this matches the event page's own "3:00pm Thursday, August 27" exactly (2026-08-27 is independently confirmed to be a Thursday; no discrepancy).** Compute remaining time against this absolute value, not against any hour-count carried over from earlier in a conversation — those decay fast and are easy to get wrong. Full research: [`docs/hackathon-brief.md`](../hackathon-brief.md) (rubric, tracks, sponsors, submission mechanics — all re-verified against the live page this session, not assumed). The original candidate list (`docs/candidates.md`) was superseded by the two designs below and deleted this session — see the source-map entry further down for what was preserved from it. **Decision state: RESOLVED — internal track chosen.** Liminal-flux's idle-discovery pattern (implemented fresh — that repo has no running code, only the ADR-005 pattern) + AIsa-metered resource spend as the real-boundary evidence and per-checkpoint receipt + Cotal-mesh coordination (pending the fork verification in progress) + checkpoint/replay. The external design below is kept for reference (both AIsa payment paths were live-tested and confirmed working, so it remains a viable fallback if the internal build hits a wall before the deadline) but is **not** the current build target. ## Two converged "wow factor" designs ### Internal (CHOSEN) — falsifiable autonomy + AIsa-metered real-boundary evidence + third-party-verified coordination See the design further down (originally written second, now the active one) for the full architecture and diagram. **New refinement this session**: the idle-discovery agent's resource-consuming step routes through AIsa's Bearer-key gateway (confirmed live) instead of a free API — this makes "real work across a real boundary" (30 pts) literal (a real, tiny, metered spend, not a free call), and the checkpoint written for each episode includes AIsa's usage/response as a receipt, not just a narrated log entry. Cotal-mesh coordination visibility is still pending end-to-end verification (a fork is checking `/graph`, `/connect`, `/device` right now). The external-track design (AIsa credential → Tenki sandboxed compute → optional Runtype-scripted caller) was the documented fallback if the internal build hit a wall before the deadline. It never built, the deadline passed, and the project closed with the internal track submitted — the design notes and vendor re-verification detail that used to live here added nothing once that decision was final, so they've been removed rather than kept as unused history. The internal design actually shipped is below. ### Internal — falsifiable autonomy + third-party-verified coordination An agent wakes on a schedule with **no task queued** → self-selects its own next goal via liminal-flux's idle-discovery pattern (one `if/else` on an empty goal queue — not a new agent/workflow) → coordinates visibly on **Cotal**'s hosted, shared `hack.cotal.ai` mesh (`/graph` — a judge can watch it live on Cotal's own UI, not ours) → the whole episode is checkpointed so a skeptical judge can **replay it deterministically, offline, afterward** (the bar set by the (different-hackathon) Broker repo's `make replay`: reproduces a committed run byte-for-byte, no live calls needed). Full sponsor facts (Cotal's confirmed tech stack, Mitosis Labs' actual current status) live in [`docs/hackathon-brief.md`](../hackathon-brief.md) — not repeated here. What matters for this design's viability: Cotal's real nav (`/graph`, `/connect`, `/device`, `/agents`, `/personas`) was confirmed by rendering the JS page with polyfetch/patchright (plain fetch only returns the SPA shell), and its NATS+JetStream/MCP-tool-catalog tech was re-confirmed directly against docs.cotal.ai this session. It's a hosted, shared instance — not something to self-host NATS for. **Still not verified:** the actual `/connect` + `/device` approval flow has never been walked end-to-end — nav existing doesn't confirm the auth mechanics work as assumed; this remains the sharpest open risk for this design (row 5 in the remaining-work table). **Mitosis Labs — now verified, and the finding changes how it should be used.** It's a real product (Cortex, a memory/persistence layer, "the source of truth for your agents" — confirmed directly against mitosislabs.ai) but the event page's own sponsor blurb states plainly it is **not offering builder credits and has no self-serve page for this hackathon at all** — engagement is in-person only (a booth, two named people). There is no confirmed programmatic API path to integrate against before today's deadline. **Recommendation: do not build a live dependency on Mitosis Labs.** It remains usable only as a conceptual/demo-narration tie-in ("this is the kind of memory layer our checkpoint mechanism stands in for"), not as an integration the design's own checkpoint/replay mechanism should route through. ``` INTERNAL TRACK -- idle wake -> self-selected goal -> Cotal-mesh coordination -> checkpoint/replay ================================================================================================== ,-----------------------. | Scheduled trigger | | (cron, no human | | present, no task | | queued) | '-----------+-------------' | (1) heartbeat fires v ,-----------------------------------. | Idle-discovery if/else | <- liminal-flux pattern: ONE branch on an | goal queue empty? -> observe state,| empty goal queue. No new agent/workflow. | generate ONE goal, queue it | '-----------+-------------------------' | (2) goal selected v ,-----------------------------------. | Agent executes the goal | '-----------+-------------------------' | (3) publish progress/findings v ,-----------------------------------. ,--------------------------------. | Cotal hosted mesh | <----> | hack.cotal.ai/graph | | (hack.cotal.ai) -- NOT self-hosted | live | judge watches THIS live, on | | NATS+JetStream [CONFIRMED via | view | Cotal's own UI, not ours | | docs.cotal.ai] | '--------------------------------' | - cotal_send/cotal_dm/cotal_anycast| | - cotal_spawn/cotal_persona | NOTE: /connect + /device approval flow | - credentials via `cotal mint` | still NOT walked end-to-end -- open risk '-----------+-------------------------' (remaining-work row 5), test before demo. | (4) episode completes v ,-----------------------------------. | Checkpoint written to disk | <- mirrors the (different-hackathon) Broker | (committed state files, no live | repo's `make replay` bar: byte-for-byte | calls needed to replay) | reproducible offline, no live calls. '-----------+-------------------------' | (5) time passes (cold, separate run) v ,-----------------------------------. | `make replay` (or equivalent) | | reproduces the run from committed | | state alone -- "it runs" gate: | | judge triggers this LIVE | '--------------------------------------' Mitosis Labs is deliberately OUTSIDE this diagram: confirmed this session to have no self-serve/API path for this event (in-person booth only, no builder credits) -- it is demo-narration framing at most, not a wired dependency of the checkpoint mechanism above. ``` ## 🗺️ Source map (what exists right now) - **AIsa test API key used this session was owner-provided, one-time, and will be rotated after testing** — do not assume `sk-aisa-3kZvOZk9tLdwRyplQ3QBUXjbusUsccDkkTPBL5wwg1s` still works in a future session; it was never written into any file in this repo (kept in `/tmp/aisa_key.env` on the agent's local sandbox only, outside git entirely). A fresh key will be needed for any further live testing or for the actual build. - `docs/hackathon-brief.md` — compiled, cited research: rubric, both track descriptions, full sponsor list with what each is actually giving, submission mechanics, pattern-source citations. - `docs/candidates.md` — **deleted this session.** It was original working notes (6 candidates, 3/track, plus a Cotal-recombination analysis) written *before* the "no Cloudflare sponsorship" correction and *before* the AIsa/Tenki/Runtype/Mitosis Labs verification. Re-checked line-by-line against this session's full first-party verification pass before deleting: nothing in it was more accurate than what's in this file, and everything in it that still mattered (the arXiv research-restraint citations, the Cotal-fits-internal-not-external reasoning, the "one track, one candidate" recommendation) is already captured in this plan or in `docs/hackathon-brief.md`. Fully superseded, confirmed, removed — not recoverable via git (the file was untracked). - ~~No code has been written in this repo.~~ **Stale as of the build — see the remaining-work table below for what shipped.** This line is left here only as a historical marker of the plan's starting point, not a current-state claim. ## Remaining-work table (SINGLE source of open work) | # | Item | Gate | Done-when | |---|------|------|-----------| | ~~1~~ | ~~Decide: external, internal, or scoped-down version of one~~ | owner | **Done — internal chosen (liminal-flux idle-discovery + AIsa-metered receipts + Cotal coordination + checkpoint/replay); external kept as documented fallback, not deleted** | | ~~2~~ | ~~Confirm the actual submission deadline~~ | owner | **Done — today (2026-08-27) 3:00 PM PT / 10:00 PM UTC, owner-confirmed** | | ~~3~~ | ~~Confirm AIsa's payment path works live~~ | owner/agent | **Partly done — both surfaces confirmed live this session with the real key (Bearer-key chat completion succeeded; x402 challenge returned real $0.008 USDC terms). Remaining: either top up the Bearer-key account balance, or complete one real x402 settlement with a funded wallet (owner-gated — needs a private key, not an agent action) — do this before the live demo, not during it.** | | ~~4~~ | ~~Verify Runtype's actual product surface before building against it~~ | agent | **Done — confirmed via docs.runtype.com/runtype.ai: real AI product platform (agents/flows/evals/REST APIs)** | | ~~5~~ | ~~Walk Cotal's `/connect` + `/device` flow end-to-end~~ | agent | **Done — CONFIRMED buildable/demo-able, no hidden blocker (an earlier "inconclusive" report in this same session was wrong — a too-short render timeout, corrected on retry). `/graph` is fully public, no login wall — a judge can view it with zero setup, and shows a real empty-state message confirming the mesh is live. Fastest path: `/agents` — "boots a sandbox, installs the standard CLI, enrols an agent... takes about two minutes" — zero local setup. Alternative: the 5-step `/connect` laptop CLI (`curl get.cotal.ai \| sh` → `cotal setup --yes` → `cotal meshes add` → `cotal login` → approve at `/device`). Either path needs creating/joining a team + one `cotal login`/`/device` code-approval step (a real account action, not just viewing — not attempted by the read-only exploration). One doc correction: the event-specific flow uses `cotal setup --yes` (connects directly to the already-hosted mesh) — simpler than the general product docs' `cotal-ai setup --yes && cotal-ai up --detach` (which provisions a local broker); don't use the general-docs command for this event.** | | ~~6~~ | ~~Verify Mitosis Labs' actual product surface~~ | agent | **Done — confirmed via mitosislabs.ai: real product (Cortex), but no builder credits/self-serve path for this event — do not build a live dependency on it** | | ~~7~~ | ~~Build the core loop: Worker/agent implementing idle-discovery (bounded GH-signals → AIsa-gated decision → NONE-fallback to this plan's own open rows → checkpoint)~~ | agent | **Done (PR #3) — `wrangler dev` smoke-tested locally end-to-end against real GitHub API calls: `/`, `/.well-known/ai-agent.json`, `/trigger`, `/checkpoints`. `npm run typecheck`/`test`/`replay` all green, CI green.** | | ~~7a~~ | ~~Cotal coordination-visibility wiring~~ | agent then owner | **Closed, permanently blocked — the "stateless Worker can't hold a persistent NATS connection" limitation was solved (a persistent Tenki cloud sandbox had `cotal` CLI installed, mesh `hack` registered, and login succeeded), and a bridge script published episode summaries against real live `/checkpoints` data. The one remaining block never cleared: `cotal send msg` failed with `NATS permission denied` — this account had no publish rights on the mesh. The fix (`cotal actor grant cli --sub oW8kEuuV9NajVc8tTrUmojUKBHuougLz`) can only be run by the mesh's operator, not self-serviceable, and no grant ever came before the project closed. The now-unrunnable bridge script has been deleted; `/checkpoints` + `org2`'s own agent carried the coordination-visibility story instead.** | | ~~7b~~ | ~~Deploy the Worker to Cloudflare for real~~ | owner then agent | **Done — live at https://agent-native-hack.cloudflare-driveway392.workers.dev. `wrangler login --device` (RFC 8628) used after the localhost-callback OAuth flow timed out in this container; real `CHECKPOINTS` KV namespace created and wired; `GITHUB_TOKEN` deployed as a secret, piped in directly, never displayed.** | | ~~7c~~ | ~~Wire a live AIsa key~~ | owner then agent | **Done — owner-provided key uploaded via `wrangler secret put AISA_API_KEY` (piped from `.dev.vars`, never displayed). Confirmed live: a real `/trigger` call against the deployed URL returned `aisaReceipt.mode: "live"` with a genuine model-generated goal ("Increase documentation for the src directory...") reasoning from real edit-frequency data.** | | ~~8~~ | ~~Rehearse the full live demo at least once, cold, before presenting to judges~~ | owner+agent | **Done — repeatedly verified live and unattended across this session (multiple `/trigger` calls, all succeeding cold with `aisaReceipt.mode: "live"`). Owner should still click through the GH Pages landing page once themselves before presenting, to confirm the button UX end-to-end from a fresh browser.** | | ~~9~~ | ~~Register team / confirm team status~~ | owner | **Done — real root cause found: the `signup-with-agent` device-code flow was reusing an already-logged-in browser session under the wrong identity. Fixed by re-approving in a fresh session as `staioneffe@protonmail.com` (the email on the Cloudflare builder list) — `ic_hack_me` then returned `registered: true, role: {roles: ["participant"]}`. Team `nolim` (`t_eae57647f38568ec`) created via `ic_hack_team_create`. NDA signed via `ic_hack_sign_nda` at 2026-08-27T21:23:04Z.** | | ~~10~~ | ~~Submit the solution~~ | owner then agent | **Done, API-confirmed — `ic_hack_submit` returned `ok: true` at 2026-08-27T21:22:53Z (not just a human's belief it worked: the actual JSON response was read and is quoted in this session). `agent_surface: "MCP server"`, all fields per the "Live deployment" line above. Idempotent/overwrite-until-lock — safe to resubmit if anything material changes before 22:00 UTC.** | | ~~10a~~ | ~~Upgrade `agent_surface` from generic value before submitting~~ | agent | **Done — built a real MCP server (`src/mcp.ts`, `/mcp` JSON-RPC 2.0 endpoint, `run_idle_discovery_episode` tool) rather than A2A (A2A's exact JSON-RPC binding couldn't be pinned down confidently in the time available; MCP could be, since this session used MCP heavily against the hackathon's own platform all day). Submitted with `agent_surface: "MCP server"`.** | | ~~11~~ | ~~Real cross-repo execution~~ | agent | **Done — `src/execute.ts` writes a real GitHub issue to this repo AND to an independently-maintained counterparty repo ([`org2`](https://github.com/qte77/2026-08-26-AgentNativeHack-FT-CF-SF-org2)), plus a real committed file under `org2`'s `requests/`, all read back to confirm they landed. `org2` also has its own independent GitHub Actions agent (`.github/workflows/respond.yml` + `scripts/respond.mjs`) that reacts to incoming requests using only its own Actions-provided `GITHUB_TOKEN` — two real, separately-authenticated systems, not one agent narrating both sides.** | | ~~12~~ | ~~Live E2E verification, not just plain HTTP checks~~ | agent | **Done — a browser-driven pass (polyfetch-scrape, real Chromium) against the deployed landing page caught 3 real bugs, all fixed and redeployed: checkpoint keys sorting lexicographically by UUID instead of chronologically; an uncaught exception anywhere falling through to Cloudflare's CORS-less default error page; older pre-schema-change checkpoints 500ing on read. Also fixed: `GET /mcp` 404'd even though it's presented as a clickable link.** | ## Known blockers / open risks (current, not resolved) Superseded items (deadline framing, track decision, team/submission status, Runtype/Mitosis verification) have been removed from this section — they're closed, tracked only in the struck rows above, per this repo's own rule against two lists of open work drifting apart. - **Cotal mesh publish stayed ACL-blocked, not architecture-blocked, through the project's close** — see row 7a. It needed a mesh operator to run `cotal actor grant cli --sub oW8kEuuV9NajVc8tTrUmojUKBHuougLz`; that grant never came, was never self-serviceable by the agent or the owner alone, and the project is now closed with no further action pending on it. - **AIsa real settlement remains one step short by design, not by omission** — the Bearer-key free-tier call is genuinely live (confirmed repeatedly), but completing an actual paid settlement (topping up the balance, or signing an x402 EIP-712 authorization with a funded wallet) needs the owner's own financial/signing action. The agent will not handle a private key for real fund movement — a standing boundary, not a time-pressure call. - **The submission's `updated_at` (2026-08-27T22:58:09Z) is after the stated 22:00 UTC deadline** — `ic_hack_submit` returned `ok: true` with no deadline-related error, and the record shows `locked: false`, so it was accepted; flagging the timing discrepancy honestly rather than omitting it. See [`docs/submission.md`](../submission.md).