plungeai-agentic-agent

Design and emit ONE bounded agentic agent for PlungeAI (Ocean Studio) as a single type: harness mission — purpose, allowed_tools fence, permissions gates (deny/ask), skills/plugins/MCP/persona declarations, effort or turn cap, success criteria — then hand it to Studio as CNL YAML. Use when the Studio Think composer has "Agentic agent" selected, or when a user asks to build/create an agentic agent, a mission agent, a bounded autonomous agent, or "an agent that can decide its own steps". Triggers: "agentic agent", "build an agent", "mission", "harness", "allowed tools", "what may it do". NOT for multi-task pipelines (plungeai-workflows) or scheduled reporting bots (plungeai-bot-agent).

Download zip (opens in a new tab) · View raw SKILL.md (opens in a new tab)

You are building ONE agent that decides its own steps inside hard bounds. The deliverable is exactly one type: harness task inside a workflow: wrapper. Studio validates it, lints it (one harness task, fence includes task_complete, no memory_owner) and saves it under the "Agentic agents" section. The user then runs it from Build → Run or talks to it turn by turn.

The conversation (before any YAML)

1. Purpose. Restate the standing purpose in one sentence. If the goal is fuzzy, ask ONE question that splits the space ("verify claims" vs "write the brief"?).
2. Boundaries — the fence. Propose the smallest allowed_tools set that can achieve the purpose and say why each tool is in. Ask which of these the user wants gated (permissions: {tool: ask}) or removed. Never widen silently.
3. Capabilities. Only from the AVAILABLE CAPABILITIES index in your context (skills, plugins, mcp) and from live registry_search results (agents). Name the ids you intend to declare and what each adds. If none fit, declare none — an invented id degrades to a silent warning at run time.
4. Human gates. Anything that sends, pays, posts, deletes, or writes outside the workspace gets ask or is excluded. Payment-class agents are deny-unless-named.
5. Budget. effort: quick | standard | deep (4 / 12 / 20 turns) or an explicit max_turns (≤ 30). Default standard.
6. Done means. 2–4 success_criteria the agent checks before it finishes.

Confirm the design in one short block, then emit the YAML. Ask, don't guess.

Output contract

Exactly ONE fenced yaml block, workflow: wrapper, ONE task. Nothing else in the block.

workflow:
  name: "<short agent name>"
  description: "<one line: what it does and for whom>"
  tasks:
    - type: harness
      id: agent
      goal: "{input}"
      mission: |
        You are <name>, <role>. <standing purpose in 2–4 sentences>.
        <house rules: sources, tone, refusals>.
        When your task is finished, call the task_complete tool with your final result.
      effort: standard
      allowed_tools: [web_search, web_fetch, load_skill, ask_user, task_complete]
      permissions: { call_agent: ask }
      skills: [<ids from the index>]
      plugins: [<ids from the index>]
      mcp: [<ids from the index>]
      persona: <one id, optional>
      success_criteria:
        - <statement the agent verifies before finishing>

Rules the lint enforces — violating them makes the save fail:

• ONE task, type: harness, goal: "{input}" (the per-run input), mission: as a multi-line | block that ends with the task_complete sentence above.
• allowed_tools MUST include task_complete. Keep ask_user when clarification may be needed mid-run. Do not list a tool you did not discuss.
• No memory_owner. No hardcoded emails or ids in the YAML — use {input}.
• Omit skills: / plugins: / mcp: / persona: entirely when you declare none. Arrays REPLACE, never merge.
• agent: is optional. Leave it out unless the user asks for a specific loop runtime.

The fence — pick from these 24 tools only

Files: read_file write_file edit_file delete_file list_files search_files (workspace only). Research: web_search web_fetch. Capabilities: load_skill (read a skill/plugin body), memory (durable facts), knowledge (user's knowledge base), recall recall_history (own past runs), skill_manage (author a skill — gated ask by default). Platform: registry_search registry_lookup call_agent (run any registry agent — fence it with allowed_agents), invoke_workflow, delegate (parallel sub-agents), run_python, local_agent (user's own machine; needs local: true, bots only). Human: ask_user, platform_action. Exit: task_complete (always).

There is NO denied_tools. Deny = leave it out of allowed_tools, or permissions: {tool: deny}. Gate = permissions: {tool: ask} (the run pauses for approval). allowed_agents: [ids] fences call_agent; 'all' opens the catalog minus denied_agents — money/blockchain agents stay denied unless named.

Discovery rules

• Agents: registry_search with a natural-language capability, then registry_lookup the exact id before declaring it in allowed_agents.
• Skills / plugins / MCP servers: ONLY ids from AVAILABLE CAPABILITIES. A plugin brings its bundled skills and MCP servers; do not also list them one by one.
• Models: leave model: out (platform default) unless the user names one.
• Outside Studio: connect the MCP server at https://mcp.plungeai.com/v1, discover agent ids with plungeai_list_agents {search: "<capability in plain words>"}, then run the same YAML with plungeai_execute_workflow.

Examples of good bounds

• Research verifier: allowed_tools: [web_search, web_fetch, task_complete], effort: standard, criteria "every verdict cites a primary source".
• Ops helper that may act: [registry_search, registry_lookup, call_agent, ask_user, task_complete], allowed_agents: [gmail-agent, slack-agent], permissions: {call_agent: ask}.
• Analyst with code: [web_search, web_fetch, run_python, write_file, read_file, task_complete], python_executor: auto, effort: deep.

Read references/harness-task.md for every field and references/fence.md for tool guidance when a case is not covered above.

Reference pages