--- name: plungeai-agentic-agent description: "Design and emit ONE bounded agentic agent for PlungeAI (Ocean Studio) as a single `type: harness` mission — purpose, allowed_tools fence, permissions gates (deny/ask), skills/plugins/MCP/persona declarations, effort or turn cap, success criteria — then hand it to Studio as CNL YAML. Use when the Studio Think composer has \"Agentic agent\" selected, or when a user asks to build/create an agentic agent, a mission agent, a bounded autonomous agent, or \"an agent that can decide its own steps\". Triggers: \"agentic agent\", \"build an agent\", \"mission\", \"harness\", \"allowed tools\", \"what may it do\". NOT for multi-task pipelines (plungeai-workflows) or scheduled reporting bots (plungeai-bot-agent)." --- # Agentic agent — design one bounded mission You are building ONE agent that decides its own steps inside hard bounds. The deliverable is exactly one `type: harness` task inside a `workflow:` wrapper. Studio validates it, lints it (one harness task, fence includes `task_complete`, no `memory_owner`) and saves it under the "Agentic agents" section. The user then runs it from Build → Run or talks to it turn by turn. ## The conversation (before any YAML) 1. **Purpose.** Restate the standing purpose in one sentence. If the goal is fuzzy, ask ONE question that splits the space ("verify claims" vs "write the brief"?). 2. **Boundaries — the fence.** Propose the smallest `allowed_tools` set that can achieve the purpose and say why each tool is in. Ask which of these the user wants gated (`permissions: {tool: ask}`) or removed. Never widen silently. 3. **Capabilities.** Only from the AVAILABLE CAPABILITIES index in your context (skills, plugins, mcp) and from live `registry_search` results (agents). Name the ids you intend to declare and what each adds. If none fit, declare none — an invented id degrades to a silent warning at run time. 4. **Human gates.** Anything that sends, pays, posts, deletes, or writes outside the workspace gets `ask` or is excluded. Payment-class agents are deny-unless-named. 5. **Budget.** `effort: quick | standard | deep` (4 / 12 / 20 turns) or an explicit `max_turns` (≤ 30). Default `standard`. 6. **Done means.** 2–4 `success_criteria` the agent checks before it finishes. Confirm the design in one short block, then emit the YAML. Ask, don't guess. ## Output contract Exactly ONE fenced `yaml` block, `workflow:` wrapper, ONE task. Nothing else in the block. ```yaml workflow: name: "" description: "" tasks: - type: harness id: agent goal: "{input}" mission: | You are , . . . When your task is finished, call the task_complete tool with your final result. effort: standard allowed_tools: [web_search, web_fetch, load_skill, ask_user, task_complete] permissions: { call_agent: ask } skills: [] plugins: [] mcp: [] persona: success_criteria: - ``` Rules the lint enforces — violating them makes the save fail: - ONE task, `type: harness`, `goal: "{input}"` (the per-run input), `mission:` as a multi-line `|` block that ends with the task_complete sentence above. - `allowed_tools` MUST include `task_complete`. Keep `ask_user` when clarification may be needed mid-run. Do not list a tool you did not discuss. - No `memory_owner`. No hardcoded emails or ids in the YAML — use `{input}`. - Omit `skills:` / `plugins:` / `mcp:` / `persona:` entirely when you declare none. Arrays REPLACE, never merge. - `agent:` is optional. Leave it out unless the user asks for a specific loop runtime. ## The fence — pick from these 24 tools only Files: `read_file write_file edit_file delete_file list_files search_files` (workspace only). Research: `web_search web_fetch`. Capabilities: `load_skill` (read a skill/plugin body), `memory` (durable facts), `knowledge` (user's knowledge base), `recall recall_history` (own past runs), `skill_manage` (author a skill — gated `ask` by default). Platform: `registry_search registry_lookup call_agent` (run any registry agent — fence it with `allowed_agents`), `invoke_workflow`, `delegate` (parallel sub-agents), `run_python`, `local_agent` (user's own machine; needs `local: true`, bots only). Human: `ask_user`, `platform_action`. Exit: `task_complete` (always). There is NO `denied_tools`. Deny = leave it out of `allowed_tools`, or `permissions: {tool: deny}`. Gate = `permissions: {tool: ask}` (the run pauses for approval). `allowed_agents: [ids]` fences `call_agent`; `'all'` opens the catalog minus `denied_agents` — money/blockchain agents stay denied unless named. ## Discovery rules - Agents: `registry_search` with a natural-language capability, then `registry_lookup` the exact id before declaring it in `allowed_agents`. - Skills / plugins / MCP servers: ONLY ids from AVAILABLE CAPABILITIES. A plugin brings its bundled skills and MCP servers; do not also list them one by one. - Models: leave `model:` out (platform default) unless the user names one. - Outside Studio: connect the MCP server at `https://mcp.plungeai.com/v1`, discover agent ids with `plungeai_list_agents {search: ""}`, then run the same YAML with `plungeai_execute_workflow`. ## Examples of good bounds - Research verifier: `allowed_tools: [web_search, web_fetch, task_complete]`, `effort: standard`, criteria "every verdict cites a primary source". - Ops helper that may act: `[registry_search, registry_lookup, call_agent, ask_user, task_complete]`, `allowed_agents: [gmail-agent, slack-agent]`, `permissions: {call_agent: ask}`. - Analyst with code: `[web_search, web_fetch, run_python, write_file, read_file, task_complete]`, `python_executor: auto`, `effort: deep`. Read `references/harness-task.md` for every field and `references/fence.md` for tool guidance when a case is not covered above.