submit: runesleo-agent-acceptance-gate

submissions/mcp-hackathon/runesleo-agent-acceptance-gate/RIGHTS.md

@@ -0,0 +1,14 @@
+# Submission rights declaration
+
+Project: `Agent Acceptance Gate`
+Submission slug: `runesleo-agent-acceptance-gate`
+Submitter: `Leo / runesleo`
+Date: `2026-09-17`
+
+I own, or have sufficient authorization for, the source code, service, data, branding, and other materials submitted in this pull request. I authorize X-Agent to retain, review, archive, and evaluate this submission under the official X-Agent MCP Hackathon 2026 rules.
+
+Authorization basis: owner Leo explicitly approved public repository visibility, Cloudflare Worker deployment of commit `15c007b4a785a1263df989bb72c6e10e4b60ddf4` to `https://api.leolabs.me`, and official PR submission to `xagentAI/xagt-plugin` on 2026-09-17 ("部署呗 不搞白不搞").
+
+Third-party components and their licenses: Node.js built-ins; Cloudflare Wrangler 4.133.0 as development/deployment tooling (pinned in `source/package-lock.json`); Cloudflare Workers as the hosting runtime. Review upstream license notices as applicable.
+
+Exceptions or restrictions: The source repository currently has no standalone `LICENSE` file. The existing paid x402 surfaces on the same Worker remain separate from this reviewer capability and are not part of the hackathon claim beyond noting they are unchanged.

submissions/mcp-hackathon/runesleo-agent-acceptance-gate/SUBMISSION.md

@@ -0,0 +1,54 @@
+# Agent Acceptance Gate
+
+## Capability
+
+- **One-line description:** Deterministically audit an AI-agent delivery before acceptance and return a verdict, evidence gaps, risks, and the next safe gate.
+- **Who it helps:** Agent marketplaces, buyers, evaluators, and orchestration systems that need a machine-readable acceptance gate.
+- **Capability boundary:** Read-only evaluation of supplied evidence. It does not inspect a private repository, execute validation commands, sign, settle, pay, trade, mutate files, or change an account.
+- **Track:** General Challenge (Open Innovation)
+
+## Live API
+
+- **API base URL:** https://api.leolabs.me
+- **Capability URL:** https://api.leolabs.me/xagent/agent-delivery-acceptance-audit
+- **Health-check URL:** https://api.leolabs.me/health
+- **Deployment proof URL:** https://api.leolabs.me/.well-known/xagent-verification.json
+- **Authentication:** None during the bounded reviewer window. The route is disabled unless `XAGENT_REVIEW_ENABLED=true` is explicitly deployed.
+- **Rate limits / known limits:** Cloudflare Worker platform limits apply; JSON request bodies are capped at 1 MiB. The audit is deterministic and makes no outbound call on this route.
+- **API contract:** `source/openapi.yaml`
+
+## Source and reproducibility
+
+- **Source repository:** https://github.com/runesleo/agent-acceptance-gate
+- **Review commit:** `15c007b4a785a1263df989bb72c6e10e4b60ddf4`
+- **Public branch:** `codex/xagent-mcp-hackathon-prep-20260917`
+- **Source submitted in this PR:** `source/`
+- **Setup:** `npm ci`
+- **Run tests:** `npm test && npm run worker:check`
+- **Run locally:** `npx wrangler dev --var XAGENT_GIT_COMMIT:15c007b4a785a1263df989bb72c6e10e4b60ddf4 --var XAGENT_PROJECT_SLUG:runesleo-agent-acceptance-gate --var XAGENT_REVIEW_ENABLED:true`
+- **Deploy:** `npm run deploy:worker -- --var XAGENT_GIT_COMMIT:15c007b4a785a1263df989bb72c6e10e4b60ddf4 --var XAGENT_PROJECT_SLUG:runesleo-agent-acceptance-gate --var XAGENT_REVIEW_ENABLED:true`
+- **Version binding:** The Worker returns `15c007b4a785a1263df989bb72c6e10e4b60ddf4` from `/health` and from the same-origin verification document. Missing or malformed deployment identity fails closed with HTTP 503.
+
+Unrelated `research/demo-video-cn/` media is excluded. Worker implementation, tests, API contract, config example, and dependency lock are included.
+
+## Verification
+
+Repeatable commands and live response fixtures are in `verification/README.md`.
+
+- **Offline health/proof contract:** Covered by `npm run test:xagent`.
+- **Capability call:** `POST /xagent/agent-delivery-acceptance-audit` with `verification/request.json`.
+- **Expected error behavior:** Missing `delivery_summary` returns HTTP 400; a disabled review route returns HTTP 404; missing deployment identity returns HTTP 503.
+
+## Security and data handling
+
+- **Data collected:** Request fields describing a task and delivery evidence. No wallet seed, signature, payment credential, or customer record is required.
+- **Purpose and retention:** The reviewer route evaluates the body in memory and does not persist it.
+- **Third parties / outbound network calls:** Cloudflare Workers hosts the API. This reviewer route makes no outbound call. Existing paid routes have separate x402/OKX behavior and are not changed by this review route.
+- **Secrets:** No secrets are committed. Deployment values in `config/xagent-review.env.example` are non-secret bindings.
+- **Known risks / restrictions:** The result is a deterministic evidence-quality judgment, not a security certification. It relies on caller-supplied evidence and intentionally preserves human approval gates.
+
+## Support
+
+- **Team / builder:** Leo / `runesleo`
+- **Contact:** GitHub `@runesleo` via the source repository
+- **License / rights:** See `RIGHTS.md`.

submissions/mcp-hackathon/runesleo-agent-acceptance-gate/source/.gitignore

@@ -0,0 +1,18 @@
+node_modules/
+.DS_Store
+.env
+.env.*
+generated-audits/
+coverage/
+dist/
+*.log
+
+.secrets.env
+.dev.vars
+.wrangler/
+
+# demo intermediates
+research/demo-video-cn/audio/
+research/demo-video-cn/part-*.mp4
+research/demo-video-cn/slides/
+research/demo-video-cn/concat.txt

submissions/mcp-hackathon/runesleo-agent-acceptance-gate/source/AGENTS.md

@@ -0,0 +1,41 @@
+# Agent Instructions
+
+Default communication: Chinese.
+
+## Scope
+
+This repo is a local-only prototype for `Agent Acceptance Gate`.
+
+It should stay agent-first and human-readable:
+
+- agents call the API/tool;
+- humans review the result and authorize next gates.
+
+## Allowed local work
+
+- Edit source, docs, schemas, discovery metadata, demo files, and tests.
+- Run `npm test`.
+- Run `npm run serve` locally.
+- Add more sample inputs/outputs from public-safe or local worker writebacks.
+
+## Hard gates
+
+Do not do these without explicit Leo approval:
+
+- push to any remote;
+- create public GitHub repo or change repo visibility;
+- deploy a public endpoint;
+- submit OKX.AI ASP listing;
+- connect OKX Agentic Wallet, API credentials, wallet address, x402, or payment middleware;
+- publish to leolabs / X as official launch;
+- claim legal, investment, smart-contract security, or guaranteed correctness.
+
+## Product boundary
+
+This is not an observability platform, full code review tool, security auditor, wallet tool, or general AI evaluation framework.
+
+Primary positioning:
+
+```text
+Can this agent delivery be accepted?
+```

submissions/mcp-hackathon/runesleo-agent-acceptance-gate/source/CLAUDE_INDEPENDENT_RESEARCH_PROMPT.md

@@ -0,0 +1,93 @@
+# Claude Independent Research Prompt
+
+Purpose: let Claude independently re-evaluate the OKX.AI / Agent commerce opportunity without being anchored by the current Codex-built product.
+
+Use this tomorrow in a fresh Claude thread.
+
+## Phase 1: Blind market research
+
+Do **not** read `/Users/zhangxu/Projects/agent-acceptance-gate` yet.
+
+Start from first principles and current market evidence.
+
+Research:
+
+1. What will the OKX.AI / agent-commerce / A2A / A2MCP market likely become?
+2. In a world where agents hire agents, call tools, spend budgets, deliver work, release escrow, and dispute outcomes, which services are naturally high-frequency?
+3. Which services have the largest market capacity or highest willingness to pay?
+4. Which services are likely to be platform-owned vs third-party ASP opportunities?
+5. What should a one-person company build first if the target is meaningful revenue, not just a hackathon demo?
+
+Required sources:
+
+- OKX.AI official docs: ASP, A2MCP, A2A, Evaluator, ASP registration.
+- OKX / X Layer hackathon announcement and Star_OKX $1M OPC tweet.
+- Agentic payments: x402, AP2, UCP, OKX Payment SDK.
+- MCP ecosystem: tool directories, MCP adoption, MCP security/market research.
+- Agent marketplaces: RentAHuman or similar task/escrow systems.
+- Agent eval / observability / QA companies: LangSmith, Braintrust, HoneyHive, Arize.
+
+Output format:
+
+```text
+1. Market structure map
+2. High-frequency service demand map
+3. Highest-revenue opportunity ranking
+4. Risks / platform-owned areas
+5. Recommended wedge for Leo
+6. 7-day execution plan
+7. Kill criteria
+```
+
+Important:
+
+- Do not assume `Agent Acceptance Gate` is correct.
+- Do not optimize for what Codex already built.
+- If the best answer is unrelated to acceptance/verification, say so.
+- Separate "strategically interesting" from "currently demanded."
+
+## Phase 2: Compare against Codex repo
+
+Only after Phase 1 is complete, read:
+
+```text
+/Users/zhangxu/Projects/agent-acceptance-gate
+```
+
+Then compare:
+
+1. Where does the existing repo match your independent market thesis?
+2. Where is it overfit to Codex's assumptions?
+3. What should be kept?
+4. What should be renamed, pivoted, or killed?
+5. What is the next concrete step if Leo wants to pursue the strongest opportunity?
+
+Output format:
+
+```text
+Claude independent conclusion:
+
+Keep:
+Change:
+Kill:
+New direction:
+Next 24h:
+Next 7d:
+Hard gates:
+```
+
+## Hard gates
+
+Do not do any of these without explicit Leo approval:
+
+- OKX.AI account / Agentic Wallet login;
+- API key / credential setup;
+- wallet address / funding / signing / transaction / staking;
+- payment middleware / x402 / OKX Payment SDK integration;
+- ASP listing submission;
+- GitHub remote creation or public repo;
+- push / deploy / production endpoint;
+- leolabs public publish.
+
+Read-only web research and local notes are allowed.
+

submissions/mcp-hackathon/runesleo-agent-acceptance-gate/source/DEPLOYMENT.md

@@ -0,0 +1,72 @@
+# Deployment
+
+Status: worker_api_live_xagent_patch_local_only
+
+## Public surfaces currently live
+
+- Static demo: https://agent-acceptance-gate.pages.dev/
+- Cloudflare Worker API: https://api.leolabs.me
+- Current production health: https://api.leolabs.me/health
+- Existing paid service catalogue: https://api.leolabs.me/api/okx-ai-services
+
+The existing Worker API is live. The X-Agent commit-bound health response,
+same-origin verification document, and reviewer POST route prepared on
+`codex/xagent-mcp-hackathon-prep-20260917` are **not yet deployed**.
+
+## X-Agent deployment identity
+
+A review deployment must set all three values. Start from
+`config/xagent-review.env.example` and bind the exact public source commit:
+
+```text
+XAGENT_GIT_COMMIT=<exact 40-character public Git commit deployed>
+XAGENT_PROJECT_SLUG=runesleo-agent-acceptance-gate
+XAGENT_REVIEW_ENABLED=true
+```
+
+`XAGENT_GIT_COMMIT` must match the public source commit submitted for review.
+With a missing or malformed commit, `/health` and the verification endpoint
+fail closed with HTTP 503. When `XAGENT_REVIEW_ENABLED` is unset or false, the
+reviewer POST route returns HTTP 404 and the existing x402 route remains intact.
+
+## Local verification
+
+```bash
+npm test
+npm run worker:check
+npm run test:xagent
+npm run test:xagent-submission
+```
+
+## Deployment command
+
+After the source commit is public and Leo explicitly approves deployment,
+inject the non-secret Worker variables explicitly through Wrangler:
+
+```bash
+npm run deploy:worker -- \
+  --var XAGENT_GIT_COMMIT:<exact-40-character-public-commit> \
+  --var XAGENT_PROJECT_SLUG:runesleo-agent-acceptance-gate \
+  --var XAGENT_REVIEW_ENABLED:true
+```
+
+For a local Worker check, use the same `--var` arguments with `npx wrangler dev`.
+Shell environment variables alone are not treated as Worker bindings.
+
+After deployment, verify:
+
+```bash
+curl --fail --silent --show-error https://api.leolabs.me/health
+curl --fail --silent --show-error https://api.leolabs.me/.well-known/xagent-verification.json
+```
+
+The two responses must expose the same exact 40-character commit as the public
+review commit. A reviewer capability call is documented in the submission
+verification packet.
+
+## Rollback
+
+Rollback means redeploying the previously verified Worker source and restoring
+its prior environment configuration. Do not deploy, alter Worker variables,
+push source, or open the official submission PR without explicit Leo approval.
+The static Pages demo is a separate surface and is not changed by this patch.

submissions/mcp-hackathon/runesleo-agent-acceptance-gate/source/PROJECT_SSOT.md

@@ -0,0 +1,73 @@
+# PROJECT SSOT
+
+Project: Agent Acceptance Gate
+Chinese name: Agent 验收门禁
+Status: local_repo_private_static_demo_public
+Owner thread: product_distribution / cmd5
+Created: 2026-07-02
+
+## Purpose
+
+Agent-first, human-readable acceptance gate for AI agent deliveries.
+
+The service is designed for an agent marketplace flow:
+
+```text
+Seller Agent finishes work
+Buyer Agent / Seller Agent / Evaluator Agent calls audit_agent_delivery
+Service returns pass / needs_review / fail
+Human reviews result and authorizes next gate
+```
+
+## Current state
+
+Runnable prototype with public static demo:
+
+- deterministic audit engine;
+- CLI;
+- local HTTP API;
+- buyer-facing demo;
+- OpenAPI draft;
+- MCP-style tool manifest;
+- agent discovery metadata;
+- launch/billing drafts;
+- public static demo at https://agent-acceptance-gate.pages.dev/.
+
+## Not launched
+
+The project is not:
+
+- submitted to OKX.AI;
+- connected to wallet/payment middleware;
+- connected to API keys or credentials;
+- pushed to GitHub;
+- published on leolabs.
+
+Only `demo/index.html` is publicly deployed as a static Cloudflare Pages demo.
+
+## Hard gates
+
+Require explicit Leo approval before:
+
+- creating a public GitHub repo or changing visibility;
+- adding remote origin / pushing;
+- deploying public endpoint;
+- OKX.AI Agentic Wallet login or ASP listing;
+- adding wallet address / payment middleware / x402 / OKX Payment SDK;
+- publishing leolabs or X announcement as an official launch;
+- claiming security, legal, investment, or smart-contract audit coverage.
+
+## Validation
+
+Current local validation:
+
+```bash
+npm test
+```
+
+Expected:
+
+```text
+PASS 5/5 sample audit cases
+PASS http smoke
+```