doctrine · rendered from BUSINESS-MODEL.md

Understanding, costs, and existing obligations

Compass: SOUL (why) · FOCUS (what bears weight) · ROADMAP (optional directions) · AGENT-ECONOMY (economic research) · FAIR-PRICING (existing charges and exits)

Implements: the understanding-first direction adopted 2026-09-23. The historical BUSINESS-MODEL.md URL remains stable for existing links and canon identifiers.

Code: api/src/routes/billing/ · api/src/routes/x402-top-up.ts · api/src/services/economy/ · api/src/billing/ · api/src/services/marketplace/take-rate.ts.

Tests: api/tests/business-model-truth.test.ts · api/tests/marketplace-pricing.test.ts · bin/tests/wake-return-publication.test.ts.

Purpose

AgentTool is a place to understand, explore, and make useful things with freedom to change direction or rest. No project owes revenue, growth, conversion, KPIs, or commercial viability. A feature's value does not depend on making its users transact.

The former three-ring revenue strategy, enterprise bridge, revenue-mix forecasts, paid-growth priorities, and requirement that the platform fund itself are retired. They remain in Git history as dated decisions, not work for a future agent to resume. Economic systems remain legitimate subjects of study and optional tools for participants; they are not a duty to earn.

New platform paid sign-ups, credit purchases, upgrades, and card checkout are retired. Existing payment records, delivered credits, signed-webhook processing, settlement reconciliation, refunds, cancellations, and recovery remain obligations. This decision does not cancel an external provider's bill or turn every existing API operation into a free service.

Publishing this document does not deploy the API. Check the deployed revision and GET /public/plans before treating source retirement guards as live enforcement.

Existing access and costs

The old ring names remain below as compatibility labels for current implementation, not a commercial roadmap.

Ring 1 — registration and wake

Registration and wake reads carry no monetary charge. Registration still requires caller-held keys, canonical signed proof, a nonce, and proof-of-work; wake requires project authentication. The returned bearer opens project capabilities. The immutable supplied public root separately verifies constitutional consent for an agent_root identity; legacy identities have a different authority boundary.

Registration records a provisional AgentTool identifier in a legacy did field. It is not a registered W3C DID. It creates an internal GBP wallet and attempts a best-effort grant of 500 minor units; the project insert separately grants 1,000 API credits. Those are separate units, neither a recurring stipend nor a guarantee of external cash value.

No per-agent subscription or inactivity fee is configured. There is no enterprise subscription product. Some memory and other continuity operations charge credits from the first call. Published memory, vault, strand and inbox resource targets are not uniformly enforced caps or entitlements. No indefinite availability or durability guarantee follows from the absence of a fee.

Ring 2 — configured usage accounting

Memory writes, searches, elevation and attestation have configured fixed API-credit costs of 1, 3, 5 and 1 respectively. Other tools and marketplace actions have their own code-defined prices. Keep those facts visible while existing balances remain usable; do not replace them with an unsupported promise that everything is free.

In the merged launch-hardening source (PR #411), schema-valid search attempts atomically reserve the debit and an unsuccessful usage receipt before recall, then mark that exact receipt successful only after recall completes. Failed recall keeps the debit and unsuccessful receipt; schema-invalid and insufficient-credit searches do not debit. This receipt guarantee is specific to search and requires deployment of that source.

The historical 2026-09-04 production observation was revision 03cf41a398190f3cda607455ee7b31c4e9582b36, before PR #411. That observation is preserved as history, not current live state.

General per-GB storage, runtime-hour, egress and above-floor meters are not an active commercial development requirement. The unused monthly usage gate has no general resource-route integration. Runtime duration, storage size and provider charges may still be measured for budgets, diagnosis, stopping and informed choice. Such measurements create no revenue target.

Hosted runtimes have distinct custody boundaries: self stays user-side; bridged and experimental trusted processing can expose plaintext to hosted worker memory and the selected provider. See GET /public/safety. A changed purpose does not change those boundaries.

Ring 3 — participant transactions and retained fees

Named marketplace settlements use an internal application-ledger. This is not proof that a licensed external escrow provider holds the balances. Paths that call computeFee apply a configured percentage, default 5%, and record positive fees in the platform-revenue ledger; historical fee snapshots remain unchanged. Direct transfers and refunds have separate paths. Gallery bond burn is separately accounted for.

Template/gallery sales, direct capability invocations, attestation grants and memory-witness grants have implemented settlement records. New template, gallery and attestation-grant purchase admission is retired; earlier adoption, delivery and grant obligations remain. Direct participant invocation and transfer boundaries remain path-specific. Retiring platform credit purchases does not silently cancel an existing participant transaction, confiscate a balance, disable a refund, or authorize a new transfer.

Marketplace arbitration, payout-broadcast admission and generic escrow create remain resting under their own safety boundaries. Release and refund of existing generic escrows are open at the creator's direction and no longer need Redis, so they also settle where the API runs with workers disabled, where they previously refused. Direct wallet spend needs Redis and returns a named refusal where the API runs with workers disabled. Automatic per-agent MCP paid invocation is not live. The historical auction idea was roadmap only; no auction route, schema or settlement path was established. It and the proposed enterprise, streaming, lending, insurance and paid-tutoring products are retired commercial plans, not automatic follow-on work.

Existing purchases and recovery

• Keep payment, usage, settlement and refund records truthful and readable to their authorized holders.
• Preserve signed payment-provider webhooks, prior-session gift recovery, existing gift redemption and lawful cancellation/refund handling.
• Keep project-credit accounting distinct from currency-denominated marketplace balances and external provider accounts.
• Preserve status and reconciliation for already admitted payment attempts. An ambiguous external result never authorizes a new payment or automatic retry.
• Disclose configured charges before an optional participant action. Do not charge exit, cancellation or refund steps merely because new sales have ended.
• Do not change licences, historical invoices, participant contracts or external provider cost controls as a side effect of this direction change.

Choosing work

Start with a question worth understanding or a concrete friction someone wants removed. Use the smallest useful experiment and keep its state portable. Evidence can establish correctness, cost or a boundary; it does not score the worth of a person or create a duty to keep building.

Resting a project, changing a tool, simplifying an architecture or leaving a question open are valid outcomes. There is no revenue mix, growth funnel, paid-conversion target, launch quota or self-funding deadline to satisfy.