For AI agents: a documentation index is available at https://www.plungeai.com/docs/llms.txt. Append .md to any page URL, or send Accept: text/markdown, to get markdown. Setup instructions for agents are at https://www.plungeai.com/docs/agents.md. One ozk_ key opens every plane, models included.

Documentation Index: fetch the complete documentation index at /llms.txt. Use this file to discover all available pages before exploring further.

plungeai-agentic-agent

The fence — tools, agents, and fan-out guards

allowedtools is a hard whitelist — only listed tools ever reach the LLM; an out-of-fence call is refused by the runtime, not merely discouraged. Omit it and one-agent offers every tool (the 8-tool default fence is universal-agent's only) — so always list the fence you mean.

The tool fence

allowed_tools is a hard whitelist — only listed tools ever reach the LLM; an out-of-fence call is refused by the runtime, not merely discouraged. Omit it and one-agent offers every tool (the 8-tool default fence is universal-agent's only) — so always list the fence you mean.

The full loop-tool catalog (fence vocabulary): read_file, write_file, edit_file, list_files, search_files, delete_file, web_search, web_fetch, load_skill, memory, knowledge, skill_manage, recall, recall_history, delegate, local_agent, registry_search, registry_lookup, call_agent, invoke_workflow, run_python, ask_user, platform_action, task_complete — plus the five always-on tools schedule, message_bot, browser, code, mcp_tool_search, which need a saved bot (plungeai-bot-agent), 29 tools in all.

Fence design rules:

  • Always include task_complete — it is how a run ends cleanly.
  • Smallest set that can achieve the goal. A verification mission needs web_search, web_fetch, task_complete — not the file tools.
  • ask_user keeps human-question continuations available on every surface; include it when the goal may need clarification mid-run.
  • The loop runtime is agent: one-agent — always name it on the harness task (a harness task with no agent: still lands on the legacy harness-agent id until the switch-over). With no allowed_tools it has every tool, registry agents included (the thin 8-tool fence — the registry triad, web_search, web_fetch, load_skill, ask_user, task_complete — is universal-agent's default). An explicit allowed_tools always narrows it.

The agent fence and money-class protection

call_agent lets the loop invoke registry agents. allowed_agents: [a, b] limits it to those; 'all' opens the catalog minus denied_agents. Payment/blockchain-class agents stay deny-unless-explicitly-named even under 'all' — naming them is the only way a mission can touch money, and permissions: {call_agent: ask} adds a human gate on top. This is a trust fence: surface refusals, never work around them.

Recursion and fan-out guards

  • delegate spawns parallel child agents; children get a minimal default tool set and ALWAYS have delegate, invoke_workflow, and memory stripped — no fan-out explosions, no child memory writes.
  • Orchestrator depth is propagated (depth → children send depth+1) and hard-capped (default max depth 3); a too-deep dispatch is refused.
  • max_parallel caps one delegate call's width by refusal, never by serializing — silent batching would multiply wall clock.

Planned: TI-34

The docs assistant is not available yet. You can hand these docs to your own assistant instead.