Add Widespread Worker agent + instructions by TerexitariusStomp · Pull Request #6405 · github/awesome-copilot

TerexitariusStomp · 2026-11-13T05:36:39Z

Adds widespread.agent.md + widespread.instructions.md: an agent that discovers and earns escrowed work on the Widespread verified-work protocol via its remote MCP endpoint (https://widespread-bridge.widespread.workers.dev/mcp) — challenge→register→claim→ship with non-custodial Ed25519-signed attestations and sealed-runner guidance.

Generated with Devin

github-actions · 2026-11-13T05:37:06Z

🔒 PR Risk Scan Results

Scanned 2 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	2
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	`package-exec-command`	`agents/widespread.agent.md`	16	``- Local stdio (full earn loop with agent-owned Ed25519 key): `uvx widespread-mcp```
🟠	`package-exec-command`	`instructions/widespread.instructions.md`	13	- Local earn loop: `uvx widespread-mcp` — agent-owned Ed25519 key at `~/.config/widespread/agent.json`. Never commit it.

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

github-actions · 2026-11-13T05:37:07Z

🚦 Submission status: 👀 Ready for review

Risk tier: merge-risk:high — Privileged execution, automation, or review-policy change
Required to merge: passing submission-gate checks plus 1 approval from reviewers with write access, including a maintainer with admin or maintain permission.

Why this tier

Label needs-review:HIGH flags a high contributor-risk signal

Automated checks

Check	Status	Details
Line endings	✅ Passed	Passed · logs
Spelling	✅ Passed	Passed · logs
Generated README consistency	✅ Passed	Passed · logs
Skill lint (vally)	✅ Passed	Passed · logs
Risk scan	✅ Passed	Passed · logs
Contributor reputation	✅ Passed	Passed · logs
Duplicate resource scan	✅ Passed	Passed · logs
PR quality signal	⏭️ Skipped	Skipped by its workflow · logs

Review

Approvals: 0/1
Assigned reviewer: not assigned yet — comment /request-review to ask for one
Review target date: not set
Still needed: 1 more approval(s); an approval from a maintainer with admin or maintain permission
The core-maintainers pool is not staffed yet; an approver with admin or maintain permission is required instead.

Commands

Command	Who	What it does
`/rerun-checks`	PR author, maintainers	Re-runs failed or incomplete checks and re-evaluates this gate
`/request-review`	PR author, maintainers	Asks the review rotation to assign a reviewer (adds `needs-reviewer`)

_{Updated for a71550f · gate run · This comment is maintained automatically — see submission gate docs.}

github-actions · 2026-11-13T05:37:14Z

🔍 Vally Lint Results

⚠️ Warnings or advisories found

Scope	Checked
Skills	0
Agents	1
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	1

Summary

Level	Finding
ℹ️	Vally currently lints SKILL.md content. Agent files were detected but skipped:

Full linter output

### Agent files detected (not linted by vally)
ℹ️ Vally currently lints SKILL.md content. Agent files were detected but skipped:
agents/widespread.agent.md

github-actions · 2026-11-13T05:37:39Z

🔴 Contributor Reputation Check: HIGH risk

Check	Risk
Profile	HIGH
Credential audit	NONE

Maintainers: please review this contributor before merging.
See the workflow run for full details.
Automated check powered by AGT.

Copilot

🟡 Changes recommended

The agent’s tool allowlist excludes required Widespread MCP tools, while global instructions apply Widespread earning guidance to unrelated tasks without explicit user opt-in.

3 open issues

Widespread MCP tools are missing from the allowlist · New
Widespread guidance applies to unrelated tasks · New
Generated resource catalogs are not updated · New

What changed in this PR

Adds a Widespread Worker agent and companion instructions to the Copilot resource collection for discovering escrowed work and following a signed submission workflow.

Changes:

Documents remote MCP and local stdio interfaces, plus discovery, registration, claim, submission, and status steps.
Adds guidance for private-key handling, isolated execution, and user confirmation before claims or submissions.

File	Description
`instructions/widespread.instructions.md`	Adds protocol endpoints, key-storage guidance, and confirmation requirements.
`agents/widespread.agent.md`	Defines the worker profile, earn loop, and safety guidance.

_{Review effort: Max (dynamic)}

@@ -0,0 +1,32 @@
+---
+description: 'Verified-work protocol agent: discovers funded bounties and escrowed work markets, claims work, and submits signed attestations for payout'
+name: 'Widespread Worker'


…s, catalogs - agent: add widespread/* + widespread-mcp/* to tools allowlist so the MCP tools are reachable when the server is configured - instructions: keep applyTo '**' but condition application on bounty/verified-work tasks (context7 pattern) instead of an unconditional statement on every file - regenerate docs/README.{agents,instructions}.md catalogs (fixes validate-readme + submission-gate) Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Copilot

🟡 Changes recommended

Tool-registration and naming errors block the local workflow, while missing approval gates and isolation safeguards risk funded actions, payouts, and host execution without adequate user control.

5 open issues

1 previously missed issue

In code that hasn't changed since last review

Make service-specific guidance opt-in

instructions/widespread.instructions.md:3

With applyTo: '**', this service-specific guidance is attached to unrelated file-based coding requests; the task restriction in the body cannot prevent that loading. It also duplicates the selected agent's setup and safety guidance. Keep this workflow opt-in by removing this file and its catalog entry, or by moving the guidance into an on-demand skill.

2 resolved since last review

_{Review effort: Max (dynamic)}

+- **Remote MCP** (Streamable HTTP, read tools need no auth): `https://widespread-bridge.widespread.workers.dev/mcp`
+- **Local stdio** (full earn loop with agent-owned Ed25519 key): `uvx widespread-mcp`


+1. `feed_search` / `wide_markets` / `wide_bounties` — find funded work matching the user's capability and payout expectations.
+2. `wide_agent_challenge` → sign the canonical bytes with the local Ed25519 key → `wide_agent_register` to obtain the agent DID.
+3. `wide_claim` — register claim intent on a funded market.
+4. Land the deliverable as a signed `ship` op on the originating forge.
+5. `wide_ship_prepare` → sign → `wide_ship_submit` — the bridge verifies the signature and relays the attestation.
+6. `wide_status` — track claims, verdicts, and payout traces.


+## Safety
+
+- Non-custodial: the agent's Ed25519 key lives at `~/.config/widespread/agent.json`; never expose or transmit it.
+- Never run untrusted repository code on the bare host — use sealed runners (`runners_list`).


+
+- Non-custodial: the agent's Ed25519 key lives at `~/.config/widespread/agent.json`; never expose or transmit it.
+- Never run untrusted repository code on the bare host — use sealed runners (`runners_list`).
+- Confirm with the user before claiming markets or submitting attestations.


Add widespread verified-work agent and instructions

caf19c9

TerexitariusStomp requested a review from a team as a code owner November 13, 2026 05:36

Copilot AI dynamic review requested due to automatic review settings November 13, 2026 05:36

github-actions Bot added awaiting-automation merge-risk:medium agent PR touches agents instructions PR touches instructions new-submission PR adds at least one new contribution labels Nov 13, 2026

Copilot started reviewing on behalf of TerexitariusStomp November 13, 2026 05:37

View session

github-actions Bot added needs-review:HIGH Contributor reputation check flagged HIGH risk merge-risk:high requires-submitter-fixes Submission has quality-gate findings that submitter must fix before maintainer review and removed merge-risk:medium awaiting-automation labels Nov 13, 2026

Copilot AI reviewed Nov 13, 2026

View reviewed changes

TerexitariusStomp requested a review from a team as a code owner November 13, 2026 07:03

Copilot AI dynamic review requested due to automatic review settings November 13, 2026 07:03

github-actions Bot added awaiting-automation and removed requires-submitter-fixes Submission has quality-gate findings that submitter must fix before maintainer review labels Nov 13, 2026

Copilot started reviewing on behalf of TerexitariusStomp November 13, 2026 07:04

View session

github-actions Bot added ready-for-review Submission passed intake validation and is ready for maintainer review and removed awaiting-automation labels Nov 13, 2026

Copilot AI reviewed Nov 13, 2026

View reviewed changes

Navigation Menu

Repository navigation

Add Widespread Worker agent + instructions - #6405

Add Widespread Worker agent + instructions#6405
TerexitariusStomp wants to merge 2 commits into
github:mainfrom
TerexitariusStomp:add-widespread-agent

TerexitariusStomp commented Nov 13, 2026

Uh oh!

github-actions Bot commented Nov 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 13, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Nov 13, 2026

Uh oh!

github-actions Bot commented Nov 13, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		- Remote MCP (Streamable HTTP, read tools need no auth): `https://widespread-bridge.widespread.workers.dev/mcp`
		- Local stdio (full earn loop with agent-owned Ed25519 key): `uvx widespread-mcp`

Conversation

TerexitariusStomp commented Nov 13, 2026

Uh oh!

github-actions Bot commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 PR Risk Scan Results

Uh oh!

github-actions Bot commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚦 Submission status: 👀 Ready for review

Automated checks

Review

Commands

Uh oh!

github-actions Bot commented Nov 13, 2026

🔍 Vally Lint Results

Summary

Uh oh!

github-actions Bot commented Nov 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Nov 13, 2026 •

edited

Loading

github-actions Bot commented Nov 13, 2026 •

edited

Loading

github-actions Bot commented Nov 13, 2026 •

edited

Loading