A task for your
agent’s future self.
Schedule one-time HTTP tasks, inspect attempts, and recover safely from uncertain results. Start by understanding what’s available.
One safe check. Then your key.
Anyone can inspect the API’s declared mode. This does not enroll an identity, create a task or spend an attempt unit.
curl --fail-with-body https://api.runlater.io/healthThe response should include mode: production, task_api: restricted_alpha_opt_in and outbound: restricted_exact_receiver. This is a configuration signal, not a guarantee that an identity, grant or destination is currently usable.
Already approved by the operator?
Use the executable Node client from the repository (Node 22+; no package install needed). You need your approved project identifier and an owner-only Ed25519 PEM file. The client does not generate credentials or request approval for you.
git clone https://github.com/thachp/runlater.git
cd runlater
export RUNLATER_PROJECT_ID="your-approved-project"
export RUNLATER_KEY_FILE="/secure/path/operator.pem"
node examples/alpha-quickstart.mjs --enrollEnrollment signs the server’s one-use proof-of-possession challenge. It requires prior operator approval and does not prove a person’s identity or grant a trial. Public local fixture tokens are rejected by the hosted API.
# Keep this key and schedule unchanged if retrying admission.
node examples/alpha-quickstart.mjs --send-synthetic demo_01 0
# Use the returned task ID to inspect current state.
node examples/alpha-quickstart.mjs --status task_00000000000000010 means eligible now. To schedule later, pass an explicit UTC millisecond timestamp as the final argument. The client uses registered:receiver_a and a synthetic success payload; it cannot contact your own URL. Do not run task creation unless you intend to use your finite operator grant. Stop on an expired identity, exhausted grant or unsupported capability.
Task creation returns a task ID, not confirmation of callback success. Use status to inspect the eventual outcome. See the Markdown guide for cancellation and error handling, or the loopback guide for public local fixtures.
Possession, scope and an expiry.
Hosted requests use a RunLater-owned Ed25519 envelope binding origin, project, public key, method, path, empty query, exact body digest, idempotency key, timestamps and nonce. Bearer tokens are not supported. The private key never leaves your client.
| Operation | Required authority |
|---|---|
| Create / redrive task | Current enrolled key, enqueue / redrive scope, unexpired finite grant and available registered destination |
| Inspect task | Read scope; identical signed reads can replay within their validity window |
| Cancel task | Cancel scope; already in-flight effects remain uncertain |
| Queue configuration | Configure scope; not included in the current test identity |
Signatures have a maximum 60-second validity window and no implicit clock-skew allowance. Use current trusted UTC time. Query parameters are unsupported. The hosted alpha contract describes these routes and exact framing. Callback HMAC-v2 keys are separate from client request keys.
Accepted means durable. Delivered is later.
- Accept: task, idempotency identity, destination snapshot and finite retry reservation commit together in the authoritative project ledger.
- Wait and claim: alarms and Queue references wake eligible work. A fenced lease prevents duplicate transport references from creating a new simultaneous claim.
- Attempt: the receiver gets the exact body, stable operation key and a callback-v2 signature. Current signing material is selected at dispatch.
- Record: the durable attempt outcome drives success, a bounded retry or terminal failure. Inspect task state rather than assuming a lost response means failure.
Delivery is at least once. An uncertain callback can be repeated, so real receivers need durable operation-key deduplication. Cancellation blocks new claims; it cannot undo an in-flight side effect. Redrive creates a new linked execution with its own funded admission. Replay an enqueue with the same idempotency key and unchanged body, operation key and schedule; conflicting input returns 409.
A deliberately finite alpha.
| Boundary | Current behavior |
|---|---|
| Access & funding | Operator-approved, scoped identities and finite internal grants. The currently provisioned identity/grant is 24 hours and 20 attempt units; this is not a public trial offer. |
| Lifetime project caps | 16 accepted tasks, 128 publication reservations. Cancel, retention and redeploy do not reset these counters. |
| Attempts & age | At most 5 logical attempts; retry-age budget 24 hours from initial due time. Full finite attempt budget is reserved at acceptance. |
| Callback boundary | Exact owned synthetic receiver only; 1 KiB body/response, 2 KiB response headers and 3-second deadline. All redirects rejected. |
| Identity/grant expiry | New admission stops. Already accepted work retains its reservation; expiry does not discard accepted tasks. |
| Guarantees | No SLA, exact-time, ordering or exactly-once guarantee. This is not customer general availability. |
Public registration, arbitrary customer endpoints, commercial trials, wallet delegation and credit purchases remain disabled. No price, currency, launch date or automatic top-up is offered. Machine-readable pricing status preserves that distinction.
Information before action.
The versioned descriptor reports capability states. It is a RunLater-owned format, not an installed tool or a standard authorization mechanism. llms.txt follows a community proposal. Neither can override a client’s safeguards, wallet delegation or execution authority.
openapi.json remains the canonical local emulator contract with loopback bearer fixtures. It is not the hosted authentication or destination contract. The separate alpha descriptor provides the implemented hosted route subset; proposed payment tools have no executable REST binding.