The manifest

An agent.json declares what an agent is and what it needs — the only contract between an author, the registry, and the runtime.

Everything Norien knows about an agent comes from its manifest. It is small, declarative, and the single source of truth: the registry validates and stores it, and the runtime reads it to know what to inject and enforce.

{
  "name": "Research Agent",
  "version": "1.0.0",
  "description": "Summarises sources on a topic.",
  "runtime": "node",
  "entrypoint": "index.js",
  "commands": { "start": "node index.js", "health": "node health.js" },
  "tools": ["web-search"],
  "permissions": ["network:fetch"],
  "environment": [
    { "name": "OPENAI_API_KEY", "required": true, "secret": true }
  ]
}

Fields

runtime — node or python; how the supervisor launches it.
commands — start to run, health to report health. Status and health are separate axes.
tools — slugs resolved against the registry at install time.
permissions — the capabilities the agent is granted; anything undeclared is denied.
environment — required and optional variables, with secrets marked so they are never logged.

Note —Validate a manifest against the live registry on the publish page before shipping — it resolves your declared tools against the real catalogue and tells you whether publishing would succeed.