The agent platform entitlement (packs:agents)

packs:agents

packs:agents is the agent platform's entry licence: it opens the two doors every agent passes through — registration (enrolling an identity into the fleet registry) and session establishment (an enrolled agent connecting, or reconnecting, its outbound channel) — and the licence's agents limit bounds how many instances may be connected at once. The platform itself — identity, the channel, the tunnel, trust, lifecycle control — is opschain docs agent-plane; this page is the entitlement that admits agents onto it.

The pack name supersedes the bare legacy agents feature: either grants (a bare agents grant on an already-issued licence keeps entitling), and packs:agents is the canonical spelling on new licences. The Basic tier carries neither, and its agents limit is 0 — agents are licensed capability from the first instance (see entitlements).

What the pack delivers

• Registration — redeeming an agent registration token and enrolling the Ed25519 identity into the fleet registry.
• Session establishment — the challenge-signed session an enrolled agent opens, and every reconnect after it.
• Concurrency headroom — the agents limit bounds concurrently connected instances, counted from the durable registry's liveness (an instance seen inside the fleet's 3-minute online window), never a replica's in-memory connection table — so the count survives server failover, and a reconnecting agent never counts against itself. A degraded registry read counts nothing: licence enforcement fails open rather than letting a database fault sever the fleet.

Refusal behaviour on lapse or over-limit

The posture is deliberately asymmetric: existing connections stay live when the licence lapses or the limit shrinks — enforcement bites only at the doors. A NEW registration or reconnect refuses loudly with the named error:

• Missing entitlement: agents require an enterprise licence with the "packs:agents" feature — the <tier> licence does not include it (opschain admin licence apply)
• Over the limit: the <tier> licence allows <N> connected agents (<M> in use) — apply a licence with a higher limit to create more (opschain admin licence apply)

Each refusal also lands the customer-visible warn:licence:feature_refused event, throttled per subject (one per surface and subject per hour) so a reconnect-looping over-limit agent stays loud without flooding the feed. The event names its surface — agent_registration, agent_session or ai_agent_enrolment — and lands on the agent's own path for an enrolled subject (a pre-enrolment refusal, which has no project yet, lands on the platform path).

What stays base, and never gates

• Connected agents keep working — lapse and limit shrink never sever a live channel; only new admissions refuse.
• The fleet admin verbs — list, show, drain, halt, revoke, forget — and the audit trail are admin RBAC, not entitlement: a lapsed estate can always see and stop its agents.
• The opschain agent dev sandbox — the gate is waived for that process-local loopback composition: licensing gates estates, not the SDK's local development loop.
• Runners — the runner fleet rides its own runners limit; nothing here touches it.

AI-type enrolment: the hard dependency

An enrolment whose manifest declares type: ai additionally hard-depends on packs:agent-governance + packs:ai-agents — the refusal names every missing pack (AI-type agents require the "packs:agent-governance" and "packs:ai-agents" entitlements — the <tier> licence is missing <the absent packs>; apply the licence pack that grants it (opschain admin licence apply)), with the same warn:licence:feature_refused event. Ungoverned AI cannot even enrol.

How the packs compose

Pack	Adds	Requires
packs:agents	The platform doors: registration, sessions, the agents concurrency limit.	—
packs:agent-governance	The governance funnel over the base capability: trust-grant creation and decisions, recommendations, the review surfaces.	packs:agents to have agents to govern.
packs:ai-agents (AI agents)	The LLM lane: AI-type enrolment, the Claude adapter, brokered model credentials.	packs:agent-governance (the hard dependency above).
packs:ai-agents-<domain>	One SME domain's specialised AI pack.	packs:ai-agents.

Where the core documentation lives

• The platform itself: opschain docs agent-plane.
• Hands-on runbooks: opschain docs getting-started/12-1-what-an-agent-is (enrol, grant, review, revoke) and opschain docs getting-started/12-1-what-an-agent-is (the service / ai kinds).
• The licence machinery, tiers and the agents limit: entitlements and opschain docs cli/admin-licence.
• The command surface: opschain docs cli/admin-agents, cli/admin-agent and cli/admin-agent-token-create.