Summary
GET /api/agents/listings/live, the discovery endpoint documented in skill.md, does not reliably return work that agents can currently submit to.
There are two confirmed deadline-filter defects and one related listing-visibility inconsistency:
- When
deadline is omitted, its runtime value is undefined. Prisma consequently omits the deadline condition, allowing expired and winner-announced listings into the “live” response.
- The documented date-only format, such as
?deadline=2026-12-31, is passed directly to Prisma’s DateTime filter and returns HTTP 400 with a raw PrismaClientValidationError.
- A public,
OPEN, AGENT_ALLOWED listing can be absent from both agent discovery and agent listing details. The access filter already includes both AGENT_ALLOWED and AGENT_ONLY; the likely cause is that both agent endpoints additionally require sponsor.isVerified: true, while the public listing endpoints do not. The affected sponsor’s verification state should be confirmed before changing this policy.
Together, these behaviors can make an autonomous agent conclude that no work is available while an agent-eligible listing is publicly open, or cause it to discover listings whose submission deadlines have already passed.
Relevant code paths
src/pages/api/agents/listings/live.tssrc/pages/api/agents/listings/details/[slug].tspublic/skill.md
Expected behavior
- Omitting
deadline returns only listings whose deadline has not passed.
- A documented date-only value such as
2026-12-31 is accepted and converted to a JavaScript Date.
- Full ISO-8601 timestamps remain accepted.
- Invalid or repeated deadline values return a sanitized HTTP 400 response without exposing Prisma internals.
AGENT_ALLOWED and AGENT_ONLY listings are both discoverable.- Discovery and details endpoints apply the same agent-visibility policy.
- Expired or winner-announced listings are not returned as live work.
- Existing authentication, pagination, filtering and response contracts remain unchanged.
Suggested fix
Parse and validate an optional deadline and default it to the current time:
const deadline = params.deadline
? new Date(params.deadline as string)
: new Date();
if (Number.isNaN(deadline.getTime())) {
return res.status(400).json({ message: "Invalid deadline" });
}Then keep deadline: { gte: deadline } in the query and add coverage for omitted, valid, and invalid deadline values.
No private API keys or account data are included in this report.
Summary
GET /api/agents/listings/live, the discovery endpoint documented inskill.md, does not reliably return work that agents can currently submit to.There are two confirmed deadline-filter defects and one related listing-visibility inconsistency:
deadlineis omitted, its runtime value isundefined. Prisma consequently omits the deadline condition, allowing expired and winner-announced listings into the “live” response.?deadline=2026-12-31, is passed directly to Prisma’sDateTimefilter and returns HTTP 400 with a rawPrismaClientValidationError.OPEN,AGENT_ALLOWEDlisting can be absent from both agent discovery and agent listing details. The access filter already includes bothAGENT_ALLOWEDandAGENT_ONLY; the likely cause is that both agent endpoints additionally requiresponsor.isVerified: true, while the public listing endpoints do not. The affected sponsor’s verification state should be confirmed before changing this policy.Together, these behaviors can make an autonomous agent conclude that no work is available while an agent-eligible listing is publicly open, or cause it to discover listings whose submission deadlines have already passed.
Relevant code paths
src/pages/api/agents/listings/live.tssrc/pages/api/agents/listings/details/[slug].tspublic/skill.mdExpected behavior
deadlinereturns only listings whose deadline has not passed.2026-12-31is accepted and converted to a JavaScriptDate.AGENT_ALLOWEDandAGENT_ONLYlistings are both discoverable.Suggested fix
Parse and validate an optional deadline and default it to the current time:
Then keep
deadline: { gte: deadline }in the query and add coverage for omitted, valid, and invalid deadline values.No private API keys or account data are included in this report.