03 · NETWORK
Early accessAvailable in early access. Opt in, and your shell can delegate to another product's shell — with capability discovery, runtime user consent, and a single-use delegation token. Audited on both sides. The network grows as more products opt in.
See it in action
Early accessA request routed across the network with runtime consent and a single-use scoped token — audited on both sides. Early access; off by default.

Why this mode
Public shells are findable by capability search — no bilateral partner setup. Your users get cross-product actions without custom integrations.
The user approves every cross-shell action in chat — with the target product clearly labelled. Not a background handoff.
A 60-second token scoped to one action. Neither product shares credentials across the boundary — both sides log the call with a shared chain ID.
Flow
Define actions once in duct.config.ts — this is how that contract plays out for this caller.
User asks in your shell
They request something — a refund, a ticket, a status check — that lives in another product.
Duct searches the network
Capability search finds public shells with a matching agentAccessible action. No pre-configuration required.
User consents in chat
A confirmation card shows which product will handle the request. The user approves before anything crosses the boundary.
Delegation executes
A single-use 60-second token is minted for that exact action. The target shell runs it — result and audit on both ends.
Where this is going
Today · early access
Opt-in cross-shell delegation with runtime user consent and single-use 60-second scoped tokens. Off by default — you turn it on per shell when you're ready.
Tomorrow · the network
Capability search across the whole Duct network, so a user request can be matched to any public shell that can fulfil it — no bilateral setup. Public shell marketplace is on the roadmap.