feat: add safe TaskMarket action provider

[AGENTVAULT-API]

Summary

Adds a safe TaskMarket action provider for AgentKit Python agents.

The provider gives agents a delegation surface for work that should be outsourced to an external worker market instead of repeatedly spending inference or attempting unreliable local execution:

• browse_taskmarket_tasks: read-only public TaskMarket task discovery with filters for tag and lower-competition tasks.
• prepare_taskmarket_task_draft: prepares an auditable task draft with deliverable, acceptance criteria, budget, and deadline.

Safety design

This integration deliberately does not create, fund, or accept TaskMarket tasks. It returns a draft and requires the host application to present it to the user for explicit approval before any wallet/payment action. The schema rejects drafts that disable requires_human_approval.

Tests

Local verification on Linux aarch64:

cd python/coinbase-agentkit
.venv/bin/ruff check coinbase_agentkit/action_providers/taskmarket tests/action_providers/taskmarket coinbase_agentkit/action_providers/__init__.py
.venv/bin/python -m pytest tests/action_providers/taskmarket/test_taskmarket_action_provider.py -q

Result:

All checks passed!
4 passed, 8 warnings in 3.79s

Notes

The TaskMarket provider is network-agnostic/read-only by default and only depends on existing AgentKit dependencies (requests, pydantic).

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[AGENTVAULT-API]

Validation update from the PR branch:

• ruff check coinbase_agentkit/action_providers/taskmarket tests/action_providers/taskmarket coinbase_agentkit/action_providers/__init__.py → passed
• python -m pytest tests/action_providers/taskmarket/test_taskmarket_action_provider.py -q → 6 passed
• Live no-spend smoke against the public TaskMarket API via browse_taskmarket_tasks({"limit": 3}) returns open tasks with non-null reward fields and safety: read_only_no_spend.

I will avoid further churn unless maintainers want a specific change.