AgentHealth v0.5.0

AgentHealth v0.5.0 — Agent health

v0.5.0 implements Phase 7 direct and composite agent health through a bounded,
framework-neutral health-resource interface. See PR #19
and RFC #18.

Changes

• Add agent and multi-agent support to ping, check and doctor with
  consistent terminal/JSON/YAML output and existing health exit codes.
• Validate agent metadata, declared liveness/readiness, required capabilities
  and names-only dependency discovery. Share the passive document per target.
• Add explicitly safe, opt-in task probes and selected downstream communication
  probes. Keep first-agent, peer, path and supporting dependency evidence in
  separate named results; retain independent critical/optional aggregation.
• Add optional v1 agent configuration, strict validation, stable diagnostic
  codes, schema fixtures, examples and affected-phase impact reviews.
• Align downstream selectors with the 1024-Unicode-character schema limit;
  allow empty selectors as omission and reject whitespace-only selectors.
  Retain the separate 64 KiB UTF-8 byte limit for task text.
• Update CLI help for supported agent types and the A2A 1.0 default.
• Drain MCP OAuth browser callback responses before server shutdown, fixing an
  intermittent EOF on rejected callbacks. Bound graceful cleanup to one second.

Runtime prerequisite and limitations

Your agent application must expose the documented HEAD/GET health resource
and implement the safe POST probe handler. For a first-to-downstream path
probe, the first agent must actually contact the selected peer directly or
through A2A before reporting completion. AgentHealth sends/evaluates probes;
it does not install a handler into your application or trace remote execution.
It trusts runtime completion reports. Peer endpoint health alone does not
prove a working path. See the adapter contract and
setup example.

Discovery matches advertised names against explicitly configured dependencies;
it never creates targets or follows remote addresses. Functional probes run
once without polling or retries. Incomplete evidence is UNKNOWN. Passive
readiness is a runtime declaration, not proof of task execution.

Framework-specific integrations, Agentgateway/Agent Router adapters, graph
scheduling, AHP serving, SDK packages, Docker and Kubernetes remain roadmap
work. Existing A2A JSON-RPC limitations still apply. OS-native executable
signing and macOS notarization are not provided.

Migration and compatibility

The configuration and JSON/YAML result envelopes retain v1. Existing supported
HTTP/API, MCP and A2A targets preserve their behavior. Previously unsupported
agent targets now execute checks against the health-resource interface.

Legacy agent configurations listing functional without task options remain
syntactically valid but produce MISCONFIGURED before networking. Add
agent.functional with safe: true and a bounded nonempty text to enable
functional execution. Dependencies do not inherit credentials or check policy.
Consumers should tolerate new engine-owned diagnostic code identifiers.

Installation and verification

Download the matching platform archive and CycloneDX SBOM from this release;
verify their hashes with checksums.txt. The five platform archives cover Linux
AMD64/ARM64, macOS AMD64/ARM64 and Windows AMD64. Build provenance and SBOM
attestations use GitHub keyless signing. Follow the
installation and attestation instructions.

Validation

Local Go vet/race tests and Python suite passed (83 passed, 3 optional SDK
interoperability tests skipped locally); marked documentation examples,
standalone configurations and links validated. The OAuth callback test passed
100 repetitions under the race detector. PR CI passed Linux/macOS/Windows Go
checks, current/legacy official SDK interoperability, schema/documentation
checks and vulnerability scanning. Release CI validates the tagged source,
uses Go 1.27.1, builds all platforms and smoke-tests Linux AMD64; other archive
platforms are cross-compiled. CI runtime checks are separate from archive
runtime testing.