Skip to content

v2.3.0 — Discovery + Streaming, Auth Enforcement, Conformance & Protocol Spec

Choose a tag to compare

View all tags
@alexfrmn alexfrmn released this 22 Jun 19:33
· 58 commits to main since this release
v2.3.0
46a69d3

Murmur v2.3.0

Second autonomous wave (JARVIS ↔ CODEX-VOLT, PR-per-feature cross-review). Discovery + streaming complete, an auth/authz enforcement mechanism, conformance + a versioned protocol spec across every wire type, and a real cross-host A2A validation.

npm install @murmurv2/core @murmurv2/federation @murmurv2/broker-nats   # @ 0.2.0
npm install @murmurv2/security @murmurv2/mcp-server @murmurv2/broker-ws

Highlights

  • Agent discovery — complete. Presence frames + candidate registry (ttl expiry, dedupe, out-of-order guard), signed presence over NATS (announcePresence/subscribePresence), and an operator promote-flow (queryCandidates + promoteCandidate). Trust is always an explicit operator promotion — candidates are never auto-trusted.
  • Message streaming — complete. Stream frames (start/chunk/end), UTF-8-safe chunking, in-memory + durable SQLite reassembly (out-of-order, idempotent, conflict-reject), backpressure (chunk + byte windows), sha256 integrity, and an ACK window.
  • Auth/authz enforcement mechanism. Signed subject (actor) in auth tokens, an optional signed authToken on EnvelopeV1 (covered by the signature; byte-identical back-compat when absent), authorizeInbound (binds subject === senderAgentId), and broker ingress enforcement behind MURMUR_ENFORCE_AUTH (default-OFF, NACK auth-rejected:<reason>). Daemon end-to-end wiring is the remaining step.
  • Conformance + versioned protocol spec — all wire types. Draft 2020-12 schema and schema↔runtime-guard agreement matrices now cover envelope, ack, presence, and stream frames; docs/protocol-v1.md + docs/protocol-compatibility.md.
  • Single canonical signing payload. stableEnvelopePayload centralized into @murmurv2/core (was copy-pasted across 7 sites), golden-locked by test.

Validated

  • Real cross-host A2A. A fresh Murmur agent on a remote host (Phoenix/agent-hq), running over the published @murmurv2/* packages, connected to the live broker over Tailscale and exchanged bidirectional encrypt/verify/ACK traffic with the mesh — closing the "real mesh deploy" mechanism gate. A second real partner org (federation) and a real remote A2A agent remain external gates.

npm

@murmurv2/core, @murmurv2/federation, @murmurv2/broker-nats published at 0.2.0; security/observability @ 0.1.1; all other @murmurv2/* @ 0.1.0.

Full changelog: CHANGELOG.md

Assets 2
Loading