0.41.0

Loom 0.41.0 makes agents deployable: b10x-loom agent check and agent serve (http binding, A2A), the LoomAgent CRD, the b10x-loom-operator controller and the loom-agents Helm chart, on ESS 0.69.2.

Breaking

No breaking changes.

Changed

• b10x-loom agent check --spec <FILE> says whether a loom.agent/1 spec can be served: exit 0 with one checked line, 3 with the first refusal naming its reason and member, 1 when the file cannot be read (story:agent-check)
• b10x-loom agent serve --spec <FILE> --state <DIR> [--once] hosts the agent a loom.agent/1 spec declares on the plugin host: polls only channel.allow, answers each item in a governed turn on the inner loop's protocol under the state whose when names the intent, with exactly policy.capabilities as its authority; reply.send writes the recorded proposal to the item's channel through the Connectors command line, at most writes.max_per_hour an hour, and in writes.mode: approval only after b10x-loom approve <COMMISSION> reply.send --state <DIR>; b10x-loom agent resume <COMMISSION> performs a granted send now; SIGTERM ends the host after the item (story:agent-serve)
• An agent spec's http binding is read by a served turn: source.read {source, kind: get, input: {path, query?}} is one GET of a path exactly in allow_paths (no \, no . or .. segment, no encoded separator, even when listed; agent check refuses such an entry as Malformed) under base_url, with the bearer the variable bearer_env names (unset, empty or blank is BearerMissing), no redirect followed (the refusal carries at most 256 bytes of the location), the body cut at max_bytes in bytes on a character boundary and marked, never longer than max_bytes (a byte that is not UTF-8 is dropped); a refusal (the method, the path, the bearer, a redirect, a failing status) is a refused step the model reads as data (story:agent-http-binding)
• b10x-loom agent serve answers A2A when the spec declares expose.a2a, on --a2a-address (default 0.0.0.0) and expose.a2a.port: the agent card at /.well-known/agent-card.json, SendMessage (one turn on inbound-answer@1, answered with its record; nothing is sent through A2A) and GetTask at expose.a2a.path, and /ready and /live; every other request needs Authorization: Bearer with the token LOOM_A2A_BEARER holds, and the host refuses to start without it (story:agent-a2a)
• The loom.resource domain and the LoomAgent CRD projected from it, held by task crd-drift (story:loom-agent-resource-domain)
• b10x-loom-operator, the LoomAgent controller: run --config, render --resource and crd; it checks the spec before any child exists (story:loom-operator)
• charts/loom-agents, the Helm chart that installs the CRD and the controller with a namespaced Role, versioned with Loom (story:loom-operator)
• Loom requires ESS 0.69.2; the conformance crates take ess-conformance and ess-primitives at tag 0.69.2

CHANGELOG