v0.1.0-alpha.9

What's Changed

• sandbox: flip the boundary to named HTTP tunnels via tun2connect by @aojea in #346
• feat(node): add A2A support by @kaisoz in #347
• enforce freshness boundary on token refresh by @IbrahimAhmed8 in #350
• node: fail closed when a required-labels spec names no label by @HosniBelfeki in #348
• node: remove the send_message MCP tool by @kaisoz in #354
• sam-one, single binary for control plane for development and deployment on cloud run like platforms by @aojea in #360
• sambox: an agent serves only itself, over A2A, contracted statically by @aojea in #361
• feat(a2a-bridge): stdio MCP server making any MCP harness an A2A client over the mesh by @kaisoz in #357
• node,router: reconcile peer bans from the control plane instead of a local store by @HosniBelfeki in #356
• deploy: define sam:role:node in the seeded policy and fail loudly on … by @aojea in #363
• 3 security fixes and advisory published

Full Changelog: v0.1.0-alpha.8...v0.1.0-alpha.9