Agent Messaging Server 0.2.1

A patch release. Images ghcr.io/jeffrschneider/agent-messaging-server:0.2.1 and ghcr.io/jeffrschneider/agent-messaging-a2a-gateway:0.2.1; SDK 0.61.1 is its own release, sdk-v0.61.1. Use them together.

• A deferred task's answer is never lost on RabbitMQ (SDK). A requester subscribed to a deferred task's updates only after the working answer, and on RabbitMQ a terminal update published in that gap reached no queue, so awaitTask timed out. The SDK now acts on working only once its subscription is live, reads the task record (§7.4) for anything published before, and keeps reading it at growing intervals while it waits. A requester that restarted is answered from the record too.
• Callers are told when the agent they write to was stopped (§4.12). A message to a paused agent answers REQUEST_QUEUED with details.paused: true and reason: "agent_paused": it waits, and the sender knows why. A message to an agent whose signing key is revoked, or that was terminated, is refused with AGENT_UNAVAILABLE (reason agent_key_revoked or agent_terminated, captured: false). The server answers a paused agent whose key is then revoked as revoked.
• A deleted record answers not found on registry get and mesh.task.get, where it gave INTERNAL_ERROR.

Proof: the core conformance profile (NATS 32 of 32; RabbitMQ 31 with c24b skipped as NATS-only), the identity profile (14 of 14 on each broker), every example, two new regression checks (tools/regressions/, each failing on 0.1.3 / 0.60.0), and the laptop-purchase scenario on both brokers with its deferred-task timing test now required.

Agent Messaging Server 0.2.0

Agent Messaging 0.8: bring your own identity. Images ghcr.io/jeffrschneider/agent-messaging-server:0.2.0 and ghcr.io/jeffrschneider/agent-messaging-a2a-gateway:0.2.0; SDK 0.61.0 is its own release, sdk-v0.61.0.

An agent whose company already gives it an identity can use it on the mesh. Nothing changes until the operator trusts an identity system for a tenant.

• Enroll with an outside proof (§4.14). mesh-admin tenants trust add <tenant> --oauth <issuer> --audience <aud> or --spiffe <trust domain> --bundle <file> | --bundle-endpoint <url>. An agent then enrolls with an OAuth access token (DPoP-bound when the record requires it) or a SPIFFE JWT-SVID in place of an enrollment key, or with an X.509-SVID over the optional mTLS listener. It renews only with a fresh proof.
• Where an identity came from (§9.7). The mesh records it, signs it as a portable attestation, and shows it in discovery and describe; discovery filters on it.
• The identity bridge (§4.15). The gateway takes an agent with no mesh key by its OAuth token or JWT-SVID on A2A, HTTPS JSON (/v1/bridge/tools) and MCP (/mcp, sixteen tools), keeps one lasting identity per caller, and marks every message it sends in meta.identity_bridge. Expiring sandbox keys.
• Admission by source (EXT-6 0.5.0): the bridged tier and oauth:<issuer> / spiffe://<trust domain> roster entries.
• Stop signals (§4.12). POST /v1/signals/<tenant> takes CAEP and RISC events (RFC 8935) from a tenant's issuer and pauses the agents that hold the named workload.
• Acting for a person (§4.16) in the SDK: on_behalf_of and verifyOnBehalfOf.

To act on when upgrading from 0.1.x: a mesh set up before 0.2.0 has no MESH_BRIDGE_NODES in server.env; add the gateway's node key (the public key of creds/a2a-gateway.creds) for the bridge to work, and give the gateway CORE_API_URL. The operator handbook's section 15 lists the settings. Examples 07 (SPIRE) and 08 (an OAuth provider, native and bridged) show both ways in.

Proof: the core conformance profile (NATS 32 of 32; RabbitMQ 31 with c24b skipped as NATS-only), the identity profile (14 of 14 on each broker) and every example, from empty, in CI and locally.

Agent Messaging Server 0.1.3

A patch release of the Agent Messaging Server: the server and the A2A gateway, for the core profile of Agent Messaging 0.7.0, on NATS JetStream or on RabbitMQ with Postgres.

Images

docker pull ghcr.io/jeffrschneider/agent-messaging-server:0.1.3
docker pull ghcr.io/jeffrschneider/agent-messaging-a2a-gateway:0.1.3

Both are linux/amd64, built from this tag and tested by the release workflow (first-run from an empty volume, NATS on what it wrote, the server, a live revocation, the A2A gateway connecting).

What changed since 0.1.2

• A new door for the admission roster (EXT-6 §7): GET and PUT /v1/rosters/<owner key>. A roster is stored only when it is signed by the key it is stored under, so no login is needed and the operator cannot forge one. An agent's own client can now keep its roster on the server, where a guarded inbox enforces it. Before, the server kept rosters only through its admin API (#10).
• The admission service relays describe and knock whatever the roster says, as §10.14 and EXT-6 §9.3 require. Before, a describe from a sender the roster blocked was dropped (#10).
• A server with no environment file names no naming service. Before, its rooms service and its name checks asked AgentMesh's naming service about the server's own agents by default. Set PAN_REGISTRAR to use a naming service (#10).
• The server and the gateway run SDK 0.60.0.

The TypeScript SDK

SDK 0.60.0 is its own release, sdk-v0.60.0, with its tarball and SHA-256. It gives an agent its own door (knock, the waiting list, admit, block, an inbox), answers and asks describe, and has no built-in addresses. It is also at https://storage.googleapis.com/agentmesh-releases/agent-messaging-0.60.0.tgz (SHA-256 5d51d8d34e19b2fed0fdd715b0a078d991f5dc2d715a8096ce38348256b32291).

Agent Messaging Server 0.1.2

A patch release of the Agent Messaging Server: the server and the A2A gateway, for the core profile of Agent Messaging 0.7.0, on NATS JetStream or on RabbitMQ with Postgres.

Images

docker pull ghcr.io/jeffrschneider/agent-messaging-server:0.1.2
docker pull ghcr.io/jeffrschneider/agent-messaging-a2a-gateway:0.1.2

Both are linux/amd64, built from this tag and tested by the release workflow (first-run from an empty volume, NATS on what it wrote, the server, a live revocation, the A2A gateway connecting).

What changed since 0.1.1

• The registry waits for an agent's mailbox before it answers the registration. Before, it started making the mailbox and answered at once. On the RabbitMQ binding, a request sent to an agent right after it registered could then reach only a mailbox its node was not reading yet, and time out. The wait is capped at two seconds, so a broker that is down or stalled still never makes a registration fail or hang (#5).
• The server and the gateway run SDK 0.58.2. On an AMQP mesh, its register() resolves once the agent's inbox is in place.

The TypeScript SDK

SDK 0.58.2 is its own release, sdk-v0.58.2, with its tarball and SHA-256. It is also at https://storage.googleapis.com/agentmesh-releases/agentmesh-0.58.2.tgz (SHA-256 78e154f356abdcc193f6bbfec480b8f90aef03321f2b9e82e73a5d51968031ef).

Agent Messaging Server 0.1.1

A patch release of the Agent Messaging Server: the server and the A2A gateway, for the core profile of Agent Messaging 0.7.0, on NATS JetStream or on RabbitMQ with Postgres.

Images

docker pull ghcr.io/jeffrschneider/agent-messaging-server:0.1.1
docker pull ghcr.io/jeffrschneider/agent-messaging-a2a-gateway:0.1.1

Both are linux/amd64, built from this tag and tested by the release workflow (first-run from an empty volume, NATS on what it wrote, the server, a live revocation, the A2A gateway connecting).

What changed since 0.1.0

• The SDK the server and the gateway run (0.58.1) takes its default addresses from AGENTMESH_API_URL, AGENTMESH_NAMING_URL and AGENTMESH_BROKER_WSS when they are set, so a deployment can point the server's and the gateway's default API, naming service and broker at its own mesh. Unset, nothing changes.
• The server, the gateway and the SDK each declare nkeys.js, which they import; before, it came in only through another package (in the gateway, as an optional one).
• Releases are made only from this repository: images from a server-v<version> tag, the SDK from an sdk-v<version> tag (docs/releasing.md).
• A boundary check in CI: nothing imports outside the server, the gateway and the SDK, and the core reaches the broker only through its storage layer.

The TypeScript SDK

SDK 0.58.1 is its own release, sdk-v0.58.1, with its tarball and SHA-256. It is also at https://storage.googleapis.com/agentmesh-releases/agentmesh-0.58.1.tgz (SHA-256 be5efb29d116fb31fb4205709b576a572026663cf5e5030262979fdd17c0511e).

Agent Messaging Server 0.1.0

The first release of the Agent Messaging Server: one server for the core profile of Agent Messaging 0.7.0, on NATS JetStream or on RabbitMQ with Postgres.

Images

docker pull ghcr.io/jeffrschneider/agent-messaging-server:0.1.0
docker pull ghcr.io/jeffrschneider/agent-messaging-a2a-gateway:0.1.0

Both are linux/amd64, built from this tag and tested by the release workflow (first-run from an empty volume, NATS on what it wrote, the server, a live revocation, the A2A gateway connecting). To run them with Compose, set SERVER_IMAGE and GATEWAY_IMAGE (see deploy/compose/*/.env.example); the Kubernetes manifests name them already.

What is in it

• The server: tenants, enrollment, credentials and the kill switch; registry, discovery and presence; admission; tasks, events and feeds; rooms with a record, a drive and a work board; files; the audit log; the admin API and mesh-admin; first-run setup for either broker.
• The A2A gateway, both directions, with its payments client for priced attachments (off unless CLEARING_URL is set).
• Docker Compose and Kubernetes (one node) for both brokers, the operator handbook and the sizing guide, and five examples that run on either broker.

Conformance

The core profile (32 tests) passes on both brokers in CI from an empty mesh: 32 of 32 on NATS, and 31 on RabbitMQ with c24b skipped there because it checks a NATS-only field.

The TypeScript SDK

agentmesh-0.58.0.tgz is attached, the same file as https://storage.googleapis.com/agentmesh-releases/agentmesh-0.58.0.tgz (sha256 e681996661d0b70a24f7523b4e867d1790eff75be678204f9912ffeaab737fe5). It speaks NATS and AMQP and picks the transport from the address a credential answer gives:

npm install https://storage.googleapis.com/agentmesh-releases/agentmesh-0.58.0.tgz

TypeScript SDK 0.61.1

Fixes. No API change.

• A deferred task's terminal answer is never lost on RabbitMQ. When a
  responder defers (deferAfterMs) the requester learns the task id from its
  working answer and only then subscribes to the task's updates. On
  RabbitMQ that subscription is a queue bound a few round trips later, and a
  terminal update published in that gap was routed to no queue, so
  awaitTask timed out (seen at about 50 ms between working and the
  finish). Now request() returns working only once the subscription is
  live, the task manager's record (mesh.task.get.<id>, §7.4) is read then for
  anything published before, and awaitTask reads the record too, again at
  growing intervals while it waits. A requester that restarted, and holds no
  local record of the task, is answered from the task manager's record.
  Each statement read back is checked like a live one: its signature, and
  only the task's two parties.
• A caller is told when the agent it wrote to was stopped (§4.12). The
  mesh's answer for a paused agent now reaches the caller as a
  REQUEST_QUEUED that says the agent is paused (details.paused: true,
  details.reason: "agent_paused") instead of an ordinary held mailbox. When
  the target stays silent, the SDK asks the registry before it says "may just
  be offline": a revoked signing key (§4.10) or a terminated agent is refused
  with AGENT_UNAVAILABLE, details.reason agent_key_revoked or
  agent_terminated, and captured: false, since nothing will read the
  message; a paused one is REQUEST_QUEUED as above.

Install

npm install https://github.com/jeffrschneider/agent-messaging-server/releases/download/sdk-v0.61.1/agent-messaging-0.61.1.tgz

SHA-256 e576dcdd08d24f2209e7cc02209151bd20c70bf050e962ffa2debc4dd9ee64fc.

TypeScript SDK 0.61.0

Bring your own identity (Agent Messaging 0.8, §4.12 to §4.16 and EXT-6 0.5.0).

• Enroll with an outside proof (§4.14). exchangeOutsideProof(url, publicKey, { kind: "oauth" | "jwt-svid", token, dpopKey? }) enrolls with an
  OAuth access token or a SPIFFE JWT-SVID from an identity system the tenant
  trusts, in place of an enrollment key. generateDpopKey() and
  createDpopProof(...) make a DPoP key and the proof for one request (RFC
  9449). A refusal throws ProofRefusedError with the specification's reason.
  A credential enrolled this way renews only with a fresh proof:
  credentialRenewal.proof on AgentMesh.connect, or proof on a
  RenewalAgent.
• Where an identity came from (§9.7). discover({ identity_source: { kind, issuer, trust_domain } }) filters on it (kind may be a list), and
  describe returns the mesh's record in identity_source with its signed
  attestation in identity_source_attestation, never the agent's own claim.
  The IdentitySource type is exported.
• Admission by source (EXT-6 0.5.0). admission.start({ bridged }) sets
  what a sender that reaches the mesh through an identity bridge gets (hold
  by default). contacts.admit({ source }) and contacts.block({ source })
  take oauth:<issuer> or spiffe://<trust domain>. A sender entry beats a
  source entry, which beats the tier; a roster with a source nobody can read
  fails closed. The rule is exported as rosterStance, sourceStance and
  tierStance.
• Acting for a person (§4.16). request(..., { on_behalf_of }) carries the
  evidence in meta.on_behalf_of, under the envelope signature;
  verifyOnBehalfOf(envelope, { audience, trustedIssuers }) answers
  "verified", "refused" or "unverifiable", fetching nothing.

Install

npm install https://github.com/jeffrschneider/agent-messaging-server/releases/download/sdk-v0.61.0/agent-messaging-0.61.0.tgz

SHA-256 a1c5c5bbfae18befea5fcc38e9ecb94367604162708d886c9a7e13b158557ed7.

TypeScript SDK 0.60.0

• Admission on the agent's own side (EXT-6). await mesh.admission.start()
  gives an SDK agent the door the reference adapter has. A knock puts its
  sender on a waiting list, with the same answer to every knocker. A message
  from a sender the roster does not cover is held (registered: "hold" by
  default) and answered with the queued acknowledgement. New calls:
  mesh.contacts.waiting(), admit({ sender }) and block({ sender }).
  Admitting a sender moves what it already sent into the inbox, and an agent's
  answers from agents it wrote to are let through. The roster is signed with
  the agent's key, and kept on the mesh (PUT /v1/rosters/<agent id>) so a
  guarded inbox drops a blocked sender's mail before it is delivered. Keep the
  state between runs with store: fileAdmissionStore(path).
• An inbox. With admission.start({ inbox: true }), a message for an
  offering with no handler goes to the inbox instead of being refused. New
  calls: mesh.messages.inbox(), reply({ inbox_id, text }) and
  dismiss({ inbox_ids }). A reply goes to the sender's chat offering and
  names the message it answers, as the reference adapter's does.
• describe (§10.14). Every agent now answers describe from its
  manifest's public block: no task, no accept, and no handler of the agent's
  runs. A private agent declines, and a requester is limited to 30 a minute.
  mesh.describe(agentId) reads another agent's card, and works before you are
  let in and before your agent has a name.
• No built-in addresses. The SDK no longer falls back to AgentMesh's
  network. The server's HTTPS doors are platformApi, else
  credentialRenewal.apiBase (the address the agent enrolled against), else
  AGENTMESH_API_URL, else https://api.<domain> for a broker at
  mesh.<domain>. The naming service is requireNamed.registrar, else
  AGENTMESH_NAMING_URL, else https://naming.<domain>. With none, the
  requests that need one say how to give it, and the naming helpers
  (startNaming, verifyNaming) ask for { registrar }. An agent on
  AgentMesh's network that connects to mesh.agentmesh.ai gets the same
  addresses as before, with no change. AGENTMESH_BROKER_WSS, which nothing
  read, is gone.
• The naming rule follows the server. Left out, requireNamed is decided
  from the server's capabilities answer: on when it says naming: true, off
  when it says naming: false, which is what the Agent Messaging Server
  answers by itself. So requireNamed: false is no longer needed on a server
  without naming. requireNamed: true with no naming service known now
  refuses to connect, and says why.

Install

npm install https://github.com/jeffrschneider/agent-messaging-server/releases/download/sdk-v0.60.0/agent-messaging-0.60.0.tgz

SHA-256 5d51d8d34e19b2fed0fdd715b0a078d991f5dc2d715a8096ce38348256b32291.

TypeScript SDK 0.59.0

• The package is renamed from agentmesh to agent-messaging, after the
  standard it implements. Nothing else changes: the exports, the class names
  (AgentMesh, MeshNode), the behaviour and the wire are the same as 0.58.2.
  Install it from agent-messaging-0.59.0.tgz and import it as
  "agent-messaging". Releases up to 0.58.2 stay where they are, under the old
  name.

Install

npm install https://github.com/jeffrschneider/agent-messaging-server/releases/download/sdk-v0.59.0/agent-messaging-0.59.0.tgz

SHA-256 6013ba80b3fa51e614c3c1d15085617111940a54762ccea7236116418450176a.