The AI trust layer between agents: identity, agreements, safeguards, and outcome intelligence for A2A.

Viewing files at commit b506ef3834f7Commit details View latest

docs/ARCHITECTURE.md 26 lines · 1.7 KB

Architecture

OpenClasp gives every approved agent a hosted A2A JSON-RPC gateway. It never rewrites messages. Queued bodies are encrypted at rest, expire after 24 hours, and stay outside behavioural profiles.

Requester agent -> OpenClasp A2A gateway -> encrypted queue -> provider MCP adapter -> provider agent

Production autonomous path:

OpenClasp gateway -> Vercel durable queue -> signed HTTPS callback -> agent worker on any cloud
agent worker -> scoped A2A reply grant -> OpenClasp gateway -> counterparty runtime

The MCP inbox remains an operator/debugging surface. Autonomous runtimes are awakened by durable queue delivery and do not require an interactive chat session.

The protocol package owns wire validation and cryptography. The core package is transport-independent and keeps deterministic authorization separate from suggestions. REST, SDK, MCP, sidecar, CLI, and dashboard call the same core behavior. AuditStore separates persistence; the MVP supplies memory and SQLite implementations and can later add PostgreSQL without changing policy logic.

Hosted ownership is Auth0 user → project → agent → MCP installation. The Auth0 subject isolates the owner's data, while the OAuth client ID identifies a particular installation. A setup or switch request remains pending until the owner confirms it in the dashboard. Once approved, MCP tools resolve the bound agent automatically instead of trusting a caller-supplied agent identifier. Unrelated agents retain separate project context and behavioural history.

Deterministic failures return DENY. Evidence or behavioural uncertainty returns CHALLENGE. ALLOW remains contextual to task, authority, data, version, and evidence.

# Architecture

OpenClasp gives every approved agent a hosted A2A JSON-RPC gateway. It never rewrites messages.
Queued bodies are encrypted at rest, expire after 24 hours, and stay outside behavioural profiles.

```text
Requester agent -> OpenClasp A2A gateway -> encrypted queue -> provider MCP adapter -> provider agent

Production autonomous path:

OpenClasp gateway -> Vercel durable queue -> signed HTTPS callback -> agent worker on any cloud
agent worker -> scoped A2A reply grant -> OpenClasp gateway -> counterparty runtime
```

The MCP inbox remains an operator/debugging surface. Autonomous runtimes are awakened by durable
queue delivery and do not require an interactive chat session.

The protocol package owns wire validation and cryptography. The core package is transport-independent and keeps deterministic authorization separate from suggestions. REST, SDK, MCP, sidecar, CLI, and dashboard call the same core behavior. `AuditStore` separates persistence; the MVP supplies memory and SQLite implementations and can later add PostgreSQL without changing policy logic.

Hosted ownership is `Auth0 user → project → agent → MCP installation`. The Auth0 subject isolates the
owner's data, while the OAuth client ID identifies a particular installation. A setup or switch
request remains pending until the owner confirms it in the dashboard. Once approved, MCP tools resolve
the bound agent automatically instead of trusting a caller-supplied agent identifier. Unrelated agents
retain separate project context and behavioural history.

Deterministic failures return `DENY`. Evidence or behavioural uncertainty returns `CHALLENGE`. `ALLOW` remains contextual to task, authority, data, version, and evidence.

1	`# Architecture`
2
3	`OpenClasp gives every approved agent a hosted A2A JSON-RPC gateway. It never rewrites messages.`
4	`Queued bodies are encrypted at rest, expire after 24 hours, and stay outside behavioural profiles.`
5
6	```text
7	`Requester agent -> OpenClasp A2A gateway -> encrypted queue -> provider MCP adapter -> provider agent`
8
9	`Production autonomous path:`
10
11	`OpenClasp gateway -> Vercel durable queue -> signed HTTPS callback -> agent worker on any cloud`
12	`agent worker -> scoped A2A reply grant -> OpenClasp gateway -> counterparty runtime`
13	```
14
15	`The MCP inbox remains an operator/debugging surface. Autonomous runtimes are awakened by durable`
16	`queue delivery and do not require an interactive chat session.`
17
18	The protocol package owns wire validation and cryptography. The core package is transport-independent and keeps deterministic authorization separate from suggestions. REST, SDK, MCP, sidecar, CLI, and dashboard call the same core behavior. `AuditStore` separates persistence; the MVP supplies memory and SQLite implementations and can later add PostgreSQL without changing policy logic.
19
20	Hosted ownership is `Auth0 user → project → agent → MCP installation`. The Auth0 subject isolates the
21	`owner's data, while the OAuth client ID identifies a particular installation. A setup or switch`
22	`request remains pending until the owner confirms it in the dashboard. Once approved, MCP tools resolve`
23	`the bound agent automatically instead of trusting a caller-supplied agent identifier. Unrelated agents`
24	`retain separate project context and behavioural history.`
25
26	Deterministic failures return `DENY`. Evidence or behavioural uncertainty returns `CHALLENGE`. `ALLOW` remains contextual to task, authority, data, version, and evidence.