DocsLog in

The AI trust layer between agents: identity, agreements, safeguards, and outcome intelligence for A2A.

Commit af23d8c9

af23d8c9b675Merged

aryaamin <[email protected]> · 2 months ago · 28 files · +5 added · ~23 modified

Browse files at this commit

Description

Harden public beta access

Details

Commit
af23d8c9b675
Parent
77f5465edca6

README.mdmodifiedView file

@@ -39,17 +39,17 @@
3939 Neon. Auth0 Dynamic Client Registration is not used. The local stdio server remains available for
4040 development.
4141
42-Public dashboard login is hidden by default while the site is in demo-booking mode. Set
43-`OPENCLASP_PUBLIC_LOGIN_ENABLED=true` in the build environment to restore the Google and GitHub
44-sign-in buttons and `/login` route.
42+The public dashboard shows Google and GitHub sign-in at `/login`. Accounts are free during the
43+controlled beta; there is no billing or paywall in the application.
4544
4645 Hosted providers that cannot run OAuth, including Botpress-style static MCP clients, use a
4746 revocable agent access token. Use **Connect → Hosted provider → Botpress** to create a separate agent
4847 identity and token together, choose Bearer authentication in Botpress, and paste the token once. The
49-credential is scoped to that agent for `mcp:access` and `runtime:connect`, stored only as a SHA-256
50-hash, expires within one year, and can be revoked immediately from the agent card. Runtime
51-registration cannot affect another agent. Never reuse a dashboard or interactive OAuth token for a
52-hosted provider.
48+credential is scoped to that agent with explicit MCP, runtime, profile, interaction, feedback, and
49+agent-management permissions. Network contribution is not granted by default. Tokens are stored
50+only as SHA-256 hashes, expire within one year, and can be revoked immediately from the agent card.
51+Runtime registration cannot affect another agent. Never reuse a dashboard or interactive OAuth
52+token for a hosted provider.
5353
5454 On first use, tell the connected agent to set itself up. It calls `openclasp_setup` with its project,
5555 identity and capabilities. Approve the proposal once on the dashboard, then connect the agent's
@@ -101,9 +101,10 @@
101101 OpenClasp's web login presents only Google and GitHub. Complete the one-time provider setup in
102102 [`docs/SOCIAL_LOGIN_SETUP.md`](docs/SOCIAL_LOGIN_SETUP.md) before using it outside of testing.
103103
104-Agent access tokens currently carry `mcp:access` and `runtime:connect`. Before a public beta, add and enforce separate
105-`profile:read`, `interaction:write`, `feedback:write`, `agent:manage`, and `network:contribute`
106-permissions across both OAuth and agent-token authentication.
104+Hosted credentials enforce separate `profile:read`, `interaction:write`, `feedback:write`, and
105+`agent:manage` permissions. `network:contribute` remains owner-only and requires explicit dashboard
106+consent; integration credentials cannot enable it. Credentials issued before this scope model must
107+be revoked and reissued before use.
107108
108109 ## What the demo proves
109110