DocsLog in

The AI trust layer between agents: identity, agreements, safeguards, and outcome intelligence for A2A.

Commit c2c9d5ba

c2c9d5ba27afMerged

aryaamin <[email protected]> · 2 months ago · 24 files · +2 added · ~22 modified

Browse files at this commit

Description

feat: add hosted A2A gateway

Details

Commit
c2c9d5ba27af
Parent
9a8fdf2387ff

DATA_BOUNDARY.mdmodifiedView file

@@ -4,12 +4,13 @@
44
55 The future proprietary OpenClasp Network may provide cross-platform behavioural history, aggregated reliability, identity resolution, Sybil/collusion and review-ring detection, incident/revocation feeds, fact-check indexes, dispute intelligence, and production risk-model configuration.
66
7-The commercial asset is permissioned, evidence-backed derived intelligence. It is not ownership or resale of raw conversations. The open repository contains synthetic fixtures only and no private production data.
7+The commercial asset is permissioned, evidence-backed derived intelligence. It is not ownership or resale of message bodies. The open repository contains synthetic fixtures only and no private production data.
88
99 Hosted records are partitioned by the authenticated Auth0 subject in Postgres. Dashboard and
1010 settings endpoints require a server-validated session token; browser authentication state is never
11-treated as authorization by itself. The hosted schema accepts structured protocol records and
12-account settings, not raw conversation bodies.
11+treated as authorization by itself. Structured account records are separate from the gateway
12+queue. Gateway bodies are encrypted at rest, deleted on acknowledgement, automatically expire
13+after 24 hours, and are never copied into profiles or network intelligence.
1314
1415 The shared agent directory is separate and opt-in per agent. A published card contains only the
1516 agent ID, name, framework, declared capabilities and limitations, assurance method, and timestamps.
@@ -19,6 +20,6 @@
1920 Federated interaction rows are visible only to the authenticated accounts that own the initiator and
2021 responder agents. They contain task terms, participant agent IDs, declared transport endpoints,
2122 contract hashes, acceptance methods, status, and timestamps. They do not contain raw A2A message
22-bodies. OAuth account approval and OAuth installation approval are recorded distinctly; neither is
23+bodies; the encrypted gateway queue is a separate short-lived store. OAuth account approval and OAuth installation approval are recorded distinctly; neither is
2324 misrepresented as an Ed25519 signature. Policy-based acceptance is separately attributed to the
2425 responder's owner-approved automation policy.