Crate agentd 

agentd — a minimal, MCP-native, reactive agent runtime.

One binary that is CLI, daemon, and subagent re-exec. A supervisor owns lifecycle, triggers, and the process tree but never reasons; the agentic loop lives only inside subagent processes. Tools come only from MCP servers; reactivity comes from MCP resource subscriptions; agentd is itself an MCP server so agents compose with one protocol.

The split is deliberate: because only subagent processes reason, a wedged or runaway model can never take the supervisor down with it, and the supervisor’s kill/reap/budget guarantees hold no matter what a model does.

Module map below. agentloop is named to avoid the loop keyword.

Re-exports

pub use ::net;

Modules

a2a

The A2A surface: agentd’s only external channel. Principals + roles + authorization (principals) and durable tasks + conversations (tasks). The transport binding — the HTTPS listener and the command/NL/gate routing into the runtime — lives in the runtime, so this module stays a pure model of who may call what and what a task is.

agentloop

auth

Endpoint authentication — the interactive and workload credential providers and the token cache they share.

cel

CEL (Common Expression Language) evaluation — the ONE gated exception to the zero-dependency moat (--features cel, default OFF).

config

Configuration: precedence, then validate-at-startup.

context

Contexts: the durable, self-compacting working memory of the root agent (context/root) and of every A2A conversation (context/<contextId>). A context is a versioned record of messages, a structured summary block, the loaded skill set, the working plan, the last preflight verdict and a token estimate. The runtime is its single writer and checkpoints it after every turn, so nothing here needs locking and a crash loses at most the turn in flight.

engine

The workflow engine: the workflow model and its validation (model), templates (template), the data steps (data) and the durable run record with its pure scheduler (run).

exit

The public exit-code contract: a stable, machine-actionable API (e.g. for a Kubernetes podFailurePolicy). Schedulers branch on these numbers, so treat any change to a code’s meaning as breaking.

governor

The token governor: windowed, durable token/request budgets that pace how fast an instance burns intelligence, with the tactics wait | slow | degrade | refuse | fail when a window is exhausted.

identity

Instance identity from the Kubernetes downward API.

intel

json

Shared JSON-RPC 2.0 codec.

jsonschema

A dependency-free JSON Schema subset validator (draft 2020-12 vocabulary, the parts tool contracts and workflow schemas actually use): type (single or list, integer distinct from number), properties, required, additionalProperties (bool or schema), patternProperties (literal-prefix and ^…$ anchored-literal patterns only — no regex engine), enum, const, items (schema), prefixItems, minItems/maxItems, uniqueItems, minimum/maximum/exclusiveMinimum/exclusiveMaximum, multipleOf, minLength/maxLength, minProperties/maxProperties, allOf/anyOf/ oneOf/not, if/then/else, $ref to #/$defs/<name> / #/definitions/<name> / # (root), boolean schemas, nullable (OpenAPI sugar), default (ignored), format/pattern/description/title/ examples/$schema/$id/$comment (accepted, not enforced — pattern is checked only for the same literal shapes as patternProperties).

mcp

obs

Observability. The default build ships three dependency-free things: a hand-rolled JSON-lines logger to stderr, a tiny health surface, and W3C trace-context propagation. Only the heavier surfaces (metrics, OTLP export) are feature-gated.

registry

The tool registry: one registry serving the root agent, workflow steps and subagents, with three tiers and dispatch precedence internal > code > MCP. Every tool carries JSON Schemas for input and output and a grant (who may call it). Internal tools are contracts with a built-in implementation by default, overridable by a mapped MCP tool (tools.overrides) and disable-able (tools.disabled); mapping-only contracts (code.run, knowledge.*, search.*) are unavailable until mapped (or until a server advertises the profile’s tool names).

runtime

The agentd runtime: the supervisor’s event loop over durable state, the turn workers it spawns, and the lifecycle policy.

sec

sha

A compact, dependency-free SHA-256 (FIPS 180-4) — content identity: workflow hashes, skill body hashes, artifact digests. A checkpoint envelope binds the graph it was taken from by sha256(canonical graph JSON); resume refuses a mismatch. Hand-rolled like the cron parser and FNV-1a (the minimalism moat): ~60 lines, byte-oriented, verified against the FIPS/NIST test vectors below. Also backs hmac_sha256 for inbound webhook signature verification (RFC 2104); agentd’s own outbound request signing (RFC 9421) uses ring under aauth.

signals

Signal handling + the self-pipe wakeup.

state

The durable state model: entity kinds, the manifest, the write-ahead inbox, timers, the checkpoint policy and the restore protocol — one façade (Durable) over a crate::store::Store that the runtime is the single writer of.

store

The state store contract and adapters.

subagent

supervisor

tools

CODE-REGISTERED tools — the embedder seam.

triggers

Trigger primitives: the cron schedule parser behind the schedule start node.

wire

Constants

VERSION

Crate version, surfaced in logs (agentd_build_info) and --version.

Functions

announce_addr

Announce a bound loopback listener’s address through addr_file — the discovery handshake for the built-in test mocks (--internal-mock-llm, --internal-mock-mcp-http): the harness passes a fresh path, waits for the file to exist, then reads host:port from it. Written atomically (tmp + rename) so a waiter never observes a half-written address.