Crate agentd 

agentd — a minimal, MCP-native, reactive agent runtime.

One binary that is CLI, daemon, and subagent re-exec. A supervisor owns lifecycle, triggers, and the process tree but never reasons; the agentic loop lives only inside subagent processes. Tools come only from MCP servers; reactivity comes from MCP resource subscriptions; agentd is itself an MCP server so agents compose with one protocol.

Architecture: rfcs/0001-mcp-native-agent-runtime.md (front door) and rfcs/0002–0013. Binding decisions: docs/design/00-architecture-assessment.md. Build order: docs/design/PLAN.md.

Module map (assessment §4.0). agentloop is named to avoid the loop keyword.

Re-exports

pub use ::net;

Modules

a2a

The A2A v2 surface (RFC 0029): agentd 2.0’s only external channel. Principals + roles + authorization (principals) and durable tasks + conversations (tasks). The transport binding (the HTTPS listener + the command/NL/gate routing into the runtime) is wired in the runtime at the P5 cut-over.

agentloop

auth

Endpoint authentication — the interactive & workload credential providers and the durable token cache they share (RFC 0031).

cel

CEL (Common Expression Language) evaluation — the ONE gated exception to the zero-dependency moat (--features cel, default OFF).

config

Configuration: precedence + validate-at-startup. RFC 0011 §2-§3.

context

Contexts (RFC 0026 §5): the durable, self-compacting working memory of the root agent (context/root) and of every A2A conversation (context/<contextId>). A context is a versioned record of messages, a structured summary block, the loaded skill set, the working plan (RFC 0026 §5.3), the last preflight verdict and a token estimate; the runtime is its single writer and checkpoints it after every turn.

engine

The workflow engine v3 (RFC 0027): the dialect-3 model + validation (model), templates (template), and the durable run record + pure scheduler (run). Step execution (turn workers, MCP calls, internal tools, timers) is the runtime’s job (crate::runtime): the engine says what is ready and records what happened. P3 ships the model, validation and the scheduler with the core step kinds; P4 completes the catalogue (iteration, waits, child runs, start nodes beyond once/manual).

exit

The public exit-code contract. RFC 0011 §5 — this is a stable, machine-actionable API (e.g. for a Kubernetes podFailurePolicy); treat changes as breaking.

governor

The token governor (RFC 0026 §7, plan §3.17): windowed, durable token/ request budgets that pace how fast an instance burns intelligence, with the tactics wait | slow | degrade | refuse | fail when a window is exhausted.

identity

Instance identity from the Kubernetes downward API (RFC 0015 §6, RFC 0014 §6.4).

intel

json

Shared JSON-RPC 2.0 codec.

jsonschema

A dependency-free JSON Schema subset validator (draft 2020-12 vocabulary, the parts tool contracts and workflow schemas actually use): type (single or list, integer distinct from number), properties, required, additionalProperties (bool or schema), patternProperties (literal-prefix and ^…$ anchored-literal patterns only — no regex engine), enum, const, items (schema), prefixItems, minItems/maxItems, uniqueItems, minimum/maximum/exclusiveMinimum/exclusiveMaximum, multipleOf, minLength/maxLength, minProperties/maxProperties, allOf/anyOf/ oneOf/not, if/then/else, $ref to #/$defs/<name> / #/definitions/<name> / # (root), boolean schemas, nullable (OpenAPI sugar), default (ignored), format/pattern/description/title/ examples/$schema/$id/$comment (accepted, not enforced — pattern is checked only for the same literal shapes as patternProperties).

mcp

obs

Observability. The default build ships three dependency-free things: a hand-rolled JSON-lines logger to stderr, a tiny health surface, and W3C trace-context propagation. Only the heavier surfaces (metrics, OTLP export) are feature-gated. RFC 0010.

registry

The tool registry (RFC 0028): one registry serving the root agent, workflow steps and subagents, with three tiers and dispatch precedence internal > code > MCP. Every tool carries JSON Schemas for input and output and a grant (who may call it). Internal tools are contracts with a built-in implementation by default, overridable by a mapped MCP tool (tools.overrides) and disable-able (tools.disabled); mapping-only contracts (code.run, knowledge.*, search.*) are unavailable until mapped (or until a server advertises the profile’s tool names).

runtime

The agentd 2.0 runtime (RFC 0026): the supervisor’s event loop over durable state, the turn workers it spawns, and the lifecycle policy. Built beside the 1.x mode drivers and selected by a v2 configuration document; the 1.x drivers are removed at the P5 cut-over.

sec

sha

A compact, dependency-free SHA-256 (FIPS 180-4) — content identity: the workflow hash (RFC 0021 §8.2 / RFC 0027 §9), skill body hashes, artifact digests. A checkpoint envelope binds the graph it was taken from by sha256(canonical graph JSON); resume refuses a mismatch. Hand-rolled like the cron parser and FNV-1a (the minimalism moat): ~60 lines, byte-oriented, verified against the FIPS/NIST test vectors below. Also backs hmac_sha256 for inbound webhook signature verification (RFC 2104); agentd’s own outbound request signing (RFC 9421) uses ring under aauth.

signals

Signal handling + the self-pipe wakeup. RFC 0003 §signals, RFC 0011 §signals.

state

The durable state model (RFC 0025 §3, §5–§7): entity kinds, the manifest, the write-ahead inbox, timers, the checkpoint policy and the restore protocol — one façade (Durable) over a crate::store::Store that the runtime (RFC 0026) is the single writer of.

store

The state store contract and adapters (RFC 0025 §2, §4).

subagent

supervisor

tools

CODE-REGISTERED tools (RFC 0022 §4) — the embedder seam.

triggers

Trigger primitives. agentd 2.0 removed the v1 supervisor mode drivers (mode, warm, router); timer (cron) backs the v2 schedule start node.

wire

Constants

VERSION

Crate version, surfaced in logs (agentd_build_info) and --version.

Functions

announce_addr

Announce a bound loopback listener’s address through addr_file — the discovery handshake for the built-in test mocks (--internal-mock-llm, --internal-mock-mcp-http): the harness passes a fresh path, waits for the file to exist, then reads host:port from it. Written atomically (tmp + rename) so a waiter never observes a half-written address.