Must-understand feature bits for AgentEnvelope::must_understand. Each
constant names one capability a message may demand a receiver implement.
Defined additively as features land: a newer producer sets a bit an older
receiver does not know, and that receiver rejects rather than mis-handling
the message. No bits are defined yet, so today the marker is the mechanism
in place for the first feature that needs strict handling.
The structured body of a kind = error envelope, mirroring the wire error
enums of the other surfaces. The code is the machine discriminator, the
optional message is human detail.
A structured capability on an AgentCard: which skill, its I/O content
shape, advisory cost and latency classes, concurrency, health, and load.
Mirrors the SDK A2A AgentSkill so the bridge maps one to the other.
The interpretation-bearing attributes a Signature binds beyond the
envelope body: the content-type code (agdx.ct) and wire version (agdx.av)
a consumer reads to select its codec and decoder. Riding unsigned headers,
these would let an intermediary reinterpret a signed record. Folded into the
preimage here, a change invalidates the signature.
What a message is. A closed vocabulary by design: adding a kind requires an
AGENT_OP_VERSION bump and a hello advertisement, because an unknown kind
must fail decode rather than flow misinterpreted.
The content shape on a capability’s input or output: either a content-type
or a registered writer-schema id. Externally tagged (content_type /
schema_id) rather than untagged: a content-type name and a schema id are
both strings, so an untagged encoding would decode a schema id literally named
json as ContentType::Json, and a
content-type name from a newer peer as a schema id. The tag makes the two
unambiguous and forward-safe.
A2A’s task lifecycle, adopted verbatim, riding the wire as a u8 code (the
agdx.ct dictionary pattern) so a future A2A state takes the next free code
and flows through old consumers as an opaque non-terminal value instead of
forcing a version bump on someone else’s release schedule. Codes are
permanent and never renumbered.
Metadata key: the bridge hop list, a Value::List of bridge id strings.
A bridge republishing a message appends its own id, and drops a message
whose hop list already contains it: the loop guard for multi-bridge
deployments (A2A in, AG-UI out, A2A out again). Bounded by the metadata
caps like every other entry.
Metadata key: the user an agent acts on behalf of. It rides metadata (not a
header) so it falls inside the signed envelope span, so the signer cannot
forge whom it claims to act for.
Metadata key: the declared purpose of the operation, a stable input for a
policy engine at the effect boundary. Advisory unless the envelope is signed.
Metadata key: the message’s chat role. Recommended values: user,
assistant, system, tool. A string because that vocabulary belongs to
the model providers and the edge protocols, not to us.
Metadata key: the run id a status record belongs to, stamped by a
registered workflow or contract and read by the run-registry fold. A record
without it never enters the fold, so the key costs nothing and means
nothing for everything that is not a registered run. Bounded by the
metadata caps like every other entry.
The status operation value for a quarantine fact: an operator marks an agent
out of routing. The body is the quarantined agent id. Authorized by the
registry topic’s write access control (only an operator may append it), and
optionally signed for defense in depth.
The status operation value for an un-quarantine fact: an operator lifts a
prior quarantine, returning the agent to routing. The body is the agent id.
Same authorization as OPERATION_QUARANTINE, so quarantine is not a
one-way door that only retention expiry can undo.
The domain separator prefixed to the canonical envelope encoding before
signing, so an AGDX signature can never be replayed into another protocol.
The canonical encoding is this crate’s own: named-field CBOR, fields in
declaration order, absent optionals skipped, the signature field absent.