Must-understand feature bits for AgentEnvelope::must_understand. Each
constant names one capability a message may demand a receiver implement.
Defined additively as features land: a newer producer sets a bit an older
receiver does not know, and that receiver rejects rather than mis-handling
the message. No bits are defined yet, so today the marker is the mechanism
in place for the first feature that needs strict handling.
The structured body of a kind = error envelope, mirroring the wire error
enums of the other surfaces. The code is the machine discriminator, the
optional message is human detail.
A structured capability on an AgentCard: which skill, its I/O content
shape, advisory cost and latency classes, concurrency, health, and load.
Mirrors the SDK A2A AgentSkill so the bridge maps one to the other.
One work record an agent held while its session was paused. A
session_parked event on the session lane carries it, and a
session_unparked event with the same body records that the agent handled
the record after the resume. The source address with its topic generation,
the agent, and the pause request position together identify one parking.
The JSON body of a session_pause request on agent.control: the agents
whose acknowledgments complete the pause, frozen when the request is
written. An empty set names no agent, and every agent that receives work
for the session while it is paused acknowledges when it holds that work.
The interpretation-bearing attributes a Signature binds beyond the
envelope body: the content-type code (agdx.ct) and wire version (agdx.av)
a consumer reads to select its codec and decoder. Riding unsigned headers,
these would let an intermediary reinterpret a signed record. Folded into the
preimage here, a change invalidates the signature.
What a message is. A closed vocabulary by design: adding a kind requires an
AGENT_OP_VERSION bump and a hello advertisement, because an unknown kind
must fail decode rather than flow misinterpreted.
The content shape on a capability’s input or output: either a content-type
or a registered writer-schema id. Externally tagged (content_type /
schema_id) rather than untagged: a content-type name and a schema id are
both strings, so an untagged encoding would decode a schema id literally named
json as ContentType::Json, and a
content-type name from a newer peer as a schema id. The tag makes the two
unambiguous and forward-safe.
A2A’s task lifecycle with LaserData’s Paused extension, riding the wire as a u8 code (the
agdx.ct dictionary pattern) so a future A2A state takes the next free code
and flows through old consumers as an opaque non-terminal value instead of
forcing a version bump on someone else’s release schedule. Codes are
permanent and never renumbered.
Metadata key: the bridge hop list, a Value::List of bridge id strings.
A bridge republishing a message appends its own id, and drops a message
whose hop list already contains it: the loop guard for multi-bridge
deployments (A2A in, AG-UI out, A2A out again). Bounded by the metadata
caps like every other entry.
Metadata key: the user an agent acts on behalf of. It rides metadata (not a
header) so it falls inside the signed envelope span, so the signer cannot
forge whom it claims to act for.
Metadata key: the declared purpose of the operation, a stable input for a
policy engine at the effect boundary. Advisory unless the envelope is signed.
Metadata key: the message’s chat role. Recommended values: user,
assistant, system, tool. A string because that vocabulary belongs to
the model providers and the edge protocols, not to us.
The metadata key that marks a command as the first command of a
submitted session. The receiving agent marks the session working when it
picks the command up.
The status operation value for a quarantine fact: an operator marks an agent
out of routing. The body is the quarantined agent id. Authorized by the
registry topic’s write access control (only an operator may append it), and
optionally signed for defense in depth.
The status operation value for an un-quarantine fact: an operator lifts a
prior quarantine, returning the agent to routing. The body is the agent id.
Same authorization as OPERATION_QUARANTINE, so quarantine is not a
one-way door that only retention expiry can undo.
The domain separator prefixed to the canonical envelope encoding before
signing, so an AGDX signature can never be replayed into another protocol.
The canonical encoding is this crate’s own: named-field CBOR, fields in
declaration order, absent optionals skipped, the signature field absent.