@bluefly/openstandardagents 0.4.9 → 0.5.0

package/.version.json

@@ -1,7 +1,7 @@
 {
-  "current": "0.4.9",
-  "latest_stable": "0.4.8",
-  "spec_version": "0.4.9",
+  "current": "0.5.0",
+  "latest_stable": "0.4.9",
+  "spec_version": "0.5.0",
   "spec_path": "spec/v0.5",
   "schema_file": "agent.schema.json"
 }

package/CHANGELOG.md

@@ -89,7 +89,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Summary
 Phase 0 - Foundation fixes + tech debt reduction. Massive codebase cleanup resulting in 47% LOC reduction, SDK adoption, and complete Skills pipeline implementation.
 
-### 🎯 Key Metrics
+### Key Metrics
 - **16,574 LOC removed** (47% codebase reduction: 35,425 → 18,851)
 - **3,713 LOC directly deleted** (dead code elimination)
 - **513 LOC removed from Anthropic adapter** (25.8% reduction via SDK migration)
@@ -99,7 +99,7 @@ Phase 0 - Foundation fixes + tech debt reduction. Massive codebase cleanup resul
 - **Tests: 19 new Skills pipeline tests** (100% passing)
 - **SDK adoption: 22% → 28%** (Anthropic now uses official @anthropic-ai/sdk)
 
-### ✨ New Features
+### New Features
 
 #### Skills Pipeline (P0-1, P0-2, P0-3 from PRD)
 - **`ossa skills research`** - Index Claude Skills from curated sources
@@ -251,7 +251,7 @@ Phase 0 - Foundation fixes + tech debt reduction. Massive codebase cleanup resul
 - **NPM converter tests**: 53/53 passing
 - **GitLab generator tests**: 20/21 passing (1 skip)
 
-### 📦 Dependencies
+### Dependencies
 - **@anthropic-ai/sdk** - Official Anthropic SDK (new dependency)
 - No breaking dependency changes
 
@@ -259,13 +259,13 @@ Phase 0 - Foundation fixes + tech debt reduction. Massive codebase cleanup resul
 - **Build failures** - Fixed 10 TypeScript errors by restoring missing services
 - **Duplicate code** - Eliminated 99 LOC of duplication via BasePackageGenerator
 
-### 💡 Known Issues
+### Known Issues
 - **Jest type configuration** - Skills pipeline tests have TypeScript errors
   - Tests run and pass (19/19) but TypeScript doesn't recognize Jest globals
   - Needs @types/jest configuration in tsconfig or test setup file
 - **GitLab generator test** - 1 test skipped (20/21 passing)
 
-### 🚀 Migration Guide
+### Migration Guide
 No breaking changes. This release is purely additive with tech debt reduction.
 
 #### New Commands
@@ -296,7 +296,7 @@ npm run publish:dry-run                 # Test publication without publishing
 - ✅ README reflects infrastructure bridge positioning
 - ✅ Ready for npm publish (scripts, docs, config all prepared)
 
-### 🎯 Next Steps
+### Next Steps
 - Fix Jest type configuration for Skills pipeline tests
 - Run publish:check validation
 - Publish to npm registry
@@ -353,7 +353,7 @@ Every registered command now works. Every version reference is correct. The READ
 
 ### Added
 
-**🚀 GitLab Duo Agent Platform Export (Comprehensive Implementation)**
+**GitLab Duo Agent Platform Export (Comprehensive Implementation)**
 
 Complete production-ready GitLab Duo integration enabling OSSA agents to run natively on GitLab's Agent Platform.
 
@@ -678,7 +678,7 @@ All 11 platforms now generate complete, production-ready packages validated by c
 
 ### Added
 
-**🎯 The Ultimate Agent Specification Standard - "The OpenAPI for Agents"**
+**The Ultimate Agent Specification Standard - "The OpenAPI for Agents"**
 
 This release transforms OSSA from a manifest format into THE definitive agent specification standard that will define what AI agents ARE for the next 5 years.
 

package/README.md

@@ -14,63 +14,73 @@ OSSA is not a protocol (like MCP or A2A) and not a framework (like LangChain or
 - **Builds on A2A** - Supports A2A messaging and agent-to-agent communication
 - **Extends protocols** - Adds deployment and packaging layer on top of communication protocols
 
-## 🇺🇸 NIST CAISI RFI Alignment (NIST-2025-0035)
+## Why OSSA + DUADP
 
-OSSA natively aligns with the [NIST CAISI Request for Information on Collaborative AI Systems Integration](https://www.regulations.gov/docket/NIST-2025-0035), providing the critical **Contract Layer** missing from current agent protocols.
-
-- **Agent Identity (IA-3)**: W3C Decentralized Identifiers (GAID) provide cryptographic origin authentication for agents.
-- **Pre-Authorization (AC-3, AC-6)**: Deterministic AWS Cedar policies evaluated at the transport layer enforce zero-trust bounds before an LLM receives context.
-- **Federated Discovery**: Integration with DUADP (`.well-known` endpoints) scales agent discovery securely across organizational boundaries without centralized lock-in.
-- **Supply Chain Security (SI-7)**: Cryptographically signed manifests (`x-signature`) and explicit OSCAL/SBOM pointers prevent tool poisoning and supply chain attacks.
-
-## What's New
+AI agents need the same foundational infrastructure the internet has: **identity**, **discovery**, and **governance**. OSSA and DUADP together deliver that stack:
 
-### AgentScope Integration (v0.4.8)
+```
+┌──────────────────────────────────────────────────────────────┐
+│  Layer 1 — IDENTITY  (this repo)                             │
+│  OSSA (Open Standard for Software Agents)                    │
+│  openstandardagents.org                                      │
+│                                                              │
+│  · Agent DID — W3C decentralized identity per agent          │
+│  · Signed manifests — cryptographic provenance + SBOM        │
+│  · Cedar policies — zero-trust authorization bounds          │
+│  · NIST SP 800-53 control mapping built in                   │
+└─────────────────────┬────────────────────────────────────────┘
+                      │  secure identity
+                      ▼
+┌──────────────────────────────────────────────────────────────┐
+│  Layer 2 — DISCOVERY                                         │
+│  DUADP (Decentralized Universal AI Discovery Protocol)       │
+│  duadp.org | npm install @bluefly/duadp                      │
+│                                                              │
+│  · Federated DNS + WebFinger agent discovery                 │
+│  · Cross-node gossip federation                              │
+│  · Policy-aware capability routing                           │
+│  · Trust-tier gating (community → verified → federal)        │
+└─────────────────────┬────────────────────────────────────────┘
+                      │  policy-filtered
+                      ▼
+┌──────────────────────────────────────────────────────────────┐
+│  Layer 3 — EXECUTION                                         │
+│  Your runtime: Kubernetes, Claude, LangChain, Drupal, etc.   │
+└──────────────────────────────────────────────────────────────┘
+```
 
-- **New agent framework**: `agentscope` — Alibaba's production-ready Python agent framework (Apache 2.0, 17.8k stars) now supported as an OSSA agent type
-- **Python adapter**: Full OSSA-to-AgentScope bridge — reads OSSA manifests, instantiates ReActAgent with MCP tools, A2A protocol, memory backends (Mem0, Redis, ReMe)
-- **MCP server wrapper**: Expose any AgentScope agent as an MCP server for Claude Code, Cursor, VS Code
-- **A2A endpoint**: Serve AgentScope agents as discoverable A2A protocol endpoints with `.well-known/agent.json`
-- **Drupal module**: `ai_agents_agentscope` — contrib-first AiProvider plugin bridging AgentScope into Drupal's AI Agents ecosystem
-- **Docker support**: Dockerfile + docker-compose for containerized AgentScope runtime
-- **CLI**: `ossa-agentscope run|validate|serve` commands for manifest-driven agent execution
-- **Unique capabilities** not available in other frameworks: RL-based agent training, realtime voice agents, built-in evaluation framework
-- **Schema**: `extensions.agentscope` block in v0.4 and v0.5 specs with agent_class, capabilities, memory_backend, orchestration, formatter, compression, skill_dirs
+**OSSA defines the agent. DUADP discovers it.**
 
-### OpenAI Agents SDK Export (2026-02-16)
+| Security requirement | OSSA | DUADP |
+|---|---|---|
+| Agent identity & authentication | ✅ W3C DID (GAID) per agent | ✅ DID-verified nodes |
+| Authorization & least-privilege | ✅ AWS Cedar policies in manifest | ✅ Trust-tier gating |
+| Governance & human oversight | ✅ Signed manifests + OSCAL pointers | ✅ Audit log + attestation API |
+| Cross-system interoperability | ✅ Multi-platform exports | ✅ Federated gossip discovery |
+| Monitoring & incident response | ✅ Observability config in spec | ✅ Revocation + incident endpoints |
+| Supply chain security | ✅ `x-signature` + SBOM | ✅ Signed resource registry |
 
-- **New export platform**: `openai-agents-sdk` (22nd platform) — generates runnable `@openai/agents` TypeScript packages from OSSA manifests
-- Maps OSSA `spec.personality` to agent instructions, `spec.llm` to model selection, `spec.tools` to function tools, `spec.mcp` to MCPServerStreamableHttp connections, `spec.safety` to guardrails
-- Generates: `agent.ts`, `mcp-config.ts`, `guardrails.ts`, `run.ts`, `package.json`, `tsconfig.json`
-- Usage: `ossa export --platform openai-agents-sdk agent.ossa.yaml`
-- New OSSA extension blocks planned: `openai_agents_sdk`, `openai_responses_api`, `openai_realtime`, `openai_deep_research`
-- Supports defining agents once and exporting to both Claude and OpenAI platforms
+> [openstandardagents.org/specification →](https://openstandardagents.org/specification) | [duadp.org →](https://duadp.org)
 
-### Multi-Agent Team Topology (2026-02-17)
+## 🇺🇸 NIST CAISI Alignment (NIST-2025-0035)
 
-- **Team definitions** (`spec.team`): Define coordinated multi-agent teams with 4 team models — lead-teammate, peer-to-peer, hierarchical, swarm
-- **Subagent definitions** (`spec.subagents`): Parent-child delegation hierarchies with role-based agents (worker, specialist, reviewer, debugger)
-- **8 architecture patterns**: single, swarm, pipeline, graph, hierarchical, reactive, cognitive, lead-teammate
-- **Team code generation**: Export team topology to CrewAI (Python), OpenAI Agents SDK (TypeScript), Claude Code (markdown), and npm (TypeScript)
-- **`--perfect-agent` CLI flag**: Generate a complete production bundle — AGENTS.md, team scaffolding, CLEAR eval stubs, governance config, observability config, and agent card
-- **Team-aware AGENTS.md**: Auto-generated documentation with team topology tables, member roles, coordination strategy, and hierarchy diagrams
-- **5 new export platforms**: `openai-agents-sdk` (beta), `a2a` (alpha), `claude-skills` (beta), `mobile-agent` (alpha), `symfony` (alpha) — bringing total to 22
+If you're evaluating OSSA/DUADP for federal or regulated deployments, see the detailed alignment documentation:
 
-### v0.4.6 (2026-02-19)
+OSSA natively aligns with the [NIST CAISI Request for Information on Collaborative AI Systems Integration](https://www.regulations.gov/docket/NIST-2025-0035), providing the critical **Contract Layer** missing from current agent protocols.
 
-**Version Update**:
-- Updated all version references from 0.4.5 to 0.4.6
-- Package version bumped to 0.4.6
+- **Agent Identity (IA-3)**: W3C Decentralized Identifiers (GAID) provide cryptographic origin authentication for agents.
+- **Pre-Authorization (AC-3, AC-6)**: Deterministic AWS Cedar policies evaluated at the transport layer enforce zero-trust bounds before an LLM receives context.
+- **Federated Discovery**: Integration with DUADP (`.well-known` endpoints) scales agent discovery securely across organizational boundaries without centralized lock-in.
+- **Supply Chain Security (SI-7)**: Cryptographically signed manifests (`x-signature`) and explicit OSCAL/SBOM pointers prevent tool poisoning and supply chain attacks.
 
-### v0.4.5 (2026-02-10)
+## What's New in v0.5.0
 
-**Major Cleanup & Foundation Improvements**:
-- 16,574 LOC removed - 47% codebase reduction (35,425 to 18,851 LOC)
-- SDK Migration - Anthropic adapter now uses official `@anthropic-ai/sdk` (513 LOC removed, 25.8% reduction)
-- Complete Skills Pipeline - Research, generate, export, validate, sync Claude Skills
-- Zero Build Errors - Fixed all TypeScript errors, 100% passing tests
-- DRY Improvements - Eliminated 99 LOC duplication via BasePackageGenerator
-- 19 New Tests - Skills pipeline fully tested (100% passing)
+- **Spec and schema are aligned on `0.5.0`**. Public examples, migration commands, and SDK snippets now use `ossa/v0.5.0` and [`spec/v0.5/agent.schema.json`](./spec/v0.5/agent.schema.json).
+- **Release-facing examples are normalized**. The getting-started manifests and walkthroughs now validate cleanly as `v0.5.0` instead of mixing `v0.4.x` references into the release branch.
+- **OpenAI Agents SDK export remains first-class**. Use `ossa export agent.ossa.yaml --platform openai-agents-sdk` to generate a runnable `@openai/agents` TypeScript package with MCP config and guardrails.
+- **AgentScope support remains available in `v0.5.0`**. `extensions.agentscope` continues to cover agent class, orchestration, memory backend, capabilities, and compression settings for AgentScope-based deployments.
+- **Team topology stays in the core contract**. `spec.team`, `spec.subagents`, and `--perfect-agent` continue to support lead-teammate, peer, hierarchical, and swarm compositions from a single manifest.
+- **Release validation is stricter**. CI now checks the release-facing docs and getting-started examples so `README.md`, `llms.txt`, and tutorial manifests do not silently drift behind the current spec.
 
 See [CHANGELOG.md](./CHANGELOG.md) for complete details.
 
@@ -288,7 +298,7 @@ Upgrade manifests to the latest spec version:
 
 ```bash
 # Migrate from older version to current
-ossa migrate agent.ossa.yaml --to 0.4.6
+ossa migrate agent.ossa.yaml --to 0.5.0
 
 # List available migration paths
 ossa migrate --list
@@ -315,7 +325,7 @@ if (result.valid) {
 }
 ```
 
-## Production Status (v0.4.6)
+## Production Status (v0.5.0)
 
 ### ✅ Production-Ready (Tested & Documented)
 
@@ -327,13 +337,13 @@ if (result.valid) {
 - `ossa migrate` - Migrate between spec versions
 - `ossa generate-gaid` - Global Agent ID generation
 
-**Production Platform Exports** (4 production, 8 beta, 10 alpha — 22 total):
+**Production Platform Exports** (see `ossa export --list-platforms` for the live matrix):
 - `langchain` (production) - Python + TypeScript agents (uses @langchain/* SDK v0.3+)
 - `mcp` (production) - MCP server for Claude Code (uses @modelcontextprotocol/sdk v1.0+)
 - `npm` (production) - TypeScript package with manifest
 - `agent-skills` (production) - SKILL.md for Claude Code
 
-**Skills Pipeline** (✅ Complete in v0.4.6):
+**Skills Pipeline** (✅ Current in v0.5.0):
 - `ossa skills research` - Index skills from curated sources (cached locally at ~/.ossa/skills-index.json)
 - `ossa skills generate` - Auto-detects input format (OSSA, Oracle Agent Spec, AGENTS.md)
 - `ossa skills export` - Package as npm, install to ~/.claude/skills/, publish to registry
@@ -352,7 +362,7 @@ if (result.valid) {
 - `ossa agents-local` - Local `.agents/` folder management
 - `ossa agents-md` - Generate, validate, sync [agents.md](https://agents.md) files (standard: [agentsmd/agents.md](https://github.com/agentsmd/agents.md)); customize via wizard step or `ossa agents-md generate|validate|sync`
 - Export to: `crewai`, `drupal`, `claude-code`, `cursor`, `warp`, `anthropic`
-- Anthropic runtime adapter uses official `@anthropic-ai/sdk` (v0.4.6 improvement: 513 LOC removed)
+- Anthropic runtime adapter uses official `@anthropic-ai/sdk`
 
 ### GitLab Agent Examples (Fully Implemented)
 
@@ -396,7 +406,7 @@ OSSA complements MCP and A2A by adding the packaging and deployment layer they d
 ### Manifest Format
 
 ```yaml
-apiVersion: ossa/v0.4.6
+apiVersion: ossa/v0.5.0
 kind: Agent
 metadata:
   name: code-reviewer
@@ -423,7 +433,7 @@ spec:
 #### Team Manifest Example
 
 ```yaml
-apiVersion: ossa/v0.4.6
+apiVersion: ossa/v0.5.0
 kind: Agent
 metadata:
   name: dev-team
@@ -517,7 +527,7 @@ import { validateManifest } from '@bluefly/openstandardagents/validation';
 import type { OssaAgent } from '@bluefly/openstandardagents/types';
 
 const agent: OssaAgent = {
-  apiVersion: 'ossa/v0.4.6',
+  apiVersion: 'ossa/v0.5.0',
   kind: 'Agent',
   metadata: { name: 'creative-agent-naming', version: '1.0.0' },
   spec: {
@@ -532,7 +542,7 @@ if (result.valid) console.log('Valid manifest');
 
 ## Spec Features
 
-The OSSA v0.4 schema supports these optional sections:
+The OSSA v0.5.0 schema supports these optional sections:
 
 - **LLM Configuration** - Provider, model, temperature, max tokens, caching
 - **Tools** - Named tools with input schemas
@@ -563,7 +573,7 @@ OSSA is designed to work **alongside** existing agent protocols, not replace the
 **Example**: An OSSA manifest can declare that an agent uses MCP tools and A2A messaging, then export that configuration to Docker, Kubernetes, or LangChain deployment packages.
 
 ```yaml
-apiVersion: ossa/v0.4.6
+apiVersion: ossa/v0.5.0
 kind: Agent
 metadata:
   name: code-reviewer
@@ -617,7 +627,7 @@ ossa export agent.ossa.yaml --platform docker --output ./docker-deploy
 ossa export --list-platforms
 ossa lint agent.ossa.yaml
 ossa diff old.ossa.yaml new.ossa.yaml
-ossa migrate agent.ossa.yaml --to 0.4.6
+ossa migrate agent.ossa.yaml --to 0.5.0
 ossa generate-gaid agent.ossa.yaml
 ossa export agent.ossa.yaml --perfect-agent
 ossa export agent.ossa.yaml --include-agents-md --include-team --include-evals
@@ -705,7 +715,7 @@ All mutation commands support:
 - [Agents workspace and registry](./docs/getting-started/agents-workspace-registry.md) - `.agents-workspace/` layout, sources, MCP/A2A
 - [CHANGELOG](./CHANGELOG.md) - Release history
 - [Examples](./examples) - Sample manifests
-- [JSON Schema](./spec/v0.4/agent.schema.json) - Full spec
+- [JSON Schema](./spec/v0.5/agent.schema.json) - Full spec
 - [GitLab](https://gitlab.com/blueflyio/ossa/openstandardagents) - Source
 - [GitHub Mirror](https://github.com/blueflyio/openstandardagents)
 

package/dist/.version.json

@@ -1,7 +1,7 @@
 {
-  "current": "0.4.9",
-  "latest_stable": "0.4.8",
-  "spec_version": "0.4.9",
+  "current": "0.5.0",
+  "latest_stable": "0.4.9",
+  "spec_version": "0.5.0",
   "spec_path": "spec/v0.5",
   "schema_file": "agent.schema.json"
 }

package/dist/adapters/claude-code/adapter.js

@@ -325,8 +325,8 @@ fi`)
 
 # Delegate to OSSA CLI when available (set OSSA_MANIFEST to manifest path)
 if command -v ossa >/dev/null 2>&1 && [[ -n "\${OSSA_MANIFEST:-}" ]]; then
-  ossa run "\${OSSA_MANIFEST}" --tool ${tool.name} -- "\$@"
-  exit \$?
+  ossa run "\${OSSA_MANIFEST}" --tool ${tool.name} -- "$@"
+  exit $?
 fi
 
 # Fallback: output structured result

package/dist/adapters/docker/generators.js

@@ -438,18 +438,18 @@ set -e
 echo "Starting ${agentName}..."
 
 # Wait for dependencies
-if [ -n "\$POSTGRES_HOST" ]; then
+if [ -n "$POSTGRES_HOST" ]; then
   echo "Waiting for PostgreSQL..."
-  until nc -z "\$POSTGRES_HOST" "\${POSTGRES_PORT:-5432}"; do
+  until nc -z "$POSTGRES_HOST" "\${POSTGRES_PORT:-5432}"; do
     echo "PostgreSQL is unavailable - sleeping"
     sleep 1
   done
   echo "PostgreSQL is up"
 fi
 
-if [ -n "\$REDIS_HOST" ]; then
+if [ -n "$REDIS_HOST" ]; then
   echo "Waiting for Redis..."
-  until nc -z "\$REDIS_HOST" "\${REDIS_PORT:-6379}"; do
+  until nc -z "$REDIS_HOST" "\${REDIS_PORT:-6379}"; do
     echo "Redis is unavailable - sleeping"
     sleep 1
   done
@@ -464,7 +464,7 @@ fi
 
 # Execute the main command
 echo "Starting application..."
-exec "\$@"
+exec "$@"
 `;
     }
     /**
@@ -484,13 +484,13 @@ if ! pgrep -f "node" > /dev/null; then
 fi
 
 # Check HTTP health endpoint
-response=\$(curl -s -o /dev/null -w "%{http_code}" http://localhost:${port}/health || echo "000")
+response=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:${port}/health || echo "000")
 
-if [ "\$response" = "200" ]; then
+if [ "$response" = "200" ]; then
   echo "Health check passed"
   exit 0
 else
-  echo "Health check failed with status: \$response"
+  echo "Health check failed with status: $response"
   exit 1
 fi
 `;
@@ -523,7 +523,7 @@ docker build \\
 
 echo "✓ Build complete"
 echo "  Image: \${IMAGE_NAME}:\${VERSION}"
-echo "  Size: \$(docker images \${IMAGE_NAME}:\${VERSION} --format "{{.Size}}")"
+echo "  Size: $(docker images \${IMAGE_NAME}:\${VERSION} --format "{{.Size}}")"
 `;
     }
     /**
@@ -540,7 +540,7 @@ IMAGE_NAME="${agentName}"
 VERSION=\${VERSION:-latest}
 REGISTRY=\${REGISTRY:-docker.io}
 
-if [ -z "\$REGISTRY" ]; then
+if [ -z "$REGISTRY" ]; then
   echo "Error: REGISTRY environment variable is required"
   exit 1
 fi
@@ -709,9 +709,9 @@ http {
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
-    log_format main '\$remote_addr - \$remote_user [\$time_local] "\$request" '
-                    '\$status \$body_bytes_sent "\$http_referer" '
-                    '"\$http_user_agent" "\$http_x_forwarded_for"';
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
 
     access_log /var/log/nginx/access.log main;
 
@@ -728,7 +728,7 @@ http {
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
 
     # Rate limiting
-    limit_req_zone \$binary_remote_addr zone=api_limit:10m rate=10r/s;
+    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
 
     upstream agent_backend {
         least_conn;
@@ -756,12 +756,12 @@ http {
 
             proxy_pass http://agent_backend;
             proxy_http_version 1.1;
-            proxy_set_header Upgrade \$http_upgrade;
+            proxy_set_header Upgrade $http_upgrade;
             proxy_set_header Connection "upgrade";
-            proxy_set_header Host \$host;
-            proxy_set_header X-Real-IP \$remote_addr;
-            proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto \$scheme;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
 
             # Timeouts
             proxy_connect_timeout 60;