@bluefly/openstandardagents 0.4.9 → 0.5.1

package/.version.json

@@ -1,7 +1,7 @@
 {
-  "current": "0.4.9",
-  "latest_stable": "0.4.8",
-  "spec_version": "0.4.9",
+  "current": "0.5.1",
+  "latest_stable": "0.5.1",
+  "spec_version": "0.5.1",
   "spec_path": "spec/v0.5",
   "schema_file": "agent.schema.json"
 }

package/CHANGELOG.md

@@ -7,6 +7,37 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.1] - 2026-03-21
+
+### Added
+- **Memory Hierarchy (P5)**: Three-tier memory contracts (`spec/v0.5/memory-hierarchy.yaml`) — working, episodic, and long-term layers with promotion rules
+- **`ossa memory` CLI subcommand**: `init`, `index`, `resolve`, `promote` — wire agents to the three-tier memory spec
+- **Execution Economics (Layer 4)**: `ExecutionProfile`, `ContextPack`, and `ReplayPacket` schemas for portable execution intent and cost-aware agent design
+- **Reasoning Escrow**: Cryptographic hash of reasoning traces via the AI SDK v6 `ToolLoopAgent` — auditable yet private agent decisions
+- **StateMesh Integration**: Agents publish `StateClaims` (Evidence/Intent) to the mesh during runtime; governed state exchange via `extensions.statemesh`
+- **AI SDK v6 Loop**: Native `ToolLoopAgent` in the production `OpenAIAdapter`; `@ai-sdk/anthropic` and `@ai-sdk/google` adapters added
+- **DUADP Trust Tiers**: Native four-tier model (Official → Verified → Community → Unverified) wired into discovery and GKG Matchmaker
+- **Agent Builder API**: `/api/agent-builder` route replaces deprecated `/api/v1/wizard`; `apiVersion >= ossa/v0.5.0` enforced at scaffold time
+- **CAOE cognition types**: `session`, `hypothesis`, and `alignment gate` JSON schema extensions (`spec/v0.5/extensions/cognition/`)
+- **`kind: Role` manifest**: Declarative role-based agent identity (`spec/v0.5/role.schema.json`)
+- **Agent Builder OpenAPI spec**: `spec/v0.5/agent-builder-openapi.yaml` — frozen builder contract
+- **Registry API v0.5.1**: `spec/registry/openapi.yaml` bumped; `agent-crud` generated types updated
+- **Skills CLI (6 commands)**: `ossa skills research | generate | export | list | validate | sync` — full skills pipeline production-ready; 19 tests, 100% passing
+- **5 new skills plugin files**: `database-migration`, `chaos-engineering`, `performance-profiling`, `compliance-auditing`, `incident-response`
+- **`ossa execution-profile validate`**, **`ossa context-pack build`**, **`ossa task quote`** CLI commands
+
+### Changed
+- `uuid` dependency: `^11.0.5` → `^11.1.0` (platform `dependency_standards` compliance)
+- `@modelcontextprotocol/sdk`: aligned to `^1.26.0`
+- MCP DI services wired: `ossa_validate` and `ossa_publish` connected to dependency injection
+- Open-source publication: removed all internal paths, private domains, and platform-specific references
+
+### Fixed
+- Test framework: 3 test files using `vitest` in Jest runner corrected to `@jest/globals`; 76/76 suites, 1305 tests, 0 failures
+- `OssaApiVersionSchema`: union accepts `ossa/v0.5.0` and `ossa/v0.3.2` for migration compatibility
+- Registry and agent-crud OpenAPI versions bumped `0.3.3` → `0.5.1`
+- `undici` vulnerability overrides applied; `postgres` password parameterized in Docker generator
+
 ## [0.5.0] - 2026-03-08
 
 ### Added
@@ -500,7 +531,7 @@ Complete agent registration infrastructure enabling global agent discovery, veri
 - HTTP client for registry API integration (248 lines)
 - Axios-based with TypeScript types
 - Methods: `registerAgent()`, `discoverAgents()`, `verifyAgent()`, `getAgentCard()`
-- Configurable base URL (default: https://mesh.blueflyagents.com)
+- Configurable base URL (default: https://mesh.bluefly.internal)
 - Comprehensive error handling
 - Exported from index.ts for SDK consumption
 
@@ -511,7 +542,7 @@ Complete agent registration infrastructure enabling global agent discovery, veri
   - Organization name for GAID (default: blueflyio)
   - Serial number prefix (default: AG)
   - 📡 Register agent to platform registry? (default: no)
-  - Registry API URL (default: https://mesh.blueflyagents.com)
+  - Registry API URL (default: https://mesh.bluefly.internal)
 - Serial number format: `{PREFIX}-{TIMESTAMP}-{RANDOM}`
   - Example: `AG-1K2L3M-4N5P`
   - Unique, time-sortable, URL-safe
@@ -524,7 +555,7 @@ Complete agent registration infrastructure enabling global agent discovery, veri
       ossa.org/organization: blueflyio
       ossa.org/registered-at: 2026-02-06T...
       ossa.org/registered: "true"
-      ossa.org/registry-url: https://mesh.blueflyagents.com
+      ossa.org/registry-url: https://mesh.bluefly.internal
       ossa.org/signature: sha256:abc...
   ```
 - GAID info file: Saves `.gaid.json` with registration metadata
@@ -655,7 +686,7 @@ ossa validate creative-agent-naming.ossa.yaml
 ossa generate-gaid creative-agent-naming.ossa.yaml --org blueflyio
 
 # Register to platform
-ossa register creative-agent-naming.ossa.yaml --registry https://mesh.blueflyagents.com
+ossa register creative-agent-naming.ossa.yaml --registry https://mesh.bluefly.internal
 
 # Discover agents
 ossa discover --capability compliance-audit

package/README.md

@@ -1,7 +1,7 @@
 # OSSA - Open Standard for Software Agents
 
-> **Development happens on [GitLab](https://gitlab.com/blueflyio/ossa/openstandardagents).** This repo is a read-only mirror.
-> [Source](https://gitlab.com/blueflyio/ossa/openstandardagents) | [Issues](https://gitlab.com/blueflyio/ossa/openstandardagents/-/issues) | [npm](https://www.npmjs.com/package/@bluefly/openstandardagents)
+> **Source of truth**: [GitLab](https://gitlab.com/blueflyio/ossa/openstandardagents) — development, issues, and CI happen here.
+> [GitLab](https://gitlab.com/blueflyio/ossa/openstandardagents) | [Issues](https://gitlab.com/blueflyio/ossa/openstandardagents/-/issues) | [npm](https://www.npmjs.com/package/@bluefly/openstandardagents)
 
 **The infrastructure bridge between agent protocols and deployment platforms.**
 
@@ -14,63 +14,78 @@ OSSA is not a protocol (like MCP or A2A) and not a framework (like LangChain or
 - **Builds on A2A** - Supports A2A messaging and agent-to-agent communication
 - **Extends protocols** - Adds deployment and packaging layer on top of communication protocols
 
-## 🇺🇸 NIST CAISI RFI Alignment (NIST-2025-0035)
+## Why OSSA + DUADP
 
-OSSA natively aligns with the [NIST CAISI Request for Information on Collaborative AI Systems Integration](https://www.regulations.gov/docket/NIST-2025-0035), providing the critical **Contract Layer** missing from current agent protocols.
-
-- **Agent Identity (IA-3)**: W3C Decentralized Identifiers (GAID) provide cryptographic origin authentication for agents.
-- **Pre-Authorization (AC-3, AC-6)**: Deterministic AWS Cedar policies evaluated at the transport layer enforce zero-trust bounds before an LLM receives context.
-- **Federated Discovery**: Integration with DUADP (`.well-known` endpoints) scales agent discovery securely across organizational boundaries without centralized lock-in.
-- **Supply Chain Security (SI-7)**: Cryptographically signed manifests (`x-signature`) and explicit OSCAL/SBOM pointers prevent tool poisoning and supply chain attacks.
-
-## What's New
+AI agents need the same foundational infrastructure the internet has: **identity**, **discovery**, and **governance**. OSSA and DUADP together deliver that stack:
 
-### AgentScope Integration (v0.4.8)
+```
+┌──────────────────────────────────────────────────────────────┐
+│  Layer 1 — IDENTITY  (this repo)                             │
+│  OSSA (Open Standard for Software Agents)                    │
+│  openstandardagents.org                                      │
+│                                                              │
+│  · Agent DID — W3C decentralized identity per agent          │
+│  · Signed manifests — cryptographic provenance + SBOM        │
+│  · Cedar policies — zero-trust authorization bounds          │
+│  · NIST SP 800-53 control mapping built in                   │
+└─────────────────────┬────────────────────────────────────────┘
+                      │  secure identity
+                      ▼
+┌──────────────────────────────────────────────────────────────┐
+│  Layer 2 — DISCOVERY                                         │
+│  DUADP (Decentralized Universal AI Discovery Protocol)       │
+│  duadp.org | npm install @bluefly/duadp                      │
+│                                                              │
+│  · Federated DNS + WebFinger agent discovery                 │
+│  · Cross-node gossip federation                              │
+│  · Policy-aware capability routing                           │
+│  · Trust-tier gating (community → verified → federal)        │
+└─────────────────────┬────────────────────────────────────────┘
+                      │  policy-filtered
+                      ▼
+┌──────────────────────────────────────────────────────────────┐
+│  Layer 3 — EXECUTION                                         │
+│  Your runtime: Kubernetes, Claude, LangChain, Drupal, etc.   │
+└──────────────────────────────────────────────────────────────┘
+```
 
-- **New agent framework**: `agentscope` — Alibaba's production-ready Python agent framework (Apache 2.0, 17.8k stars) now supported as an OSSA agent type
-- **Python adapter**: Full OSSA-to-AgentScope bridge — reads OSSA manifests, instantiates ReActAgent with MCP tools, A2A protocol, memory backends (Mem0, Redis, ReMe)
-- **MCP server wrapper**: Expose any AgentScope agent as an MCP server for Claude Code, Cursor, VS Code
-- **A2A endpoint**: Serve AgentScope agents as discoverable A2A protocol endpoints with `.well-known/agent.json`
-- **Drupal module**: `ai_agents_agentscope` — contrib-first AiProvider plugin bridging AgentScope into Drupal's AI Agents ecosystem
-- **Docker support**: Dockerfile + docker-compose for containerized AgentScope runtime
-- **CLI**: `ossa-agentscope run|validate|serve` commands for manifest-driven agent execution
-- **Unique capabilities** not available in other frameworks: RL-based agent training, realtime voice agents, built-in evaluation framework
-- **Schema**: `extensions.agentscope` block in v0.4 and v0.5 specs with agent_class, capabilities, memory_backend, orchestration, formatter, compression, skill_dirs
+**OSSA defines the agent. DUADP discovers it.**
 
-### OpenAI Agents SDK Export (2026-02-16)
+| Security requirement | OSSA | DUADP |
+|---|---|---|
+| Agent identity & authentication | W3C DID (GAID) per agent | DID-verified nodes |
+| Authorization & least-privilege | AWS Cedar policies in manifest | Trust-tier gating |
+| Governance & human oversight | Signed manifests + OSCAL pointers | Audit log + attestation API |
+| Cross-system interoperability | Multi-platform exports | Federated gossip discovery |
+| Monitoring & incident response | Observability config in spec | Revocation + incident endpoints |
+| Supply chain security | `x-signature` + SBOM | Signed resource registry |
 
-- **New export platform**: `openai-agents-sdk` (22nd platform) — generates runnable `@openai/agents` TypeScript packages from OSSA manifests
-- Maps OSSA `spec.personality` to agent instructions, `spec.llm` to model selection, `spec.tools` to function tools, `spec.mcp` to MCPServerStreamableHttp connections, `spec.safety` to guardrails
-- Generates: `agent.ts`, `mcp-config.ts`, `guardrails.ts`, `run.ts`, `package.json`, `tsconfig.json`
-- Usage: `ossa export --platform openai-agents-sdk agent.ossa.yaml`
-- New OSSA extension blocks planned: `openai_agents_sdk`, `openai_responses_api`, `openai_realtime`, `openai_deep_research`
-- Supports defining agents once and exporting to both Claude and OpenAI platforms
+> [openstandardagents.org/specification →](https://openstandardagents.org/specification) | [duadp.org →](https://duadp.org)
 
-### Multi-Agent Team Topology (2026-02-17)
+## NIST CAISI Alignment (NIST-2025-0035)
 
-- **Team definitions** (`spec.team`): Define coordinated multi-agent teams with 4 team models — lead-teammate, peer-to-peer, hierarchical, swarm
-- **Subagent definitions** (`spec.subagents`): Parent-child delegation hierarchies with role-based agents (worker, specialist, reviewer, debugger)
-- **8 architecture patterns**: single, swarm, pipeline, graph, hierarchical, reactive, cognitive, lead-teammate
-- **Team code generation**: Export team topology to CrewAI (Python), OpenAI Agents SDK (TypeScript), Claude Code (markdown), and npm (TypeScript)
-- **`--perfect-agent` CLI flag**: Generate a complete production bundle — AGENTS.md, team scaffolding, CLEAR eval stubs, governance config, observability config, and agent card
-- **Team-aware AGENTS.md**: Auto-generated documentation with team topology tables, member roles, coordination strategy, and hierarchy diagrams
-- **5 new export platforms**: `openai-agents-sdk` (beta), `a2a` (alpha), `claude-skills` (beta), `mobile-agent` (alpha), `symfony` (alpha) — bringing total to 22
+If you're evaluating OSSA/DUADP for federal or regulated deployments, see the detailed alignment documentation:
 
-### v0.4.6 (2026-02-19)
+OSSA natively aligns with the [NIST CAISI Request for Information on Collaborative AI Systems Integration](https://www.regulations.gov/docket/NIST-2025-0035), providing the critical **Contract Layer** missing from current agent protocols.
 
-**Version Update**:
-- Updated all version references from 0.4.5 to 0.4.6
-- Package version bumped to 0.4.6
+- **Agent Identity (IA-3)**: W3C Decentralized Identifiers (GAID) provide cryptographic origin authentication for agents.
+- **Pre-Authorization (AC-3, AC-6)**: Deterministic AWS Cedar policies evaluated at the transport layer enforce zero-trust bounds before an LLM receives context.
+- **Federated Discovery**: Integration with DUADP (`.well-known` endpoints) scales agent discovery securely across organizational boundaries without centralized lock-in.
+- **Supply Chain Security (SI-7)**: Cryptographically signed manifests (`x-signature`) and explicit OSCAL/SBOM pointers prevent tool poisoning and supply chain attacks.
 
-### v0.4.5 (2026-02-10)
+## What's New in v0.5.1
 
-**Major Cleanup & Foundation Improvements**:
-- 16,574 LOC removed - 47% codebase reduction (35,425 to 18,851 LOC)
-- SDK Migration - Anthropic adapter now uses official `@anthropic-ai/sdk` (513 LOC removed, 25.8% reduction)
-- Complete Skills Pipeline - Research, generate, export, validate, sync Claude Skills
-- Zero Build Errors - Fixed all TypeScript errors, 100% passing tests
-- DRY Improvements - Eliminated 99 LOC duplication via BasePackageGenerator
-- 19 New Tests - Skills pipeline fully tested (100% passing)
+- **Memory Hierarchy (P5)**: Three-tier memory contracts (working → episodic → long-term) with `ossa memory init|index|resolve|promote` CLI.
+- **Execution Economics (Layer 4)**: `ExecutionProfile`, `ContextPack`, `ReplayPacket` schemas; `ossa execution-profile validate`, `ossa context-pack build`, `ossa task quote`.
+- **StateMesh Integration**: Agents publish `StateClaims` to the mesh at runtime; governed state exchange via `extensions.statemesh`.
+- **Reasoning Escrow**: Cryptographic hashing of reasoning traces in the AI SDK v6 `ToolLoopAgent` — auditable yet private.
+- **AI SDK v6 Loop**: Native `ToolLoopAgent` in `OpenAIAdapter`; `@ai-sdk/anthropic` and `@ai-sdk/google` adapters added.
+- **DUADP Trust Tiers**: Native four-tier trust model (Official → Verified → Community → Unverified) wired into discovery.
+- **Agent Builder API**: `/api/agent-builder` canonical route; `apiVersion >= ossa/v0.5.0` enforced at scaffold time.
+- **CAOE cognition types**: `session`, `hypothesis`, `alignment gate` JSON schema extensions + `kind: Role` manifest.
+- **Skills Pipeline (6 commands)**: `ossa skills research|generate|export|list|validate|sync` — production-ready, 19 tests passing.
+- **5 new skill plugins**: `database-migration`, `chaos-engineering`, `performance-profiling`, `compliance-auditing`, `incident-response`.
+- **Dependency compliance**: `uuid ^11.1.0`, `@modelcontextprotocol/sdk ^1.26.0`.
 
 See [CHANGELOG.md](./CHANGELOG.md) for complete details.
 
@@ -288,7 +303,7 @@ Upgrade manifests to the latest spec version:
 
 ```bash
 # Migrate from older version to current
-ossa migrate agent.ossa.yaml --to 0.4.6
+ossa migrate agent.ossa.yaml --to 0.5.1
 
 # List available migration paths
 ossa migrate --list
@@ -315,9 +330,9 @@ if (result.valid) {
 }
 ```
 
-## Production Status (v0.4.6)
+## Production Status (v0.5.1)
 
-### ✅ Production-Ready (Tested & Documented)
+### Production-Ready (Tested & Documented)
 
 **Core CLI Commands**:
 - `ossa validate` - Validate manifests against JSON Schema
@@ -327,13 +342,13 @@ if (result.valid) {
 - `ossa migrate` - Migrate between spec versions
 - `ossa generate-gaid` - Global Agent ID generation
 
-**Production Platform Exports** (4 production, 8 beta, 10 alpha — 22 total):
+**Production Platform Exports** (see `ossa export --list-platforms` for the live matrix):
 - `langchain` (production) - Python + TypeScript agents (uses @langchain/* SDK v0.3+)
 - `mcp` (production) - MCP server for Claude Code (uses @modelcontextprotocol/sdk v1.0+)
 - `npm` (production) - TypeScript package with manifest
 - `agent-skills` (production) - SKILL.md for Claude Code
 
-**Skills Pipeline** (✅ Complete in v0.4.6):
+**Skills Pipeline** (Current in v0.5.1):
 - `ossa skills research` - Index skills from curated sources (cached locally at ~/.ossa/skills-index.json)
 - `ossa skills generate` - Auto-detects input format (OSSA, Oracle Agent Spec, AGENTS.md)
 - `ossa skills export` - Package as npm, install to ~/.claude/skills/, publish to registry
@@ -347,12 +362,12 @@ if (result.valid) {
 - Type definitions (`@bluefly/openstandardagents/types`)
 - JSON Schema access (`@bluefly/openstandardagents/schema`)
 
-### 🚧 Beta (Functional but needs testing)
+### Beta (Functional but needs testing)
 
 - `ossa agents-local` - Local `.agents/` folder management
 - `ossa agents-md` - Generate, validate, sync [agents.md](https://agents.md) files (standard: [agentsmd/agents.md](https://github.com/agentsmd/agents.md)); customize via wizard step or `ossa agents-md generate|validate|sync`
 - Export to: `crewai`, `drupal`, `claude-code`, `cursor`, `warp`, `anthropic`
-- Anthropic runtime adapter uses official `@anthropic-ai/sdk` (v0.4.6 improvement: 513 LOC removed)
+- Anthropic runtime adapter uses official `@anthropic-ai/sdk`
 
 ### GitLab Agent Examples (Fully Implemented)
 
@@ -396,7 +411,7 @@ OSSA complements MCP and A2A by adding the packaging and deployment layer they d
 ### Manifest Format
 
 ```yaml
-apiVersion: ossa/v0.4.6
+apiVersion: ossa/v0.5.1
 kind: Agent
 metadata:
   name: code-reviewer
@@ -423,7 +438,7 @@ spec:
 #### Team Manifest Example
 
 ```yaml
-apiVersion: ossa/v0.4.6
+apiVersion: ossa/v0.5.1
 kind: Agent
 metadata:
   name: dev-team
@@ -517,7 +532,7 @@ import { validateManifest } from '@bluefly/openstandardagents/validation';
 import type { OssaAgent } from '@bluefly/openstandardagents/types';
 
 const agent: OssaAgent = {
-  apiVersion: 'ossa/v0.4.6',
+  apiVersion: 'ossa/v0.5.1',
   kind: 'Agent',
   metadata: { name: 'creative-agent-naming', version: '1.0.0' },
   spec: {
@@ -532,7 +547,7 @@ if (result.valid) console.log('Valid manifest');
 
 ## Spec Features
 
-The OSSA v0.4 schema supports these optional sections:
+The OSSA v0.5.0 schema supports these optional sections:
 
 - **LLM Configuration** - Provider, model, temperature, max tokens, caching
 - **Tools** - Named tools with input schemas
@@ -563,7 +578,7 @@ OSSA is designed to work **alongside** existing agent protocols, not replace the
 **Example**: An OSSA manifest can declare that an agent uses MCP tools and A2A messaging, then export that configuration to Docker, Kubernetes, or LangChain deployment packages.
 
 ```yaml
-apiVersion: ossa/v0.4.6
+apiVersion: ossa/v0.5.1
 kind: Agent
 metadata:
   name: code-reviewer
@@ -617,7 +632,7 @@ ossa export agent.ossa.yaml --platform docker --output ./docker-deploy
 ossa export --list-platforms
 ossa lint agent.ossa.yaml
 ossa diff old.ossa.yaml new.ossa.yaml
-ossa migrate agent.ossa.yaml --to 0.4.6
+ossa migrate agent.ossa.yaml --to 0.5.1
 ossa generate-gaid agent.ossa.yaml
 ossa export agent.ossa.yaml --perfect-agent
 ossa export agent.ossa.yaml --include-agents-md --include-team --include-evals
@@ -705,7 +720,7 @@ All mutation commands support:
 - [Agents workspace and registry](./docs/getting-started/agents-workspace-registry.md) - `.agents-workspace/` layout, sources, MCP/A2A
 - [CHANGELOG](./CHANGELOG.md) - Release history
 - [Examples](./examples) - Sample manifests
-- [JSON Schema](./spec/v0.4/agent.schema.json) - Full spec
+- [JSON Schema](./spec/v0.5/agent.schema.json) - Full spec
 - [GitLab](https://gitlab.com/blueflyio/ossa/openstandardagents) - Source
 - [GitHub Mirror](https://github.com/blueflyio/openstandardagents)
 

package/dist/.version.json

@@ -1,7 +1,7 @@
 {
-  "current": "0.4.9",
-  "latest_stable": "0.4.8",
-  "spec_version": "0.4.9",
+  "current": "0.5.1",
+  "latest_stable": "0.5.1",
+  "spec_version": "0.5.1",
   "spec_path": "spec/v0.5",
   "schema_file": "agent.schema.json"
 }

package/dist/adapters/a2a/a2a-protocol.js

@@ -11,6 +11,7 @@
  * @module adapters/a2a/a2a-protocol
  */
 import { z } from 'zod';
+import { trace } from '@opentelemetry/api';
 /**
  * Message Priority Levels
  */
@@ -203,8 +204,9 @@ export function validateA2AMessage(message) {
  */
 export function createA2AMessage(from, to, type, payload, options) {
     const now = new Date().toISOString();
-    const traceId = generateTraceId();
-    const spanId = generateSpanId();
+    const activeSpan = trace.getActiveSpan();
+    const traceId = activeSpan?.spanContext().traceId ?? generateTraceId();
+    const spanId = activeSpan?.spanContext().spanId ?? generateSpanId();
     return {
         id: crypto.randomUUID(),
         from,

package/dist/adapters/a2a/a2a-tool.js

@@ -5,6 +5,7 @@
  *
  * @module adapters/a2a/a2a-tool
  */
+import { trace } from '@opentelemetry/api';
 /**
  * A2A Tool Definition
  * Tool for agent-to-agent communication using MCP protocol
@@ -280,8 +281,9 @@ export class A2AToolHandler {
         return mapping[pattern] || 'request';
     }
     createTraceContext() {
-        const traceId = this.generateHex(32);
-        const spanId = this.generateHex(16);
+        const activeSpan = trace.getActiveSpan();
+        const traceId = activeSpan?.spanContext().traceId ?? this.generateHex(32);
+        const spanId = activeSpan?.spanContext().spanId ?? this.generateHex(16);
         return {
             traceparent: `00-${traceId}-${spanId}-01`,
             traceId,

package/dist/adapters/a2a/mcp-integration.d.ts

@@ -239,7 +239,8 @@ export declare class MCPIntegrationService {
      */
     private mapMCPTypeToA2A;
     /**
-     * Create trace context
+     * Create trace context — prefers active OTel span so outbound messages
+     * carry the same traceId as the surrounding span tree.
      */
     private createTraceContext;
     /**

package/dist/adapters/a2a/mcp-integration.js

@@ -11,6 +11,7 @@
  *
  * @module adapters/a2a/mcp-integration
  */
+import { trace } from '@opentelemetry/api';
 import { MCPTransportManager } from './mcp-transport.js';
 /**
  * MCP Protocol Version
@@ -295,11 +296,13 @@ export class MCPIntegrationService {
         return mapping[method] || 'event';
     }
     /**
-     * Create trace context
+     * Create trace context — prefers active OTel span so outbound messages
+     * carry the same traceId as the surrounding span tree.
      */
     createTraceContext() {
-        const traceId = this.generateHex(32);
-        const spanId = this.generateHex(16);
+        const activeSpan = trace.getActiveSpan();
+        const traceId = activeSpan?.spanContext().traceId ?? this.generateHex(32);
+        const spanId = activeSpan?.spanContext().spanId ?? this.generateHex(16);
         return {
             traceparent: `00-${traceId}-${spanId}-01`,
             traceId,

package/dist/adapters/browser/browser-exporter.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Browser Exporter — Generate browser automation config from OSSA manifests.
+ *
+ * When an agent has browser capabilities, this generates the agent-browser
+ * configuration and startup scripts.
+ */
+import type { OssaAgent } from '../../types/index.js';
+export interface BrowserExportResult {
+    files: Array<{
+        path: string;
+        content: string;
+    }>;
+    command: string;
+}
+export declare class BrowserExporter {
+    /**
+     * Export OSSA agent as a browser automation agent.
+     * Generates agent-browser config and launch scripts.
+     */
+    export(manifest: OssaAgent): BrowserExportResult;
+    /**
+     * Check if an OSSA manifest declares browser capabilities.
+     */
+    hasBrowserCapability(manifest: OssaAgent): boolean;
+}
+//# sourceMappingURL=browser-exporter.d.ts.map

package/dist/adapters/browser/browser-exporter.js

@@ -0,0 +1,73 @@
+/**
+ * Browser Exporter — Generate browser automation config from OSSA manifests.
+ *
+ * When an agent has browser capabilities, this generates the agent-browser
+ * configuration and startup scripts.
+ */
+export class BrowserExporter {
+    /**
+     * Export OSSA agent as a browser automation agent.
+     * Generates agent-browser config and launch scripts.
+     */
+    export(manifest) {
+        const name = manifest.metadata?.name || 'ossa-browser-agent';
+        const headless = true;
+        const launchScript = [
+            '#!/bin/bash',
+            `# Browser agent: ${name}`,
+            `# Generated by ossa export --format=browser-agent`,
+            '',
+            '# Start agent-browser in headless mode',
+            `npx agent-browser --headless=${headless} \\`,
+            `  --url="\${BASE_URL:-http://localhost:3000}" \\`,
+            '  --timeout=30000 \\',
+            '  --screenshot-on-error',
+            '',
+        ].join('\n');
+        const dockerService = {
+            [`${name}-browser`]: {
+                image: 'ghcr.io/nicepkg/agent-browser:latest',
+                environment: {
+                    HEADLESS: 'true',
+                    BASE_URL: '${BASE_URL:-http://localhost:3000}',
+                },
+                ports: ['9222:9222'],
+                restart: 'unless-stopped',
+            },
+        };
+        const dockerCompose = `# Browser automation service for ${name}
+# Add to your docker-compose.yml services section
+services:
+  ${name}-browser:
+    image: ghcr.io/nicepkg/agent-browser:latest
+    environment:
+      - HEADLESS=true
+      - BASE_URL=\${BASE_URL:-http://localhost:3000}
+    ports:
+      - "9222:9222"
+    restart: unless-stopped
+`;
+        return {
+            files: [
+                { path: 'scripts/browser-agent.sh', content: launchScript },
+                { path: 'docker-compose.browser.yml', content: dockerCompose },
+            ],
+            command: `npx agent-browser --headless`,
+        };
+    }
+    /**
+     * Check if an OSSA manifest declares browser capabilities.
+     */
+    hasBrowserCapability(manifest) {
+        const tools = manifest.spec?.tools || [];
+        const toolNames = tools.map((t) => typeof t === 'string' ? t : typeof t === 'object' && t !== null ? t.name || '' : '').join(' ').toLowerCase();
+        const role = (manifest.spec?.role || '').toLowerCase();
+        return (toolNames.includes('browser') ||
+            toolNames.includes('playwright') ||
+            toolNames.includes('cdp') ||
+            toolNames.includes('web-scrape') ||
+            role.includes('browser') ||
+            role.includes('scraper'));
+    }
+}
+//# sourceMappingURL=browser-exporter.js.map

package/dist/adapters/browser/browser-runner.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Browser Test Runner — Run agent acceptance tests in headless Chrome.
+ *
+ * Uses agent-browser CLI for CDP-based browser automation.
+ * Replaces custom Playwright bootstrapping for agent testing.
+ */
+export interface BrowserTestResult {
+    passed: boolean;
+    output: string;
+    error?: string;
+    duration: number;
+}
+export declare class BrowserTestRunner {
+    /**
+     * Run a browser-based test using agent-browser.
+     */
+    run(url: string, options?: {
+        timeout?: number;
+        headless?: boolean;
+        screenshotOnError?: boolean;
+    }): Promise<BrowserTestResult>;
+}
+//# sourceMappingURL=browser-runner.d.ts.map

package/dist/adapters/browser/browser-runner.js

@@ -0,0 +1,46 @@
+/**
+ * Browser Test Runner — Run agent acceptance tests in headless Chrome.
+ *
+ * Uses agent-browser CLI for CDP-based browser automation.
+ * Replaces custom Playwright bootstrapping for agent testing.
+ */
+import { execFile } from 'child_process';
+import { promisify } from 'util';
+const execFileAsync = promisify(execFile);
+export class BrowserTestRunner {
+    /**
+     * Run a browser-based test using agent-browser.
+     */
+    async run(url, options = {}) {
+        const startTime = Date.now();
+        const args = [
+            'agent-browser',
+            `--url=${url}`,
+            `--headless=${options.headless !== false}`,
+            `--timeout=${options.timeout || 30000}`,
+        ];
+        if (options.screenshotOnError) {
+            args.push('--screenshot-on-error');
+        }
+        try {
+            const result = await execFileAsync('npx', args, {
+                timeout: (options.timeout || 30000) + 5000,
+            });
+            return {
+                passed: true,
+                output: result.stdout,
+                duration: Date.now() - startTime,
+            };
+        }
+        catch (error) {
+            const err = error;
+            return {
+                passed: false,
+                output: err.stdout || '',
+                error: err.stderr || err.message || 'Unknown error',
+                duration: Date.now() - startTime,
+            };
+        }
+    }
+}
+//# sourceMappingURL=browser-runner.js.map

package/dist/adapters/browser/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Browser Adapter — Export OSSA agents as browser automation agents
+ * and run browser-based acceptance tests using agent-browser.
+ *
+ * agent-browser provides headless Chrome via CDP with zero dependencies.
+ */
+export { BrowserExporter } from './browser-exporter.js';
+export { BrowserTestRunner } from './browser-runner.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/browser/index.js

@@ -0,0 +1,9 @@
+/**
+ * Browser Adapter — Export OSSA agents as browser automation agents
+ * and run browser-based acceptance tests using agent-browser.
+ *
+ * agent-browser provides headless Chrome via CDP with zero dependencies.
+ */
+export { BrowserExporter } from './browser-exporter.js';
+export { BrowserTestRunner } from './browser-runner.js';
+//# sourceMappingURL=index.js.map

package/dist/adapters/claude-code/adapter.js

@@ -325,8 +325,8 @@ fi`)
 
 # Delegate to OSSA CLI when available (set OSSA_MANIFEST to manifest path)
 if command -v ossa >/dev/null 2>&1 && [[ -n "\${OSSA_MANIFEST:-}" ]]; then
-  ossa run "\${OSSA_MANIFEST}" --tool ${tool.name} -- "\$@"
-  exit \$?
+  ossa run "\${OSSA_MANIFEST}" --tool ${tool.name} -- "$@"
+  exit $?
 fi
 
 # Fallback: output structured result