git-a2a 1.3.2 → 1.4.0-rc.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "git-a2a",
3
- "version": "1.3.2",
3
+ "version": "1.4.0-rc.2",
4
4
  "description": "Import git modules together with their owning agents",
5
5
  "mcpName": "io.github.neprel/git-a2a",
6
6
  "license": "MIT",
@@ -19,11 +19,11 @@
19
19
  "skills/"
20
20
  ],
21
21
  "optionalDependencies": {
22
- "@git-a2a/darwin-amd64": "1.3.2",
23
- "@git-a2a/darwin-arm64": "1.3.2",
24
- "@git-a2a/linux-amd64": "1.3.2",
25
- "@git-a2a/linux-arm64": "1.3.2",
26
- "@git-a2a/windows-amd64": "1.3.2",
27
- "@git-a2a/windows-arm64": "1.3.2"
22
+ "@git-a2a/darwin-amd64": "1.4.0-rc.2",
23
+ "@git-a2a/darwin-arm64": "1.4.0-rc.2",
24
+ "@git-a2a/linux-amd64": "1.4.0-rc.2",
25
+ "@git-a2a/linux-arm64": "1.4.0-rc.2",
26
+ "@git-a2a/windows-amd64": "1.4.0-rc.2",
27
+ "@git-a2a/windows-arm64": "1.4.0-rc.2"
28
28
  }
29
29
  }
@@ -3,7 +3,7 @@ name: git-a2a
3
3
  description: Use git-a2a to consume or author a dependency on a Git repository together with its owner, resolve who owns a dependency, inspect or repair an AGENTS.md module roster, or edit and validate a2amodule.yml manifest.
4
4
  compatibility: requires git ≥ 2.25 and the git-a2a CLI
5
5
  metadata:
6
- version: "1.3.2"
6
+ version: "1.4.0"
7
7
  ---
8
8
 
9
9
  # git-a2a
@@ -70,7 +70,10 @@ mutation refresh an existing block.
70
70
  3. With authorization for the external side effect, put a concise request in a file and run
71
71
  `git-a2a contact ID --intent INTENT --message FILE`.
72
72
 
73
- `contact` may create an A2A task or GitHub Issue. URL, email, and chat kinds print instructions;
73
+ `contact` may create an A2A task or an issue on GitHub, GitLab, or a Gitea-family forge. Run
74
+ `git-a2a contact [ID] --list-drivers` before automation when transport availability matters.
75
+ Unknown kinds use a consumer-installed `git-a2a-contact-<kind>` plugin or print instructions;
76
+ URL, email, and chat kinds print instructions;
74
77
  do not invent delivery or store conversation state.
75
78
 
76
79
  ## Outcomes
@@ -111,9 +111,12 @@ agents:
111
111
  note: Describe the consumer, the need, and the affected languages.
112
112
  ```
113
113
 
114
- `a2a` and `github-issue` have delivery drivers. `url`, `email`, and chat kinds print an exact
115
- instruction; they do not pretend delivery occurred. The kind-specific keys and delivery behavior
116
- are listed in the [field reference](manifest-reference.md).
114
+ `a2a`, `github-issue`, `gitlab-issue`, and `gitea-issue` have built-in delivery drivers with
115
+ instruction fallback. Open kinds can use a consumer-side [contact plugin](contact-plugins.md).
116
+ Owner-described `http` and `exec` values remain instructions unless the consumer allowlists the
117
+ origin or bare binary in its own `settings.contact`; an owner declaration is never consent.
118
+ `url`, `email`, and chat kinds print an exact instruction and do not pretend delivery occurred.
119
+ The kind-specific keys and behavior are listed in the [field reference](manifest-reference.md).
117
120
 
118
121
  ## 6. State routing and the consumer boundary
119
122
 
@@ -192,16 +192,24 @@ acme-lib change → owner → library-owner
192
192
 
193
193
  ## contact
194
194
 
195
- `git-a2a contact ID --intent INTENT --message FILE|- [--wait] [--external-ok]` uses the first supported routed
196
- contact. A2A sends `SendMessage`; GitHub Issue uses `gh` then REST; URL/email/chat contacts print
197
- instructions. An owner declaration `accepts-external: false` refuses a different organisation;
195
+ `git-a2a contact [ID] [--intent INTENT --message FILE|-] [--wait] [--external-ok] [--dry-run]
196
+ [--list-drivers]` uses the first routed contact. Resolution is consumer plugin, built-in driver,
197
+ consumer-consented `http`/`exec`, then an exact instruction. GitHub, GitLab, and Gitea-family issue
198
+ drivers prefer `gh`, `glab`, or `tea`, then their REST API using consumer environment credentials;
199
+ without either they print a prefilled issue deep link. `--wait` selects A2A streaming. `--dry-run`
200
+ keeps delivery at the instruction layer. `--list-drivers` needs no message and shows the selected
201
+ layer globally or for one dependency's declared kinds. An owner declaration
202
+ `accepts-external: false` refuses a different organisation;
198
203
  only the CLI exposes `--external-ok`, so a human can explicitly approve and record the override.
199
- MCP has no bypass. Each delivery writes one record and stores no conversation state. `ask` is an
200
- alias. Exit `1` means delivery failed; exit `2` means routing/input resolved nothing.
204
+ MCP has no bypass. Each delivery writes one record including `driver=...` and stores no
205
+ conversation state. Consumer-installed kinds use the versioned [contact plugin
206
+ protocol](contact-plugins.md). Owner-described invocations never add credentials or use a shell;
207
+ MCP always refuses declared `exec`. `ask` is an alias. Exit `1` means delivery failed; exit `2`
208
+ means routing/input resolved nothing.
201
209
 
202
210
  ```text
203
211
  $ printf 'Please review the API.' | git-a2a contact acme-lib --intent review --message -
204
- acme-lib owner github-issue issue=https://github.com/acme/lib/issues/42
212
+ agent="owner" kind=github-issue id="https://github.com/acme/lib/issues/42" state=created driver=gh
205
213
  ```
206
214
 
207
215
  ## status
@@ -86,7 +86,7 @@ list, see [#dependency](../spec/_.hint). Modules this module depends on.
86
86
  - Type: string; required.
87
87
  - Default: none declared.
88
88
  - Allowed values: pattern `^[a-z0-9][a-z0-9._-]{0,63}$`.
89
- - Normative source: [`spec/_.hint:166`](../spec/_.hint#L166).
89
+ - Normative source: [`spec/_.hint:175`](../spec/_.hint#L175).
90
90
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
91
91
 
92
92
  Behavior and consequence:
@@ -101,7 +101,7 @@ breaking change for every consumer.
101
101
  - Type: string; optional.
102
102
  - Default: `module.id`.
103
103
  - Allowed values: schema type plus the normative behavior in this entry.
104
- - Normative source: [`spec/_.hint:173`](../spec/_.hint#L173).
104
+ - Normative source: [`spec/_.hint:182`](../spec/_.hint#L182).
105
105
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
106
106
 
107
107
  Behavior and consequence:
@@ -113,7 +113,7 @@ string. Display name. Defaults to `id`.
113
113
  - Type: string; optional.
114
114
  - Default: none declared.
115
115
  - Allowed values: schema type plus the normative behavior in this entry.
116
- - Normative source: [`spec/_.hint:177`](../spec/_.hint#L177).
116
+ - Normative source: [`spec/_.hint:186`](../spec/_.hint#L186).
117
117
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
118
118
 
119
119
  Behavior and consequence:
@@ -127,7 +127,7 @@ expects. Whitespace is normalised when rendered.
127
127
  - Type: array of string; optional.
128
128
  - Default: none declared.
129
129
  - Allowed values: open vocabulary; see the known-values table in this entry.
130
- - Normative source: [`spec/_.hint:183`](../spec/_.hint#L183).
130
+ - Normative source: [`spec/_.hint:192`](../spec/_.hint#L192).
131
131
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
132
132
 
133
133
  Behavior and consequence:
@@ -150,7 +150,7 @@ Known values:
150
150
  - Type: string; optional.
151
151
  - Default: none declared.
152
152
  - Allowed values: minimum length 1.
153
- - Normative source: [`spec/_.hint:189`](../spec/_.hint#L189).
153
+ - Normative source: [`spec/_.hint:198`](../spec/_.hint#L198).
154
154
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
155
155
 
156
156
  Behavior and consequence:
@@ -163,7 +163,7 @@ published beyond the manifest.
163
163
  - Type: string; optional.
164
164
  - Default: none declared.
165
165
  - Allowed values: schema type plus the normative behavior in this entry.
166
- - Normative source: [`spec/_.hint:194`](../spec/_.hint#L194).
166
+ - Normative source: [`spec/_.hint:203`](../spec/_.hint#L203).
167
167
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
168
168
 
169
169
  Behavior and consequence:
@@ -178,7 +178,7 @@ to whoever maintains the copy. Informative; never used to fetch.
178
178
  - Type: object; optional.
179
179
  - Default: none declared.
180
180
  - Allowed values: schema type plus the normative behavior in this entry.
181
- - Normative source: [`spec/_.hint:201`](../spec/_.hint#L201).
181
+ - Normative source: [`spec/_.hint:210`](../spec/_.hint#L210).
182
182
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
183
183
 
184
184
  Behavior and consequence:
@@ -193,7 +193,7 @@ source silently.
193
193
  - Type: string; optional.
194
194
  - Default: none declared.
195
195
  - Allowed values: schema type plus the normative behavior in this entry.
196
- - Normative source: [`spec/_.hint:208`](../spec/_.hint#L208).
196
+ - Normative source: [`spec/_.hint:217`](../spec/_.hint#L217).
197
197
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
198
198
 
199
199
  Behavior and consequence:
@@ -205,7 +205,7 @@ string; URL of human documentation.
205
205
  - Type: object; optional.
206
206
  - Default: none declared.
207
207
  - Allowed values: schema type plus the normative behavior in this entry.
208
- - Normative source: [`spec/_.hint:212`](../spec/_.hint#L212).
208
+ - Normative source: [`spec/_.hint:221`](../spec/_.hint#L221).
209
209
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
210
210
 
211
211
  Behavior and consequence:
@@ -220,7 +220,7 @@ module without naming one.
220
220
  - Type: array of object; optional.
221
221
  - Default: none declared.
222
222
  - Allowed values: schema type plus the normative behavior in this entry.
223
- - Normative source: [`spec/_.hint:219`](../spec/_.hint#L219).
223
+ - Normative source: [`spec/_.hint:228`](../spec/_.hint#L228).
224
224
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
225
225
 
226
226
  Behavior and consequence:
@@ -239,7 +239,7 @@ dist"). Ecosystem-specific keys are allowed under `x-<ecosystem>-*`.
239
239
  - Type: string; required.
240
240
  - Default: none declared.
241
241
  - Allowed values: schema type plus the normative behavior in this entry.
242
- - Normative source: [`spec/_.hint:235`](../spec/_.hint#L235).
242
+ - Normative source: [`spec/_.hint:244`](../spec/_.hint#L244).
243
243
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
244
244
 
245
245
  Behavior and consequence:
@@ -252,7 +252,7 @@ consumers remain on the current source until an explicit `set --git`.
252
252
  - Type: string; optional.
253
253
  - Default: `.`.
254
254
  - Allowed values: minimum length 1.
255
- - Normative source: [`spec/_.hint:240`](../spec/_.hint#L240).
255
+ - Normative source: [`spec/_.hint:249`](../spec/_.hint#L249).
256
256
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
257
257
 
258
258
  Behavior and consequence:
@@ -265,7 +265,7 @@ it changes the destination module root offered with the new Git URL.
265
265
  - Type: string; optional.
266
266
  - Default: none declared.
267
267
  - Allowed values: schema type plus the normative behavior in this entry.
268
- - Normative source: [`spec/_.hint:245`](../spec/_.hint#L245).
268
+ - Normative source: [`spec/_.hint:254`](../spec/_.hint#L254).
269
269
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
270
270
 
271
271
  Behavior and consequence:
@@ -278,7 +278,7 @@ the guidance, never the source automatically.
278
278
  - Type: string; optional.
279
279
  - Default: none declared.
280
280
  - Allowed values: schema type plus the normative behavior in this entry.
281
- - Normative source: [`spec/_.hint:254`](../spec/_.hint#L254).
281
+ - Normative source: [`spec/_.hint:263`](../spec/_.hint#L263).
282
282
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
283
283
 
284
284
  Behavior and consequence:
@@ -291,7 +291,7 @@ Changing it affects future adds; existing consumers retain their declared ref un
291
291
  - Type: boolean; optional.
292
292
  - Default: `false`.
293
293
  - Allowed values: schema type plus the normative behavior in this entry.
294
- - Normative source: [`spec/_.hint:259`](../spec/_.hint#L259).
294
+ - Normative source: [`spec/_.hint:268`](../spec/_.hint#L268).
295
295
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
296
296
 
297
297
  Behavior and consequence:
@@ -304,7 +304,7 @@ Changing it changes what consumers may reasonably select with `set --ref`; it do
304
304
  - Type: string; optional.
305
305
  - Default: none declared.
306
306
  - Allowed values: schema type plus the normative behavior in this entry.
307
- - Normative source: [`spec/_.hint:264`](../spec/_.hint#L264).
307
+ - Normative source: [`spec/_.hint:273`](../spec/_.hint#L273).
308
308
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
309
309
 
310
310
  Behavior and consequence:
@@ -317,7 +317,7 @@ only and does not resolve or move a dependency.
317
317
  - Type: string; required.
318
318
  - Default: none declared.
319
319
  - Allowed values: minimum length 1; open vocabulary; see the known-values table in this entry.
320
- - Normative source: [`spec/_.hint:273`](../spec/_.hint#L273).
320
+ - Normative source: [`spec/_.hint:282`](../spec/_.hint#L282).
321
321
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
322
322
 
323
323
  Behavior and consequence:
@@ -341,7 +341,7 @@ Known values:
341
341
  - Type: string; required.
342
342
  - Default: none declared.
343
343
  - Allowed values: minimum length 1.
344
- - Normative source: [`spec/_.hint:279`](../spec/_.hint#L279).
344
+ - Normative source: [`spec/_.hint:288`](../spec/_.hint#L288).
345
345
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
346
346
 
347
347
  Behavior and consequence:
@@ -354,7 +354,7 @@ consumer from the old native entry to the new one on the next mutation or `wire`
354
354
  - Type: string; optional.
355
355
  - Default: the module directory (`.`).
356
356
  - Allowed values: minimum length 1.
357
- - Normative source: [`spec/_.hint:284`](../spec/_.hint#L284).
357
+ - Normative source: [`spec/_.hint:293`](../spec/_.hint#L293).
358
358
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
359
359
 
360
360
  Behavior and consequence:
@@ -367,7 +367,7 @@ Changing it changes the Git subdirectory expression; unsupported adapters report
367
367
  - Type: string; optional.
368
368
  - Default: none declared.
369
369
  - Allowed values: schema type plus the normative behavior in this entry.
370
- - Normative source: [`spec/_.hint:289`](../spec/_.hint#L289).
370
+ - Normative source: [`spec/_.hint:298`](../spec/_.hint#L298).
371
371
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
372
372
 
373
373
  Behavior and consequence:
@@ -380,7 +380,7 @@ guidance but does not itself alter adapter behavior.
380
380
  - Type: string; required.
381
381
  - Default: none declared.
382
382
  - Allowed values: minimum length 1.
383
- - Normative source: [`spec/_.hint:298`](../spec/_.hint#L298).
383
+ - Normative source: [`spec/_.hint:307`](../spec/_.hint#L307).
384
384
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
385
385
 
386
386
  Behavior and consequence:
@@ -398,7 +398,7 @@ on a bare name being globally unique.
398
398
  - Type: string; required.
399
399
  - Default: none declared.
400
400
  - Allowed values: minimum length 1; open vocabulary; see the known-values table in this entry.
401
- - Normative source: [`spec/_.hint:308`](../spec/_.hint#L308).
401
+ - Normative source: [`spec/_.hint:317`](../spec/_.hint#L317).
402
402
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
403
403
 
404
404
  Behavior and consequence:
@@ -422,7 +422,7 @@ Known values:
422
422
  - Type: array of string; optional.
423
423
  - Default: `["**"]`.
424
424
  - Allowed values: schema type plus the normative behavior in this entry.
425
- - Normative source: [`spec/_.hint:314`](../spec/_.hint#L314).
425
+ - Normative source: [`spec/_.hint:323`](../spec/_.hint#L323).
426
426
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
427
427
 
428
428
  Behavior and consequence:
@@ -436,7 +436,7 @@ then declared order.
436
436
  - Type: string; optional.
437
437
  - Default: none declared.
438
438
  - Allowed values: minimum length 1.
439
- - Normative source: [`spec/_.hint:320`](../spec/_.hint#L320).
439
+ - Normative source: [`spec/_.hint:329`](../spec/_.hint#L329).
440
440
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
441
441
 
442
442
  Behavior and consequence:
@@ -450,7 +450,7 @@ the authority for `description`, `skills`, interfaces and security; git-a2a snap
450
450
  - Type: string; optional.
451
451
  - Default: none declared.
452
452
  - Allowed values: schema type plus the normative behavior in this entry.
453
- - Normative source: [`spec/_.hint:326`](../spec/_.hint#L326).
453
+ - Normative source: [`spec/_.hint:335`](../spec/_.hint#L335).
454
454
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
455
455
 
456
456
  Behavior and consequence:
@@ -463,7 +463,7 @@ ask it about …"). Never a copy of the card's description.
463
463
  - Type: array of object; optional.
464
464
  - Default: none declared.
465
465
  - Allowed values: open vocabulary; see the known-values table in this entry.
466
- - Normative source: [`spec/_.hint:331`](../spec/_.hint#L331).
466
+ - Normative source: [`spec/_.hint:340`](../spec/_.hint#L340).
467
467
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
468
468
 
469
469
  Behavior and consequence:
@@ -478,7 +478,7 @@ on"), plus kind-specific keys. Order expresses preference within an intent.
478
478
  - Type: object; optional.
479
479
  - Default: none declared.
480
480
  - Allowed values: schema type plus the normative behavior in this entry.
481
- - Normative source: [`spec/_.hint:338`](../spec/_.hint#L338).
481
+ - Normative source: [`spec/_.hint:347`](../spec/_.hint#L347).
482
482
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
483
483
 
484
484
  Behavior and consequence:
@@ -509,7 +509,7 @@ consumer requires `card-origin`, a warning otherwise.
509
509
  - Type: array of string; required.
510
510
  - Default: none declared.
511
511
  - Allowed values: minimum 1 item(s); open vocabulary; see the known-values table in this entry.
512
- - Normative source: [`spec/_.hint:366`](../spec/_.hint#L366).
512
+ - Normative source: [`spec/_.hint:375`](../spec/_.hint#L375).
513
513
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
514
514
 
515
515
  Behavior and consequence:
@@ -534,7 +534,7 @@ Known values:
534
534
  - Type: string; required.
535
535
  - Default: none declared.
536
536
  - Allowed values: minimum length 1; open vocabulary; see the known-values table in this entry.
537
- - Normative source: [`spec/_.hint:372`](../spec/_.hint#L372).
537
+ - Normative source: [`spec/_.hint:381`](../spec/_.hint#L381).
538
538
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
539
539
 
540
540
  Behavior and consequence:
@@ -550,8 +550,13 @@ The kind vocabulary is open; these kinds have defined keys and delivery behavior
550
550
  | Kind | Allowed kind-specific keys | Driver or instruction | Consequence of changing it | Unknown kind |
551
551
  | --- | --- | --- | --- | --- |
552
552
  | `a2a` | `url`, optional `skill` | Sends A2A `SendMessage` JSON-RPC 1.0; the only kind derivable from a card. | Changes the JSON-RPC endpoint or target skill. | Accepted, but no delivery driver is selected. |
553
- | `github-issue` | `repo`, optional `labels`, `template` | Creates an issue through `gh`, then GitHub REST fallback. | Changes the repository, labels, or issue template. | Accepted, but no delivery driver is selected. |
554
- | `gitlab-issue` | `repo`, optional `labels`, `template` | Prints an instruction; no reference delivery driver. | Changes the instructed issue destination. | Accepted, but no delivery driver is selected. |
553
+ | `github-issue` | `repo`, optional `server`, `labels`, `template` | Creates an issue through `gh`, then GitHub REST fallback (`server` selects a GitHub Enterprise host; API base `https://<server>/api/v3` unless `GITHUB_API_URL` overrides). | Changes the repository, host, labels, or issue template. | Accepted, but no delivery driver is selected. |
554
+ | `gitlab-issue` | `repo`, optional `server` (default `gitlab.com`), `labels`, `template` | Creates an issue through `glab`, then GitLab REST fallback (`POST /api/v4/projects/<url-encoded path>/issues`, token from `GITLAB_TOKEN`/`GLAB_TOKEN`). | Changes the project, host, labels, or template. | Accepted, but no delivery driver is selected. |
555
+ | `gitea-issue` | `repo`, `server` (required), optional `labels` | Creates an issue through `tea`, then Gitea/Forgejo REST fallback (`POST /api/v1/repos/<owner>/<repo>/issues`, token from `GITEA_TOKEN`/`FORGEJO_TOKEN`). Covers Gitea, Forgejo and Codeberg. | Changes the instance or repository. | Accepted, but no delivery driver is selected. |
556
+ | `bitbucket-issue` | `repo` (`workspace/slug`), optional `labels` | Prints an instruction with a prefilled deep link; Bitbucket Cloud only — Data Center has no issue tracker. | Changes the instructed destination. | Accepted, but no delivery driver is selected. |
557
+ | `azure-boards` | `organization`, `project`, optional `issue-type` | Prints an `az boards work-item create` instruction. | Changes the instructed organization, project, or type. | Accepted, but no delivery driver is selected. |
558
+ | `http` | `url` (https), optional `method` (default `POST`), `headers` (static literals), `content-type`, `body` | Owner-described request. Instruction by default (rendered as the exact final request); delivered only when the consumer allows the origin in `settings.contact.allow-http`; no credential is ever attached from the declaration. | Changes the described endpoint or payload. | — |
559
+ | `exec` | `command` (argv, bare binary name first), optional `args`, `stdin` (default `{message}`) | Owner-described local invocation. Instruction by default; executed only when the binary name is in the consumer's `settings.contact.allow-exec` and resolves on PATH; argv exec, never a shell; CLI-only — the MCP `contact` tool refuses `exec`. | Changes the described invocation. | — |
555
560
  | `email` | `address`, optional `subject-prefix` | Prints an email instruction; does not send mail. | Changes the instructed recipient or subject. | Accepted, but no delivery driver is selected. |
556
561
  | `jira` | `url`, `project`, optional `issue-type` | Prints a Jira instruction. | Changes the instructed site, project, or issue type. | Accepted, but no delivery driver is selected. |
557
562
  | `mattermost`, `slack`, `discord`, `telegram`, `teams` | `channel`, `handle`, optional `server` | Prints a chat instruction. | Changes the instructed workspace, channel, or handle. | Accepted, but no delivery driver is selected. |
@@ -560,12 +565,26 @@ The kind vocabulary is open; these kinds have defined keys and delivery behavior
560
565
  An unknown kind is rendered as `kind: <value>` with its extension keys, is never a validation
561
566
  error, and cannot be delivered by `contact` until a driver exists.
562
567
 
568
+ Issue-kind instructions include a prefilled, URL-encoded and length-capped deep link when the
569
+ forge supports one, so a driverless contact is one click for a human and one request for an
570
+ agent. GitHub, Gitea, and Bitbucket use `…/issues/new?title=…&body=…`; GitLab uses
571
+ `…/-/issues/new?issue[title]=…&issue[description]=…`. The title is the same capped first
572
+ non-empty message line used by delivery drivers, and the body/description is the capped full
573
+ message. Forges without a tracker (Gerrit, Bitbucket Data Center, bare git hosting) are served
574
+ by `email`, `jira`, `url`, or a chat kind — contacts bind to intents, not to where the code is
575
+ hosted.
576
+
577
+ Driver resolution per contact, in order: a consumer-installed plugin executable
578
+ `git-a2a-contact-<kind>` on PATH; the built-in driver; a declared `http`/`exec` invocation the
579
+ consumer has consented to; the rendered instruction. The chosen path is named in the delivery
580
+ record and by `contact --list-drivers`.
581
+
563
582
  ## `agents[].contacts[].note`
564
583
 
565
584
  - Type: string; optional.
566
585
  - Default: none declared.
567
586
  - Allowed values: schema type plus the normative behavior in this entry.
568
- - Normative source: [`spec/_.hint:378`](../spec/_.hint#L378).
587
+ - Normative source: [`spec/_.hint:387`](../spec/_.hint#L387).
569
588
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
570
589
 
571
590
  Behavior and consequence:
@@ -578,20 +597,21 @@ guidance, not routing priority or delivery mechanics.
578
597
  - Type: string; optional.
579
598
  - Default: none declared.
580
599
  - Allowed values: schema type plus the normative behavior in this entry.
581
- - Normative source: [`spec/_.hint:383`](../spec/_.hint#L383).
600
+ - Normative source: [`spec/_.hint:392`](../spec/_.hint#L392).
582
601
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
583
602
 
584
603
  Behavior and consequence:
585
604
 
586
- string, optional for `a2a`, `jira`, and `url`. Changing it changes the service or instruction
587
- destination; for A2A it is the JSON-RPC endpoint.
605
+ string, optional for `a2a`, `jira`, and `url`, required and HTTPS for `http`. Changing it changes
606
+ the service or instruction destination; for A2A it is the JSON-RPC endpoint. `http` templates may
607
+ place non-message placeholders only in query values according to `contact_placeholders`.
588
608
 
589
609
  ## `agents[].contacts[].skill`
590
610
 
591
611
  - Type: string; optional.
592
612
  - Default: none declared.
593
613
  - Allowed values: schema type plus the normative behavior in this entry.
594
- - Normative source: [`spec/_.hint:388`](../spec/_.hint#L388).
614
+ - Normative source: [`spec/_.hint:398`](../spec/_.hint#L398).
595
615
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
596
616
 
597
617
  Behavior and consequence:
@@ -604,7 +624,7 @@ the A2A target skill without changing the endpoint.
604
624
  - Type: string; optional.
605
625
  - Default: none declared.
606
626
  - Allowed values: schema type plus the normative behavior in this entry.
607
- - Normative source: [`spec/_.hint:393`](../spec/_.hint#L393).
627
+ - Normative source: [`spec/_.hint:403`](../spec/_.hint#L403).
608
628
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
609
629
 
610
630
  Behavior and consequence:
@@ -617,7 +637,7 @@ instruction; the reference CLI does not send email.
617
637
  - Type: string; optional.
618
638
  - Default: none declared.
619
639
  - Allowed values: schema type plus the normative behavior in this entry.
620
- - Normative source: [`spec/_.hint:398`](../spec/_.hint#L398).
640
+ - Normative source: [`spec/_.hint:408`](../spec/_.hint#L408).
621
641
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
622
642
 
623
643
  Behavior and consequence:
@@ -630,20 +650,21 @@ the printed instruction.
630
650
  - Type: string; optional.
631
651
  - Default: none declared.
632
652
  - Allowed values: schema type plus the normative behavior in this entry.
633
- - Normative source: [`spec/_.hint:403`](../spec/_.hint#L403).
653
+ - Normative source: [`spec/_.hint:413`](../spec/_.hint#L413).
634
654
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
635
655
 
636
656
  Behavior and consequence:
637
657
 
638
- string, optional for `github-issue` and `gitlab-issue`, in `owner/name` form. Changing it changes
639
- the repository where the issue driver delivers the request.
658
+ string for `github-issue`, `gitlab-issue`, `gitea-issue`, and `bitbucket-issue`; normally
659
+ `owner/name`, while GitLab permits nested `group/subgroup/name`. Changing it changes the repository
660
+ where the issue driver delivers the request.
640
661
 
641
662
  ## `agents[].contacts[].labels`
642
663
 
643
664
  - Type: array of string; optional.
644
665
  - Default: none declared.
645
666
  - Allowed values: schema type plus the normative behavior in this entry.
646
- - Normative source: [`spec/_.hint:408`](../spec/_.hint#L408).
667
+ - Normative source: [`spec/_.hint:419`](../spec/_.hint#L419).
647
668
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
648
669
 
649
670
  Behavior and consequence:
@@ -656,25 +677,38 @@ created; a missing label is a delivery error from the host.
656
677
  - Type: string; optional.
657
678
  - Default: none declared.
658
679
  - Allowed values: schema type plus the normative behavior in this entry.
659
- - Normative source: [`spec/_.hint:413`](../spec/_.hint#L413).
680
+ - Normative source: [`spec/_.hint:424`](../spec/_.hint#L424).
660
681
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
661
682
 
662
683
  Behavior and consequence:
663
684
 
664
685
  string, optional for issue kinds. Issue form/template name. Changing it changes the requested
665
- host template without changing routing.
686
+ template without changing routing.
666
687
 
667
688
  ## `agents[].contacts[].project`
668
689
 
669
690
  - Type: string; optional.
670
691
  - Default: none declared.
671
692
  - Allowed values: schema type plus the normative behavior in this entry.
672
- - Normative source: [`spec/_.hint:418`](../spec/_.hint#L418).
693
+ - Normative source: [`spec/_.hint:469`](../spec/_.hint#L469).
694
+ - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
695
+
696
+ Behavior and consequence:
697
+
698
+ string for `jira` and `azure-boards`. Project key. Changing it changes the project named in the
699
+ instruction.
700
+
701
+ ## `agents[].contacts[].organization`
702
+
703
+ - Type: string; optional.
704
+ - Default: none declared.
705
+ - Allowed values: schema type plus the normative behavior in this entry.
706
+ - Normative source: [`spec/_.hint:429`](../spec/_.hint#L429).
673
707
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
674
708
 
675
709
  Behavior and consequence:
676
710
 
677
- string, optional for `jira`. Project key. Changing it changes the Jira project named in the
711
+ string for `azure-boards`. Changing it changes the Azure DevOps organization named by the
678
712
  instruction.
679
713
 
680
714
  ## `agents[].contacts[].issue-type`
@@ -682,7 +716,7 @@ instruction.
682
716
  - Type: string; optional.
683
717
  - Default: none declared.
684
718
  - Allowed values: schema type plus the normative behavior in this entry.
685
- - Normative source: [`spec/_.hint:423`](../spec/_.hint#L423).
719
+ - Normative source: [`spec/_.hint:474`](../spec/_.hint#L474).
686
720
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
687
721
 
688
722
  Behavior and consequence:
@@ -695,7 +729,7 @@ instruction.
695
729
  - Type: string; optional.
696
730
  - Default: none declared.
697
731
  - Allowed values: schema type plus the normative behavior in this entry.
698
- - Normative source: [`spec/_.hint:428`](../spec/_.hint#L428).
732
+ - Normative source: [`spec/_.hint:479`](../spec/_.hint#L479).
699
733
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
700
734
 
701
735
  Behavior and consequence:
@@ -708,7 +742,7 @@ destination; chat contacts are instruction-only.
708
742
  - Type: string; optional.
709
743
  - Default: none declared.
710
744
  - Allowed values: schema type plus the normative behavior in this entry.
711
- - Normative source: [`spec/_.hint:433`](../spec/_.hint#L433).
745
+ - Normative source: [`spec/_.hint:484`](../spec/_.hint#L484).
712
746
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
713
747
 
714
748
  Behavior and consequence:
@@ -721,7 +755,7 @@ told to address.
721
755
  - Type: string; optional.
722
756
  - Default: none declared.
723
757
  - Allowed values: schema type plus the normative behavior in this entry.
724
- - Normative source: [`spec/_.hint:438`](../spec/_.hint#L438).
758
+ - Normative source: [`spec/_.hint:489`](../spec/_.hint#L489).
725
759
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
726
760
 
727
761
  Behavior and consequence:
@@ -729,12 +763,103 @@ Behavior and consequence:
729
763
  string, optional for chat kinds. Workspace or server URL/name. Changing it disambiguates the
730
764
  printed chat destination.
731
765
 
766
+ ## `agents[].contacts[].method`
767
+
768
+ - Type: string; optional.
769
+ - Default: none declared.
770
+ - Allowed values: schema type plus the normative behavior in this entry.
771
+ - Normative source: [`spec/_.hint:434`](../spec/_.hint#L434).
772
+ - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
773
+
774
+ Behavior and consequence:
775
+
776
+ string, optional for `http`, default `POST`. Changing it changes the exact instructed or allowed
777
+ HTTP request method.
778
+
779
+ ## `agents[].contacts[].headers`
780
+
781
+ - Type: object; optional.
782
+ - Default: none declared.
783
+ - Allowed values: schema type plus the normative behavior in this entry.
784
+ - Normative source: [`spec/_.hint:439`](../spec/_.hint#L439).
785
+ - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
786
+
787
+ Behavior and consequence:
788
+
789
+ map of string to string, optional for `http`. Values are static literals: placeholders are invalid,
790
+ and git-a2a never adds credentials from the declaration or consumer environment.
791
+
792
+ ## `agents[].contacts[].content-type`
793
+
794
+ - Type: string; optional.
795
+ - Default: none declared.
796
+ - Allowed values: schema type plus the normative behavior in this entry.
797
+ - Normative source: [`spec/_.hint:444`](../spec/_.hint#L444).
798
+ - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
799
+
800
+ Behavior and consequence:
801
+
802
+ string, optional for `http`. It selects the request Content-Type and JSON-aware placeholder
803
+ escaping when it contains `json`.
804
+
805
+ ## `agents[].contacts[].body`
806
+
807
+ - Type: string; optional.
808
+ - Default: none declared.
809
+ - Allowed values: schema type plus the normative behavior in this entry.
810
+ - Normative source: [`spec/_.hint:449`](../spec/_.hint#L449).
811
+ - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
812
+
813
+ Behavior and consequence:
814
+
815
+ string template, optional for `http`. It may use every value in `contact_placeholders`, including
816
+ `{message}`; changing it changes the exact instructed or delivered payload.
817
+
818
+ ## `agents[].contacts[].command`
819
+
820
+ - Type: array of string; optional.
821
+ - Default: none declared.
822
+ - Allowed values: minimum 1 item(s).
823
+ - Normative source: [`spec/_.hint:454`](../spec/_.hint#L454).
824
+ - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
825
+
826
+ Behavior and consequence:
827
+
828
+ list of strings, required for `exec`. The first item is a bare binary name without a path separator;
829
+ remaining items are argv entries. It is never interpreted by a shell.
830
+
831
+ ## `agents[].contacts[].args`
832
+
833
+ - Type: array of string; optional.
834
+ - Default: none declared.
835
+ - Allowed values: schema type plus the normative behavior in this entry.
836
+ - Normative source: [`spec/_.hint:459`](../spec/_.hint#L459).
837
+ - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
838
+
839
+ Behavior and consequence:
840
+
841
+ list of string templates, optional for `exec`, appended to `command`. It may use every non-message
842
+ placeholder in `contact_placeholders`; changing it changes argv only.
843
+
844
+ ## `agents[].contacts[].stdin`
845
+
846
+ - Type: string; optional.
847
+ - Default: none declared.
848
+ - Allowed values: schema type plus the normative behavior in this entry.
849
+ - Normative source: [`spec/_.hint:464`](../spec/_.hint#L464).
850
+ - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
851
+
852
+ Behavior and consequence:
853
+
854
+ string template, optional for `exec`, default `{message}`. It may use the complete placeholder set
855
+ and is passed as stdin without shell or environment expansion.
856
+
732
857
  ## `agents[].trust.signatures`
733
858
 
734
859
  - Type: boolean; optional.
735
860
  - Default: `false`.
736
861
  - Allowed values: schema type plus the normative behavior in this entry.
737
- - Normative source: [`spec/_.hint:447`](../spec/_.hint#L447).
862
+ - Normative source: [`spec/_.hint:498`](../spec/_.hint#L498).
738
863
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
739
864
 
740
865
  Behavior and consequence:
@@ -747,7 +872,7 @@ cards make `status` fail and make `update` warn while retaining the dependency u
747
872
  - Type: boolean; optional.
748
873
  - Default: unstated.
749
874
  - Allowed values: schema type plus the normative behavior in this entry.
750
- - Normative source: [`spec/_.hint:452`](../spec/_.hint#L452).
875
+ - Normative source: [`spec/_.hint:503`](../spec/_.hint#L503).
751
876
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
752
877
 
753
878
  Behavior and consequence:
@@ -762,7 +887,7 @@ agent "(external requests not accepted)". Organisation = origin host plus first
762
887
  - Type: array of string; optional.
763
888
  - Default: no pinned JWKS sources.
764
889
  - Allowed values: schema type plus the normative behavior in this entry.
765
- - Normative source: [`spec/_.hint:459`](../spec/_.hint#L459).
890
+ - Normative source: [`spec/_.hint:510`](../spec/_.hint#L510).
766
891
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
767
892
 
768
893
  Behavior and consequence:
@@ -776,7 +901,7 @@ subject to lock key-change review.
776
901
  - Type: array of string; optional.
777
902
  - Default: no pinned key thumbprints.
778
903
  - Allowed values: schema type plus the normative behavior in this entry.
779
- - Normative source: [`spec/_.hint:465`](../spec/_.hint#L465).
904
+ - Normative source: [`spec/_.hint:516`](../spec/_.hint#L516).
780
905
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
781
906
 
782
907
  Behavior and consequence:
@@ -789,7 +914,7 @@ of these pins regardless of JWKS URL. Changing the list changes the exact accept
789
914
  - Type: array of string; optional.
790
915
  - Default: repository/card binding rules.
791
916
  - Allowed values: schema type plus the normative behavior in this entry.
792
- - Normative source: [`spec/_.hint:470`](../spec/_.hint#L470).
917
+ - Normative source: [`spec/_.hint:521`](../spec/_.hint#L521).
793
918
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
794
919
 
795
920
  Behavior and consequence:
@@ -802,7 +927,7 @@ one of these origins. Changing it changes the allowed network identity of the ag
802
927
  - Type: string; optional.
803
928
  - Default: `24h`.
804
929
  - Allowed values: minimum length 1.
805
- - Normative source: [`spec/_.hint:475`](../spec/_.hint#L475).
930
+ - Normative source: [`spec/_.hint:526`](../spec/_.hint#L526).
806
931
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
807
932
 
808
933
  Behavior and consequence:
@@ -816,7 +941,7 @@ recoverable status.
816
941
  - Type: object; optional.
817
942
  - Default: unlisted intents route to `owner`.
818
943
  - Allowed values: schema type plus the normative behavior in this entry.
819
- - Normative source: [`spec/_.hint:508`](../spec/_.hint#L508).
944
+ - Normative source: [`spec/_.hint:591`](../spec/_.hint#L591).
820
945
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
821
946
 
822
947
  Behavior and consequence:
@@ -850,7 +975,7 @@ Known values:
850
975
  - Type: object; optional.
851
976
  - Default: none declared.
852
977
  - Allowed values: open vocabulary; see the known-values table in this entry.
853
- - Normative source: [`spec/_.hint:515`](../spec/_.hint#L515).
978
+ - Normative source: [`spec/_.hint:598`](../spec/_.hint#L598).
854
979
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
855
980
 
856
981
  Behavior and consequence:
@@ -865,7 +990,7 @@ consumer's roster block so an agent sees the boundary before it acts. Defaults w
865
990
  - Type: string; optional.
866
991
  - Default: none declared.
867
992
  - Allowed values: schema type plus the normative behavior in this entry.
868
- - Normative source: [`spec/_.hint:522`](../spec/_.hint#L522).
993
+ - Normative source: [`spec/_.hint:605`](../spec/_.hint#L605).
869
994
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
870
995
 
871
996
  Behavior and consequence:
@@ -877,7 +1002,7 @@ string. Anything else consumers must know, verbatim.
877
1002
  - Type: array of string; optional.
878
1003
  - Default: `[read-surface, ask]`.
879
1004
  - Allowed values: schema type plus the normative behavior in this entry.
880
- - Normative source: [`spec/_.hint:530`](../spec/_.hint#L530).
1005
+ - Normative source: [`spec/_.hint:613`](../spec/_.hint#L613).
881
1006
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
882
1007
 
883
1008
  Behavior and consequence:
@@ -900,7 +1025,7 @@ Known values:
900
1025
  - Type: array of string; optional.
901
1026
  - Default: `[commit]`.
902
1027
  - Allowed values: schema type plus the normative behavior in this entry.
903
- - Normative source: [`spec/_.hint:536`](../spec/_.hint#L536).
1028
+ - Normative source: [`spec/_.hint:619`](../spec/_.hint#L619).
904
1029
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
905
1030
 
906
1031
  Behavior and consequence:
@@ -961,12 +1086,29 @@ for `accepts-external` decisions, e.g. `["https://github.com/neprel", "ssh://git
961
1086
  Default: the origin host and first path segment of `module.repository`. Changing it changes only
962
1087
  the external-contact boundary used by `contact`.
963
1088
 
1089
+ ## `settings.contact`
1090
+
1091
+ - Type: object; optional.
1092
+ - Default: none declared.
1093
+ - Allowed values: schema type plus the normative behavior in this entry.
1094
+ - Normative source: [`spec/_.hint:160`](../spec/_.hint#L160).
1095
+ - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1096
+
1097
+ Behavior and consequence:
1098
+
1099
+ object, optional: consumer consent for owner-described invocations. `allow-http` — list of
1100
+ origins (`https://host[:port]`); a dependency's `http` contact is delivered only when its URL's
1101
+ origin is listed, otherwise it renders as an instruction. `allow-exec` — list of bare binary
1102
+ names; a dependency's `exec` contact runs only when `command[0]` is listed and resolves on
1103
+ PATH. The lists live in the consumer's own manifest, so consent is authored, reviewed, and
1104
+ versioned by the consumer — never by the dependency. Defaults: empty, meaning instruction-only.
1105
+
964
1106
  ## `dependencies[].id`
965
1107
 
966
1108
  - Type: string; optional.
967
1109
  - Default: none declared.
968
1110
  - Allowed values: pattern `^[a-z0-9][a-z0-9._-]{0,63}$`.
969
- - Normative source: [`spec/_.hint:546`](../spec/_.hint#L546).
1111
+ - Normative source: [`spec/_.hint:629`](../spec/_.hint#L629).
970
1112
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
971
1113
 
972
1114
  Behavior and consequence:
@@ -979,7 +1121,7 @@ manifest); the lock is keyed on it.
979
1121
  - Type: string; required.
980
1122
  - Default: none declared.
981
1123
  - Allowed values: minimum length 1.
982
- - Normative source: [`spec/_.hint:551`](../spec/_.hint#L551).
1124
+ - Normative source: [`spec/_.hint:634`](../spec/_.hint#L634).
983
1125
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
984
1126
 
985
1127
  Behavior and consequence:
@@ -992,7 +1134,7 @@ Stored exactly as given; credentials are never stored.
992
1134
  - Type: string; optional.
993
1135
  - Default: the owner's `release.channel`, otherwise remote HEAD.
994
1136
  - Allowed values: minimum length 1.
995
- - Normative source: [`spec/_.hint:556`](../spec/_.hint#L556).
1137
+ - Normative source: [`spec/_.hint:639`](../spec/_.hint#L639).
996
1138
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
997
1139
 
998
1140
  Behavior and consequence:
@@ -1011,7 +1153,7 @@ the new source and pin together.
1011
1153
  - Type: string; optional.
1012
1154
  - Default: `.`.
1013
1155
  - Allowed values: minimum length 1.
1014
- - Normative source: [`spec/_.hint:567`](../spec/_.hint#L567).
1156
+ - Normative source: [`spec/_.hint:650`](../spec/_.hint#L650).
1015
1157
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1016
1158
 
1017
1159
  Behavior and consequence:
@@ -1023,7 +1165,7 @@ string. Subdirectory containing the dependency's `a2amodule.yml` (monorepo). Def
1023
1165
  - Type: string; optional.
1024
1166
  - Default: `locked`.
1025
1167
  - Allowed values: one of `locked`, `floating`.
1026
- - Normative source: [`spec/_.hint:571`](../spec/_.hint#L571).
1168
+ - Normative source: [`spec/_.hint:654`](../spec/_.hint#L654).
1027
1169
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1028
1170
 
1029
1171
  Behavior and consequence:
@@ -1044,7 +1186,7 @@ Known values:
1044
1186
  - Type: array of string; optional.
1045
1187
  - Default: all matching detected ecosystems.
1046
1188
  - Allowed values: schema type plus the normative behavior in this entry.
1047
- - Normative source: [`spec/_.hint:577`](../spec/_.hint#L577).
1189
+ - Normative source: [`spec/_.hint:660`](../spec/_.hint#L660).
1048
1190
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1049
1191
 
1050
1192
  Behavior and consequence:
@@ -1063,7 +1205,7 @@ dependency is a state the tool can always see and always fix, never one it hides
1063
1205
  - Type: object; optional.
1064
1206
  - Default: none declared.
1065
1207
  - Allowed values: schema type plus the normative behavior in this entry.
1066
- - Normative source: [`spec/_.hint:588`](../spec/_.hint#L588).
1208
+ - Normative source: [`spec/_.hint:671`](../spec/_.hint#L671).
1067
1209
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1068
1210
 
1069
1211
  Behavior and consequence:
@@ -1076,7 +1218,7 @@ the locked source tree in this consumer; a dependency is never vendored implicit
1076
1218
  - Type: object; optional.
1077
1219
  - Default: none declared.
1078
1220
  - Allowed values: schema type plus the normative behavior in this entry.
1079
- - Normative source: [`spec/_.hint:593`](../spec/_.hint#L593).
1221
+ - Normative source: [`spec/_.hint:676`](../spec/_.hint#L676).
1080
1222
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1081
1223
 
1082
1224
  Behavior and consequence:
@@ -1089,7 +1231,7 @@ locking or contacting this dependency. Defaults preserve the permissive behavior
1089
1231
  - Type: string; optional.
1090
1232
  - Default: `any`.
1091
1233
  - Allowed values: one of `any`, `signed`.
1092
- - Normative source: [`spec/_.hint:606`](../spec/_.hint#L606).
1234
+ - Normative source: [`spec/_.hint:689`](../spec/_.hint#L689).
1093
1235
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1094
1236
 
1095
1237
  Behavior and consequence:
@@ -1103,7 +1245,7 @@ the check on the next mutation and on `status`; unknown values are rejected.
1103
1245
  - Type: string; optional.
1104
1246
  - Default: none declared.
1105
1247
  - Allowed values: minimum length 1.
1106
- - Normative source: [`spec/_.hint:612`](../spec/_.hint#L612).
1248
+ - Normative source: [`spec/_.hint:695`](../spec/_.hint#L695).
1107
1249
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1108
1250
 
1109
1251
  Behavior and consequence:
@@ -1117,7 +1259,7 @@ Changing it changes the trusted SSH/GPG signer set. A failed check leaves the lo
1117
1259
  - Type: string; optional.
1118
1260
  - Default: `any`.
1119
1261
  - Allowed values: one of `any`, `signed`.
1120
- - Normative source: [`spec/_.hint:618`](../spec/_.hint#L618).
1262
+ - Normative source: [`spec/_.hint:701`](../spec/_.hint#L701).
1121
1263
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1122
1264
 
1123
1265
  Behavior and consequence:
@@ -1131,7 +1273,7 @@ are accepted; unknown values are rejected.
1131
1273
  - Type: boolean; optional.
1132
1274
  - Default: `false`.
1133
1275
  - Allowed values: schema type plus the normative behavior in this entry.
1134
- - Normative source: [`spec/_.hint:624`](../spec/_.hint#L624).
1276
+ - Normative source: [`spec/_.hint:707`](../spec/_.hint#L707).
1135
1277
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1136
1278
 
1137
1279
  Behavior and consequence:
@@ -1144,7 +1286,7 @@ rather than a warning. Changing it changes mismatch severity, not the origin com
1144
1286
  - Type: string; optional.
1145
1287
  - Default: `submodule`.
1146
1288
  - Allowed values: one of `submodule`, `copy`.
1147
- - Normative source: [`spec/_.hint:638`](../spec/_.hint#L638).
1289
+ - Normative source: [`spec/_.hint:721`](../spec/_.hint#L721).
1148
1290
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1149
1291
 
1150
1292
  Behavior and consequence:
@@ -1158,7 +1300,7 @@ one representation with the other transactionally; unknown values are rejected.
1158
1300
  - Type: string; optional.
1159
1301
  - Default: `<settings.vendor-dir>/<dependency-id>`.
1160
1302
  - Allowed values: minimum length 1.
1161
- - Normative source: [`spec/_.hint:644`](../spec/_.hint#L644).
1303
+ - Normative source: [`spec/_.hint:727`](../spec/_.hint#L727).
1162
1304
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1163
1305
 
1164
1306
  Behavior and consequence:
@@ -1175,7 +1317,7 @@ reports violations and never silently rewrites the path.
1175
1317
  - Type: boolean; optional.
1176
1318
  - Default: `false`.
1177
1319
  - Allowed values: schema type plus the normative behavior in this entry.
1178
- - Normative source: [`spec/_.hint:653`](../spec/_.hint#L653).
1320
+ - Normative source: [`spec/_.hint:736`](../spec/_.hint#L736).
1179
1321
  - Example: see the [public library manifest](https://github.com/neprel/git-a2a-demo-acme-lib/blob/main/a2amodule.yml) and [consumer manifest](https://github.com/neprel/git-a2a-demo-acme-app/blob/main/a2amodule.yml).
1180
1322
 
1181
1323
  Behavior and consequence: