melchizedek-agents 1.13.0 → 1.15.0

package/.env.example

@@ -251,9 +251,17 @@ PUBLIC_URL=
 # byok: each caller's X-API-Key funds its X-Provider. With A2A_AUTH=secret,
 # byok also scopes data by a hash of that key (the pre-0.16 behaviour).
 # A2A_KEY_MODE=server
-# Bare agent ids that load from the adk_agent_registry table (comma list).
+# Bare agent ids that load from the adk_agent_registry table (comma list),
+# over DATABASE_URL when it is set, else over the Supabase API.
 # Every other bare id is a file; registry:<id> always means the registry.
 # A2A_REGISTRY_AGENTS=
+# The whole syndicate file in one variable, base64 (base64 < agent.yaml), for a
+# host that only takes variables (the published image without a database). It
+# is served as MELCHIZEDEK_AGENT_ID (default agent) and as the default, from a
+# private directory that becomes the agents directory, so MELCHIZEDEK_AGENTS_DIR
+# must be unset. Nested yaml_references travel in its bundled_references.
+# MELCHIZEDEK_AGENT_YAML=
+# MELCHIZEDEK_AGENT_ID=agent
 
 # ── A2A server: binding, limits, lifecycle (all optional) ─────────────────────
 # Without A2A_SERVER_SECRET the server binds 127.0.0.1 only. To bind another
@@ -295,7 +303,10 @@ PUBLIC_URL=
 # OpenAPI tools: the exact environment variables an `auth:` may name. Unset, any
 # variable but the framework's own settings (this file's) is allowed.
 # OPENAPI_CREDENTIAL_ENVS=WEATHER_API_KEY,CRM_TOKEN
-# A2A_BODY_LIMIT=1mb
+# Inline files in one message, decoded bytes; 0 refuses file parts. A file by URL is always refused.
+# A2A_MAX_FILE_BYTES=10485760
+# Set by default to hold A2A_MAX_FILE_BYTES as base64.
+# A2A_BODY_LIMIT=15mb
 # How long SIGTERM waits for running tasks before canceling them.
 # A2A_SHUTDOWN_GRACE_MS=25000
 # Of that, how long /readyz fails while requests are still served, so a load

package/CHANGELOG.md

@@ -4,6 +4,98 @@ Consumers of the package read this file; it records changes to the
 **published API surface** (the exports map in `package.json`, the bins,
 the starter pack and the templates), not the repo's full history.
 
+## 1.15.0 — 2026-11-02
+
+**Breaking — read before upgrading**
+
+- **Compaction and masking are on for every agent** (ADR 0152, 0154). A
+  `context:` block used to be allowed on delegates only and nothing
+  compacted unless it set `compact_after_tokens`. Now every agent compacts
+  when a request passes 60% of its model's context window
+  (`lib/models/contextWindow.ts` holds the table; an unknown model counts
+  as 100k; an Ollama model reads its own context length, default 4,096),
+  and a tool result older than the last 6 events and longer than 1,000
+  characters goes to the model as a stub it can fetch back with
+  `recall_tool_result`. `context: off` on an agent restores the old
+  behaviour; `compact_after_tokens: 0` and `mask_over_chars: 0` switch
+  the two off separately; `keep_recent_events` and `summary_model` are
+  the other keys. A request the provider refuses as too long is retried
+  once after a forced compaction.
+- **A `defineTool` result is capped at 20,000 characters** unless the spec
+  sets `maxResultChars` (0 lifts the cap). A tool that returned more now
+  returns the head and a note saying so.
+
+**The prompt prefix is stable** (ADR 0151). Text that changes between an
+agent's requests (`preload_memory`'s recall) leaves the system prompt for
+`ModelRequest.turnNotes`, which every adapter places after the history, so
+a provider's prefix cache covers the tools, the system prompt and the
+history. An `InstructionTool` marked `volatile: true` writes there. The
+Claude adapter sends `cache_control: { type: 'ephemeral' }` on Anthropic's
+own API.
+
+**The summary is sectioned and anchored** (ADR 0153): Intent, Stated facts,
+Decisions, Artifacts, Open, Last state, written from the previous summary
+and the new span only, tool calls and results included, within 1,200 words.
+A summary the model fails to write is skipped (the turn goes on with the
+full history, and the span records `compaction.skipped`) instead of
+replacing the history with nothing. A compacted event carries
+`summaryFormat: 'sections/1'`; the summary's own model call carries
+`llm.purpose: compaction` and `llm.compaction.events`.
+
+**`CapabilityReport.contextWindow`** says how many tokens a model's context
+holds, when the table knows the model.
+
+**The server image is published with every release** (ADR 0149).
+`ghcr.io/jhwadman/melchizedek-serve:<version>` (and `:latest`) for
+linux/amd64 and linux/arm64, with a build-provenance attestation; the
+GitHub Release carries its digest as `melchizedek-serve-v<version>.digest`.
+Pull by that digest.
+
+**A syndicate in one environment variable.** `melchizedek-serve` (and
+`startServer` from `melchizedek-agents/server`) reads
+`MELCHIZEDEK_AGENT_YAML`, the whole syndicate file base64-encoded, and
+serves it as `MELCHIZEDEK_AGENT_ID` (default `agent`) and as the default
+syndicate, from a private directory that becomes the agents directory. A
+definition that does not load stops the boot. It refuses
+`MELCHIZEDEK_AGENTS_DIR` beside it, a syndicate argument other than its
+own, and a nested `yaml_reference` its `bundled_references` does not carry.
+Unset, nothing changes.
+
+**The `Dockerfile` builds again.** `npm ci` ran the package's own
+`prepare` (the build) before the sources were copied, so `docker build`
+failed; both stages now install with `--ignore-scripts`.
+
+**The registry works on any Postgres** (ADR 0150). With `DATABASE_URL`, the
+server loads `registry:<id>` and `A2A_REGISTRY_AGENTS` rows from that
+database (in `MELCHIZEDEK_DB_SCHEMA` when it names one) instead of over the
+Supabase API, and `melchizedek-registry` publishes, rolls back and retires
+there too. Without `DATABASE_URL`, nothing changes. In the library:
+`melchizedek-agents/registry` exports `postgresRegistryReader(pool)` and its
+functions take a supabase-js client or anything with pg's `query` (a
+`pg.Pool`, PGlite); `loadSyndicateFromRegistry(id, { registry })` reads
+through a `RegistryReader`; `postgresStorage` returns `registry`, and
+`createA2AApp` reads `storage.registry` when it is given. A deployment that
+sets both `DATABASE_URL` and Supabase credentials, for different databases,
+now reads the registry from `DATABASE_URL`'s.
+
+## 1.14.0 — 2026-11-01
+
+**Files in a message.** The A2A server takes inline file parts (`raw`, or 0.3's
+`file.bytes`): images and documents the agent's model reads go to it as blobs,
+text types as a text part, and anything else ends `rejected` naming what it
+does read. `A2A_MAX_FILE_BYTES` (default 10 MiB) caps one message's files, and
+0 restores the old refusal; `A2A_BODY_LIMIT` now defaults to what holds that
+limit as base64. A file by URL is still refused. The agent card's
+`defaultInputModes` lists the types.
+
+**`attachmentSupport(model)`** (from the barrel) says which file types a
+model's path takes and how large, for a caller that converts a file first.
+
+**Claude reads PDFs.** A `application/pdf` blob is a `document` block; it was
+dropped. The chat-completions adapters no longer label a non-image blob as an
+image, which failed the whole request; it is left out with a warning. A failed
+call's recorded request keeps a file's size, not its bytes.
+
 ## 1.13.0 — 2026-10-24
 
 **A Prompt Writer template.** `templates/prompt_writer.yaml` writes

package/DOCUMENTATION.md

@@ -1056,7 +1056,7 @@ running". The lock is in-process by default and a Postgres advisory lock
 with `DATABASE_URL`, so it holds across instances. `tasks/cancel` stops a running task, including the model call
 in flight, and the task ends `canceled`. Final states: `completed`,
 `failed` (the message names the stage and the provider's reason),
-`canceled`, `rejected` (a file part, an empty message, or the server at
+`canceled`, `rejected` (a file its model does not read, a file by URL, an empty message, or the server at
 capacity). Message parts may be `text` or `data` (sent to the model as
 JSON); `file` parts are refused.
 
@@ -1342,6 +1342,19 @@ local conversation keeps talking to the same remote conversation.
 
 `Dockerfile` builds the compiled server and runs it as a non-root user with
 a health check; `compose.yaml` adds optional Ollama and Phoenix (traces).
+Every release also publishes it as `ghcr.io/jhwadman/melchizedek-serve:<version>`
+for linux/amd64 and linux/arm64, with a build-provenance attestation; the
+release carries the digest (`melchizedek-serve-v<version>.digest`), and a
+deployment should pull by that digest. The image needs no agents directory:
+`MELCHIZEDEK_AGENT_YAML` carries the syndicate file base64-encoded and serves
+it as `MELCHIZEDEK_AGENT_ID` (`agent`), or `A2A_REGISTRY_AGENTS` loads it from
+the registry.
+
+```bash
+docker run -p 4000:4000 -e A2A_SERVER_SECRET=… -e GOOGLE_GENAI_API_KEY=… \
+  -e MELCHIZEDEK_AGENT_YAML="$(base64 < agent.yaml)" ghcr.io/jhwadman/melchizedek-serve@sha256:…
+```
+
 `npx melchizedek-db print|apply|status` installs and checks the database.
 Set `PUBLIC_URL`, `A2A_SERVER_SECRET`, `A2A_AUTH`, `A2A_SERVED_AGENTS`,
 `A2A_TRUST_PROXY` and the provider keys from your secret manager; give the orchestrator's stop timeout at least
@@ -1421,6 +1434,15 @@ npx melchizedek-registry rollback desk 3 --note "v4 misroutes refunds"
 npx melchizedek-registry retire desk --yes    # stop serving; history stays
 ```
 
+The server reads the registry from the database its storage is on: over
+`DATABASE_URL` when it is set (any Postgres with the migrations, in
+`MELCHIZEDEK_DB_SCHEMA` when that names a private schema), else over the
+Supabase API with `SUPABASE_URL` and `SUPABASE_SERVICE_ROLE_KEY`.
+`melchizedek-registry` reaches it the same way, `DATABASE_URL` first, and
+the library's functions take either a supabase-js client or a `pg.Pool`
+(`postgresRegistryReader(pool)` is the read side, which `postgresStorage`
+supplies as `registry`).
+
 `publish` and `rollback` validate against the same schema the loader uses
 before anything is written. The author recorded is
 `MELCHIZEDEK_REGISTRY_AUTHOR`, else the local user name; a direct write

package/config/agents/syndicate.schema.json

@@ -1013,31 +1013,42 @@
           "additionalProperties": false
         },
         "context": {
-          "description": "Summarize a long conversation instead of overflowing the window. The orchestrator of a delegate syndicate only.",
-          "type": "object",
-          "properties": {
-            "compact_after_tokens": {
-              "type": "integer",
-              "minimum": 1000,
-              "maximum": 9007199254740991,
-              "description": "Compact when the last request's prompt passed this many tokens."
-            },
-            "keep_recent_events": {
-              "description": "Events kept verbatim after the summary. Default 6.",
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 100
+          "description": "What the model is sent of a long conversation: older tool results as recallable stubs, and a summary of earlier turns past a share of the window; both on by default. \"off\" sends everything as it is.",
+          "anyOf": [
+            {
+              "type": "object",
+              "properties": {
+                "compact_after_tokens": {
+                  "description": "Compact when the last request's prompt passed this many tokens. Default: 60% of the model's context window; 0 never compacts.",
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 9007199254740991
+                },
+                "keep_recent_events": {
+                  "description": "Events kept verbatim after the summary, and before masking. Default 6.",
+                  "type": "integer",
+                  "minimum": 1,
+                  "maximum": 100
+                },
+                "summary_model": {
+                  "description": "The model that writes the summary. Default: the agent's own.",
+                  "type": "string",
+                  "minLength": 1
+                },
+                "mask_over_chars": {
+                  "description": "An older tool result longer than this many characters is sent as a stub the model can recall. Default 1000; 0 masks none.",
+                  "type": "integer",
+                  "minimum": 0,
+                  "maximum": 9007199254740991
+                }
+              },
+              "additionalProperties": false
             },
-            "summary_model": {
-              "description": "The model that writes the summary. Default: the agent's own.",
+            {
               "type": "string",
-              "minLength": 1
+              "const": "off"
             }
-          },
-          "required": [
-            "compact_after_tokens"
-          ],
-          "additionalProperties": false
+          ]
         },
         "examples": {
           "description": "Few-shot exchanges (input, output) added to every request's instruction.",
@@ -2129,31 +2140,42 @@
             "additionalProperties": false
           },
           "context": {
-            "description": "Summarize a long conversation instead of overflowing the window. The orchestrator of a delegate syndicate only.",
-            "type": "object",
-            "properties": {
-              "compact_after_tokens": {
-                "type": "integer",
-                "minimum": 1000,
-                "maximum": 9007199254740991,
-                "description": "Compact when the last request's prompt passed this many tokens."
-              },
-              "keep_recent_events": {
-                "description": "Events kept verbatim after the summary. Default 6.",
-                "type": "integer",
-                "minimum": 1,
-                "maximum": 100
+            "description": "What the model is sent of a long conversation: older tool results as recallable stubs, and a summary of earlier turns past a share of the window; both on by default. \"off\" sends everything as it is.",
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "compact_after_tokens": {
+                    "description": "Compact when the last request's prompt passed this many tokens. Default: 60% of the model's context window; 0 never compacts.",
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 9007199254740991
+                  },
+                  "keep_recent_events": {
+                    "description": "Events kept verbatim after the summary, and before masking. Default 6.",
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 100
+                  },
+                  "summary_model": {
+                    "description": "The model that writes the summary. Default: the agent's own.",
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "mask_over_chars": {
+                    "description": "An older tool result longer than this many characters is sent as a stub the model can recall. Default 1000; 0 masks none.",
+                    "type": "integer",
+                    "minimum": 0,
+                    "maximum": 9007199254740991
+                  }
+                },
+                "additionalProperties": false
               },
-              "summary_model": {
-                "description": "The model that writes the summary. Default: the agent's own.",
+              {
                 "type": "string",
-                "minLength": 1
+                "const": "off"
               }
-            },
-            "required": [
-              "compact_after_tokens"
-            ],
-            "additionalProperties": false
+            ]
           },
           "examples": {
             "description": "Few-shot exchanges (input, output) added to every request's instruction.",

package/config/agents/syndicateSchema.yaml

@@ -368,14 +368,19 @@ orchestrator:
   # run_code:
   #   attach: true
 
-  # [optional] Summarize a long conversation instead of overflowing the
-  # window: past `compact_after_tokens` (the last request's prompt), earlier
-  # turns become one summary and the last `keep_recent_events` stay
-  # verbatim. The full history stays stored. Orchestrator of a delegate
-  # syndicate only (ADR 0033).
+  # [optional] What the model is sent of a long conversation; both parts are
+  # on by default, and `context: off` turns both off. A tool result older
+  # than the last `keep_recent_events` events and longer than
+  # `mask_over_chars` goes as a stub the model can read back with
+  # recall_tool_result (0 masks none). Past `compact_after_tokens` (default
+  # 60% of the model's context window; 0 never compacts) the earlier turns
+  # become one sectioned summary, and a prompt that overflows the window
+  # anyway is compacted and retried once. The full history stays stored
+  # either way (ADR 0152, ADR 0153, ADR 0154).
   # context:
-  #   compact_after_tokens: 60000
+  #   mask_over_chars: 1000
   #   keep_recent_events: 6
+  #   compact_after_tokens: 60000
   #   summary_model: "gemini-3.5-flash-lite"   # default: this agent's model
 
   # [optional] "task" on a WORKFLOW NODE: the agent works with its tools

package/dist/lib/a2a/app.d.ts

@@ -46,6 +46,7 @@ import type { TaskStore } from '@a2a-js/sdk/server';
 import type { CompileOptions } from '../compile.ts';
 import type { SessionService } from '../runtime/sessions.ts';
 import type { MemoryService } from '../runtime/memoryService.ts';
+import type { RegistryReader } from '../loadSyndicate.ts';
 import type { SyndicateYamlConfig } from '../loadSyndicate.ts';
 import type { ProviderEndpoint, ProviderId } from '../models/registry.ts';
 import type { TurnLock } from './turnLock.ts';
@@ -128,6 +129,13 @@ export interface A2AAppOptions {
          * route answers 501.
          */
         feedback?: FeedbackStore;
+        /**
+         * Where registry rows load from (`registry:<id>`, `registryAgents`): a
+         * direct connection to the database holding adk_agent_registry.
+         * postgresStorage supplies one on its pool. Without it they load over
+         * the Supabase API (SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY).
+         */
+        registry?: RegistryReader;
         /**
          * One turn at a time per conversation across instances (postgresStorage
          * supplies an advisory lock). Default: a lock in this process.
@@ -309,8 +317,10 @@ export interface A2AAppOptions {
     };
     /** Express `trust proxy` setting (hop count, boolean, or subnet list). */
     trustProxy?: number | boolean | string;
-    /** JSON body size limit, e.g. "1mb". */
+    /** JSON body size limit, e.g. "1mb". An inline file is base64 in this body: leave room for `maxFileBytes`. */
     bodyLimit?: string;
+    /** Largest total of inline files in one message, decoded bytes. Undefined or 0 refuses file parts. */
+    maxFileBytes?: number;
     /**
      * Allowlist of agent ids reachable at /:agentId/*. Undefined = any id with
      * a file in the deployment's own agents directory. Ids listed here may also
@@ -386,6 +396,8 @@ export declare function compileAgentCard(config: SyndicateYamlConfig, opts: {
     identity?: IdentityScheme;
     version: string;
     byok?: boolean;
+    /** The server takes file parts: the card names what this agent's model reads. */
+    files?: boolean;
 }): AgentCard;
 /**
  * The app name a syndicate's sessions and memory are stored under: its

package/dist/lib/a2a/app.js

@@ -73,6 +73,7 @@ import { setCredentialHosts } from '../tools/credentialHosts.js';
 import { syndicateCredentialHostProblems } from '../tools/credentialUses.js';
 import { syndicateOAuthHostProblems } from '../tools/oauthTools.js';
 import { credentialValue } from '../models/credentialSource.js';
+import { attachmentSupport } from '../models/attachments.js';
 const SURFACE_HEADERS = [
     ['x-surface', 'name'],
     ['x-surface-guild', 'guild'],
@@ -183,6 +184,7 @@ const scopeUserBuilder = async () => {
  */
 export function compileAgentCard(config, opts) {
     const base = `${opts.baseUrl.replace(/\/$/, '')}${opts.routePrefix ?? ''}`;
+    const fileSupport = opts.files ? attachmentSupport(config.orchestrator?.model) : undefined;
     const securitySchemes = {};
     if (opts.byok) {
         securitySchemes.apiKey = {
@@ -242,7 +244,7 @@ export function compileAgentCard(config, opts) {
         },
         securitySchemes,
         securityRequirements: Object.keys(requirement).length ? [{ schemes: requirement }] : [],
-        defaultInputModes: ['text/plain', 'application/json'],
+        defaultInputModes: ['text/plain', 'application/json', ...(fileSupport ? [...fileSupport.images, ...fileSupport.documents, ...fileSupport.media] : [])],
         defaultOutputModes: ['text/plain'],
         skills: (config.subagents ?? []).map((sub) => ({
             id: sub.name,
@@ -318,7 +320,7 @@ export async function createA2AApp(options) {
     };
     // ── The default syndicate ──────────────────────────────────────────────────
     const config = checkOAuthHosts(options.defaultSyndicate.startsWith('registry:')
-        ? await loadSyndicateFromRegistry(options.defaultSyndicate.slice('registry:'.length), { bindings: bindings() })
+        ? await loadSyndicateFromRegistry(options.defaultSyndicate.slice('registry:'.length), { bindings: bindings(), ...(options.storage?.registry ? { registry: options.storage.registry } : {}) })
         : loadSyndicate(options.defaultSyndicate, { bindings: bindings() }), options.defaultSyndicate);
     // ── Persistence ────────────────────────────────────────────────────────────
     let durableSessions;
@@ -541,6 +543,7 @@ export async function createA2AApp(options) {
             memoryService: services.memoryService,
             compileFor,
             taskTimeoutMs: options.taskTimeoutMs,
+            maxFileBytes: options.maxFileBytes,
             streamText: options.streamText,
             turnLock,
             turnLockWaitMs: options.turnLockWaitMs,
@@ -556,6 +559,7 @@ export async function createA2AApp(options) {
         });
         const version = executor.configHashFor().slice(0, 12);
         const cardFor = (base) => compileAgentCard(cfg, {
+            files: !!options.maxFileBytes,
             baseUrl: base,
             routePrefix,
             bearer: !!options.serverSecret,
@@ -972,7 +976,7 @@ export async function createA2AApp(options) {
         const registryId = agentId.startsWith('registry:') ? agentId.slice('registry:'.length) : registryIds.has(agentId) ? agentId : undefined;
         if (registryId) {
             try {
-                const loaded = await loadSyndicateFromRegistry(registryId, { bindings: bindings() });
+                const loaded = await loadSyndicateFromRegistry(registryId, { bindings: bindings(), ...(options.storage?.registry ? { registry: options.storage.registry } : {}) });
                 return { config: checkOAuthHosts(loaded, `registry:${registryId}`), source: `registry:${registryId}` };
             }
             catch (err) {

package/dist/lib/a2a/executor.d.ts

@@ -26,6 +26,7 @@ import type { TaskRecord } from '../observability/metrics.ts';
 import type { AuditSink } from '../observability/audit.ts';
 import type { Policy } from './policy.ts';
 import type { Metadata } from '../observability/metadata.ts';
+import type { AttachmentSupport } from '../models/attachments.ts';
 /** Per-request caller context, set by the server's identity middleware. */
 export interface A2AContext {
     /** The caller's provider key in BYOK mode (or from resolveRequest); '' otherwise. */
@@ -108,17 +109,24 @@ export declare function describeTurnError(error: {
 }): string;
 /** The failed task's message for a turn result. */
 export declare function describeFailedTurn(result: SyndicateTurnResult): string;
+/** What this server takes as a file part: the bytes it allows and what the agent's model reads. */
+export interface FilePartPolicy {
+    /** Largest total of files in one message, decoded bytes. */
+    maxBytes: number;
+    support: AttachmentSupport;
+}
 /**
  * A2A message parts → model parts. Text passes through; a `data` part
  * becomes its JSON as text (callers inject structured payloads this way).
- * File parts (`url` or `raw` content) are refused with a clear error rather
- * than silently blanked: a file URL fetched server-side is an SSRF surface,
- * and inline bytes need a size policy this server does not yet have.
+ * An inline file (`raw` content, or 0.3's `file.bytes`) becomes a blob part
+ * the agent's model reads, or text when it is text, within `files`; anything
+ * else is refused with a clear error rather than silently blanked. A file by
+ * URL is always refused: fetching one server-side is an SSRF surface.
  *
  * Accepts A2A 1.0 parts (`content.$case`) and, for callers that hand in
  * plain objects, the 0.3 shapes (`kind: 'text' | 'data' | 'file'`).
  */
-export declare function a2aPartsToMessage(rawParts: unknown[]): {
+export declare function a2aPartsToMessage(rawParts: unknown[], files?: FilePartPolicy): {
     parts: MessagePart[];
     refused?: string;
 };
@@ -132,6 +140,8 @@ export interface ExecutorOptions {
     compileFor: (ctx: A2AContext) => CompileOptions;
     /** Wall-clock budget per task in ms; 0 or undefined = none. */
     taskTimeoutMs?: number;
+    /** Largest total of inline files in one message, decoded bytes; 0 or undefined refuses file parts. */
+    maxFileBytes?: number;
     /** Shared across every executor on the server. */
     limiter: TaskLimiter;
     /** The agent id this executor serves ('' for the default syndicate). */

package/dist/lib/a2a/executor.js

@@ -27,6 +27,7 @@ import { isWorkflowSyndicate } from '../workflow.js';
 import { describeInput } from '../runtime/syndicateTurn.js';
 import { describeConsent } from '../runtime/credentials.js';
 import { MAX_META_KEYS, metaAttributes, requestMetadata } from '../observability/metadata.js';
+import { attachmentSupport, takesBlob } from '../models/attachments.js';
 export const requestContextStorage = new AsyncLocalStorage();
 /** The app name every A2A session and memory silo is stored under. */
 export const A2A_APP_NAME = 'melchizedek-a2a';
@@ -143,19 +144,62 @@ export function describeFailedTurn(result) {
     }
     return `Error: [${error.code}] The agent run failed — ${describeTurnError(error)}`;
 }
+/** Types read as text whatever the model: they go to it as a text part. */
+const TEXT_FILE = /^(text\/[\w.+-]+|application\/(json|xml|yaml|x-yaml|x-ndjson|csv))$/;
+/** A file's name as the model reads it: printable and short, since the caller chose it. */
+const fileLabel = (name) => (typeof name === 'string' ? name : '').replace(/[^\p{L}\p{N} ._()-]/gu, '_').slice(0, 120) || 'file';
+/** One inline file as model parts, or why it is refused. */
+function filePart(bytes, declared, name, policy) {
+    const type = String(declared ?? '').split(';')[0].trim().toLowerCase();
+    const shown = type.replace(/[^\x20-\x7e]/g, '?').slice(0, 64) || 'a file with no type';
+    if (TEXT_FILE.test(type)) {
+        let text;
+        try {
+            text = new TextDecoder('utf-8', { fatal: true }).decode(bytes);
+        }
+        catch {
+            return `The file part declared as ${shown} is not UTF-8 text.`;
+        }
+        return { text: `<attached_file name="${fileLabel(name)}" type="${shown}">\n${text}\n</attached_file>` };
+    }
+    if (!takesBlob(policy.support, type))
+        return `This agent's model does not read ${shown}. It reads ${[...policy.support.images, ...policy.support.documents, ...policy.support.media].join(', ')} and text.`;
+    const limit = policy.support.images.includes(type) ? policy.support.maxImageBytes : policy.support.maxFileBytes;
+    if (bytes.length > limit)
+        return `A ${shown} file may be at most ${limit} bytes for this agent's model; this one is ${bytes.length}.`;
+    return { inlineData: { mimeType: type, data: bytes.toString('base64') } };
+}
 /**
  * A2A message parts → model parts. Text passes through; a `data` part
  * becomes its JSON as text (callers inject structured payloads this way).
- * File parts (`url` or `raw` content) are refused with a clear error rather
- * than silently blanked: a file URL fetched server-side is an SSRF surface,
- * and inline bytes need a size policy this server does not yet have.
+ * An inline file (`raw` content, or 0.3's `file.bytes`) becomes a blob part
+ * the agent's model reads, or text when it is text, within `files`; anything
+ * else is refused with a clear error rather than silently blanked. A file by
+ * URL is always refused: fetching one server-side is an SSRF surface.
  *
  * Accepts A2A 1.0 parts (`content.$case`) and, for callers that hand in
  * plain objects, the 0.3 shapes (`kind: 'text' | 'data' | 'file'`).
  */
-export function a2aPartsToMessage(rawParts) {
+export function a2aPartsToMessage(rawParts, files) {
     const parts = [];
-    const refusal = 'File parts are not supported by this server; send text or data parts.';
+    const refusal = files ? 'A file part given by URL is not fetched by this server; send its bytes.' : 'File parts are not supported by this server; send text or data parts.';
+    let total = 0;
+    /** Adds one inline file; a string is why the message is refused. */
+    const addFile = (value, declared, name) => {
+        if (!files)
+            return refusal;
+        const bytes = typeof value === 'string' ? Buffer.from(value, 'base64') : value instanceof Uint8Array ? Buffer.from(value) : null;
+        if (!bytes || bytes.length === 0)
+            return 'A file part has no bytes.';
+        total += bytes.length;
+        if (total > files.maxBytes)
+            return `The files in one message may total at most ${files.maxBytes} bytes on this server.`;
+        const part = filePart(bytes, declared, name, files);
+        if (typeof part === 'string')
+            return part;
+        parts.push(part);
+        return undefined;
+    };
     for (const raw of rawParts) {
         if (typeof raw === 'string') {
             parts.push({ text: raw });
@@ -168,8 +212,13 @@ export function a2aPartsToMessage(rawParts) {
                 parts.push({ text: content.value });
             else if (content.$case === 'data')
                 parts.push({ text: JSON.stringify(content.value) });
-            else if (content.$case === 'url' || content.$case === 'raw')
+            else if (content.$case === 'url')
                 return { parts, refused: refusal };
+            else if (content.$case === 'raw') {
+                const refused = addFile(content.value, p.mediaType, p.filename);
+                if (refused)
+                    return { parts, refused };
+            }
             continue;
         }
         const kind = p.kind ?? (p.text !== undefined ? 'text' : p.data !== undefined ? 'data' : p.file !== undefined ? 'file' : undefined);
@@ -181,7 +230,11 @@ export function a2aPartsToMessage(rawParts) {
             parts.push({ text: JSON.stringify(p.data) });
         }
         else if (kind === 'file') {
-            return { parts, refused: refusal };
+            if (p.file?.bytes === undefined)
+                return { parts, refused: refusal };
+            const refused = addFile(p.file.bytes, p.file.mimeType, p.file.name);
+            if (refused)
+                return { parts, refused };
         }
     }
     return { parts };
@@ -606,7 +659,7 @@ export class SyndicateExecutor {
                 throw new Error('No authentication context available.');
             ctxForReport = ctx;
             const rawParts = message?.parts ?? message?.content ?? [];
-            const mapped = a2aPartsToMessage(rawParts);
+            const mapped = a2aPartsToMessage(rawParts, this.opts.maxFileBytes ? { maxBytes: this.opts.maxFileBytes, support: attachmentSupport(this.opts.config.orchestrator?.model, { callerKey: !!ctx.apiKey }) } : undefined);
             const refused = mapped.refused;
             let parts = mapped.parts;
             if (refused) {

package/dist/lib/compile.d.ts

@@ -70,8 +70,8 @@ export declare function withReasoning(agent: {
     generateContentConfig?: object;
 }, model: string | undefined): Record<string, unknown> | undefined;
 /** An agent's `context:` block and its default, owned by the compactor (ADR 0033). */
-export type { ContextConfig } from './runtime/native/compaction.ts';
-import type { ContextConfig } from './runtime/native/compaction.ts';
+export type { ContextConfig, ContextSetting } from './runtime/native/compaction.ts';
+import type { ContextSetting } from './runtime/native/compaction.ts';
 export { DEFAULT_KEEP_RECENT_EVENTS } from './runtime/native/compaction.ts';
 /** True when any agent of a syndicate may pause for approval: a gated tool, or skill scripts. */
 export declare function declaresApprovals(config: SyndicateYamlConfig): boolean;
@@ -202,8 +202,8 @@ export interface AgentSpec {
     disallowTransferToPeers?: boolean;
     /** `code_execution: gemini`. */
     codeExecution?: 'gemini';
-    /** `context:`: compaction (ADR 0033). */
-    context?: ContextConfig;
+    /** `context:`: masking and compaction (ADR 0033, ADR 0154), or `off`. */
+    context?: ContextSetting;
     /** `mode: task`. */
     mode?: 'task';
     /** The syndicate's `max_concurrency`, on its orchestrator (ADR 0116): delegated calls one step runs at once. */

package/dist/lib/compileNative.js

@@ -147,6 +147,9 @@ export function compileNative(spec) {
         agent.fallbackModel = spec.fallbackModel;
     if (spec.context)
         agent.context = spec.context;
+    // The YAML's id when the adapter's differs: the context-window table reads it (ADR 0154).
+    if (spec.modelId && spec.modelId !== model)
+        agent.modelId = spec.modelId;
     if (spec.maxConcurrency !== undefined)
         agent.maxConcurrency = spec.maxConcurrency;
     if (spec.metadata)
@@ -271,7 +274,7 @@ export function nativeAdapterFor(opts = {}, spec) {
                 if (id && !known.has(id))
                     known.set(id, s.resolvedModel);
         }
-        for (const id of [s.fallbackModel, s.context?.summary_model]) {
+        for (const id of [s.fallbackModel, typeof s.context === 'object' ? s.context.summary_model : undefined]) {
             if (!id || known.has(id) || !opts.resolveModel)
                 continue;
             const resolved = opts.resolveModel(id);