ur-agent 1.46.0 → 1.47.1

package/docs/A2A.md

@@ -5,14 +5,17 @@ surfaces:
 
 | Surface | Path | Contract |
 | --- | --- | --- |
-| Agent Card | `/.well-known/agent-card.json` | Public discovery metadata that exactly describes the running server |
-| A2A JSON-RPC | `/a2a/jsonrpc` | A2A protocol v0.3, implemented with the official stable JavaScript SDK |
+| Agent Card | `/.well-known/agent-card.json` | Strict v1 card by default; send `A2A-Version: 0.3` for the separate v0.3 card |
+| A2A v1 JSON-RPC | `/` or `/a2a/v1/jsonrpc` | ProtoJSON, PascalCase lifecycle methods, `A2A-Version: 1.0` |
+| A2A v1 HTTP+JSON | `/message:send`, `/tasks`, or `/a2a/v1/...` | Versioned REST lifecycle with pagination, artifacts, references, and cancellation |
+| A2A v0.3 JSON-RPC | `/a2a/jsonrpc` | Stable v0.3 binding implemented with the official JavaScript SDK |
 | UR compatibility API | `/a2a/tasks` and `/a2a/tasks/:id` | UR-specific REST-style background-task controls; not an A2A REST binding |
 
-The A2A specification itself is at v1. UR does not claim v1 conformance yet:
-the official JavaScript SDK's v1 support is prerelease, while its current
-stable line implements v0.3. UR will migrate and run the official conformance
-suite when a stable JavaScript v1 path is available.
+The two protocol versions deliberately use separate schemas and handlers. The
+stable SDK remains pinned for v0.3; UR's dependency-free v1 compatibility layer
+translates strict v1 messages and tasks onto the same bounded durable execution
+engine. It is covered by UR tests and the official A2A TCK, but does not claim
+certification by the prerelease JavaScript SDK.
 
 ## Start the server
 
@@ -49,11 +52,42 @@ Inspect the live card:
 curl -s http://127.0.0.1:8765/.well-known/agent-card.json
 ```
 
-The card advertises protocol `0.3.0`, `JSONRPC`, `/a2a/jsonrpc`, unary task
-execution, the installed UR version, skills, and only the authentication
-schemes actually configured for that server.
+Without a version header, discovery returns the v1 ProtoJSON card with
+`supportedInterfaces` for JSON-RPC, HTTP+JSON, and the legacy v0.3 binding. Use
+`A2A-Version: 0.3` to retrieve the standalone v0.3 SDK card. Both cards report
+the installed UR version, skills, implemented capabilities, and only the
+authentication schemes configured for that server; responses include
+`Vary: A2A-Version`.
 
-Send a blocking message:
+Send a blocking v1 message over JSON-RPC:
+
+```sh
+curl -s http://127.0.0.1:8765/a2a/v1/jsonrpc \
+  -H 'content-type: application/json' \
+  -H 'A2A-Version: 1.0' \
+  -H "authorization: Bearer $UR_A2A_TOKEN" \
+  -d '{
+    "jsonrpc":"2.0",
+    "id":"request-v1",
+    "method":"SendMessage",
+    "params":{
+      "configuration":{"blocking":true},
+      "message":{
+        "messageId":"message-v1",
+        "role":"ROLE_USER",
+        "parts":[{"text":"Review the current diff."}]
+      }
+    }
+  }'
+```
+
+The v1 HTTP+JSON binding accepts `application/a2a+json` and exposes
+`message:send`, task list/get/cancel, continuation, and artifact/reference
+operations at the advertised transport root or under `/a2a/v1`. List cursors
+are opaque and filter-bound. An optional tenant segment, for example
+`/a2a/v1/acme/tasks`, requires a matching `tenant:acme` delegation scope.
+
+Send a blocking v0.3 message:
 
 ```sh
 curl -s http://127.0.0.1:8765/a2a/jsonrpc \
@@ -78,10 +112,10 @@ curl -s http://127.0.0.1:8765/a2a/jsonrpc \
 ```
 
 Set `configuration.blocking` to `false` to receive a working task promptly,
-then call `tasks/get`; use `tasks/cancel` for a nonterminal task. The stable
+then call `tasks/get`; use `tasks/cancel` for a nonterminal task. The v0.3
 binding supports `message/send`, `tasks/get`, and `tasks/cancel`. Streaming,
 resubscription, push notifications, and authenticated extended cards are not
-advertised and return protocol errors if requested.
+advertised by either card and return protocol errors if requested.
 
 `params.metadata.skill` selects an advertised skill; the default is
 `coding-agent`. Requests with an unknown skill are rejected before execution.
@@ -134,10 +168,13 @@ The server bounds work with these environment variables:
 - `UR_A2A_MAX_ACTIVE_TASKS_PER_OWNER`
 - `UR_A2A_TASK_TIMEOUT_MS`
 
-Protocol task state is persisted with owner and skill metadata in
-`.ur/a2a/protocol-tasks.json` using owner-only file permissions. UR
-compatibility task state remains under the same `.ur/a2a/` directory and links
-to `.ur/background/` output files.
+Protocol task state and v1 artifacts are persisted with owner, tenant, skill,
+and version metadata under `.ur/a2a/` using owner-only permissions and atomic
+writes. Retrieval, continuation, reference lookup, listing, and cancellation
+all re-check the caller boundary. UR compatibility task state remains under the
+same directory and links to `.ur/background/` output files.
 
 References: [A2A v1 specification](https://a2a-protocol.org/latest/specification/),
-[official JavaScript SDK](https://github.com/a2aproject/a2a-js).
+[A2A v1 announcement](https://a2a-protocol.org/latest/announcing-1.0/),
+[official JavaScript SDK](https://github.com/a2aproject/a2a-js), and
+[official TCK](https://github.com/a2aproject/a2a-tck).

package/docs/ACP.md

@@ -27,8 +27,13 @@ Methods:
 | `initialize` | client → agent | `{ protocolVersion, agentCapabilities, authMethods }` |
 | `authenticate` | client → agent | `{}` (no auth required for local stdio) |
 | `session/new` | client → agent | `{ sessionId }` |
-| `session/resume` | client → agent | restores a persisted session without replaying history |
+| `session/list` | client → agent | returns a 50-item page and opaque, filter-bound cursor |
+| `session/load` | client → agent | restores a session and replays its exact ordered updates |
+| `session/delete` | client → agent | deletes private metadata and history after stopping active work |
+| `session/resume` | client → agent | restores identity without replaying history |
 | `session/close` | client → agent | cancels active work and releases the in-process session |
+| `session/set_mode` | client → agent | selects `default`, `acceptEdits`, or `plan` |
+| `session/set_config_option` | client → agent | selects full tool updates or permission-only updates |
 | `session/prompt` | client → agent | `{ stopReason }`, with streaming `session/update` notifications |
 | `session/cancel` | client → agent (notification) | aborts the in-flight prompt |
 | `session/request_permission` | agent → client | asks the user to allow or reject a tool call |
@@ -44,19 +49,21 @@ During `session/prompt` the agent emits `session/update` notifications:
 
 `session/prompt` resolves with `{ "stopReason": "end_turn" }` (or `"cancelled"`
 if a `session/cancel` arrived). Repeated prompts resume the underlying UR CLI
-conversation for that ACP session. Stable `session/resume` reconnects after an
-agent restart without replaying history; UR stores only the ACP-to-CLI session
-identity and working directory in mode-`0600` metadata under
-`~/.ur/acp/sessions/`. MCP credentials are never written there. Configure the
-agent with `ur ide config zed`.
+conversation for that ACP session. `session/resume` reconnects after an agent
+restart without replay; `session/load` emits the bounded, exact stored update
+sequence before current session information and available commands. UR stores
+the ACP-to-CLI identity, working directory, modes/options, and append-only
+history in private metadata under `~/.ur/acp/sessions/`. Writes are locked,
+atomic, bounded, migration-aware, and fail closed on malformed state. MCP
+credentials are never persisted there. Configure the agent with
+`ur ide config zed`.
 
 The stdio surface advertises text and resource-link prompt support, additional
-workspace directories, MCP stdio/HTTP/SSE transports, and stable resume/close
-capabilities. Client-provided MCP configuration is validated, written to a
-mode-`0600` temporary file instead of argv, and removed after each turn. Image,
-audio, embedded-context, and `session/load` capabilities are not advertised;
-`session/load` requires full history replay, while `session/resume` deliberately
-does not replay it.
+workspace directories, MCP stdio/HTTP/SSE transports, load/list/delete,
+resume/close, modes, configuration options, and available commands.
+Client-provided MCP configuration is validated, written to a mode-`0600`
+temporary file instead of argv, and removed after each turn. Image, audio, and
+embedded-context capabilities are not advertised.
 
 Tool calls that require approval are bridged to the client's native ACP
 permission UI with allow-once, reject, and (when UR supplies a durable rule)
@@ -64,7 +71,8 @@ always-allow choices. Cancellation and client errors fail closed. The prompt is
 sent over stdin rather than argv. Session count, prompt size, output size, and
 runtime are bounded by `UR_ACP_STDIO_MAX_SESSIONS`,
 `UR_ACP_STDIO_MAX_PROMPT_CHARS`, `UR_ACP_STDIO_MAX_OUTPUT_CHARS`, and
-`UR_ACP_STDIO_PROMPT_TIMEOUT_MS`.
+`UR_ACP_STDIO_PROMPT_TIMEOUT_MS`. History additionally enforces per-event,
+event-count, total-byte, and discovery-scan limits.
 
 ## HTTP JSON-RPC server
 

package/docs/AGENT_FEATURES.md

@@ -9,6 +9,44 @@ reproducible autonomous software engineering agent: every substantial task can
 be driven as `spec -> plan -> patch -> test -> report -> rollback`, with the
 spec as the durable source of truth and command evidence as the success gate.
 
+## v1.47.0 Additions
+
+- `ur ag-ui serve` adds a secure AG-UI HTTP/SSE boundary for user-facing
+  applications. Official schemas and encoding, truthful capability discovery,
+  full text/tool/state lifecycle events, cancellation, exact CORS, bearer
+  protection, redacted errors, and independent resource bounds are covered by
+  provider-free regression tests.
+- A2A now runs v0.3 and v1 side by side. Strict v1 JSON-RPC and HTTP+JSON
+  bindings add version negotiation, tenant isolation, durable tasks and
+  artifacts, pagination, continuation, references, and cancellation without
+  removing the stable v0.3 SDK path.
+- ACP stdio now implements durable list/load/delete/resume/close, bounded exact
+  history replay, modes, configuration options, and available commands in
+  addition to streaming prompts, permission requests, MCP servers, and roots.
+- `ur mcp serve-http` exposes the opt-in stateless MCP 2026 compatibility
+  surface with Tasks and a self-contained Apps resource. It is loopback-only
+  without authentication and enforces request metadata, capability negotiation,
+  owner isolation, limits, private persistence, and corrupt-state quarantine.
+- OpenAI users can opt into the Responses transport with
+  `ur config set openai_transport responses`. Chat Completions remains the
+  default; Responses defaults to `store=false` and supports streaming,
+  background polling/cancellation, WebSocket continuation, compaction, and
+  deferred tool search through tested provider adapters.
+- OpenTelemetry export is explicit per signal. GenAI inference, agent,
+  workflow, tool, memory, duration, token, cache, response,
+  time-to-first-chunk, inter-output-chunk latency, and error fields follow
+  current semantic conventions, while prompts and tool/memory content stay
+  redacted unless the operator
+  separately opts in.
+- Agent Skills receive strict open-spec validation and deterministic provenance.
+  `ur skill verify|sign|keygen` supports Ed25519 integrity manifests and trusted
+  keys; loaded skills are re-hashed immediately before execution. Native
+  `.ur/skills/` and standard cross-client `.agents/skills/` project/user roots
+  use explicit, deterministic precedence.
+- Project task memory now has per-entry provenance, UUIDs, SHA-256 content
+  digests, an append-only hash chain, cross-process locks, private atomic writes,
+  and `ur context-pack memory verify|quarantine|rollback` recovery commands.
+
 ## v1.46.0 Additions
 
 - Native ACP v1 stdio support now uses the official SDK and includes durable
@@ -59,6 +97,7 @@ ur automation run nightly --dry-run
 ur automation run-due
 ur model-doctor
 ur a2a serve --dry-run
+ur ag-ui serve --help
 ur bg run "fix the flaky parser test" --worktree --dry-run
 ur test-first detect
 ur test-first --dry-run
@@ -217,8 +256,8 @@ while keeping them project-local and manifest-backed:
 | --- | --- | --- |
 | Agent | `ur`, `ur agents`, `ur crew`, `ur bg`, `ur agent-templates` | `.ur/agents/`, `AGENTS.md`, `UR.md` |
 | Rules | `ur context-pack scan`, `ur safety`, `/guardrails`, `/hooks` | `AGENTS.md`, `UR.md`, `.cursor/rules/*.mdc`, `.cursorrules`, `.ur/safety-policy.json`, `.ur/guardrails.json`, `.ur/hooks.json` |
-| MCP | `ur mcp`, built-in MCP server mode, MCP tools/resources | `.mcp.json`, `.ur/mcp/`, plugin manifests |
-| Skills | `/skills`, `/create-skill`, bundled skills, plugin skills | `.ur/skills/`, user skills, plugin skill folders |
+| MCP | `ur mcp`, stdio mode, opt-in MCP 2026 HTTP Tasks/Apps, tools/resources | `.mcp.json`, `.ur/mcp/`, plugin manifests |
+| Skills | `/skills`, `/create-skill`, `ur skill verify\|sign\|keygen`, bundled/plugin skills | `.ur/skills/`, `.agents/skills/`, user skills, plugin skill folders, trusted key store |
 | CLI | `ur --help`, `ur -p`, `ur exec`, `ur acp`, workflow subcommands | `package.json` scripts, `.ur/project-manifest.json`, `.ur/verify.json` |
 | Models | `/model`, `ur model-doctor`, model router, Ollama discovery | Ollama endpoint, settings, `OLLAMA_MODEL`, model metadata cache |
 
@@ -258,7 +297,7 @@ and route model work through the local Ollama-backed UR runtime.
 | Auto compaction and memory retention | `compaction.autoThreshold`, `ur memory retention` | Configurable context compaction threshold plus TTL/max/decay pruning for `.ur/memory/*.jsonl` |
 | Code-index auto-reindex | `codeIndex.autoReindex`, `ur code-index watch` | File watcher that rebuilds the local semantic code index after source changes |
 | Live artifact steering | `ur artifacts comment <id> --feedback ... --task <bg_id>` | Artifact feedback is queued into the linked background task inbox and injected into active stream-json background agents as `priority: "now"` turns |
-| Opt-in A2A + compatibility server | `ur a2a serve`, `/a2a/jsonrpc`, `/a2a/tasks` | Official-SDK A2A v0.3 JSON-RPC task lifecycle plus clearly separate token/delegation-protected UR background-task compatibility routes |
+| Opt-in A2A + compatibility server | `ur a2a serve`, `/a2a/jsonrpc`, `/a2a/v1/*`, `/a2a/tasks` | Negotiated v1 JSON-RPC/HTTP+JSON and stable-SDK v0.3, plus clearly separate protected UR background-task compatibility routes |
 | IDE inline diff bundles | `ur ide diff capture|list|show|comment|schema`, `extensions/vscode-ur-inline-diffs/` | Editor-readable `.ur/ide/diffs/` manifest, metadata, patch files, comments, plus a native VS Code tree/webview review extension |
 | Benchmark adapters | `ur eval bench swe-bench|terminal-bench|aider-polyglot` | Imports local benchmark JSON/JSONL exports into UR eval suites without external downloads |
 
@@ -271,12 +310,12 @@ and route model work through the local Ollama-backed UR runtime.
 | Model capability report | `ur model-doctor` | Local Ollama model inventory with context length, advertised capabilities, and likely vision/code readiness |
 | Reusable agent templates | `ur agent-templates install` | Project agents for review, tests, browser QA, docs research, security, release notes, PR fixes, and memory curation |
 | GitHub agent runner | `.github/workflows/ur.yml` scaffold | Opt-in CI entry point for manual prompts or `/ur` issue comments |
-| A2A interoperability | `ur a2a serve` | Accurate Agent Card, stable A2A v0.3 JSON-RPC binding, and separate UR compatibility task API; A2A v1 waits for the official stable JS SDK |
+| A2A interoperability | `ur a2a serve` | Version-negotiated strict v1 JSON-RPC/HTTP+JSON plus stable-SDK v0.3, durable tenant-isolated protocol state, and a separate UR compatibility API |
 | Semantic memory index | `ur semantic-memory build|search` | Local memory index over durable memory, docs, README, and UR instructions |
 | Claim provenance ledger | `ur claim-ledger add|list|validate` | Maps generated claims to web, file, MCP, tool, or user sources |
 | Browser replay evals | `ur browser-qa list|validate|run` | Validates replay fixtures and performs lightweight target smoke checks |
 | Permission and safety policy | `ur safety status|init|check` | Project-aware shell safety checks for destructive operations, sandbox recommendations, permission classes, and secret exfiltration denial |
-| Project context pack | `ur context-pack scan|remember|compress` | Architecture manifest, durable task memory, and compressed context summaries based on manifests and instructions |
+| Project context pack | `ur context-pack scan|remember|memory|compress` | Architecture manifest, provenance/hash-chained task memory with verify/quarantine/rollback, and compressed context summaries |
 
 ## Design Notes
 

package/docs/AGENT_TRENDS.md

@@ -13,6 +13,7 @@ ur agent-trends
 ur agent-trends --json
 ur a2a card
 ur a2a card --base-url https://example.com
+ur ag-ui serve --help
 ur agent-features
 ur agent-features init
 ur agent-templates install
@@ -70,13 +71,14 @@ Inside an interactive session:
 | Trend | UR status | Current coverage | Professional next step |
 | --- | --- | --- | --- |
 | Provider-flexible, local-first runtime | Covered | Local Ollama; direct OpenAI, Anthropic, Gemini, OpenRouter, and OpenAI-compatible APIs; authenticated subscription-CLI adapters; explicit provider selection | Normalize capability discovery across providers and make automatic per-step routing opt-in |
-| MCP tool ecosystem | Covered | `ur mcp`, MCP OAuth/XAA helpers, elicitation, fail-closed permission checks, bounded execution, shared tool registry | Keep the production v1 SDK pinned while testing the final 2026 stateless-core transition separately |
-| MCP Tasks and MCP Apps | Adapter-ready | UR's durable task engine could back protocol tasks, but UR advertises neither experimental Tasks nor an Apps renderer | Prototype negotiated extensions; ship only against a final spec and production SDK, with context-bound task auth and cancellation |
-| A2A / Agent Card interoperability | Partial | Official-SDK A2A v0.3 Agent Card + JSON-RPC binding at `/a2a/jsonrpc`; separate UR compatibility task routes; bearer/delegation auth | Add a negotiated v1 dual stack, signed-card verification, and official TCK coverage when the JavaScript SDK v1 line is stable |
+| MCP tool ecosystem | Covered | `ur mcp`, MCP OAuth/XAA/elicitation, fail-closed bounded stdio tools, and the opt-in stateless MCP 2026 HTTP adapter | Track the final 2026 spec/SDK and add independent-client fixtures before promoting the adapter |
+| MCP Tasks and MCP Apps | Covered | Negotiated Tasks lifecycle, owner-isolated durable state, and a self-contained Apps resource through `ur mcp serve-http` | Reconcile final extension schemas and broaden client interoperability tests |
+| A2A / Agent Card interoperability | Covered | Stable-SDK v0.3 plus strict v1 ProtoJSON JSON-RPC/HTTP+JSON, negotiated cards, tenant isolation, durable artifacts, and TCK coverage | Adopt the stable v1 SDK when released; add signed-card verification and streaming only with truthful end-to-end tests |
+| AG-UI agent-to-frontend interoperability | Covered | Official-schema HTTP/SSE adapter, truthful capabilities, ordered state/text/tool events, cancellation, exact CORS, bounded requests/output, and loopback-or-bearer security | Add independent frontend fixtures before advertising optional interrupts, binary/WebSocket transport, or client tools |
 | Durable workflows and checkpoints | Covered | resume, rewind, `ur bg` background runs, optional worktrees/PRs, cron/workflow internals, file restore | Publish a checkpointed workflow format for repeated automations |
 | Multi-agent orchestration | Covered | built-in planning, exploration, verification, and general-purpose agents; custom agents | Document reusable team patterns and role selection |
-| Long-term memory | Partial | `/remember`, `/forget`, `.ur/memory`, optional local dense retrieval plus lexical fallback, semantic code search, provenance, consolidation, retention | Add scope deletion guarantees and integrity baselines, quarantine, and rollback for poisoned memory writes |
-| Portable Agent Skills | Partial | Project/user/plugin/remote/bundled `SKILL.md` support, lazy Skill tool, creation and skillification, skill-scoped permissions | Add strict open-spec validation plus signed provenance and permission manifests before community-registry installation |
+| Long-term memory | Partial | Existing memory/retrieval plus a provenance-rich SHA-256 project task-memory chain with private atomic writes, verification, quarantine, and rollback | Extend the same deletion and integrity guarantees to team, semantic, embedding, and legacy stores |
+| Portable Agent Skills | Covered | Native and `.agents/skills/` project/user discovery, strict validation, deterministic tree/permission digests, Ed25519 signing, trusted keys, and invocation-time integrity checks | Require registry attestations and dependency review before community one-command installation |
 | Semantic codebase retrieval | Covered | local embedding-based code index (`ur code-index`), opt-in `CodeSearch` tool, incremental re-index, auto-reindex watcher, Ollama embeddings | Add richer symbol-aware ranking |
 | Reliable repo editing | Covered | `ur repo-edit` builds a file/symbol index, performs AST-aware JS/TS identifier rename planning, previews patches before writing, and applies multi-file edits transactionally with rollback on syntax or check failure | Extend AST edits beyond identifier rename into import moves and signature-aware refactors |
 | Permission and safety policy | Covered | `ur safety`, `.ur/safety-policy.json`, pre-Bash safety evaluation, read/write/execute/network command classes, destructive-command approval, sandbox recommendations, and secret exfiltration denial | Record sandbox attestation in every risky command's evidence trail |
@@ -85,7 +87,7 @@ Inside an interactive session:
 | Browser and computer-use workflows | Covered | `/browser`, `/chrome`, Playwright-aware tasks, WebSearch, WebFetch, risky-action approval | Add more release fixtures with screenshots and replay assertions |
 | Provenance and citations | Partial | WebFetch source URLs, `/cite`, `/graph`, `/trace`, evidence ledgers | Add claim-to-source mapping for web/MCP answers |
 | Evals and observability | Partial | verifier gates, `.ur/verify.json`, `/verify`, `/trace`, OpenTelemetry hooks, replayable evals, dashboard, benchmark adapters | Grade complete trajectories in CI and publish versioned pass rates by category |
-| Standard GenAI telemetry | Partial | Internal interaction/model/tool/agent/hook spans and bounded Perfetto traces | Dual-emit current OpenTelemetry GenAI semantics with sensitive content redacted by default |
+| Standard GenAI telemetry | Covered | Explicit OTLP/console exporters; GenAI inference, agent/workflow, tool, memory, token, cache, response, latency, streaming time-to-first-chunk/inter-output-chunk, and error semantics; content off by default | Add trajectory policy graders and cross-provider dashboards without increasing content capture/cardinality |
 | Test-first execution | Covered | `ur test-first` detects compile/test/lint commands, stores failure traces, retries through a fix agent, and installs detected commands into `.ur/verify.json` for edit-time gates | Add per-package command plans for large monorepos |
 | Security and prompt-injection resistance | Covered | allow/ask/deny permissions, shell safety analysis, secret scan, untrusted web-content guidance, OS-level execution sandbox (macOS Seatbelt, Linux bubblewrap) | Continuously test web/MCP/repository/skill/memory injection, confused-deputy, and tool-abuse cases |
 | Agent identity and delegated authorization | Covered | MCP OAuth/XAA helpers, issuer-minted A2A bearer/delegation tokens, subject/audience/expiry/skill binding, local trust boundaries, permission rules | Keep delegated scopes narrow and auditable; HMAC child-token narrowing remains issuer-side |
@@ -96,8 +98,8 @@ Inside an interactive session:
 | Self-healing CI | Covered | `ur ci-loop` reports its resolved cwd, preserves assertion/stack context, stops no-test configuration failures before invoking a fixer, and re-runs real failures with bounded retries; commits/pushes require explicit flags and are self-review gated | Wire to `ur trigger` so a failed CI webhook can explicitly launch the loop |
 | Verifiable artifacts | Covered | `ur artifacts` records plans/diffs/test-runs with approve/reject/feedback under `.ur/artifacts/`; comments steer active background agents through stream-json inbox injection | Attach browser-QA screenshots and link artifacts to claim-ledger entries |
 | Native IDE review | Covered | `ur ide diff` bundles, a VS Code tree/webview/comment surface with background task controls, and a buildable JetBrains ACP client with cancellation | Add signed marketplace packaging and keep behavior parity covered in editor-host integration tests |
-| ACP / IDE agent server | Partial | Official-SDK ACP v1 stdio agent with permission requests, MCP stdio/HTTP/SSE, additional roots, persistent resume, close, and cancellation; separate UR HTTP JSON-RPC for scripts | Add paginated `session/list`/`session/delete`, then exact-history `session/load`; advertise config/slash capabilities only when complete |
-| Provider-native durable inference | Partial | UR provides provider-independent background processes and local compaction, while direct OpenAI requests still use Chat Completions | Add an opt-in Responses adapter for background/WebSocket execution, server compaction, and deferred tool discovery with privacy-aware defaults |
+| ACP / IDE agent server | Covered | Official-SDK ACP v1 with durable list/load/delete/resume/close, exact replay, modes, config options, commands, permissions, MCP, roots, streaming, and cancellation | Add editor-host interoperability fixtures before expanding optional UX capabilities |
+| Provider-native durable inference | Covered | Chat Completions remains default; opt-in Responses adds SSE, background polling/cancel, WebSocket continuation, compaction, deferred tools, and `store=false` | Generalize explicit provider capability discovery without silently emulating native features |
 | External tool integration | Covered | Built-in `GitHub`, `Api`, `Browser`, `Docker`, `TestRunner`, and `Database` tools complement existing file-system, terminal, web, and MCP tools | Add richer output parsing and error recovery |
 
 ## v1.13.9 Direct CLI Surfaces
@@ -118,13 +120,13 @@ ur artifacts capture-tests --command "bun test"
 
 ## A2A Position
 
-`ur a2a serve` exposes a real A2A v0.3 JSON-RPC binding, implemented by the
-official stable JavaScript SDK, at `/a2a/jsonrpc`. Its discoverable Agent Card
-is served at `/.well-known/agent-card.json`; the advertised URL, transport,
-protocol version, capabilities, and configured security schemes match the
-running server. Protocol tasks are durable under `.ur/a2a/`, and retrieval,
-continuation, references, and cancellation are isolated by delegation subject
-and skill scope. Streaming and push notifications are not advertised.
+`ur a2a serve` keeps the official stable JavaScript SDK's v0.3 JSON-RPC binding
+at `/a2a/jsonrpc` and adds separate strict v1 ProtoJSON JSON-RPC and HTTP+JSON
+bindings. `/.well-known/agent-card.json` returns the v1 card by default and the
+v0.3 card for `A2A-Version: 0.3`; `Vary` prevents cache confusion. The v1
+routes provide durable tasks/artifacts, pagination, continuation, references,
+cancellation, and tenant isolation. Streaming and push notifications are not
+advertised.
 
 The existing `/a2a/tasks` submission/list/status/output/cancel routes are a
 separate **UR compatibility API**, not an A2A REST binding. They remain useful
@@ -137,11 +139,10 @@ The server refuses unauthenticated off-loopback binds and requires
 `--public-base-url` for wildcard binds so discovery never advertises
 `0.0.0.0`. Prefer `UR_A2A_TOKEN` and `UR_A2A_DELEGATION_SECRET` over argv
 secrets. Request size, prompt size, output size, submission rate, concurrent
-submissions, and active tasks are bounded by `UR_A2A_*` settings. The current
-A2A protocol release is v1, but the official JavaScript SDK's stable line still
-implements v0.3 and its `next` v1 line is beta. UR deliberately stays on the
-official stable v0.3 binding until a production v1 SDK and conformance path are
-available, then should run both versions during a negotiated migration.
+submissions, and active tasks are bounded by `UR_A2A_*` settings. UR's v1
+compatibility layer is covered by the official TCK while the JavaScript SDK's
+v1 line remains prerelease; the stable v0.3 path therefore stays available
+during the negotiated migration.
 
 ## Model Runtime Position
 
@@ -152,28 +153,26 @@ and model selection are explicit, credentials are resolved through the
 credential layer, and the optional fallback setting is diagnostic advice rather
 than an automatic provider switch.
 
-## 2026-07-15 Frontier Priorities
-
-The research conducted after the `1.46.0` version bump produced this ordered
-backlog. Prerelease protocol work should remain behind capability flags and must
-not replace the production path until its SDK and conformance tooling are stable.
-
-1. Add an A2A v1 dual stack with version negotiation, signed Agent Card
-   verification, multi-tenant isolation, and official TCK coverage.
-2. Complete ACP's durable session lifecycle with paginated `session/list` and
-   `session/delete`; implement `session/load` only with exact ordered replay.
-3. Prepare for MCP's stateless core and negotiated Tasks/Apps extensions on a
-   compatibility branch. The announced 2026-07-28 specification is not yet the
-   production baseline for this snapshot.
-4. Add an opt-in Responses adapter: privacy-aware background execution,
-   authenticated webhooks or bounded polling, WebSocket continuation, opaque
-   compaction preservation, and deferred tool search.
-5. Adopt OpenTelemetry GenAI semantic conventions and trace graders as CI
-   regression gates without exporting prompts, tool arguments, retrieval
-   queries, or results by default.
-6. Treat durable memories and installable skills as supply-chain inputs:
-   validate provenance, constrain capabilities, quarantine suspicious writes,
-   and provide integrity snapshots and rollback.
+## v1.47 Frontier Priorities
+
+The `1.46.0` frontier set is implemented in `1.47.0`. A second free/open-source
+scan after the version bump also closed AG-UI frontend interoperability,
+cross-client `.agents/skills/` discovery, and the latest OpenTelemetry
+`invoke_workflow`/streaming-chunk latency gap. The remaining ordered backlog keeps
+prerelease protocols opt-in and focuses on evidence and trust:
+
+1. Adopt final MCP 2026 and stable A2A v1 SDK artifacts when published, while
+   preserving dual-stack negotiation and independent-client fixtures.
+2. Add A2A signed-card verification, streaming/resubscription, and push only
+   with authenticated end-to-end conformance tests.
+3. Extend task-memory provenance, deletion proofs, quarantine, and rollback to
+   every team, semantic, embedding-backed, and legacy memory store.
+4. Turn trajectory graders for tool choice, handoffs, policy compliance,
+   recovery, and outcome quality into versioned CI regression gates.
+5. Require registry attestations, dependency review, revocation, and update
+   transparency before one-command community skill/plugin installation.
+6. Enforce claim-to-source links for final web/MCP answers and complete Windows
+   OS-sandbox parity.
 
 ## Source And Trust Policy
 
@@ -199,12 +198,17 @@ Professional answer requirements:
 - OpenAI agent evals: https://developers.openai.com/api/docs/guides/agent-evals
 - Model Context Protocol: https://modelcontextprotocol.io/docs/getting-started/intro
 - MCP 2026-07-28 release candidate: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/
-- MCP Tasks extension: https://modelcontextprotocol.io/extensions/tasks/overview
+- MCP Tasks extension: https://tasks.extensions.modelcontextprotocol.io/
+- MCP Apps extension: https://apps.extensions.modelcontextprotocol.io/
 - ACP v1 schema: https://agentclientprotocol.com/protocol/v1/schema
 - A2A protocol specification: https://a2a-protocol.org/latest/specification/
 - A2A JavaScript SDK: https://github.com/a2aproject/a2a-js
-- Open Agent Skills specification: https://openagentskills.dev/docs/specification
+- Agent Skills specification: https://agentskills.io/specification
+- Agent Skills integration guide: https://agentskills.io/client-implementation/adding-skills-support
+- AG-UI documentation: https://docs.ag-ui.com/
+- AG-UI reference implementation: https://github.com/ag-ui-protocol/ag-ui
 - OpenTelemetry GenAI semantic conventions: https://opentelemetry.io/docs/specs/semconv/registry/attributes/gen-ai/
+- OpenTelemetry GenAI metrics: https://github.com/open-telemetry/semantic-conventions-genai/blob/main/docs/gen-ai/gen-ai-metrics.md
 - OWASP AI Agent Security Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/AI_Agent_Security_Cheat_Sheet.html
 - OWASP Agent Memory Guard: https://owasp.org/www-project-agent-memory-guard/
 - LangGraph overview: https://docs.langchain.com/oss/python/langgraph/overview

package/docs/AG_UI.md

@@ -0,0 +1,132 @@
+# AG-UI Integration
+
+UR-Nexus 1.47 exposes an opt-in [AG-UI](https://docs.ag-ui.com/) HTTP adapter
+for user-facing applications. It validates the official `RunAgentInput` schema
+and streams official AG-UI lifecycle, text, state, step, and tool events over
+Server-Sent Events (SSE).
+
+## Start the adapter
+
+```sh
+ur ag-ui serve
+```
+
+The default endpoint is `http://127.0.0.1:8977/ag-ui`. The adapter also exposes:
+
+- `GET /ag-ui/capabilities` — machine-readable, schema-validated capabilities.
+- `GET /healthz` — lightweight process health.
+
+The default loopback binding requires no bearer token. To expose the adapter on
+another interface, configure authentication in the environment:
+
+```sh
+UR_AG_UI_TOKEN='<random-secret>' \
+  ur ag-ui serve --host 0.0.0.0 --port 8977
+```
+
+UR refuses an off-loopback bind without `UR_AG_UI_TOKEN`. Put the server behind
+TLS before sending a bearer token over a non-loopback network.
+
+## Browser clients
+
+Browser origins are denied unless they are explicitly listed. Each value must
+be an exact HTTP(S) origin, without a path, query, credentials, or wildcard:
+
+```sh
+ur ag-ui serve \
+  --allow-origin https://app.example.com https://admin.example.com
+```
+
+When authentication is configured, send `Authorization: Bearer <token>`. The
+endpoint requires `Content-Type: application/json` and an `Accept` value that
+allows `text/event-stream`.
+
+## Minimal request
+
+```sh
+curl --no-buffer http://127.0.0.1:8977/ag-ui \
+  -H 'Accept: text/event-stream' \
+  -H 'Content-Type: application/json' \
+  --data-binary '{
+    "threadId": "thread-1",
+    "runId": "run-1",
+    "state": {},
+    "messages": [
+      {"id": "message-1", "role": "user", "content": "Review this repository."}
+    ],
+    "tools": [],
+    "context": [],
+    "forwardedProps": {}
+  }'
+```
+
+The response is an ordered SSE stream beginning with `RUN_STARTED` and a
+`STATE_SNAPSHOT`. UR then emits step, text, and tool events and terminates with
+`RUN_FINISHED` or a redacted `RUN_ERROR`. The server validates every emitted
+event through the official AG-UI schemas and uses the official SSE encoder.
+
+## Supported contract
+
+This adapter deliberately advertises only behavior that is implemented end to
+end:
+
+- HTTP/SSE streaming, text input/output, state snapshots, UR-configured tools,
+  cancellation on disconnect, delegation, and code execution are supported.
+- Client-provided tools, multimodal input, encrypted input, interrupt resume,
+  persistent AG-UI state, WebSocket/binary transport, push notifications,
+  reasoning events, and interactive human approvals are not advertised.
+- Unsupported input is rejected with a structured `4xx` error; it is never
+  silently discarded.
+
+Every request supplies the complete transcript, state, context, and forwarded
+properties for that run. UR labels this envelope as untrusted client data so a
+client-supplied system message cannot replace UR's own system or safety policy.
+Adapter runs use isolated session IDs and disable child-session persistence.
+
+## Permissions
+
+Select a permission mode explicitly when necessary:
+
+```sh
+ur ag-ui serve --permission-mode plan
+ur ag-ui serve --permission-mode acceptEdits
+```
+
+The default is `default`. Because AG-UI runs have no interactive terminal
+approval channel, any operation that still requires a prompt is denied. `plan`
+is the safest read-oriented mode. Use `acceptEdits` only in a workspace where
+the adapter is authorized to edit files; other permission checks still apply.
+
+## Resource controls
+
+The following environment variables are optional. Invalid or excessive values
+fall back to bounded defaults or are capped by the implementation.
+
+| Variable | Default | Purpose |
+| --- | ---: | --- |
+| `UR_AG_UI_TOKEN` | unset | Required bearer secret for off-loopback binds. |
+| `UR_AG_UI_MAX_REQUEST_BYTES` | `2000000` | Maximum request-body bytes. |
+| `UR_AG_UI_MAX_CALLS_PER_MINUTE` | `120` | Rolling request rate per server process. |
+| `UR_AG_UI_MAX_CONCURRENT_RUNS` | `8` | Concurrent active runs. |
+| `UR_AG_UI_PROMPT_TIMEOUT_MS` | `1800000` | Per-run execution deadline. |
+| `UR_AG_UI_MAX_OUTPUT_CHARS` | `10485760` | Maximum child stream output. |
+
+Duplicate active `threadId`/`runId` pairs are rejected per authenticated owner.
+Requests, identifiers, transcript/context data, tool payloads, output, stderr,
+and stream lines are independently bounded. Error responses do not expose
+provider stderr or internal exception details.
+
+## Cost and privacy
+
+AG-UI and the adapter dependencies are free/open-source software. Running an
+AG-UI request uses whichever model provider UR is configured to use; that
+provider may have its own pricing. Select a local Ollama model when you need a
+fully local path without paid API calls. The deterministic AG-UI tests use an
+injected fake runner and never contact a model provider.
+
+Protocol references:
+
+- [AG-UI architecture](https://docs.ag-ui.com/concepts/architecture)
+- [AG-UI events](https://docs.ag-ui.com/concepts/events)
+- [AG-UI JavaScript types](https://docs.ag-ui.com/sdk/js/core/types)
+- [AG-UI reference implementation](https://github.com/ag-ui-protocol/ag-ui)