asap-protocol 2.1.0__tar.gz → 2.2.0__tar.gz

{asap_protocol-2.1.0 → asap_protocol-2.2.0}/.gitignore

@@ -177,9 +177,11 @@ cython_debug/
 
 # Project specific
 !/.cursor/
+/drafts/
 # Strategy docs (private — do not commit)
 .cursor/product-specs/strategy/
 node_modules/
+.pnpm-store/
 .github/wiki/
 
 # Next.js app lib (do not ignore; root lib/ is for Python)

{asap_protocol-2.1.0 → asap_protocol-2.2.0}/CHANGELOG.md

@@ -12,6 +12,131 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [2.2.0] - 2026-04-15
+
+Protocol Hardening release: per-runtime agent identity, capability-based authorization, approval flows, SSE streaming, structured error taxonomy, version negotiation, and async state stores.
+
+### Added
+
+#### Per-Runtime Agent Identity (S1, ADR-17 extension)
+- **Host/Agent JWT**: `create_host_jwt`, `create_agent_jwt`, `verify_host_jwt`, `verify_agent_jwt` — Ed25519 (EdDSA) JWTs with `jti` replay cache (`auth/agent_jwt.py`)
+- **Identity stores**: `HostIdentity`, `AgentSession`, `HostStore`, `AgentStore`, `InMemoryHostStore`, `InMemoryAgentStore` — per-host and per-agent identity with JWK thumbprint (RFC 7638) (`auth/identity.py`)
+- **Agent endpoints**: `POST /asap/agent/register`, `GET /asap/agent/status`, `POST /asap/agent/revoke`, `POST /asap/agent/rotate-key` — Host JWT Bearer authentication (`transport/agent_routes.py`)
+
+#### Capability-Based Authorization (S1)
+- **Capability system**: `CapabilityDefinition`, `CapabilityGrant`, `CapabilityRegistry`, `validate_constraints` — grants with constraints (`max`, `min`, `in`, `not_in`) (`auth/capabilities.py`)
+- **Capability endpoints**: `GET /asap/capability/list`, `GET /asap/capability/describe`, `POST /asap/capability/execute`, `POST /asap/agent/reactivate` (`transport/capability_routes.py`)
+
+#### Agent Lifecycle (S1)
+- **Session lifecycle**: `check_agent_expiry`, `extend_session`, `reactivate_agent` — TTL-based session management (`auth/lifecycle.py`)
+
+#### Approval Flows (S2)
+- **Device Authorization & CIBA**: `create_device_authorization`, `create_ciba_approval`, `select_approval_method`, `ApprovalStore`, `InMemoryApprovalStore` — RFC 8628 / CIBA-style approval (`auth/approval.py`)
+- **A2H channel**: `A2HApprovalChannel` for agent-to-human approval resolution
+
+#### Self-Auth Prevention (S2)
+- **Fresh session**: `FreshSessionConfig`, `check_fresh_session`, `fresh_session_violation_detail` — time-windowed Host JWT validation (`auth/self_auth.py`)
+- **WebAuthn**: Optional `WebAuthnVerifier` for high-risk capability registration
+
+#### SSE Streaming (S3)
+- **SSE endpoint**: `POST /asap/stream` returns `text/event-stream` with Envelope JSON events (`transport/server.py`)
+- **TaskStream payload**: Streaming chunks with `chunk`, `progress`, `final`, `status` fields (`models/payloads.py`)
+- **Client streaming**: `ASAPClient.stream(envelope)` parses SSE events into Envelope objects (`transport/client.py`)
+- **Streaming handlers**: `HandlerRegistry.register_streaming_handler`, `dispatch_stream_async` for async generator handlers (`transport/handlers.py`)
+
+#### Error Taxonomy (S3, PRD §4.7)
+- **Error hierarchy**: `RecoverableError` / `FatalError` base classes with taxonomy URIs and JSON-RPC codes (-32000 to -32059) (`errors.py`)
+- **Recovery hints**: `retry_after_ms`, `alternative_agents`, `fallback_action` on all ASAP errors
+- **Remote errors**: `RemoteFatalRPCError`, `RemoteRecoverableRPCError` for client-side error reconstruction
+- **Error code registry**: Documented in `docs/error-codes.md`
+
+#### ASAP-Version Negotiation (S4)
+- **Version header**: `ASAP-Version` request/response header for wire-level version negotiation (`models/constants.py`)
+- **Version middleware**: `ASAPVersionMiddleware` validates version on `POST /asap` and `POST /asap/stream`; returns `VERSION_INCOMPATIBLE` JSON-RPC error for unsupported versions (`transport/middleware.py`)
+- **Client negotiation**: `ASAPClient` sends supported versions and tracks `last_response_asap_version` (`transport/client.py`)
+- **Manifest field**: `Manifest.supported_versions` for discovery-time version advertisement
+
+#### Async State Stores (S4)
+- **AsyncSnapshotStore**: Async protocol (`save`, `get`, `list_versions`, `delete`) replacing sync `SnapshotStore` (deprecated) (`state/snapshot.py`)
+- **AsyncMeteringStore**: Async protocol (`record`, `query`, `aggregate`) replacing sync `MeteringStore` (deprecated) (`state/metering.py`)
+- **SQLite async**: `SQLiteAsyncSnapshotStore` with WAL mode and pragma cache (`state/stores/sqlite.py`)
+
+#### JSON-RPC Batch Operations (S5)
+- **Server-side batch**: `POST /asap` accepts JSON arrays per JSON-RPC 2.0 batch spec; processes each request independently and returns array of responses (`transport/server.py`)
+- **Batch size limit**: Configurable `max_batch_size` (default 50); oversized batches rejected with `INVALID_REQUEST` error
+- **Rate limit integration**: `ASAPRateLimiter.check_n()` counts batch sub-requests against rate limits (`transport/rate_limit.py`)
+- **Client batch**: `ASAPClient.batch(envelopes)` sends single HTTP request with JSON array body (`transport/client.py`)
+
+#### Tamper-Evident Audit Logging (S5)
+- **Audit models**: `AuditEntry` with SHA-256 hash chain (`prev_hash` → `hash`) for tamper detection (`economics/audit.py`)
+- **AuditStore protocol**: `append`, `query`, `verify_chain`, `count` — with `InMemoryAuditStore` and `SQLiteAuditStore` implementations
+- **Audit hooks**: Optional `audit_store` parameter in `create_app`; automatic logging of successful message processing
+- **Audit API**: `GET /audit` with `urn`, `start`, `end`, `limit`, `offset` query parameters
+
+#### Compliance Harness v2 (S5)
+- **Harness runner**: `run_compliance_harness_v2(app)` validates ASGI applications against v2.2 spec (`testing/compliance.py`)
+- **Check categories**: Identity, streaming, errors, versioning, batch, audit — each with multiple checks
+- **Compliance report**: `ComplianceReport` with score (0.0–1.0), check results, and JSON export via `to_json()`
+
+### Security
+
+- **Dependency upgrades**: pillow 12.2.0 (CVE-2026-40192), pytest 9.0.3 (CVE-2025-71176), python-multipart 0.0.26 (CVE-2026-40347), langsmith 0.7.32 (GHSA-rr7j-v2q5-chgv)
+- **Self-auth prevention**: Agents cannot register capabilities without fresh host session and optional WebAuthn verification
+- **JTI replay cache**: Prevents JWT replay on mutating agent identity endpoints
+
+### Changed
+
+- **Wire version**: Default transport version bumped from `2.1` to `2.2`; backward compatible with `2.1`
+- **State stores**: `SnapshotStore` and `MeteringStore` sync protocols deprecated in favor of async variants
+
+### Technical Details
+
+- **Python**: 3.13+
+- **Tests**: 2941 passed, 7 skipped; full CI green (ruff, mypy, pytest, pip-audit)
+- **Coverage**: ≥90% for new v2.2 modules
+- **Full Changelog**: https://github.com/adriannoes/asap-protocol/compare/v2.1.1...v2.2.0
+
+---
+
+## [2.1.1] - 2026-03-01
+
+Patch release addressing tech debt and findings from the v2.1.0 Red-Team code review. Backward compatible with v2.1.0.
+
+### Security
+
+- **SEC-01 — JWT algorithm allowlist**: `jose_jwt.decode()` in `auth/jwks.py` and `auth/middleware.py` now restricts algorithms to `EdDSA`, `RS256`, `ES256`, preventing algorithm confusion attacks (RFC 8725 §3.2).
+- **Delegation `aud` claim**: RFC 7519 allows `aud` as an array; `economics/delegation.py` now coerces list to first element instead of string repr.
+- **Vercel AI router**: SECURITY WARNING in docstring and optional `api_key_header` parameter for auth.
+- **Frontend SSRF**: Agent registration URL validation now resolves DNS and blocks private/loopback IPs (DNS rebinding protection).
+
+### Architecture & Concurrency
+
+- **ARCH-01 — SQLite async bridging**: `state/stores/sqlite.py` exposes `save_async`, `get_async`, `list_versions_async`, `delete_async` using aiosqlite directly, avoiding `_run_sync` and event-loop blocking under concurrent load.
+- **CONC-01**: Replaced `threading.Lock` with `asyncio.Lock` in `auth/oidc.py` and `auth/jwks.py` for cache guards so the event loop is not blocked.
+- **SQLite WAL mode**: `journal_mode=WAL` and `synchronous=NORMAL` applied when opening connections in snapshot store and economics storage for better concurrency.
+- **Registry locks**: GIL-atomic `dict.setdefault()` for registry URL locks in `discovery/registry.py` (removed threading guard).
+
+### Reliability & Limits
+
+- **Webhook dead letters**: Capped at `MAX_DEAD_LETTERS` (1000) to prevent unbounded memory growth.
+- **ManifestCache**: Background cleanup hook / periodic `cleanup_expired()` documented and ensured for memory release.
+- **InMemoryNonceStore**: Cleanup probability increased; optional max-size fallback.
+- **Rate limiting**: Optional Redis backend (`ASAP_RATE_LIMIT_BACKEND=redis://...`) for shared limits across workers.
+
+### Code Quality
+
+- **echo_handler**: `TaskRequest.model_validate(envelope.payload_dict)` instead of `**payload_dict` so Pydantic validators run.
+- **Registry**: Empty-string coercion for `repository_url`/`documentation_url` (strip then None).
+- **SQLiteMeteringStorage**: `_ensure_table_once` so schema is created once per instance.
+- **Middleware docstring**: Backlog reference updated (v2.1.1).
+- **Compression**: `prefer_fast_compression` option to prefer gzip over brotli for lower latency.
+
+### Technical Details
+
+- **Full Changelog**: https://github.com/adriannoes/asap-protocol/compare/v2.1.0...v2.1.1
+
+---
+
 ## [2.1.0] - 2026-02-28
 
 Consumer SDK, framework integrations, registry UX, agent revocation, and PyPI distribution. Backward compatible with v2.0.0.

{asap_protocol-2.1.0 → asap_protocol-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: asap-protocol
-Version: 2.1.0
+Version: 2.2.0
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/adriannoes/asap-protocol
 Project-URL: Documentation, https://adriannoes.github.io/asap-protocol
@@ -21,13 +21,13 @@ Classifier: Topic :: System :: Distributed Computing
 Classifier: Typing :: Typed
 Requires-Python: >=3.13
 Requires-Dist: aiosqlite>=0.20
-Requires-Dist: authlib>=1.3
+Requires-Dist: authlib>=1.6.9
 Requires-Dist: brotli>=1.2.0
-Requires-Dist: cryptography>=41.0
+Requires-Dist: cryptography>=46.0.7
 Requires-Dist: fastapi>=0.128.0
 Requires-Dist: httpx[http2]>=0.28.1
 Requires-Dist: jcs>=0.2.0
-Requires-Dist: joserfc>=1.0
+Requires-Dist: joserfc>=1.6.3
 Requires-Dist: jsonschema>=4.23.0
 Requires-Dist: limits>=3.0
 Requires-Dist: opentelemetry-api>=1.20
@@ -53,7 +53,7 @@ Requires-Dist: pytest-asyncio>=0.24; extra == 'dev'
 Requires-Dist: pytest-benchmark>=5.1; extra == 'dev'
 Requires-Dist: pytest-cov>=6.0; extra == 'dev'
 Requires-Dist: pytest-xdist>=3.5.0; extra == 'dev'
-Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: pytest>=9.0.3; extra == 'dev'
 Requires-Dist: ruff>=0.14.14; extra == 'dev'
 Requires-Dist: types-jsonschema>=4.0.0; extra == 'dev'
 Provides-Extra: dns-sd
@@ -62,6 +62,7 @@ Provides-Extra: docs
 Requires-Dist: ghp-import>=2.1.0; extra == 'docs'
 Requires-Dist: mkdocs-material>=9.5; extra == 'docs'
 Requires-Dist: mkdocstrings[python]>=0.27; extra == 'docs'
+Requires-Dist: pymdown-extensions>=10.21; extra == 'docs'
 Provides-Extra: langchain
 Requires-Dist: langchain-core>=0.2; extra == 'langchain'
 Provides-Extra: llamaindex
@@ -87,9 +88,9 @@ Description-Content-Type: text/markdown
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: `v2.0.0` | `Apache 2.0` | `Python 3.13+` | [Marketplace](https://asap-protocol.vercel.app/) | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | [PyPI](https://pypi.org/project/asap-protocol/) | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
+**Quick Info**: `v2.1.1` | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | [PyPI](https://pypi.org/project/asap-protocol/) | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
 
-> 🚀 **Live now**: [**Agent Marketplace**](https://asap-protocol.vercel.app/) — Browse agents, register yours, request verification.
+> 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.vercel.app/) — Browse agents, register yours, request verification.
 
 ## Why ASAP?
 
@@ -98,13 +99,10 @@ Building multi-agent systems today suffers from three core technical challenges
 2. **State Drift**: Lack of native persistence makes it impossible to reliably resume long-running agentic workflows.
 3. **Fragmentation**: No unified way to handle task delegation, artifact exchange and tool execution (MCP) in a single envelope.
 
-**ASAP** provides a production-ready communication layer that simplifies these complexities. It's ideal for **multi-agent orchestration**, **stateful workflows** (persistence, resumability), **MCP integration**, and **production systems** requiring high-performance, type-safe agent communication. 
+**ASAP** provides a production-ready communication layer that simplifies these complexities. It's ideal for **multi-agent orchestration**, **stateful workflows** (persistence, resumability), **MCP support** and **production systems** requiring high-performance, type-safe agent communication. 
 
 For simple point-to-point communication, a basic HTTP API might suffice; ASAP shines when you need orchestration, state management and multi-agent coordination. See the [spec](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/v0-original-specs.md) for details.
 
-### 🔌 Framework Ecosystem
-ASAP is built for interoperability. Seamlessly integrate your agents into **LangChain**, **CrewAI**, **LlamaIndex**, and **OpenClaw** workflows using our growing library of native adapters and standardized tool-calling schemas.
-
 ### Key Features
 
 - **Stateful orchestration** — Task state machine with snapshotting for resumable workflows.
@@ -112,8 +110,11 @@ ASAP is built for interoperability. Seamlessly integrate your agents into **Lang
 - **Async-native** — `asyncio` + `httpx`; sync and async handlers supported.
 - **MCP integration** — Tool execution and coordination in a single envelope.
 - **Observable** — `trace_id` and `correlation_id` for debugging.
-- **Security** — Bearer auth, OAuth2/JWT (v1.1), Ed25519 signed manifests (v1.2), optional mTLS, replay prevention, HTTPS, rate limiting. [v1.1 Security Model](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/v1.1-security-model.md) (trust limits, Custom Claims).
-- **Economics (v1.3)** — Usage metering, delegation tokens, SLA framework with breach alerts.
+- **Security** — Bearer auth, OAuth2/JWT, Ed25519 signed manifests, optional mTLS, replay prevention, HTTPS, rate limiting. [Security Model](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/v1.1-security-model.md) (trust limits, Custom Claims).
+- **Economics** — Usage metering, delegation tokens, SLA framework with breach alerts.
+
+### 🆕 Framework Ecosystem
+ASAP is built for interoperability. Seamlessly integrate your agents into **OpenClaw**, **LangChain**, **CrewAI** and **LlamaIndex** workflows using our growing library of native adapters and standardized tool-calling schemas.
 
 ## Installation
 
@@ -129,7 +130,7 @@ Or with pip:
 pip install asap-protocol
 ```
 
-📦 **Available on [PyPI](https://pypi.org/project/asap-protocol/)**. For reproducible environments, prefer `uv` when possible.
+📦 **Available on [PyPI](https://pypi.org/project/asap-protocol/)** — for reproducible environments, prefer `uv` when possible.
 
 ## Quick Start
 
@@ -139,23 +140,9 @@ pip install asap-protocol
 uv run python -m asap.examples.run_demo
 ```
 
-**v2.0.0** — [**Agent Marketplace**](https://asap-protocol.vercel.app/) — Browse, verify, and register agents. Lean Registry, Verified Badge, IssueOps.
-
-**v1.4.0 showcase** (Pagination on Usage & SLA history):
-
-```bash
-uv run python -m asap.examples.v1_4_0_showcase
-```
-
-**v1.3.0 showcase** (Delegation + Metering + SLA in one command):
-
-```bash
-uv run python -m asap.examples.v1_3_0_showcase
-```
-
 **Build your first agent** [here](docs/tutorials/first-agent.md) — server setup, client code, step-by-step (~15 min).
 
-[15+ examples](src/asap/examples/README.md): orchestration, state migration, MCP, OAuth2, WebSocket, resilience.
+[19 examples](src/asap/examples/README.md): orchestration, state migration, MCP, OAuth2, WebSocket, resilience.
 
 ## Testing
 
@@ -171,7 +158,7 @@ uv run pytest --cov=src --cov-report=term-missing
 
 [Testing Guide](https://github.com/adriannoes/asap-protocol/blob/main/docs/testing.md) (structure, fixtures, property/load/chaos tests). [Contributing](https://github.com/adriannoes/asap-protocol/blob/main/CONTRIBUTING.md) (dev setup, CI).
 
-### Compliance Harness (v1.2)
+### Compliance Harness
 
 Validate that your agent follows the ASAP protocol:
 
@@ -182,10 +169,6 @@ pytest --asap-agent-url https://your-agent.example.com -m asap_compliance
 
 See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/compliance-testing.md) for handshake, schema and state machine validation.
 
-## Benchmarks
-
-[Benchmark Results](https://github.com/adriannoes/asap-protocol/blob/main/benchmarks/RESULTS.md): load (1,500+ RPS), stress, memory.
-
 ## Documentation
 
 **Learn**
@@ -196,8 +179,8 @@ See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/
 
 **Deep Dive**
 - [State Management](https://github.com/adriannoes/asap-protocol/blob/main/docs/state-management.md) | [Best Practices: Failover & Migration](https://github.com/adriannoes/asap-protocol/blob/main/docs/best-practices/agent-failover-migration.md) | [Error Handling](https://github.com/adriannoes/asap-protocol/blob/main/docs/error-handling.md)
-- [Transport](https://github.com/adriannoes/asap-protocol/blob/main/docs/transport.md) | [Security](https://github.com/adriannoes/asap-protocol/blob/main/docs/security.md) | [v1.1 Security Model](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/v1.1-security-model.md) (OAuth2 trust, Custom Claims, ADR-17)
-- **v1.2**: [Identity Signing](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/identity-signing.md) | [Compliance Testing](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/compliance-testing.md) | [Migration v1.1→v1.2](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/migration-v1.1-to-v1.2.md) | [mTLS](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/mtls.md)
+- [Transport](https://github.com/adriannoes/asap-protocol/blob/main/docs/transport.md) | [Security](https://github.com/adriannoes/asap-protocol/blob/main/docs/security.md) | [Security Model](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/v1.1-security-model.md) (OAuth2 trust, Custom Claims)
+- [Identity Signing](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/identity-signing.md) | [Compliance Testing](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/compliance-testing.md) | [Migration v1.1 to v1.2](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/migration-v1.1-to-v1.2.md) | [mTLS](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/mtls.md)
 - [Observability](https://github.com/adriannoes/asap-protocol/blob/main/docs/observability.md) | [Testing](https://github.com/adriannoes/asap-protocol/blob/main/docs/testing.md)
 
 **Decisions & Operations**
@@ -210,39 +193,33 @@ See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/
 
 ## CLI
 
-**v1.1** adds OAuth2, WebSocket, Discovery (well-known + Lite Registry), State Storage (SQLite), and Webhooks. **v1.2** adds Ed25519 signed manifests, trust levels, optional mTLS, and the [Compliance Harness](https://github.com/adriannoes/asap-protocol/blob/main/asap-compliance/README.md). **v1.3** adds delegation commands (`asap delegation create`, `asap delegation revoke`).
+- **v1.1** adds OAuth2, WebSocket, Discovery (well-known + Lite Registry), State Storage (SQLite) and Webhooks. 
+- **v1.2** adds Ed25519 signed manifests, trust levels, optional mTLS and the [Compliance Harness](https://github.com/adriannoes/asap-protocol/blob/main/asap-compliance/README.md). 
+- **v1.3** adds delegation commands (`asap delegation create`, `asap delegation revoke`).
 
 ```bash
 asap --version                                    # Show version
 asap list-schemas                                 # List all available schemas
 asap export-schemas                               # Export JSON schemas to file
-asap keys generate -o key.pem                     # Generate Ed25519 keypair (v1.2)
-asap manifest sign -k key.pem manifest.json       # Sign manifest (v1.2)
-asap manifest verify signed.json                  # Verify signature (v1.2)
-asap manifest info signed.json                    # Show trust level (v1.2)
+asap keys generate -o key.pem                     # Generate Ed25519 keypair
+asap manifest sign -k key.pem manifest.json       # Sign manifest
+asap manifest verify signed.json                  # Verify signature
+asap manifest info signed.json                    # Show trust level
 ```
 
 See [CLI reference](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/identity-signing.md) or run `asap --help`.
 
 See [docs index](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md#v11-features-api-reference--guides) and [Identity Signing](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/identity-signing.md) for details.
 
-## What's Next? 🔭
-
-ASAP is evolving toward an **Agent Marketplace** — an open ecosystem where AI agents discover, trust and collaborate autonomously:
-
-- **v1.1**: Identity Layer (OAuth2, WebSocket, Discovery) ✅
-- **v1.2**: Trust Layer (Signed Manifests, Compliance Harness, mTLS) ✅
-- **v1.3**: Economics Layer (Metering, SLAs, Delegation) ✅
-- **v1.4**: Resilience & Scale (Type Safety, Storage Pagination) ✅
-- **v2.0**: Agent Marketplace with Web App (Lean Registry, Verified Badge, IssueOps) ✅
+## 🔭 What's Next?
 
-See our [vision document](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/vision-agent-marketplace.md) for the full roadmap.
+ASAP is evolving toward an **Agent Marketplace** — an open ecosystem where AI agents discover, trust and collaborate autonomously. See our [vision document](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/vision-agent-marketplace.md) for the full roadmap.
 
 ## Contributing
 
-**Community feedback and contributions are essential** for ASAP Protocol's evolution. 
+**Community feedback and contributions are essential** for ASAP Protocol's evolution. We're working on improvements and your input helps shape the future of the protocol. 
 
-We're working on improvements and your input helps shape the future of the protocol. Every contribution, from bug reports to feature suggestions, documentation improvements and code contributions, makes a real difference.
+Every contribution, from bug reports to feature suggestions, documentation improvements and code contributions, makes a real difference.
 
 Check out our [contributing guidelines](https://github.com/adriannoes/asap-protocol/blob/main/CONTRIBUTING.md) to get started. It's easier than you think! 🚀
 

{asap_protocol-2.1.0 → asap_protocol-2.2.0}/README.md

@@ -7,9 +7,9 @@
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: `v2.0.0` | `Apache 2.0` | `Python 3.13+` | [Marketplace](https://asap-protocol.vercel.app/) | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | [PyPI](https://pypi.org/project/asap-protocol/) | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
+**Quick Info**: `v2.1.1` | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | [PyPI](https://pypi.org/project/asap-protocol/) | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
 
-> 🚀 **Live now**: [**Agent Marketplace**](https://asap-protocol.vercel.app/) — Browse agents, register yours, request verification.
+> 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.vercel.app/) — Browse agents, register yours, request verification.
 
 ## Why ASAP?
 
@@ -18,13 +18,10 @@ Building multi-agent systems today suffers from three core technical challenges
 2. **State Drift**: Lack of native persistence makes it impossible to reliably resume long-running agentic workflows.
 3. **Fragmentation**: No unified way to handle task delegation, artifact exchange and tool execution (MCP) in a single envelope.
 
-**ASAP** provides a production-ready communication layer that simplifies these complexities. It's ideal for **multi-agent orchestration**, **stateful workflows** (persistence, resumability), **MCP integration**, and **production systems** requiring high-performance, type-safe agent communication. 
+**ASAP** provides a production-ready communication layer that simplifies these complexities. It's ideal for **multi-agent orchestration**, **stateful workflows** (persistence, resumability), **MCP support** and **production systems** requiring high-performance, type-safe agent communication. 
 
 For simple point-to-point communication, a basic HTTP API might suffice; ASAP shines when you need orchestration, state management and multi-agent coordination. See the [spec](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/v0-original-specs.md) for details.
 
-### 🔌 Framework Ecosystem
-ASAP is built for interoperability. Seamlessly integrate your agents into **LangChain**, **CrewAI**, **LlamaIndex**, and **OpenClaw** workflows using our growing library of native adapters and standardized tool-calling schemas.
-
 ### Key Features
 
 - **Stateful orchestration** — Task state machine with snapshotting for resumable workflows.
@@ -32,8 +29,11 @@ ASAP is built for interoperability. Seamlessly integrate your agents into **Lang
 - **Async-native** — `asyncio` + `httpx`; sync and async handlers supported.
 - **MCP integration** — Tool execution and coordination in a single envelope.
 - **Observable** — `trace_id` and `correlation_id` for debugging.
-- **Security** — Bearer auth, OAuth2/JWT (v1.1), Ed25519 signed manifests (v1.2), optional mTLS, replay prevention, HTTPS, rate limiting. [v1.1 Security Model](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/v1.1-security-model.md) (trust limits, Custom Claims).
-- **Economics (v1.3)** — Usage metering, delegation tokens, SLA framework with breach alerts.
+- **Security** — Bearer auth, OAuth2/JWT, Ed25519 signed manifests, optional mTLS, replay prevention, HTTPS, rate limiting. [Security Model](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/v1.1-security-model.md) (trust limits, Custom Claims).
+- **Economics** — Usage metering, delegation tokens, SLA framework with breach alerts.
+
+### 🆕 Framework Ecosystem
+ASAP is built for interoperability. Seamlessly integrate your agents into **OpenClaw**, **LangChain**, **CrewAI** and **LlamaIndex** workflows using our growing library of native adapters and standardized tool-calling schemas.
 
 ## Installation
 
@@ -49,7 +49,7 @@ Or with pip:
 pip install asap-protocol
 ```
 
-📦 **Available on [PyPI](https://pypi.org/project/asap-protocol/)**. For reproducible environments, prefer `uv` when possible.
+📦 **Available on [PyPI](https://pypi.org/project/asap-protocol/)** — for reproducible environments, prefer `uv` when possible.
 
 ## Quick Start
 
@@ -59,23 +59,9 @@ pip install asap-protocol
 uv run python -m asap.examples.run_demo
 ```
 
-**v2.0.0** — [**Agent Marketplace**](https://asap-protocol.vercel.app/) — Browse, verify, and register agents. Lean Registry, Verified Badge, IssueOps.
-
-**v1.4.0 showcase** (Pagination on Usage & SLA history):
-
-```bash
-uv run python -m asap.examples.v1_4_0_showcase
-```
-
-**v1.3.0 showcase** (Delegation + Metering + SLA in one command):
-
-```bash
-uv run python -m asap.examples.v1_3_0_showcase
-```
-
 **Build your first agent** [here](docs/tutorials/first-agent.md) — server setup, client code, step-by-step (~15 min).
 
-[15+ examples](src/asap/examples/README.md): orchestration, state migration, MCP, OAuth2, WebSocket, resilience.
+[19 examples](src/asap/examples/README.md): orchestration, state migration, MCP, OAuth2, WebSocket, resilience.
 
 ## Testing
 
@@ -91,7 +77,7 @@ uv run pytest --cov=src --cov-report=term-missing
 
 [Testing Guide](https://github.com/adriannoes/asap-protocol/blob/main/docs/testing.md) (structure, fixtures, property/load/chaos tests). [Contributing](https://github.com/adriannoes/asap-protocol/blob/main/CONTRIBUTING.md) (dev setup, CI).
 
-### Compliance Harness (v1.2)
+### Compliance Harness
 
 Validate that your agent follows the ASAP protocol:
 
@@ -102,10 +88,6 @@ pytest --asap-agent-url https://your-agent.example.com -m asap_compliance
 
 See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/compliance-testing.md) for handshake, schema and state machine validation.
 
-## Benchmarks
-
-[Benchmark Results](https://github.com/adriannoes/asap-protocol/blob/main/benchmarks/RESULTS.md): load (1,500+ RPS), stress, memory.
-
 ## Documentation
 
 **Learn**
@@ -116,8 +98,8 @@ See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/
 
 **Deep Dive**
 - [State Management](https://github.com/adriannoes/asap-protocol/blob/main/docs/state-management.md) | [Best Practices: Failover & Migration](https://github.com/adriannoes/asap-protocol/blob/main/docs/best-practices/agent-failover-migration.md) | [Error Handling](https://github.com/adriannoes/asap-protocol/blob/main/docs/error-handling.md)
-- [Transport](https://github.com/adriannoes/asap-protocol/blob/main/docs/transport.md) | [Security](https://github.com/adriannoes/asap-protocol/blob/main/docs/security.md) | [v1.1 Security Model](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/v1.1-security-model.md) (OAuth2 trust, Custom Claims, ADR-17)
-- **v1.2**: [Identity Signing](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/identity-signing.md) | [Compliance Testing](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/compliance-testing.md) | [Migration v1.1→v1.2](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/migration-v1.1-to-v1.2.md) | [mTLS](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/mtls.md)
+- [Transport](https://github.com/adriannoes/asap-protocol/blob/main/docs/transport.md) | [Security](https://github.com/adriannoes/asap-protocol/blob/main/docs/security.md) | [Security Model](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/v1.1-security-model.md) (OAuth2 trust, Custom Claims)
+- [Identity Signing](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/identity-signing.md) | [Compliance Testing](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/compliance-testing.md) | [Migration v1.1 to v1.2](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/migration-v1.1-to-v1.2.md) | [mTLS](https://github.com/adriannoes/asap-protocol/blob/main/docs/security/mtls.md)
 - [Observability](https://github.com/adriannoes/asap-protocol/blob/main/docs/observability.md) | [Testing](https://github.com/adriannoes/asap-protocol/blob/main/docs/testing.md)
 
 **Decisions & Operations**
@@ -130,39 +112,33 @@ See [Compliance Testing Guide](https://github.com/adriannoes/asap-protocol/blob/
 
 ## CLI
 
-**v1.1** adds OAuth2, WebSocket, Discovery (well-known + Lite Registry), State Storage (SQLite), and Webhooks. **v1.2** adds Ed25519 signed manifests, trust levels, optional mTLS, and the [Compliance Harness](https://github.com/adriannoes/asap-protocol/blob/main/asap-compliance/README.md). **v1.3** adds delegation commands (`asap delegation create`, `asap delegation revoke`).
+- **v1.1** adds OAuth2, WebSocket, Discovery (well-known + Lite Registry), State Storage (SQLite) and Webhooks. 
+- **v1.2** adds Ed25519 signed manifests, trust levels, optional mTLS and the [Compliance Harness](https://github.com/adriannoes/asap-protocol/blob/main/asap-compliance/README.md). 
+- **v1.3** adds delegation commands (`asap delegation create`, `asap delegation revoke`).
 
 ```bash
 asap --version                                    # Show version
 asap list-schemas                                 # List all available schemas
 asap export-schemas                               # Export JSON schemas to file
-asap keys generate -o key.pem                     # Generate Ed25519 keypair (v1.2)
-asap manifest sign -k key.pem manifest.json       # Sign manifest (v1.2)
-asap manifest verify signed.json                  # Verify signature (v1.2)
-asap manifest info signed.json                    # Show trust level (v1.2)
+asap keys generate -o key.pem                     # Generate Ed25519 keypair
+asap manifest sign -k key.pem manifest.json       # Sign manifest
+asap manifest verify signed.json                  # Verify signature
+asap manifest info signed.json                    # Show trust level
 ```
 
 See [CLI reference](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/identity-signing.md) or run `asap --help`.
 
 See [docs index](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md#v11-features-api-reference--guides) and [Identity Signing](https://github.com/adriannoes/asap-protocol/blob/main/docs/guides/identity-signing.md) for details.
 
-## What's Next? 🔭
-
-ASAP is evolving toward an **Agent Marketplace** — an open ecosystem where AI agents discover, trust and collaborate autonomously:
-
-- **v1.1**: Identity Layer (OAuth2, WebSocket, Discovery) ✅
-- **v1.2**: Trust Layer (Signed Manifests, Compliance Harness, mTLS) ✅
-- **v1.3**: Economics Layer (Metering, SLAs, Delegation) ✅
-- **v1.4**: Resilience & Scale (Type Safety, Storage Pagination) ✅
-- **v2.0**: Agent Marketplace with Web App (Lean Registry, Verified Badge, IssueOps) ✅
+## 🔭 What's Next?
 
-See our [vision document](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/vision-agent-marketplace.md) for the full roadmap.
+ASAP is evolving toward an **Agent Marketplace** — an open ecosystem where AI agents discover, trust and collaborate autonomously. See our [vision document](https://github.com/adriannoes/asap-protocol/blob/main/.cursor/product-specs/strategy/vision-agent-marketplace.md) for the full roadmap.
 
 ## Contributing
 
-**Community feedback and contributions are essential** for ASAP Protocol's evolution. 
+**Community feedback and contributions are essential** for ASAP Protocol's evolution. We're working on improvements and your input helps shape the future of the protocol. 
 
-We're working on improvements and your input helps shape the future of the protocol. Every contribution, from bug reports to feature suggestions, documentation improvements and code contributions, makes a real difference.
+Every contribution, from bug reports to feature suggestions, documentation improvements and code contributions, makes a real difference.
 
 Check out our [contributing guidelines](https://github.com/adriannoes/asap-protocol/blob/main/CONTRIBUTING.md) to get started. It's easier than you think! 🚀
 

{asap_protocol-2.1.0 → asap_protocol-2.2.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "asap-protocol"
-version = "2.1.0"
+version = "2.2.0"
 description = "Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication"
 authors = [
     {name = "ASAP Protocol Contributors"}
@@ -22,14 +22,14 @@ classifiers = [
 
 dependencies = [
     "aiosqlite>=0.20",
-    "cryptography>=41.0",
+    "cryptography>=46.0.7",
     "jcs>=0.2.0",
     "jsonschema>=4.23.0",
     "pydantic>=2.12.5",
     "fastapi>=0.128.0",
     "httpx[http2]>=0.28.1",
-    "authlib>=1.3",
-    "joserfc>=1.0",
+    "authlib>=1.6.9",
+    "joserfc>=1.6.3",
     "uvicorn>=0.34",
     "python-ulid>=3.0",
     "packaging>=25.0",
@@ -44,14 +44,12 @@ dependencies = [
     "opentelemetry-instrumentation-fastapi>=0.41",
     "opentelemetry-instrumentation-httpx>=0.41",
     "opentelemetry-exporter-otlp-proto-grpc>=1.20",
-    "cryptography>=41.0",
-    "jcs>=0.2.0",
 ]
 
 [project.optional-dependencies]
 dev = [
     "brotli>=1.1.0",
-    "pytest>=8.0",
+    "pytest>=9.0.3",
     "pytest-asyncio>=0.24",
     "pytest-cov>=6.0",
     "pytest-benchmark>=5.1",
@@ -65,6 +63,7 @@ docs = [
     "ghp-import>=2.1.0",
     "mkdocs-material>=9.5",
     "mkdocstrings[python]>=0.27",
+    "pymdown-extensions>=10.21",
 ]
 dns-sd = [
     "zeroconf>=0.80",
@@ -103,6 +102,31 @@ Repository = "https://github.com/adriannoes/asap-protocol"
 Issues = "https://github.com/adriannoes/asap-protocol/issues"
 "PyPI" = "https://pypi.org/project/asap-protocol/"
 
+# Override transitive dependencies for security fixes:
+# - pyjwt>=2.12.0 for CVE-2026-32597 (crit header validation)
+# - pyasn1>=0.6.3 for CVE-2026-30922 (DoS via unbounded recursion)
+# - tinytag>=2.2.1 for CVE-2026-32889
+# - cryptography>=46.0.7 for CVE-2026-39892 / CVE-2026-34073 (name-constraint / peer identity)
+# - requests>=2.33.0 for CVE-2026-25645 (extract_zipped_paths temp file)
+# - pillow>=12.2.0 for CVE-2026-40192 (transitive, e.g. pdf/vision stacks)
+# - pytest>=9.0.3 for CVE-2025-71176 (dev)
+# - python-multipart>=0.0.26 for CVE-2026-40347 (FastAPI stack)
+# - pygments>=2.20.0 for CVE-2026-4539
+# - langsmith>=0.7.31 for GHSA-rr7j-v2q5-chgv
+[tool.uv]
+override-dependencies = [
+    "pyjwt>=2.12.0",
+    "pyasn1>=0.6.3",
+    "tinytag>=2.2.1",
+    "cryptography>=46.0.7",
+    "requests>=2.33.0",
+    "pillow>=12.2.0",
+    "pytest>=9.0.3",
+    "python-multipart>=0.0.26",
+    "pygments>=2.20.0",
+    "langsmith>=0.7.31",
+]
+
 [project.scripts]
 asap = "asap.cli:main"
 asap-mcp-server = "asap.mcp.serve:main"
@@ -114,6 +138,16 @@ build-backend = "hatchling.build"
 [tool.hatch.build.targets.wheel]
 packages = ["src/asap"]
 
+[tool.hatch.build.targets.sdist]
+include = [
+    "/src",
+    "/schemas",
+    "/pyproject.toml",
+    "/README.md",
+    "/LICENSE",
+    "/CHANGELOG.md",
+]
+
 [tool.ruff]
 target-version = "py313"
 line-length = 100

{asap_protocol-2.1.0 → asap_protocol-2.2.0}/src/asap/__init__.py

@@ -4,6 +4,6 @@ A streamlined, scalable, asynchronous protocol for agent-to-agent communication
 and task coordination.
 """
 
-__version__ = "2.1.0"
+__version__ = "2.2.0"
 
 __all__ = ["__version__"]