asap-protocol 2.3.0__tar.gz → 2.4.0__tar.gz

{asap_protocol-2.3.0 → asap_protocol-2.4.0}/.gitignore

@@ -186,6 +186,7 @@ product/strategy/
 product/private/
 product/private-roadmap/
 product/prd/private/
+engineering/code-review/private/
 # Tactical PRDs outside private/ (patch train); single-digit and double-digit patch (e.g. v2.3.10)
 product/prd/prd-v2.3.[1-9]-*.md
 product/prd/prd-v2.3.[1-9][0-9]-*.md
@@ -203,6 +204,8 @@ node_modules/
 # Next.js app lib (do not ignore; root lib/ is for Python)
 !apps/web/src/lib/
 !apps/web/src/lib/**
+!apps/example-mastra/src/lib/
+!apps/example-mastra/src/lib/**
 
 # Benchmark and cache artifacts
 .benchmarks/
@@ -215,3 +218,6 @@ node_modules/
 eslint-report.json
 .vercel
 .env*.local
+
+# Local weekly telemetry outputs (snapshots + dashboard; CI uses artifacts)
+private/telemetry/

{asap_protocol-2.3.0 → asap_protocol-2.4.0}/CHANGELOG.md

@@ -7,6 +7,124 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- **OAuth2 middleware**: Validate JWT `iss` and `aud` when `ASAP_AUTH_ISSUER` / `ASAP_AUTH_AUDIENCE` (or `OAuth2Config.expected_issuer` / `expected_audience`) are set; refactored validation through `validate_jwt()` in `asap.auth.jwks`.
+- **Identity binding**: Fail-closed when `manifest_id` is configured but neither custom claim nor `ASAP_AUTH_SUBJECT_MAP` allowlist matches (403 instead of warn-and-pass).
+- **Web app (`apps/web`)**: Block open redirects on E2E fixture login routes via `resolveRedirectUrl`; harden SSRF on `/api/health-check` (127.0.0.0/8, DNS resolve4/6); Zod validation on API query params; rate-limit unit tests.
+
+### Fixed
+
+- **CI security (`pip-audit`)**: Bumped transitive pins (`langchain-core`, `langsmith`, `python-multipart`, `urllib3`, `pip`, `smolagents`) and adjusted documented `--ignore-vuln` flags (pygments + **smolagents** CVEs with no PyPI fix yet; pip ≥26.1 clears prior pip ignore). See [SECURITY.md](SECURITY.md).
+- **FastAPI / Starlette**: Raised `fastapi` floor to `>=0.136.1` so `starlette>=1.0.1` resolves **PYSEC-2026-161** (Host header path injection) without a `pip-audit` ignore.
+
+### Follow-up (not in this release)
+
+- `extra="forbid"` on ingress payload models (`TaskRequestConfig`, `CommonMetadata`)
+- Opt-in protection for operator APIs (`/usage`, `/sla`, `/audit`)
+- Redis-backed `JtiReplayCache` and distributed Next.js rate limits
+- Bump optional `pydantic-ai` extra (CVE-2026-46678)
+
+---
+
+## [2.4.0] - 2026-05-24
+
+**Edge-AI discovery** — Optional structured hardware and inference capability
+advertising on manifests, mirrored to the Lite Registry, marketplace filters, and
+TypeScript discovery types. Wire protocol and existing manifests remain
+backward compatible.
+
+### Added
+
+- **feat(discovery): hardware and inference capability advertising**
+  - **Manifest schema** (`schemas/entities/manifest.schema.json`): optional
+    `capabilities.hardware` (`class`, `model`, `io`) and `capabilities.inference`
+    (`modes`, `local_models` with optional self-reported throughput); closed enums;
+    `additionalProperties: false` on nested objects. Example:
+    `schemas/examples/shellclaw-jetson-capabilities.json`.
+  - **Pydantic models** (`HardwareCapability`, `InferenceCapability`,
+    `LocalModelInfo`; enums `HardwareClass`, `HardwareIoType`, `InferenceMode`).
+  - **Registry mirror**: `RegistryEntry.hardware_class`, `inference_modes`,
+    `hardware_io`; `derive_registry_hardware_fields()` applied in
+    `auto_registration` and `process_registration` when a signed manifest is
+    loaded.
+  - **Discovery helpers**: `find_by_hardware_class`, `find_by_inference_mode`,
+    `find_by_io` in `asap.discovery.registry`.
+  - **Marketplace (web)**: Browse sidebar filters and agent detail blocks for
+    hardware class, inference mode, and I/O; register docs and IssueOps template
+    note manifest-derived fields.
+  - **TypeScript SDK** (`@asap-protocol/client@2.4.0`): optional hardware fields
+    on `RegistryEntry` with parsers in `discovery.ts`.
+  - **Docs**: `docs/transport.md`, `docs/registry/auto-registration.md`,
+    `docs/examples/registry-shellclaw.md`; fixtures under `tests/fixtures/`.
+  - **ShellClaw marketplace onboarding (S0)**: Guide
+    [docs/guides/shellclaw-registry.md](docs/guides/shellclaw-registry.md)
+    (`online_check: false`, static manifest URLs, IssueOps path); validation
+    fixtures `tests/fixtures/registry/shellclaw-v1.0-entry.json`.
+
+### Changed
+
+- **Tags vs structured fields**: `tags` (e.g. `cuda`, `jetson`) remain valid;
+  registrants may migrate to structured `hardware` / `inference` when ready.
+
+### Community feedback
+
+- Track enum and field feedback on GitHub: [#176](https://github.com/adriannoes/asap-protocol/issues/176).
+
+---
+
+## [2.3.1] - 2026-05-20
+
+**Adapter Lab I** — TypeScript-only patch: two new framework adapters on npm and
+additive exports on `@asap-protocol/client`. Python `asap-protocol` core is
+unchanged; no wire-protocol or migration work required for existing deployments.
+
+### Added
+
+- **`@asap-protocol/mastra@2.3.1`**: Expose ASAP capabilities as Mastra
+  `createTool` definitions, optional `createAsapMastraAgent` wrapper, and
+  streaming bridge. See [docs/integrations/mastra.md](docs/integrations/mastra.md).
+  ```bash
+  npm install @asap-protocol/mastra @asap-protocol/client @mastra/core zod
+  ```
+- **`@asap-protocol/openai-agents@2.3.1`**: Expose ASAP capabilities as OpenAI
+  Agents SDK `tool()` definitions, remote-agent handoff helpers, and streaming
+  bridge. See [docs/integrations/openai-agents.md](docs/integrations/openai-agents.md).
+  ```bash
+  npm install @asap-protocol/openai-agents @asap-protocol/client @openai/agents zod
+  ```
+- **Examples**: `apps/example-mastra` and `apps/example-openai-agents` (Compliance
+  Harness v2 score 1.0 against the loopback provider).
+
+### Changed
+
+- **`@asap-protocol/client@2.3.1`**: Additive exports for adapter authors —
+  public `@asap-protocol/client/adapters/shared`, `jsonSchemaForCapabilityOutput`,
+  execution types, and envelope helpers. Non-breaking; existing `@2.3.0` consumers
+  remain compatible.
+- **CI security (`pip-audit`)**: Bumped transitive pins (`idna>=3.15`,
+  `markdown>=3.10.2`, `pymdown-extensions>=10.21.3`) and documented `--ignore-vuln`
+  flags for advisories with no PyPI fix yet (`PYSEC-2026-89`, `PYSEC-2025-183`,
+  `PYSEC-2024-271`). See [SECURITY.md](SECURITY.md).
+
+### Known limitations
+
+- Adapter packages peer on pre-1.0 framework releases (`@mastra/core@^1.5.0`,
+  `@openai/agents@^0.11.0`). Pin peers in production until those ecosystems
+  stabilize semver.
+
+### Migration
+
+- **v2.3.0 → v2.3.1**: Additive release — install new packages only if you adopt
+  Mastra or OpenAI Agents SDK integrations. See
+  [migration guide](docs/migration.md#upgrading-from-v230-to-v231).
+
+### Skipped (TS-only patch)
+
+- **Python PyPI / Docker**: No changes to `asap-protocol` Python core (`2.3.0`
+  remains current on PyPI). Tag `v2.3.1` ships npm adapters only; any Docker
+  image retagged by CI is unchanged bytecode — do not treat it as a Python upgrade.
+
 ---
 
 ## [2.3.0] - 2026-05-04

{asap_protocol-2.3.0 → asap_protocol-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: asap-protocol
-Version: 2.3.0
+Version: 2.4.0
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/adriannoes/asap-protocol
 Project-URL: Documentation, https://adriannoes.github.io/asap-protocol
@@ -24,7 +24,7 @@ Requires-Dist: aiosqlite>=0.20
 Requires-Dist: authlib<2,>=1.6.11
 Requires-Dist: brotli>=1.2.0
 Requires-Dist: cryptography<47,>=46.0.7
-Requires-Dist: fastapi>=0.128.0
+Requires-Dist: fastapi>=0.136.1
 Requires-Dist: httpx[http2]>=0.28.1
 Requires-Dist: jcs>=0.2.0
 Requires-Dist: joserfc<2,>=1.6.3
@@ -46,6 +46,7 @@ Requires-Dist: websockets>=12.0
 Provides-Extra: crewai
 Requires-Dist: crewai>=0.80; extra == 'crewai'
 Provides-Extra: dev
+Requires-Dist: asgi-lifespan>=2.1.0; extra == 'dev'
 Requires-Dist: brotli>=1.1.0; extra == 'dev'
 Requires-Dist: mypy>=1.19.1; extra == 'dev'
 Requires-Dist: pip-audit>=2.7; extra == 'dev'
@@ -62,9 +63,9 @@ Provides-Extra: docs
 Requires-Dist: ghp-import>=2.1.0; extra == 'docs'
 Requires-Dist: mkdocs-material>=9.5; extra == 'docs'
 Requires-Dist: mkdocstrings[python]>=0.27; extra == 'docs'
-Requires-Dist: pymdown-extensions>=10.21; extra == 'docs'
+Requires-Dist: pymdown-extensions>=10.21.3; extra == 'docs'
 Provides-Extra: langchain
-Requires-Dist: langchain-core>=0.2; extra == 'langchain'
+Requires-Dist: langchain-core>=1.3.3; extra == 'langchain'
 Provides-Extra: llamaindex
 Requires-Dist: llama-index-core>=0.10; extra == 'llamaindex'
 Provides-Extra: mcp
@@ -78,7 +79,9 @@ Requires-Dist: pydantic-ai>=0.2; extra == 'pydanticai'
 Provides-Extra: redis
 Requires-Dist: redis>=5.0.0; extra == 'redis'
 Provides-Extra: smolagents
-Requires-Dist: smolagents>=1.0; extra == 'smolagents'
+Requires-Dist: smolagents>=1.24.0; extra == 'smolagents'
+Provides-Extra: telemetry
+Requires-Dist: pypistats>=1.11.0; extra == 'telemetry'
 Provides-Extra: webauthn
 Requires-Dist: webauthn<3,>=2.6; extra == 'webauthn'
 Description-Content-Type: text/markdown
@@ -92,7 +95,7 @@ Description-Content-Type: text/markdown
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: `v2.3.0` | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | **[PyPI `asap-protocol`](https://pypi.org/project/asap-protocol/)** | **[npm `@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client)** | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
+**Quick Info**: `v2.4.0` (PyPI) · **npm TS [`2.4.0`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.4.0)** | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | **[PyPI `asap-protocol`](https://pypi.org/project/asap-protocol/)** | **[npm `@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client)** | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
 
 > 📦 Install the ASAP **Python SDK / protocol** from **`https://pypi.org/project/asap-protocol/`** — package name **`asap-protocol`** on [PyPI](https://pypi.org/project/asap-protocol/).
 
@@ -120,6 +123,8 @@ For simple point-to-point communication, a basic HTTP API might suffice; ASAP sh
 - **Identity & capabilities (v2.2, WebAuthn real in v2.2.1)** — Per-runtime Host/Agent JWTs, capability grants with constraints (`max`, `min`, `in`, `not_in`), approval flows (device authorization / CIBA-style), real WebAuthn attestation/assertion for high-risk registration (opt-in via `asap-protocol[webauthn]`).
 - **Streaming & wire protocol (v2.2)** — `POST /asap/stream` (SSE / `TaskStream`), JSON-RPC 2.0 batch on `POST /asap`, `ASAP-Version` negotiation, tamper-evident audit logging, Compliance Harness v2.
 - **Adoption Multiplier (v2.3.0)** — OpenAPI → ASAP via `create_from_openapi` (`[openapi]` extra), official **`@asap-protocol/client`** on npm (Vercel AI / OpenAI / Anthropic adapters), optional **Auto-Registration** (`POST /registry/agents`), **capability escalation**, and **ASAP `WWW-Authenticate`** discovery challenges. All opt-in; wire protocol unchanged. See [docs/index.md](docs/index.md) and [docs/migration.md](docs/migration.md).
+- **Edge-AI discovery (v2.4.0)** — Optional `manifest.capabilities.hardware` + `inference`, Lite Registry mirror, marketplace browse filters, and `@asap-protocol/client@2.4.0` discovery types. Wire protocol unchanged. See [Migration (v2.3.x → v2.4.0)](docs/migration.md#upgrading-from-v23x-to-v240) and [ShellClaw registry guide](docs/guides/shellclaw-registry.md).
+- **Framework adapters (v2.3.1+, npm)** — **`@asap-protocol/mastra`** and **`@asap-protocol/openai-agents`** expose ASAP capabilities as Mastra tools and OpenAI Agents SDK `tool()` definitions. See [Migration (v2.3.0 → v2.3.1)](docs/migration.md#upgrading-from-v230-to-v231).
 - **Economics** — Usage metering, delegation tokens, SLA framework with breach alerts.
 
 ### 🆕 Framework Ecosystem
@@ -139,10 +144,16 @@ Or with pip:
 pip install asap-protocol
 ```
 
-**npm** (TypeScript / JavaScript — [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client), aligned with protocol **v2.3.0**):
+**npm** (TypeScript / JavaScript — [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client), **`2.4.0`**). The `latest` dist-tag matches **`npm view @asap-protocol/client version`**.
+
+**npm** Mastra [**`@asap-protocol/mastra@2.4.0`**](https://www.npmjs.com/package/@asap-protocol/mastra) bridges ASAP capabilities onto **`@mastra/core`** tools; docs: [`docs/integrations/mastra.md`](docs/integrations/mastra.md), demo: [`apps/example-mastra/README.md`](apps/example-mastra/README.md).
+
+**npm** OpenAI Agents SDK [**`@asap-protocol/openai-agents@2.4.0`**](https://www.npmjs.com/package/@asap-protocol/openai-agents) exposes ASAP capabilities as **`@openai/agents`** `tool()` definitions — **not** the Chat Completions helper [`adapters/openai`](packages/typescript/client/src/adapters/openai.ts); docs: [`docs/integrations/openai-agents.md`](docs/integrations/openai-agents.md), demo: [`apps/example-openai-agents/README.md`](apps/example-openai-agents/README.md).
 
 ```bash
-npm install @asap-protocol/client
+npm install @asap-protocol/client@2.4.0
+npm install @asap-protocol/mastra@2.4.0 @asap-protocol/client @mastra/core zod
+npm install @asap-protocol/openai-agents@2.4.0 @asap-protocol/client @openai/agents zod
 ```
 
 📦 **Canonical listing:** **[https://pypi.org/project/asap-protocol/](https://pypi.org/project/asap-protocol/)** — package **`asap-protocol`** (`pip install asap-protocol`). Prefer `uv` for reproducible environments when possible.
@@ -229,6 +240,8 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 
 | Version | What shipped |
 | :-- | :-- |
+| **v2.4.0** | **Edge-AI discovery** — **[GitHub Release `v2.4.0`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.4.0)** · optional `hardware` / `inference` manifest fields, registry mirror, marketplace filters, **`@asap-protocol/client@2.4.0`**, ShellClaw onboarding docs. See [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#240---2026-05-24) and [Migration (v2.3.x → v2.4.0)](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v23x-to-v240) |
+| **v2.3.1** | **npm TS patch** — **[GitHub Release `v2.3.1`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.3.1)** · **`@asap-protocol/mastra`**, **`@asap-protocol/openai-agents`**, **`@asap-protocol/client@2.3.1`** (additive adapter exports). Python **2.3.0** unchanged. See [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#231---2026-05-20) and [Migration (v2.3.0 → v2.3.1)](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v230-to-v231) |
 | **v2.3.0** | **OpenAPI Adapter** (`[openapi]`) · **TypeScript client** (`@asap-protocol/client`) · **Auto-Registration** · **Capability escalation** · **ASAP HTTP challenge** — see [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#230---2026-05-04) and [Migration](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v22x-to-v230) |
 | **v2.2.1** | Opt-in **WebAuthn** (`asap-protocol[webauthn]`) · `asap compliance-check` & `asap audit export` · stricter `ResolvedAgent.run()` · `AuditChainBroken` · [pinned security deps](https://github.com/adriannoes/asap-protocol/blob/main/SECURITY.md#dependency-policy) |
 | **v2.2** | Per-runtime identity & capability auth · SSE `POST /asap/stream` · `ASAP-Version` · JSON-RPC batch · tamper-evident audit · async state stores · Compliance Harness v2 |
@@ -259,6 +272,10 @@ For **general questions** about the protocol, the marketplace, partnerships, or
 
 You can also use [GitHub Discussions](https://github.com/adriannoes/asap-protocol/discussions) or [Issues](https://github.com/adriannoes/asap-protocol/issues) for public project topics.
 
+## Privacy
+
+See [PRIVACY.md](PRIVACY.md) for how the public site and maintainer telemetry use aggregate metrics (including Vercel Web Analytics) without collecting agent IDs or end-user PII in repository outputs.
+
 ## License
 
 This project is licensed under the Apache 2.0 License - see the [license](https://github.com/adriannoes/asap-protocol/blob/main/LICENSE) file for details.

{asap_protocol-2.3.0 → asap_protocol-2.4.0}/README.md

@@ -7,7 +7,7 @@
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: `v2.3.0` | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | **[PyPI `asap-protocol`](https://pypi.org/project/asap-protocol/)** | **[npm `@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client)** | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
+**Quick Info**: `v2.4.0` (PyPI) · **npm TS [`2.4.0`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.4.0)** | `Apache 2.0` | `Python 3.13+` | [Documentation](https://github.com/adriannoes/asap-protocol/blob/main/docs/index.md) | **[PyPI `asap-protocol`](https://pypi.org/project/asap-protocol/)** | **[npm `@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client)** | [Changelog](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md)
 
 > 📦 Install the ASAP **Python SDK / protocol** from **`https://pypi.org/project/asap-protocol/`** — package name **`asap-protocol`** on [PyPI](https://pypi.org/project/asap-protocol/).
 
@@ -35,6 +35,8 @@ For simple point-to-point communication, a basic HTTP API might suffice; ASAP sh
 - **Identity & capabilities (v2.2, WebAuthn real in v2.2.1)** — Per-runtime Host/Agent JWTs, capability grants with constraints (`max`, `min`, `in`, `not_in`), approval flows (device authorization / CIBA-style), real WebAuthn attestation/assertion for high-risk registration (opt-in via `asap-protocol[webauthn]`).
 - **Streaming & wire protocol (v2.2)** — `POST /asap/stream` (SSE / `TaskStream`), JSON-RPC 2.0 batch on `POST /asap`, `ASAP-Version` negotiation, tamper-evident audit logging, Compliance Harness v2.
 - **Adoption Multiplier (v2.3.0)** — OpenAPI → ASAP via `create_from_openapi` (`[openapi]` extra), official **`@asap-protocol/client`** on npm (Vercel AI / OpenAI / Anthropic adapters), optional **Auto-Registration** (`POST /registry/agents`), **capability escalation**, and **ASAP `WWW-Authenticate`** discovery challenges. All opt-in; wire protocol unchanged. See [docs/index.md](docs/index.md) and [docs/migration.md](docs/migration.md).
+- **Edge-AI discovery (v2.4.0)** — Optional `manifest.capabilities.hardware` + `inference`, Lite Registry mirror, marketplace browse filters, and `@asap-protocol/client@2.4.0` discovery types. Wire protocol unchanged. See [Migration (v2.3.x → v2.4.0)](docs/migration.md#upgrading-from-v23x-to-v240) and [ShellClaw registry guide](docs/guides/shellclaw-registry.md).
+- **Framework adapters (v2.3.1+, npm)** — **`@asap-protocol/mastra`** and **`@asap-protocol/openai-agents`** expose ASAP capabilities as Mastra tools and OpenAI Agents SDK `tool()` definitions. See [Migration (v2.3.0 → v2.3.1)](docs/migration.md#upgrading-from-v230-to-v231).
 - **Economics** — Usage metering, delegation tokens, SLA framework with breach alerts.
 
 ### 🆕 Framework Ecosystem
@@ -54,10 +56,16 @@ Or with pip:
 pip install asap-protocol
 ```
 
-**npm** (TypeScript / JavaScript — [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client), aligned with protocol **v2.3.0**):
+**npm** (TypeScript / JavaScript — [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client), **`2.4.0`**). The `latest` dist-tag matches **`npm view @asap-protocol/client version`**.
+
+**npm** Mastra [**`@asap-protocol/mastra@2.4.0`**](https://www.npmjs.com/package/@asap-protocol/mastra) bridges ASAP capabilities onto **`@mastra/core`** tools; docs: [`docs/integrations/mastra.md`](docs/integrations/mastra.md), demo: [`apps/example-mastra/README.md`](apps/example-mastra/README.md).
+
+**npm** OpenAI Agents SDK [**`@asap-protocol/openai-agents@2.4.0`**](https://www.npmjs.com/package/@asap-protocol/openai-agents) exposes ASAP capabilities as **`@openai/agents`** `tool()` definitions — **not** the Chat Completions helper [`adapters/openai`](packages/typescript/client/src/adapters/openai.ts); docs: [`docs/integrations/openai-agents.md`](docs/integrations/openai-agents.md), demo: [`apps/example-openai-agents/README.md`](apps/example-openai-agents/README.md).
 
 ```bash
-npm install @asap-protocol/client
+npm install @asap-protocol/client@2.4.0
+npm install @asap-protocol/mastra@2.4.0 @asap-protocol/client @mastra/core zod
+npm install @asap-protocol/openai-agents@2.4.0 @asap-protocol/client @openai/agents zod
 ```
 
 📦 **Canonical listing:** **[https://pypi.org/project/asap-protocol/](https://pypi.org/project/asap-protocol/)** — package **`asap-protocol`** (`pip install asap-protocol`). Prefer `uv` for reproducible environments when possible.
@@ -144,6 +152,8 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 
 | Version | What shipped |
 | :-- | :-- |
+| **v2.4.0** | **Edge-AI discovery** — **[GitHub Release `v2.4.0`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.4.0)** · optional `hardware` / `inference` manifest fields, registry mirror, marketplace filters, **`@asap-protocol/client@2.4.0`**, ShellClaw onboarding docs. See [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#240---2026-05-24) and [Migration (v2.3.x → v2.4.0)](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v23x-to-v240) |
+| **v2.3.1** | **npm TS patch** — **[GitHub Release `v2.3.1`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.3.1)** · **`@asap-protocol/mastra`**, **`@asap-protocol/openai-agents`**, **`@asap-protocol/client@2.3.1`** (additive adapter exports). Python **2.3.0** unchanged. See [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#231---2026-05-20) and [Migration (v2.3.0 → v2.3.1)](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v230-to-v231) |
 | **v2.3.0** | **OpenAPI Adapter** (`[openapi]`) · **TypeScript client** (`@asap-protocol/client`) · **Auto-Registration** · **Capability escalation** · **ASAP HTTP challenge** — see [CHANGELOG](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#230---2026-05-04) and [Migration](https://github.com/adriannoes/asap-protocol/blob/main/docs/migration.md#upgrading-from-v22x-to-v230) |
 | **v2.2.1** | Opt-in **WebAuthn** (`asap-protocol[webauthn]`) · `asap compliance-check` & `asap audit export` · stricter `ResolvedAgent.run()` · `AuditChainBroken` · [pinned security deps](https://github.com/adriannoes/asap-protocol/blob/main/SECURITY.md#dependency-policy) |
 | **v2.2** | Per-runtime identity & capability auth · SSE `POST /asap/stream` · `ASAP-Version` · JSON-RPC batch · tamper-evident audit · async state stores · Compliance Harness v2 |
@@ -174,6 +184,10 @@ For **general questions** about the protocol, the marketplace, partnerships, or
 
 You can also use [GitHub Discussions](https://github.com/adriannoes/asap-protocol/discussions) or [Issues](https://github.com/adriannoes/asap-protocol/issues) for public project topics.
 
+## Privacy
+
+See [PRIVACY.md](PRIVACY.md) for how the public site and maintainer telemetry use aggregate metrics (including Vercel Web Analytics) without collecting agent IDs or end-user PII in repository outputs.
+
 ## License
 
 This project is licensed under the Apache 2.0 License - see the [license](https://github.com/adriannoes/asap-protocol/blob/main/LICENSE) file for details.

{asap_protocol-2.3.0 → asap_protocol-2.4.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "asap-protocol"
-version = "2.3.0"
+version = "2.4.0"
 description = "Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication"
 authors = [
     {name = "ASAP Protocol Contributors"}
@@ -27,7 +27,7 @@ dependencies = [
     "jcs>=0.2.0",
     "jsonschema>=4.23.0",
     "pydantic>=2.12.5,<3",
-    "fastapi>=0.128.0",
+    "fastapi>=0.136.1",
     "httpx[http2]>=0.28.1",
     "authlib>=1.6.11,<2",
     "joserfc>=1.6.3,<2",
@@ -49,6 +49,7 @@ dependencies = [
 
 [project.optional-dependencies]
 dev = [
+    "asgi-lifespan>=2.1.0",
     "brotli>=1.1.0",
     "pytest>=9.0.3",
     "pytest-asyncio>=0.24",
@@ -64,7 +65,7 @@ docs = [
     "ghp-import>=2.1.0",
     "mkdocs-material>=9.5",
     "mkdocstrings[python]>=0.27",
-    "pymdown-extensions>=10.21",
+    "pymdown-extensions>=10.21.3",
 ]
 dns-sd = [
     "zeroconf>=0.80",
@@ -82,7 +83,7 @@ mcp = [
     "mcp>=1.0.0",
 ]
 langchain = [
-    "langchain-core>=0.2",
+    "langchain-core>=1.3.3",
 ]
 crewai = [
     "crewai>=0.80",
@@ -91,7 +92,7 @@ llamaindex = [
     "llama-index-core>=0.10",
 ]
 smolagents = [
-    "smolagents>=1.0",
+    "smolagents>=1.24.0",
 ]
 pydanticai = [
     "pydantic-ai>=0.2",
@@ -103,6 +104,9 @@ openclaw = [
 openapi = [
     "openapi-pydantic>=0.5",
 ]
+telemetry = [
+    "pypistats>=1.11.0",
+]
 
 [project.urls]
 Homepage = "https://github.com/adriannoes/asap-protocol"
@@ -119,10 +123,16 @@ Issues = "https://github.com/adriannoes/asap-protocol/issues"
 # - requests>=2.33.0 for CVE-2026-25645 (extract_zipped_paths temp file)
 # - pillow>=12.2.0 for CVE-2026-40192 (transitive, e.g. pdf/vision stacks)
 # - pytest>=9.0.3 for CVE-2025-71176 (dev)
-# - python-multipart>=0.0.26 for CVE-2026-40347 (FastAPI stack)
+# - python-multipart>=0.0.27 for CVE-2026-42561 / CVE-2026-40347 (FastAPI stack)
 # - pygments>=2.20.0 for CVE-2026-4539
-# - langsmith>=0.7.31 for GHSA-rr7j-v2q5-chgv
+# - langsmith>=0.8.0 for CVE-2026-45134 (prior: GHSA-rr7j-v2q5-chgv)
+# - langchain-core>=1.3.3 for CVE-2026-44843
+# - urllib3>=2.7.0 for CVE-2026-44431 / CVE-2026-44432
+# - pip>=26.1 for CVE-2026-6357 (transitive via pip-api / venv)
 # - python-dotenv>=1.2.2 for CVE-2026-28684 (transitive, e.g. pydantic-settings / uvicorn stacks)
+# - idna>=3.15 for CVE-2026-45409 (DoS in idna.encode; transitive via httpx/requests)
+# - markdown>=3.10.2 for PYSEC-2026-89 (DoS in html.parser during Markdown parse; mkdocs stack)
+# - pymdown-extensions>=10.21.3 for CVE-2026-46338 (snippets base_path prefix bypass; mkdocs stack)
 [tool.uv]
 override-dependencies = [
     "pyjwt>=2.12.0,<3",
@@ -132,10 +142,16 @@ override-dependencies = [
     "requests>=2.33.0",
     "pillow>=12.2.0",
     "pytest>=9.0.3",
-    "python-multipart>=0.0.26",
+    "python-multipart>=0.0.27",
     "pygments>=2.20.0",
-    "langsmith>=0.7.31",
+    "langsmith>=0.8.0",
+    "langchain-core>=1.3.3",
+    "urllib3>=2.7.0",
+    "pip>=26.1",
     "python-dotenv>=1.2.2",
+    "idna>=3.15",
+    "markdown>=3.10.2",
+    "pymdown-extensions>=10.21.3",
 ]
 
 [project.scripts]

{asap_protocol-2.3.0 → asap_protocol-2.4.0}/schemas/entities/manifest.schema.json

@@ -33,9 +33,115 @@
       "title": "AuthScheme",
       "type": "object"
     },
+    "HardwareCapability": {
+      "additionalProperties": false,
+      "description": "Optional hardware hosting profile for edge and physical agents.\n\nAll fields are optional; registrants may omit the object entirely.\nClosed enums support marketplace filtering (v2.4+).",
+      "properties": {
+        "class": {
+          "description": "Hardware class hosting the agent",
+          "enum": [
+            "cloud",
+            "sbc",
+            "edge_accelerator",
+            "microcontroller",
+            "desktop"
+          ],
+          "title": "Class",
+          "type": "string"
+        },
+        "model": {
+          "description": "Specific board or SoC (e.g. jetson_orin_nano_super_8gb)",
+          "maxLength": 100,
+          "title": "Model",
+          "type": "string"
+        },
+        "io": {
+          "description": "Physical I/O interfaces available to the agent",
+          "items": {
+            "enum": [
+              "gpio",
+              "i2c",
+              "spi",
+              "uart",
+              "csi_camera",
+              "usb_camera",
+              "audio_in",
+              "audio_out",
+              "bluetooth",
+              "lora",
+              "ble"
+            ],
+            "type": "string"
+          },
+          "title": "Io",
+          "type": "array",
+          "uniqueItems": true
+        }
+      },
+      "title": "HardwareCapability",
+      "type": "object"
+    },
+    "InferenceCapability": {
+      "additionalProperties": false,
+      "description": "Optional local and cloud inference modes advertised by the agent.",
+      "properties": {
+        "modes": {
+          "description": "Supported inference execution modes",
+          "items": {
+            "enum": [
+              "cloud",
+              "local_cpu",
+              "local_cuda",
+              "local_metal",
+              "local_npu"
+            ],
+            "type": "string"
+          },
+          "title": "Modes",
+          "type": "array",
+          "uniqueItems": true
+        },
+        "local_models": {
+          "description": "Self-reported local models (optional throughput)",
+          "items": {
+            "$ref": "#/$defs/LocalModelInfo"
+          },
+          "title": "Local Models",
+          "type": "array"
+        }
+      },
+      "title": "InferenceCapability",
+      "type": "object"
+    },
+    "LocalModelInfo": {
+      "additionalProperties": false,
+      "description": "Metadata for a model running on-device (self-reported).",
+      "properties": {
+        "id": {
+          "description": "Model identifier (e.g. Hugging Face repo or GGUF name)",
+          "maxLength": 200,
+          "title": "Id",
+          "type": "string"
+        },
+        "quantization": {
+          "description": "Quantization label (e.g. Q4_K_M)",
+          "maxLength": 50,
+          "title": "Quantization",
+          "type": "string"
+        },
+        "throughput_tokens_per_second": {
+          "description": "Self-reported throughput (tokens per second)",
+          "minimum": 0,
+          "title": "Throughput Tokens Per Second",
+          "type": "number"
+        }
+      },
+      "title": "LocalModelInfo",
+      "type": "object"
+    },
     "Capability": {
       "additionalProperties": false,
-      "description": "Collection of an agent's features and supported operations.\n\nCapabilities describe what an agent can do, including skills,\nstate persistence, streaming support, and MCP tool integration.\n\nAttributes:\n    asap_version: ASAP protocol version supported (e.g., \"0.1\")\n    skills: List of skills the agent can perform\n    state_persistence: Whether the agent supports state snapshots\n    streaming: Whether the agent supports streaming responses\n    mcp_tools: List of MCP tool names the agent can execute\n\nExample:\n    >>> capability = Capability(\n    ...     asap_version=\"0.1\",\n    ...     skills=[Skill(id=\"research\", description=\"Research skill\")],\n    ...     state_persistence=True,\n    ...     streaming=True,\n    ...     mcp_tools=[\"web_search\"]\n    ... )",
+      "description": "Collection of an agent's features and supported operations.\n\nCapabilities describe what an agent can do, including skills,\nstate persistence, streaming support, MCP tool integration, and\noptional hardware / inference advertising (v2.4+).\n\nAttributes:\n    asap_version: ASAP protocol version supported (e.g., \"0.1\")\n    skills: List of skills the agent can perform\n    state_persistence: Whether the agent supports state snapshots\n    streaming: Whether the agent supports streaming responses\n    mcp_tools: List of MCP tool names the agent can execute\n    hardware: Optional hardware class, model, and I/O (v2.4+)\n    inference: Optional inference modes and local models (v2.4+)\n\nExample:\n    >>> capability = Capability(\n    ...     asap_version=\"0.1\",\n    ...     skills=[Skill(id=\"research\", description=\"Research skill\")],\n    ...     state_persistence=True,\n    ...     streaming=True,\n    ...     mcp_tools=[\"web_search\"]\n    ... )",
       "properties": {
         "asap_version": {
           "default": "0.1",
@@ -70,6 +176,30 @@
           },
           "title": "Mcp Tools",
           "type": "array"
+        },
+        "hardware": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/HardwareCapability"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "description": "Optional hardware hosting profile (edge / physical agents)"
+        },
+        "inference": {
+          "anyOf": [
+            {
+              "$ref": "#/$defs/InferenceCapability"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "default": null,
+          "description": "Optional inference modes and local model metadata"
         }
       },
       "title": "Capability",

asap_protocol-2.4.0/schemas/examples/shellclaw-jetson-capabilities.json

@@ -0,0 +1,38 @@
+{
+  "asap_version": "2.1.0",
+  "skills": [
+    {
+      "id": "assistant",
+      "description": "General assistant on edge hardware"
+    },
+    {
+      "id": "edge_briefing",
+      "description": "Local briefing with optional cloud fallback"
+    },
+    {
+      "id": "server_admin",
+      "description": "Host administration tasks"
+    },
+    {
+      "id": "gpio_control",
+      "description": "GPIO pin control"
+    }
+  ],
+  "state_persistence": true,
+  "streaming": true,
+  "mcp_tools": [],
+  "hardware": {
+    "class": "edge_accelerator",
+    "model": "jetson_orin_nano_super_8gb",
+    "io": ["gpio", "i2c"]
+  },
+  "inference": {
+    "modes": ["cloud", "local_cuda"],
+    "local_models": [
+      {
+        "id": "Phi-3-mini-4k-instruct-Q4_K_M",
+        "quantization": "Q4_K_M"
+      }
+    ]
+  }
+}

{asap_protocol-2.3.0 → asap_protocol-2.4.0}/src/asap/__init__.py

@@ -8,7 +8,7 @@ from __future__ import annotations
 
 from typing import Any
 
-__version__ = "2.3.0"
+__version__ = "2.4.0"
 
 __all__ = ["__version__", "create_from_openapi"]
 

{asap_protocol-2.3.0 → asap_protocol-2.4.0}/src/asap/auth/agent_jwt.py

@@ -20,6 +20,7 @@ from joserfc.errors import JoseError
 from joserfc.jwk import OKPKey
 from joserfc.jws import extract_compact as _jws_extract_compact
 
+from asap.auth.claims import audience_matches_expected as _audience_matches_expected
 from asap.auth.identity import (
     AgentSession,
     AgentStore,
@@ -154,24 +155,6 @@ def _jti_present(claims: dict[str, Any]) -> bool:
     return isinstance(jti, str) and bool(jti.strip())
 
 
-def _audience_matches_expected(
-    claims: dict[str, Any],
-    expected_audience: str | list[str],
-) -> bool:
-    """Return True if ``aud`` intersects ``expected_audience`` (RFC 7519 §4.1.3)."""
-    aud = claims.get("aud")
-    expected = (
-        [expected_audience] if isinstance(expected_audience, str) else list(expected_audience)
-    )
-    if isinstance(aud, str):
-        token_auds = [aud]
-    elif isinstance(aud, list):
-        token_auds = [a for a in aud if isinstance(a, str)]
-    else:
-        return False
-    return any(a in expected for a in token_auds)
-
-
 async def verify_host_jwt(
     token: str,
     host_store: HostStore,