asap-protocol 2.5.3__tar.gz → 2.5.4__tar.gz

{asap_protocol-2.5.3 → asap_protocol-2.5.4}/CHANGELOG.md

@@ -7,9 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-### Follow-up (planned v2.5.4+)
+### Follow-up (planned v2.5.5+)
 
-- **Distribution Loop** — homepage, templates, metrics ([prd-v2.5.4-distribution-loop.md](product/prd/prd-v2.5.4-distribution-loop.md)).
 - **Formal Spec & Interop** — RFC spec, introspection, privacy ([prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md)).
 - `@asap-protocol/mcp-auth` HTTP/SSE middleware (deferred from v2.5.0 — see [2.5.0] TypeScript note and [typescript-mcp-auth-spike.md](engineering/tasks/v2.5.0/typescript-mcp-auth-spike.md)).
 - Collapse the dual `UsageMetrics`/`InMemoryMeteringStore` pair retained in S1 for API stability.
@@ -17,15 +16,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
-## [2.5.3] - 2026-07-14
+## [2.5.4] - 2026-07-18
+
+> **Status:** pending tag `v2.5.4` / PyPI publish (S5 prep). Merge → tag → publish runs after this train lands on `main` via `release/2.5.4`.
+
+**Distribution Loop** — homepage, thin starters, Build for agents guide, and maintainer
+telemetry ops (no public metrics UI). Scope:
+[prd-v2.5.4-distribution-loop.md](product/prd/prd-v2.5.4-distribution-loop.md).
+npm `@asap-protocol/*` packages remain at **2.4.1**.
+
+### Added
+
+- **Thin starters** under `examples/starters/`:
+  - `openapi-provider/` — OpenAPI → ASAP skills wrapper
+  - `typescript-consumer/` — `@asap-protocol/client` consumer smoke
+  - `mcp-auth-bridge/` — MCP Auth Bridge (`protect_server`) wrapper
+- **Build for agents guide** — [docs/guides/build-for-agents.md](docs/guides/build-for-agents.md)
+  (agent-first onboarding into the three starters).
+- **Homepage agent-first narrative** — hero / CTAs route to docs, starters, and
+  examples (marketplace browse/register remain secondary).
+- **Telemetry ops** — collector defaults expanded (npm ≥3 scoped packages,
+  PyPI ≥2); maintainer runbook; **no** public live metrics UI (PRD D4).
+
+### Security (deps)
 
-> **Status:** merged to `main` ([#291](https://github.com/adriannoes/asap-protocol/pull/291), 2026-07-15);
-> **pending tag/publish**. PyPI still serves **2.5.2** until `v2.5.3` is tagged and the
-> release workflow completes.
+- Raise optional `[mcp]` floor to `mcp>=1.28.1` for **CVE-2026-52869**,
+  **CVE-2026-52870**, and **CVE-2026-59950**. See [SECURITY.md](SECURITY.md).
+
+### Migration
+
+- **v2.5.3 → v2.5.4**: See [migration guide](docs/migration.md#upgrading-from-v253-to-v254).
+  No breaking wire-protocol changes; adopt starters/guide as needed.
+
+---
+
+## [2.5.3] - 2026-07-14
 
 **Adapter Lab II** — workflow / enterprise adapters as **docs + examples** (no wire-format
 change). Scope: [prd-v2.5.3-adapter-lab-ii.md](product/prd/prd-v2.5.3-adapter-lab-ii.md).
-npm `@asap-protocol/*` packages remain at **2.4.1**.
+npm `@asap-protocol/*` packages remain at **2.4.1**. Tag [`v2.5.3`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.3) · PyPI `asap-protocol==2.5.3`.
 
 ### Added
 

{asap_protocol-2.5.3 → asap_protocol-2.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: asap-protocol
-Version: 2.5.3
+Version: 2.5.4
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/adriannoes/asap-protocol
 Project-URL: Documentation, https://adriannoes.github.io/asap-protocol
@@ -73,7 +73,7 @@ Requires-Dist: langchain-core>=1.3.3; extra == 'langchain'
 Provides-Extra: llamaindex
 Requires-Dist: llama-index-core>=0.10; extra == 'llamaindex'
 Provides-Extra: mcp
-Requires-Dist: mcp>=1.0.0; extra == 'mcp'
+Requires-Dist: mcp>=1.28.1; extra == 'mcp'
 Provides-Extra: openapi
 Requires-Dist: openapi-pydantic>=0.5; extra == 'openapi'
 Provides-Extra: openclaw
@@ -99,9 +99,9 @@ Description-Content-Type: text/markdown
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: [`v2.5.3`](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#253---2026-07-14) (merged · pending tag/publish) · PyPI [`v2.5.2`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.3`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.3) on PyPI · in-tree **v2.5.4** pending tag · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
 
-> 📦 **Install** — [`asap-protocol` **2.5.2** on PyPI](https://pypi.org/project/asap-protocol/) (Python; **2.5.3** merged to `main`, pending tag/publish) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.3** on PyPI](https://pypi.org/project/asap-protocol/) (Python; **2.5.4** pending publish) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
@@ -156,16 +156,16 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 
 ```bash
-uv add asap-protocol  # latest on PyPI (currently 2.5.2)
+uv add asap-protocol  # latest on PyPI (currently 2.5.3; in-tree 2.5.4 pending publish)
 ```
 
 Or with pip:
 
 ```bash
-pip install asap-protocol==2.5.2
+pip install asap-protocol==2.5.3
 ```
 
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.3; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.4; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -177,7 +177,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
-**Python v2.5.3** (Adapter Lab II) is **merged to `main`** and **pending tag/publish** — stay on `asap-protocol==2.5.2` from PyPI until the release is published; then see [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253).
+**Python v2.5.4** (Distribution Loop) is **pending tag/PyPI** — see [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254). Start here: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 
 ## Quick Start
 
@@ -265,7 +265,8 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 
 | Version | What shipped |
 | :-- | :-- |
-| **v2.5.3** | **Adapter Lab II** — **merged · pending tag/publish**. Workflow OpenAPI connectors + security guide, experimental MAF / NeMo guides, JSON-safe `-32602`, MCP example client DX. PyPI still **2.5.2**. See [CHANGELOG](CHANGELOG.md#253---2026-07-14), [PRD](product/prd/prd-v2.5.3-adapter-lab-ii.md), and [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253) |
+| **v2.5.4** | **Distribution Loop** — pending tag/PyPI · thin starters (`examples/starters/`), [Build for agents](docs/guides/build-for-agents.md), homepage agent-first CTAs, telemetry ops (no public metrics UI). See [CHANGELOG](CHANGELOG.md#254---2026-07-18), [PRD](product/prd/prd-v2.5.4-distribution-loop.md), and [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254) |
+| **v2.5.3** | **Adapter Lab II** — **[GitHub Release `v2.5.3`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.3)** · workflow OpenAPI connectors + security guide, experimental MAF / NeMo guides, JSON-safe `-32602`, MCP example client DX. See [CHANGELOG](CHANGELOG.md#253---2026-07-14), [PRD](product/prd/prd-v2.5.3-adapter-lab-ii.md), and [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253) |
 | **v2.5.2** | **Security & correctness follow-up** — opt-in operator API auth, `extra="forbid"` ingress, Redis JTI replay, web distributed rate limits, v2.5.1 CR follow-ups (#245–#249), registry signed-manifest/400 fixes. See [CHANGELOG](CHANGELOG.md#252---2026-07-08), [PRD](product/prd/prd-v2.5.2-security-follow-up.md), and [Migration (v2.5.1 → v2.5.2)](docs/migration.md#upgrading-from-v251) |
 | **v2.5.1** | **Code quality patch** — behavior-preserving refactor (transport/server, client, websocket, SQLite storage, auth, integrations) + six correctness/security fixes (atomic `revoke_cascade`, `usage_events` DDL, unified Host-JWT verifier, **WS now enforces OAuth2**, OpenAPI handler cleanup, client `correlation_id` binding). Deprecated import paths removed in v2.6.0. See [CHANGELOG](CHANGELOG.md#251---2026-06-25) and [Migration (v2.5.0 → v2.5.1)](docs/migration.md#upgrading-from-v250-to-v251) |
 | **v2.5.0.1** | **Compliance publish** — **[GitHub Release `v2.5.0.1`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.0.1)** · PyPI **`asap-compliance` 1.3.0** (`mcp-auth-bridge` profile; requires `asap-protocol>=2.5.0`). No `asap-protocol` API change. See [CHANGELOG](CHANGELOG.md#2501---2026-06-24) |
@@ -287,7 +288,7 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
 
-- **v2.5.4** — distribution loop (homepage templates, starter kits, adoption metrics)
+- **v2.5.5** — Formal Spec & Interop (RFC, introspection, privacy)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** (v2.5.5) — introspection, privacy, cross-protocol interop on the path to v3.0 economy
 

{asap_protocol-2.5.3 → asap_protocol-2.5.4}/README.md

@@ -7,9 +7,9 @@
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: [`v2.5.3`](https://github.com/adriannoes/asap-protocol/blob/main/CHANGELOG.md#253---2026-07-14) (merged · pending tag/publish) · PyPI [`v2.5.2`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.3`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.3) on PyPI · in-tree **v2.5.4** pending tag · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
 
-> 📦 **Install** — [`asap-protocol` **2.5.2** on PyPI](https://pypi.org/project/asap-protocol/) (Python; **2.5.3** merged to `main`, pending tag/publish) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.3** on PyPI](https://pypi.org/project/asap-protocol/) (Python; **2.5.4** pending publish) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
@@ -64,16 +64,16 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 
 ```bash
-uv add asap-protocol  # latest on PyPI (currently 2.5.2)
+uv add asap-protocol  # latest on PyPI (currently 2.5.3; in-tree 2.5.4 pending publish)
 ```
 
 Or with pip:
 
 ```bash
-pip install asap-protocol==2.5.2
+pip install asap-protocol==2.5.3
 ```
 
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.3; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.4; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -85,7 +85,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
-**Python v2.5.3** (Adapter Lab II) is **merged to `main`** and **pending tag/publish** — stay on `asap-protocol==2.5.2` from PyPI until the release is published; then see [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253).
+**Python v2.5.4** (Distribution Loop) is **pending tag/PyPI** — see [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254). Start here: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 
 ## Quick Start
 
@@ -173,7 +173,8 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 
 | Version | What shipped |
 | :-- | :-- |
-| **v2.5.3** | **Adapter Lab II** — **merged · pending tag/publish**. Workflow OpenAPI connectors + security guide, experimental MAF / NeMo guides, JSON-safe `-32602`, MCP example client DX. PyPI still **2.5.2**. See [CHANGELOG](CHANGELOG.md#253---2026-07-14), [PRD](product/prd/prd-v2.5.3-adapter-lab-ii.md), and [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253) |
+| **v2.5.4** | **Distribution Loop** — pending tag/PyPI · thin starters (`examples/starters/`), [Build for agents](docs/guides/build-for-agents.md), homepage agent-first CTAs, telemetry ops (no public metrics UI). See [CHANGELOG](CHANGELOG.md#254---2026-07-18), [PRD](product/prd/prd-v2.5.4-distribution-loop.md), and [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254) |
+| **v2.5.3** | **Adapter Lab II** — **[GitHub Release `v2.5.3`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.3)** · workflow OpenAPI connectors + security guide, experimental MAF / NeMo guides, JSON-safe `-32602`, MCP example client DX. See [CHANGELOG](CHANGELOG.md#253---2026-07-14), [PRD](product/prd/prd-v2.5.3-adapter-lab-ii.md), and [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253) |
 | **v2.5.2** | **Security & correctness follow-up** — opt-in operator API auth, `extra="forbid"` ingress, Redis JTI replay, web distributed rate limits, v2.5.1 CR follow-ups (#245–#249), registry signed-manifest/400 fixes. See [CHANGELOG](CHANGELOG.md#252---2026-07-08), [PRD](product/prd/prd-v2.5.2-security-follow-up.md), and [Migration (v2.5.1 → v2.5.2)](docs/migration.md#upgrading-from-v251) |
 | **v2.5.1** | **Code quality patch** — behavior-preserving refactor (transport/server, client, websocket, SQLite storage, auth, integrations) + six correctness/security fixes (atomic `revoke_cascade`, `usage_events` DDL, unified Host-JWT verifier, **WS now enforces OAuth2**, OpenAPI handler cleanup, client `correlation_id` binding). Deprecated import paths removed in v2.6.0. See [CHANGELOG](CHANGELOG.md#251---2026-06-25) and [Migration (v2.5.0 → v2.5.1)](docs/migration.md#upgrading-from-v250-to-v251) |
 | **v2.5.0.1** | **Compliance publish** — **[GitHub Release `v2.5.0.1`](https://github.com/adriannoes/asap-protocol/releases/tag/v2.5.0.1)** · PyPI **`asap-compliance` 1.3.0** (`mcp-auth-bridge` profile; requires `asap-protocol>=2.5.0`). No `asap-protocol` API change. See [CHANGELOG](CHANGELOG.md#2501---2026-06-24) |
@@ -195,7 +196,7 @@ High-level only — see **[Changelog](https://github.com/adriannoes/asap-protoco
 
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
 
-- **v2.5.4** — distribution loop (homepage templates, starter kits, adoption metrics)
+- **v2.5.5** — Formal Spec & Interop (RFC, introspection, privacy)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** (v2.5.5) — introspection, privacy, cross-protocol interop on the path to v3.0 economy
 

{asap_protocol-2.5.3 → asap_protocol-2.5.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "asap-protocol"
-version = "2.5.3"
+version = "2.5.4"
 description = "Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication"
 authors = [
     {name = "ASAP Protocol Contributors"}
@@ -84,7 +84,8 @@ webauthn = [
 ]
 # Framework integrations (Sprint E3 — PKG-003).
 mcp = [
-    "mcp>=1.0.0",
+    # Floor 1.28.1 for CVE-2026-52869 / CVE-2026-52870 / CVE-2026-59950.
+    "mcp>=1.28.1",
 ]
 langchain = [
     "langchain-core>=1.3.3",

{asap_protocol-2.5.3 → asap_protocol-2.5.4}/src/asap/__init__.py

@@ -8,7 +8,7 @@ from __future__ import annotations
 
 from typing import Any
 
-__version__ = "2.5.3"
+__version__ = "2.5.4"
 
 __all__ = ["__version__", "create_from_openapi"]