merge: land application/mcp-a2a (MCP + A2A endpoint wiring for Nexo.API) - #269
Merged
Conversation
All four protocol directions become available on the API host, feature-flagged off by default (appsettings ships explicit disabled sections): - Program.cs: AddNexoMcpServer().WithHttpTransport() + AddNexoMcpClient + AddNexoA2AServer + AddNexoA2ATransport (before AddNexo so its scheme registration joins the remote-transport composition); read-only repo tools registered for MCP allowlisting; MapNexoMcpEndpoint + MapNexoA2AEndpoints after the security chain with named per-IP rate-limit policies (nexo-mcp / nexo-a2a, off by default via NexoMiddlewareIngressOptions fields). - NexoApiKeyAuthMiddleware: protocol-path handling - /api/mcp, /api/a2a, and the /.well-known/agent-card.json discovery path are protected on ALL verbs (the MCP SSE listen channel is a GET the mutating-verb scope would have ignored, and the root card lives outside /api entirely). Agent-card anonymity is an explicit opt-in mirrored from Nexo:A2A:Server via the new NexoProtocolIngressOptions so the middleware stays decoupled from adapters. - AgentRegistryA2ACatalog: host-side INexoA2AAgentCatalog over IAgentRegistry (the one place the domain persona model meets the A2A descriptor). - IngressCapability mcp/a2a keys + IngressCatalog operator-inventory rows. Live smoke on the built host: disabled => /health 200, /api/mcp 405, root card 404; enabled+ApiKey => 401 without key, 200 initialize with key (protocol version negotiated down to the client's 2025-06-18). [skip-prod-style]: ProdStyle endpoint tests live in src/Nexo.Tests.Infrastructure (layer boundary forbids src/** changes here); they land in the follow-up src-side PR together with the mcp-a2a CI gate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
feat(api): wire MCP + A2A protocol endpoints into Nexo.API
…o.API Coordinated application-layer landing (PR #267 reviewed on the application/ mcp-a2a base branch; the layer-boundary gate forbids application/** changes in PRs to master, so this branch lands via merge per established repo practice). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
Uh oh!
There was an error while loading. Please reload this page.
This was referenced Aug 13, 2026
IanFrelinger pushed a commit
that referenced
this pull request
Aug 17, 2026
…rograms historical; document spikes/ docs/DocsIndex.md: Start Here #1 is the tester quickstart, README #2, GettingStarted #3; IntegratorGuide and consumer-template/CONSUMING.md are listed for the first time; RELEASE.md, the setup-matrix scripts and the bootstrap helpers move out of the numbered list into an "escape hatches" paragraph (RELEASE stays under Operator); a new "Trust loop / certification (experimental, hold-mode)" group makes docs/trust-loop/*, the evidence ledger, governed-pipeline, SELF-EXTEND-AUDIT, the sample objective and spikes/ reachable; "Planning & Roadmap" becomes "Planning history (historical as of 2026-08-16)" because it described a finished program. Stale status docs are date-stamped rather than deleted: - ProtocolIntegration-MCP-A2A.md said the Nexo.API wiring was "planned"; it landed in #269/#270 (Program.cs registers all four adapters and maps /api/mcp and /api/a2a/{agentId}; IngressCatalog rows McpServer/A2AAgents). - ci-pre-existing-failures.md said the Full Platform Readiness Gate was RED as of 06-21; it went green with #317-#320/#335. Kept because docs/planning/* still cite it. - GapAnalysis.md and NorthStarGapAnalysis.md predate the trust loop; both get a historical banner naming their still-open rows and pointing at the ledger, ProjectTiers and CHANGELOG. GettingStarted.md #5 contradicted DocsIndex on "installer" scripts (the scripts/install/* helpers exist but bootstrap the container lane); it now says so and points first-run readers at the quickstart. The pointer to a README section "First Successful Pipeline Run" (which does not exist) now names the sections that do. IntegratorGuide.md recommended `dotnet build Nexo.sln` (the docs guard forbids it in README); it now builds Nexo.Kernel.sln and the CLI project, with hello-brick as the smallest test example, and the compatibility matrix names the solutions that actually apply. spikes/README.md: the 27 tracked files under spikes/ were cited as PASS evidence by the ledger but undocumented. It says what each spike is, every flag of the flight runner, which ledger rows cite each spike, and that none of it is a supported entry point. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Coordinated landing of the
application/mcp-a2aintegration branch onto master — the final step of the MCP/A2A protocol series (#263/#268/#265/#266 src-side already merged; #267 reviewed the application wiring on the integration branch).The diff vs master is exactly the 9
application/src/Nexo.APIfiles from #267: protocol endpoint wiring, all-verbs auth handling, catalog rows, rate limiters, and disabled-by-default appsettings. See #267 for the full description and live-host smoke evidence.Note on the layer-boundary check: it will report failing on this PR by design — it forbids
application/**changes in PRs to master precisely so application work gets reviewed on anapplication/*branch first, which is what #267 did. This PR is the sanctioned coordinated landing that follows; the check is not in the required set. (If a standing exemption forapplication/* → masterlanding PRs is wanted, that''s a one-line follow-up tolayer-boundary.yml.)Testing
f44b249f): distribution-matrix suite (incl. API image + health smoke, NuGet local pack), dependency-boundary verify, and a manually dispatched cert-gatefeat/mcp-a2a-prodstyle, already rebased onto this SHA)🤖 Generated with Claude Code
[skip-prod-style]: ProdStyle endpoint coverage lands in the immediate follow-up PR from feat/mcp-a2a-prodstyle (already rebased onto this SHA); this PR's application files were reviewed in #267.