dsh-a2a-server

Configuration

- id: a2a-server
  name: dsh-a2a-server
  config:
    basePath: /a2a
    publicUrl: https://agents.example.com/a2a   # advertised on the card
    protocolVersion: 0.3.0
    provider: deepseek-official
    model: deepseek-v4-flash

    card:
      name: dsh-harness
      description: Reads code, runs commands, reports findings.
      public: true
      skills:
        - id: general
          name: general
          description: General-purpose task execution.
          tags: [coding, research]
      provider:
        organization: Example Inc.
        url: https://example.com

    peers:
      alice: { tokenEnv: A2A_PEER_ALICE }
      bob:   { tokenEnv: A2A_PEER_BOB }
    trustedPeers: [alice]
    rateLimitPerMinute: 60
    maxContextTurns: 5

    sendMode: block
    blockTimeoutMs: 60000
    contextIdleTtlMs: 1800000
    maxResidentContexts: 64

    isolation:
      workspaceMode: per-peer
      workspaceRoot: /srv/dsh/a2a
      peerWorkspaces:
        alice: /srv/project

    push:
      enabled: false

Key	Default	Meaning
basePath	/a2a	JSON-RPC route
publicUrl	derived from Host	Routable URL published on the card
protocolVersion	0.3.0	Version advertised on the card
provider · model	—	Model route for every agent this server creates
card.public	true	Serve the card without a credential
card.skills	[]	Declared skills; falls back to one general entry
peers	{}	Identity → credential reference name
trustedPeers	all authenticated	Allow-list of identities that may run tasks
rateLimitPerMinute	60	Sliding window per identity
maxContextTurns	5	Messages accepted per context before rejected
sendMode	block	Default when the client states no preference
blockTimeoutMs	60000	After which a blocking request is declined
contextIdleTtlMs	1800000	Idle time before a context's agent is released
maxResidentContexts	64	Ceiling on resident contexts
isolation.workspaceMode	per-peer	per-peer or shared
isolation.workspaceRoot	—	Required; parent directory or shared cwd
isolation.peerWorkspaces	{}	Per-identity working-directory override
push.enabled	false	Reserved; see Boundaries

Configuration is refused at load when isolation.workspaceRoot is absent, a peer name is not [A-Za-z0-9][A-Za-z0-9_-]*, a tokenEnv is not a POSIX identifier, trustedPeers or peerWorkspaces names an undeclared peer, or basePath does not start with /.

Credentials

Configuration carries credential references, never values:

peers:
  alice: { tokenEnv: A2A_PEER_ALICE }