MCP and A2A

Alice has a small program and input. Bob has a Froglet node that can execute it under finite limits. Alice’s agent uses the local native MCP tool; her requester runtime verifies Bob’s Quote and signs the Deal. An optional A2A adapter carries that same work to Bob and exposes its Task for polling.

Component	What it does
Native MCP	Connects an agent host to Alice’s local requester node through froglet-node mcp.
Optional A2A	Connects configured counterparties using A2A 1.0 HTTP+JSON and the required Froglet extension.
Froglet runtime	Owns Quote checks, requester signing, admission, execution, recovery and result acceptance.
Settlement driver	Applies the selected existing payment method when paid work is explicitly authorized.

What works in practice

The functionality matrix below covers supported, experimental, disabled and planned paths. Verified locally means exercised with real processes on the existing test hosts. Not yet qualified means the deployment claim needs further evidence. Unsupported means the current profile does not provide that capability.

Scenario	Status	In plain language
Alice sends a small compatible program to Bob	Verified locally	Bob runs Alice’s Wasm program and returns the answer with signed records. Alice still needs to supply compiled, compatible bytes.
Alice retrieves Bob’s selected table and audits its mappings	Verified locally with illustrative data	Two observed terms have one target, one has several targets, and one is unmapped under Alice’s one-target policy. Scientific meaning remains a separate decision.
Alice’s program never finishes	Verified locally	Bob stops it at the execution limit and returns a failure record. It cannot consume unlimited compute.
Alice repeats the same request after losing a response	Recovery tested, with limits	The same program, input, provider and key can recover admitted work. A request whose admission is still unknown can remain unresolved.
Bob restarts after completing Alice’s job	Verified locally	Alice can read the existing result and Receipt. A restart does not require buying the job again.
Alice uses Codex to retrieve rows and run an analysis	Exercised with an actual Codex host on one Mac	Codex called native MCP, used the returned rows as input, ran a local compiled Wasm file on Bob and recovered the verified result. This does not qualify every host, a clean operating system or a first-time user.
Bob shares a real public terminology catalog	Exercised locally with pinned public data	Alice retrieved all 140 selected GO terms in two pages, with verified receipts. This demonstrates exchange; it does not evaluate ontology alignment or research usefulness.
Alice runs the native workflow on Linux arm64	Exercised in an isolated Docker environment	The same production source passed native MCP tests and the two-node Wasm scenario. This development build does not qualify a fresh machine, Linux agent host or public installer.
Alice runs the recorded October local demo bundle	Exercised on one Mac and in Linux arm64 Docker	The precompiled program needs no Rust, Cargo or Node. Disposable setup uses Python 3.10+; the separate TLS check also needs OpenSSL. That historical package keeps its original pin; it does not qualify a fresh operating system or the new release’s installer.
Alice and Bob declare different namespaces or units	Explicit preflight available	A research profile can make those differences visible before analysis. Alice must choose her own requirements; matching declarations do not prove scientific correctness.
Bob admits an invited, configured Alice	Exercised over local TLS	Both the admission invitation and the A2A scope must allow her. Revocation stops new work; an ordinary admission invitation still covers the provider’s services.
Bob posts a link and any stranger buys immediately	Unsupported through this A2A profile	Discovery does not grant access. Bob must authorize the requester and allowed Offers; the requester must understand Froglet’s extension.
Alice pays real money on a public deployment	Not yet qualified	Payment adapters exist, but the free local demo does not establish production execution, settlement or recovery.
Alice asks 100 providers to divide one large job	Unsupported as an automatic workflow	Individual remote jobs are supported. Froglet does not supply a multi-provider scheduler or distributed training system.

Fresh program evidence

On 1 October, separate Bob and Alice Codex sessions published selected synthetic assay rows and generated, compiled and remotely ran a new batch-summary Wasm program. The original input and three unseen cases were independently correct; the selected snapshot and publication signature were also checked. That fresh-session qualification remains incomplete: its recorder failed before exporting complete execution chains, and persistent Codex configuration changed for an unresolved reason. Correct outputs are not a substitute for those gates.

A separate deterministic replay then ran the retained program without starting another agent session. Independent offline verification checked all seven new signed execution chains: six successful Deals, including four independently correct input cases, and one deliberate execution-limit failure. It also checked the selected-data privacy boundary and exact result recovery. Two earlier recorder runs failed and were retained before this passing replay. These are new locally verified executions; they do not silently turn the earlier fresh-session attempt into a pass.

After Bob stopped and Alice’s requester restarted, exact run_compute and invoke_service retries recovered the saved results and receipts without new Deals. In that historical replay, get_task attempted to refresh Bob’s status and returned HTTP 502 while he was offline. The 3 October current-source correction revalidates saved terminal Quote/Deal/Receipt evidence locally, including after Alice restarts. Local regressions cover completed selected-data and Wasm calls, signed failures and rejected/canceled fixtures, key rotation, authentication and corrupted records. Unsigned or unresolved tasks still need Bob for status refresh. The fresh optimized native candidate replay passed independent verification of all seven chains and all six saved Alice terminal task reads with Bob stopped and Alice restarted. The earlier failures are preserved. Package/release checks and website publication remain separate; this website copy does not qualify cloud execution or paid settlement.

A research collaboration: Bob shares a selected terminology table as a data service. Alice can look up the mappings Bob supplied. If Alice and Bob disagree about what a scientific term means, Froglet does not resolve that disagreement or establish that the mapping is correct. It supplies a way to exchange the selected information and inspect the records.

A disposable analysis: Alice’s assistant helps prepare a one-off analysis as a compatible Wasm program. Bob’s configured Node can execute it under the quoted limits. The agent interface does not compile arbitrary Python, connect to Bob’s private database or grant the program access to his filesystem.

A confidential project: Bob receives the program and input in this compute flow. An access credential limits who may request work; it does not hide the input from Bob or recall a result that Alice already received. This profile is not confidential computation or automatic enforcement of a data-use agreement.

Source and release support

The immutable v0.4.7-beta.1 prerelease includes native run_compute, read-only get_task and optional configured A2A. Choose that exact release for this compute profile. Verify its published manifest and matching binary checksum, then select the downloaded froglet-node binary in your agent’s native MCP profile.

Support in an installed release depends on its exact binary: inspect the native MCP tools/list response for run_compute and get_task, and check that release’s notes. Source tests do not establish that an older immutable release includes these actions.

Additional Linux arm64 qualification exercised 625 library tests and nine native MCP integration tests, then the selected-data and Wasm workflow. Thirteen tests were ignored, including Python OS sandbox tests; this run makes no Python isolation claim. The Linux binary is a separate Docker development build from the same recorded production inputs. Clean-machine and actual Linux agent-host qualification remain open.

Quickstart retains its exact v0.4.6-beta.4 sharing baseline. For this compute profile, select v0.4.7-beta.1 explicitly; GitHub’s releases/latest does not select prereleases. In Quickstart’s manual verification sequence, use tag=v0.4.7-beta.1 and retain the manifest, asset checksum and installation-plan checks.

The two-node example below uses the matching tagged source checkout and needs development tools. It is separate from the no-clone installer and does not change agent-host settings.

Functionality and limits

Release availability, source support and deployment evidence are separate. The immutable v0.4.7-beta.1 prerelease is published. Its downloaded Mac binary passed a localhost replay and a separate native-MCP-to-Fly proof: six bounded free cases, restart persistence and offline recovery on one isolated host, now removed. Available hosted compute, production/load, fresh agent hosts, clean OS setup and payments remain unqualified. Remote A2A evidence remains separate and local. Individual experiments, disabled paths and plans remain labeled separately.

Current functionality, practical Alice/Bob scenarios and limits

Functionality	Status	What Alice and Bob can do	Current limit
SharingSelected JSON, typed CSV and SQLite tables	Implemented	Bob shares only the columns Alice needs, as a separate snapshot.	Mixed JSON needs normalization; original data is preserved. No arbitrary SQL or joins.Source reference: src/cli/prepare.rs
SharingDescribe, select, filter and page selected rows	Implemented	Alice retrieves matching rows, chosen columns and the next page.	Scalar equality only. Complex comparisons run in Alice’s analysis.Source reference: docs/SERVICE_BINDING.md
SharingPrepare, verify and approve publication	Implemented	Bob inspects an example and approves the exact public package.	Public hosting requires exact consent. A listing does not prove Alice has used it.Source reference: src/cli/mcp.rs
SharingService links, manifests and QR codes	Implemented	Bob sends a link; Alice can inspect the signed description before calling.	A link grants no credentials. Offline descriptions can be stale.Source reference: docs/SHAREABLE_SERVICE_LINK.md
SharingMarketplace search and discovery	Implemented	Alice browses named services and prices through the website or JavaScript tools.	Discovery depends on the registry. Native MCP inspects links; it has no search action.Source reference: integrations/shared/froglet-lib/tool-dispatch.js
SharingSource changes and publication lifecycle	Implemented	Bob detects an update, prepares a new version, or pauses, rolls back or withdraws it.	No automatic republishing. Already delivered results cannot be recalled.Source reference: src/cli/prepare.rs
SharingOne bounded existing HTTPS JSON operation	Implemented	Bob exposes one fixed lookup, classifier or inference call with private credentials.	Fixed GET or POST, schemas, byte limits and deadline. No arbitrary proxy, uploads or streaming.Source reference: docs/HTTP_SERVICES.md
SharingFile download sharing	Experimental	Bob shares a fixed file snapshot; Alice downloads it through the candidate file flow.	Local F1 implementation, capped at 8 MiB; Node, share UI and relay release qualification remains open.Source reference: docs/FILE_AND_COMPUTE_SCOPE.md
ComputationRequester-supplied bounded Wasm	Verified locally	Alice sends a compatible compiled program and input for Bob to execute.	Native action accepts at most 256 KiB of Wasm. It does not compile source or expose Bob’s files.Source reference: tests/cli_mcp_compute.rs
ComputationMemory, fuel and execution deadlines	Verified locally	Alice’s nonterminating program stops at Bob’s execution limit.	Limits bound execution; they do not establish that the answer is correct.Source reference: examples/a2a_compute_demo.py
ComputationExact retries and result recovery	Verified locally	Alice reads a saved completed call with get_task or its exact retry key, even after Bob stops and Alice restarts.	get_task revalidates saved terminal receipts offline. Unsigned or unresolved tasks still need Bob for refresh. Unknown admission can remain unresolved; no universal exactly-once promise.Source reference: tests/cli_mcp_compute.rs
ComputationReleased native MCP across two hosts	Qualified narrowly	Alice’s released Mac node called Bob’s released provider on one isolated Fly machine with a finite free invitation.	Six synthetic cases: five successes and an expected fuel failure; restart persistence and six offline saved-task reads. Test host removed. No remote A2A, production/load, fresh agent-host, clean-OS or paid qualification.Source reference: docs/RELEASE.md
ComputationExplicit research declarations	Verified locally	Alice checks Bob’s declared fields, namespaces, versions and units before analysis.	Declaration checks and illustrative mapping audits do not solve ontology alignment or scientific truth.Source reference: docs/RESEARCH_PROFILE.md
ComputationAdvanced Python and OCI execution profiles	Experimental	An operator configures a specific supported execution environment.	Outside native run_compute. Linux isolation and general CPU jobs have separate gates.Source reference: docs/FILE_AND_COMPUTE_SCOPE.md
ComputationGPU execution and rental	Disabled	Alice cannot currently rent Bob’s GPU through the isolated worker.	Historical T4 smoke evidence does not qualify the current disabled worker path.Source reference: docs/FILE_AND_COMPUTE_SCOPE.md
AgentsNative MCP tool	Verified locally	Alice’s agent uses one local tool for invocation, computation and recovery.	Actual Codex exercised on one Mac. Exact binary support, host attachment and fresh OS testing are separate.Source reference: docs/RELEASE.md
AgentsJavaScript MCP and OpenClaw adapters	Implemented	Alice uses the broader discovery, task and payment-inspection tools.	Adapter tests do not qualify every host. Claude’s actual signed-in session remains unrun.Source reference: integrations/shared/froglet-lib/tool-dispatch.js
AgentsOptional A2A 1.0 configured-counterparty flow	Verified locally	Authorized Alice obtains a Quote, submits a signed Deal and polls Bob’s Task.	Required Froglet extension, exact requester and Offer scope, direct ingress; disabled by default.Source reference: src/api/a2a.rs
AgentsReviewed A2A counterparty setup	Implemented	Bob and Alice prepare private settings from a reviewed plan instead of editing credentials manually.	Source helper requires Python and POSIX permissions; restart activates the new settings.Source reference: docs/A2A_COUNTERPARTY_SETUP.md
AgentsA2A streaming, push and provider cancellation	Unsupported	Alice uses polling; she cannot cancel an admitted Deal through A2A.	No conversational continuation, relay A2A ingress or full TCK certification.Source reference: docs/AGENT_INTEROPERABILITY_PLAN.md
AgentsAny stranger buys immediately from an A2A link	Unsupported	Finding Bob’s Agent Card gives Alice information, not execution authority.	Operator configuration is required. No anonymous federation or general organization-wide delegation.Source reference: docs/AGENT_INTEROPERABILITY_PLAN.md
Evidence and controlsSigned terms, workload, result commitments and receipts	Implemented	Alice can inspect what was agreed and match the received result to its commitment.	Signatures do not prove truthful execution, scientific correctness or usefulness.Source reference: docs/KERNEL.md
Evidence and controlsOffline Rust, browser and independent Python verification	Implemented	Alice checks supplied records without trusting a marketplace or calling Bob.	Browser uses the Rust implementation. Independent Python verifies but does not sign.Source reference: conformance/README.md
Evidence and controlsPrivate, invite and bounded-trial admission	Implemented	Bob issues an expiring invitation or pauses new work and caps cumulative use.	Ordinary invitations cover the provider’s services. Counters do not cap hosting or already-started upstream charges.Source reference: docs/HTTP_SERVICES.md
Evidence and controlsDiagnosis, status, identity backup and lifecycle recovery	Implemented	Bob inspects failures, preserves his identity and reconciles publication changes.	A sleeping or stopped host is unavailable. Managed always-on hosting is not provided.Source reference: docs/RELEASE.md
Evidence and controlsSelf-hosted Tor transport	Experimental	Bob explicitly operates an onion endpoint instead of direct clearnet ingress.	Advanced self-hosted path; no managed Tor hosting or A2A relay claim.Source reference: python/tests/test_tor_integration.py
PaymentsFree exchanges	Verified locally	Alice runs a job with a zero-price ceiling and no payment.	Published-Mac localhost execution is verified; the separately scoped six-case cross-host proof does not qualify an available hosted compute service or paid operation.Source reference: docs/RELEASE.md
PaymentsLightning escrow and prepaid drivers	Experimental	Configured Alice authorizes a paid call under explicit price and wallet limits.	LND regtest evidence exists; mock mode is test-only. No mainnet transcript or qualified paid MCP/A2A deployment.Source reference: docs/PAYMENT_MATRIX.md
PaymentsStripe Shared Payment Token driver	Experimental	A compatible requester supplies a token from an authorized platform.	Mock/sandbox evidence, no live-money transcript. Native compute does not accept a Stripe token argument.Source reference: docs/PAYMENT_MATRIX.md
PaymentsSeparate x402 HTTP payment endpoint	Experimental	A configured client uses the distinct HTTP 402 challenge flow.	Kernel/vectors and driver exist, but priced Quote/Deal admission rejects this rail. No live-network transcript.Source reference: src/api/mod.rs
PaymentsPrice ceilings, spend policy and payment-state inspection	Implemented	Alice limits an authorized call and inspects payment intent, invoices and usage.	Free-only defaults. A ceiling alone grants no authority; automatic refill, stake and marketplace top-up are unavailable.Source reference: integrations/shared/froglet-lib/tool-dispatch.js
Future scopePublic HTTPS operation of the new compute profile	Not yet qualified	Alice and Bob operate the current profile across independent machines.	The finite six-case Mac-to-Fly proof passed and its test host was removed. An available service still needs deployment, admission, production/load and operator qualification.Source reference: docs/RELEASE.md
Future scopeGeneral bounded CPU container jobs	Planned	Alice submits a general container job with status, cancel and result handling.	C1 foundations exist; controlled pulls, hard disk bounds and isolation qualification remain incomplete.Source reference: docs/FILE_AND_COMPUTE_SCOPE.md
Future scopeAutomatic multi-provider batch scheduling	Planned	Alice asks many providers to divide one large job automatically.	Individual tasks work today; no fan-out scheduler, distributed training or batch retry workflow.Source reference: TODO.md
Future scopeDNS/OIDC identity-attestation issuer	Planned	A service verifies Bob’s external identity and issues a renewable attestation.	Payload/validator exist. Issuance and re-verification service remains to be built.Source reference: TODO.md
Future scopeManaged always-on hosting	Planned	Bob would like a managed service to keep his provider running.	Future work; no managed product or uptime SLA exists today.Source reference: docs-site/src/pages/managed.astro
Future scopeArbitrary contracts and general organizational delegation	Unsupported	Bob cannot delegate every legal term or organization-wide permission to Froglet.	Selected scope, admission and resource limits are technical controls, not automatic legal enforcement.Source reference: docs/RELEASE.md
Future scopeConfidential execution and selective disclosure	Planned	Alice wants computation whose input Bob cannot see, or selectively disclosed evidence.	Specification scope only. The current compute flow sends Bob the program and input.Source reference: docs/CONFIDENTIAL.md
Future scopeStake slashing and economic adjudication	Planned	A dispute automatically changes deposits or reputation.	Complaint wrappers are distinct from an implemented economic mechanism; design parameters remain open.Source reference: docs/ARBITER.md

Run the free Alice/Bob example

Use a trusted v0.4.7-beta.1 source checkout that contains examples/a2a_compute_demo.py, with Python 3.10+, Cargo/Rust and the wasm32-unknown-unknown target. From its root:

rustup target add wasm32-unknown-unknown
python3 examples/a2a_compute_demo.py --serve

The script builds the node and the existing Rust Wasm adder with --locked. It starts independent Alice and Bob processes on literal localhost ports, with fresh keys, private state and free-only configuration. Alice supplies {"a":6,"b":7}; Bob returns {"sum":13,"product":42}. The native runtime and CLI check signed evidence and the canonical result hash.

An older checkout or installed release may lack this example and these actions. The native actions are included in v0.4.7-beta.1; the helper comes from its matching tagged source checkout. Running it demonstrates the local scenario described here. Public-deployment qualification remains separate.

Before keeping the nodes available, the script checks an exact retry, refusal of changed input under the same key, an infinite loop stopped by the execution limit, and recovery after Bob restarts. An exact retry leaves one provider Deal; this path does not enqueue a separate jobs row.

The sanitized report names the verifier component and includes the result hash, signed execution limits and Receipt verification. It prints paths to private mcp-host.json and agent-call.json files. Connect your host using the generated MCP configuration, then use the generated froglet tool arguments. The host file points at local token files and includes no credential values. The call file contains the compiled program and Bob’s actual identity and origin.

The agent call has its own retry key. For recovery, replace the template’s task_id with the deal_id returned by that call. A changed program or input needs a new key. Keep the demo running while the agent uses its configuration; Ctrl-C stops both nodes and removes their temporary state.

Run without --serve for a one-shot check. After the initial build, use --no-build to reuse local build artifacts. --output /path/to/report.json saves the sanitized report; --keep-state retains private state for inspection. Failures retain private logs, and started child processes are stopped.

The Rust adder example reads flat integer inputs. It is a small input-consuming program, not a general JSON schema validator or scientific workload.

Run a terminology mapping check

The ontology scenario uses a small illustrative dataset, not patient data or an authoritative scientific ontology:

python3 examples/a2a_compute_demo.py --scenario ontology --serve

Bob publishes a selected terminology table as a data service. Alice retrieves that table through her requester node, then supplies a disposable Wasm program and the returned rows as explicit input. Alice chooses a rule of one distinct target per term. The program checks whether each term has one supplied target, several distinct targets, or no supplied mapping. It reports ambiguity under that rule rather than choosing a scientific meaning; several targets may be legitimate in another research workflow.

Step	What happens	What it does not establish
Bob publishes	He deliberately selects the table to expose.	Access to the rest of his files or database.
Alice retrieves	Her requester receives the selected rows and signed records.	That the mappings are scientifically correct.
Alice runs a check	Bob’s bounded executor processes the supplied rows.	Hidden access to Bob’s data or automatic ontology alignment.
Alice inspects the report	Conflicts and missing mappings are visible.	Permission to use the data under every possible contract.

The local setup uses Bob’s operator-configured daemon origin for service metadata and Alice’s separate runtime for signing and submission. It does not relax the public HTTPS requirement for remote service links. Both service retrieval and computation use free terms and configured counterparties.

The combined recorded check returns two uniquely mapped observed terms, one source with multiple distinct targets, and one unmapped term. Four actual compute runs cover an unambiguous control, multiple targets, a missing term, and the combined case. Their outputs match an independent Python calculation from the retrieved rows. The runner also checks exact retries, changed-input refusal, a nonterminating program stopped at an execution limit, and recovery of the same data and computation records after Bob restarts. Signed evidence binds the exchange; the separate reference calculation checks this example’s answer under the stated rule.

The source-checkout runner prepares and compiles the program. The native MCP action receives compiled bytes; it does not compile arbitrary agent-written source. The generated host configuration can be used for a separate agent-host connection test while the demo is running.

With a compatible binary and an already compiled module, the runner can skip Cargo and Rustup entirely:

python3 examples/a2a_compute_demo.py --scenario ontology \
  --binary /absolute/froglet-node --module /absolute/ontology_audit.wasm --serve

Both paths are required together. The runner is a source helper; immutable v0.4.7-beta.1 provides compatible native binaries. The historical standalone demo keeps its own binary and module pins. Its development-Mac run with build tools absent from PATH does not qualify a clean OS installation or an independent user trial.

Declare research assumptions before analysis

Native prepare_service can accept an optional research_profile for selected tabular data. It checks all selected rows against the declared fields, scalar types, nullability and identifier prefixes. The profile carries namespaces, versions, units, provenance and mapping assumptions inside the existing signed output_schema; no new Kernel artifact is introduced.

Alice can compare the returned profile with her own explicit requirements using examples/research_profile.py, then check the actual retrieved rows. A mismatch reports the field and the differing declarations. It does not silently convert units or infer ontology compatibility. Other clients can ignore the annotation; this preflight is explicit consumer logic, not a universal execution gate.

For example, if Bob declares one ontology release and Alice requires another, the helper refuses declared compatibility. Even matching releases can contain wrong mappings. Signed declarations attribute the claims; scientific evaluation remains Alice’s responsibility.

The optional examples/go_subset_catalog.py prepares a reproducible public catalog from the GO Consortium’s 2026-06-19 generic subset: 140 distinct terms, selecting identifier, name and term URI. Its helper pins the source digest and writes attribution under the Consortium’s CC BY 4.0 citation policy. This is a term catalog, not ontology alignment, enrichment or evidence of demand. Native preparation is local; publication is a separate reviewed action.

Native compute and recovery

Both actions use the single MCP tool named froglet.

Action	Required work or reference	Behavior
run_compute	Either wasm_module_hex or native wasm_module_path, explicit JSON input, explicit idempotency_key	Submits or reconciles one bounded Wasm v1 program through the requester runtime.
get_task	task_id from the returned deal_id	Revalidates and reads a saved terminal operation locally, even while Bob is offline. Unsigned or unresolved operations refresh from Bob and require him to be reachable. It does not submit new work or authorize payment.

run_compute accepts a complete binary using the froglet.wasm.run_json.v1 ABI. It imports no host capabilities. The native action does not compile source or accept OCI packages or other execution runtimes. The inline module limit is 256 KiB, encoded as at most 512 KiB of hex; the canonical JSON input limit is 128 KiB. input is required even when its value is null.

Native MCP also accepts wasm_module_path: an absolute path to a readable regular nonsymlink Wasm file of at most 256 KiB on Alice’s machine. Supply exactly one module argument. The bridge reads those bytes and uses the same inline submission and commitments as the hex argument. The path is not a filesystem capability for Bob’s program. Changed file bytes under an existing retry key are refused. The JavaScript MCP/OpenClaw wrappers have not gained this native file argument.

The nonblank retry key must contain 1–128 UTF-8 bytes. Repeat the exact program, input, provider and key to reconcile uncertain work. Changed work under an existing key is refused. An explicit provider_url requires provider_id; endpoint and configured transport selection stay in the local requester runtime.

Calls default to max_price_sats: 0, so the default admits free work only. Paid Lightning calls need an explicit price ceiling and the existing configured wallet and cumulative spend budget. Supplying a ceiling alone does not grant spending authority. The Alice/Bob example configures no wallet or paid backend. The native action has no caller-supplied Stripe token argument. External Stripe tokens use the requester runtime API; its optional automatic minting helper is sandbox-only.

The provider’s signed Quote sets execution limits. The report includes those limits; they are not arbitrary caller-supplied resource ceilings. timeout_secs controls polling after submission, defaults to 15 seconds and accepts 0–60. Zero returns after admission. A polling timeout can return the existing Deal reference for later recovery; it does not cancel execution.

Use get_task with the returned deal_id before deciding whether to retry:

{
  "action": "get_task",
  "task_id": "<deal_id returned by your run_compute call>",
  "response_format": "compact"
}

This is a template: replace the placeholder with the reference from your own call. Reads use the requester’s local authentication. A task reference alone does not grant access to another requester’s private results.

A durable submission_pending reference records local intent. It does not prove that Bob accepted the work. Some ambiguous, unadmitted submissions can remain unresolved; the runtime does not automatically resubmit those intents. Exact retries are not a universal exactly-once guarantee.

Enable optional A2A

A2A is disabled by default. An operator supplies a separate private Node configuration through FROGLET_A2A_CONFIG_PATH; it is not an MCP tool argument. On Unix, the file must be operator-owned, regular, at most 64 KiB and mode 0600. Symbolic links are refused.

Node	Private configuration
Bob’s provider	clients binds a separate bearer credential to Alice’s requester public key and exact allowed signed Offer hashes.
Alice’s requester	providers binds Bob’s exact origin to that bearer credential. The matching origin selects A2A for the same native MCP action.

Use credentials separate from runtime and provider-control tokens. Keep their values out of prompts, public metadata and reports. A changed Offer requires an explicit allowlist update. For the localhost example only, Alice’s private configuration sets allow_loopback: true for Bob’s literal 127.0.0.1 origin. Caller input cannot enable that exception. Normal configured provider origins use HTTPS and retain requester egress and DNS checks.

Review counterparties without editing credential JSON

The source helper scripts/setup_a2a_counterparty.py prepares a redacted plan, then applies only the exact reviewed plan fingerprint:

python3 scripts/setup_a2a_counterparty.py --request /absolute/request.json --plan
python3 scripts/setup_a2a_counterparty.py --request /absolute/request.json \
  --approved-plan-sha256 SHA_FROM_THE_REVIEWED_PLAN

Bob’s private request supplies Alice’s signing key, Bob’s origin and identity, exact Offer hashes, an already-issued admission token file, a new destination and finite cumulative quote, Deal and runtime allowances. Alice’s import request pins both identities and refers to the private recipient handoff file. Existing unrelated A2A entries can be preserved; existing matching entries require a separate rotation review.

Apply writes new private configuration and an activation fragment. It does not change a running Node: review the generated files and restart with the settings while preserving identity, state and existing authentication. Credentials belong only in private files and a trusted recipient channel, never in prompts, public catalogs or share links.

There are two distinct controls. The A2A credential restricts the signing key and Offers on that transport. The admission invitation is still provider-wide: its holder may use other services on the ordinary HTTP path. Use separate providers when recipients must never access another service. Revoking admission stops new work; completed-task reads remain subject to the configured A2A authorization.

Bob’s Agent Card is served at /.well-known/agent-card.json. Execution uses A2A 1.0 HTTP+JSON under /a2a/v1, activates https://froglet.dev/a2a/bounded-deal/v1, and requires the configured bearer. The required extension carries unchanged Froglet Quote, Deal and workload values as exact JSON strings. A compatible requester must understand it; ordinary A2A discovery does not grant purchasing or requester-signing authority.

Task IDs derive from the signed Deal hash. Polling projects the existing Froglet state, and the signed Receipt determines terminal economic meaning. Result availability alone does not establish completion or payment settlement.

Concurrency and repeated work

There is no fixed number of people who can connect. Metadata reads, active task requests, data-service processes and Wasm execution have different limits. The default process limit is four, including selected-data services; the default Wasm execution limit and A2A request limit are sixteen each. Those values are resource controls, not a sixteen-person audience capacity guarantee. Increasing them needs measurements on the intended host and workload.

Distinct new requests from the same signing identity with identical workload and terms in the same second can produce the same single-use Quote. The current candidate refuses duplicate issuance with quote_issuance_collision and Retry-After: 1. The requester retries that specific pre-Deal collision up to three times, for four attempts total. Attempts still consume quote allowances. If the collision persists, no Deal is created for that call. It is a bounded refusal, not an unlimited queue or an automatic retry of admitted work.

Repeated identical new jobs from one identity are therefore limited by second-resolution Quote issuance. This is separate from retrying an existing job with its original key. Old ambiguous submission records are not rewritten by this change; clearing them without proof of non-admission would risk duplicating work. The original concurrent two-request reproduction now completes without leaving a pending intent.

examples/qualify_ontology_capacity.py measures selected-data retrieval followed by the same Wasm audit, preserves failures in its counts, pins the tested binary and records actual Deal counts. Its conventional file/HTTP comparison has fewer trust and recovery responsibilities. Local measurements do not establish public capacity, overall performance superiority or a reason to adopt Froglet.

Supported scope and qualification

The implemented A2A profile supports configured counterparties, direct ingress and polling. Streaming, push notifications, conversational continuation, provider cancellation and relay A2A ingress are outside this profile. It is not anonymous federation or general organizational authority delegation.

The local example qualifies free execution, native MCP evidence checks, bounded failure, exact retry and persisted Task recovery. Production paid settlement, public-network operation and full A2A TCK conformance are not qualified by this demo. Signed evidence does not independently establish output correctness or usefulness.

The compute actions are included in the immutable v0.4.7-beta.1 prerelease. The downloaded Apple Silicon binary passed a separate deterministic localhost replay: seven verified signed chains, a signed execution-budget failure and all six saved terminal task reads after the provider stopped. Verify the exact release and manifest before using its binary; source helper examples require the named files from the matching trusted checkout. This proves distribution and that local runtime scope. A separate native-MCP run used the same released Mac binary and released provider image on one isolated Fly machine with a finite free invitation. Six signed chains covered four frozen arithmetic cases, nine synthetic rows/four fields and an expected fuel failure. Six direct provider records survived an actual restart; six saved tasks remained readable after Bob stopped. The test host and private state were removed. This qualifies only that finite free cross-host scenario. It does not newly qualify remote A2A, an available hosted compute service, production/load, fresh agent/OS setup, paid settlement or the original failed agent journey. Continue with Connect Agents or the signed Deal flow.