Governed Agent Peers
Technical reference. This page is for integrations, advanced configuration, or platform operations. For portal tasks, start with the user guide.
Operators register, approve, and inspect A2A peers through Orqestra’s control plane. Product clients never call a peer URL and never present a protocol Send button. Message send/start with typed Message versus Task outcomes is not a client API until the control plane exposes operator HTTP for it.
Setup
- Register a peer card or discover from an endpoint (
orqestractl a2a peers register/discover). - Propose public signing-key material. Private keys never leave the peer.
- An independent actor approves the peer, then publish.
- Register an invocation profile against the approved card digest and look it up by workspace, route, audience, peer, and tenant.
Trust or signing changes invalidate publication. Retired peers keep history; there is no resurrection command.
Task operations
Use reserve, bind, get, list, and cancel. Continuation of an existing
task is bind against that task id, not a replacement reserve. Unknown states
are displayed as returned.
Deny recovery
Surface 403, 404, 409, 422, and 503 distinctly. A 409 stale/conflict must not
mint a new idempotency key. Artifact retention and byte retrieve are backend
limits; clients do not fetch object-store or presigned URLs. Proof retrieval
uses the existing audit-proof surfaces (governance.audit_proof.view).
Unsupported profiles fail closed with the backend denial (ambiguous_target,
selection_not_enforceable, profile_drift, or contract rejection).
Surfaces
- Portal: Connect → External systems → Agent peers (
asset.viewto list). - SDK:
client.a2a - CLI:
orqestractl a2a - MCP: operator tools (
list_a2a_peers,register_a2a_peer,reserve_a2a_task, …) with write approval on mutations. MCP is not A2A transport.