epic: Phase 2 — Differentiate, go beyond #260

Activity

1. amirkhan-ak-sf

   added this to the Phase 2 — Differentiate, go beyond (0.2.0) milestone on Sep 4, 2026
2. amirkhan-ak-sf

   added

   epicTracking issue spanning several child issuesTracking issue spanning several child issues

   priority/p1Must-have: blocks a real adapter or CI gateMust-have: blocks a real adapter or CI gate

   size/xlMulti-week, its own workstreamMulti-week, its own workstream

   on Sep 4, 2026
3. tommasobolis commented on Oct 12, 2026

   

   tommasobolis

   on Oct 12, 2026

   Collaborator

   More actions

   Related: #1102 — new GA-gated Phase 2 epic: publish agents and MCP servers through the Anypoint self-managed scanner.
4. tommasobolis commented on Oct 29, 2026

   

   tommasobolis

   on Oct 29, 2026

   Collaborator

   More actions

   Status update — 2026-10-29

   Phase 2 (0.2.0): 75 closed, 3 open (plus this epic). The latest pre-release on develop is 0.2.0.dev6.

   Shipped since the last update

   • Refusals and classification: declarative handlers that can react but never un-refuse (refusals: declarative reaction handlers registered once, applied at the transport #208, refusals: enforce that a handler can react but never un-refuse #209), the custom-policy registry (classify: a registry so custom gateway policies become typed exceptions #210), and typed rejections for Model Armor (refusals: type the Google Model Armor Guardrails rejection #1178), CrowdStrike AIDR (refusals: type the CrowdStrike AIDR Guardrails rejection #1176) and Akamai (refusals: type the Akamai federated guardrail verdict #313). Content-safety provider and categories now appear on the exception and span (Report the content-safety provider and categories on the exception and span #1183). CIBA authorization_pending is typed instead of AuthError (classify: type the OBO policy's CIBA authorization_pending instead of AuthError #1320).
   • HITL: one vocabulary (hitl: one vocabulary for pause-and-ask-a-human #211), mapped onto LangGraph (hitl: map the vocabulary onto LangGraph interrupt() and Command(resume=) #212) and onto OpenAI Agents, ADK and Strands (hitl: mappings for OpenAI Agents, ADK, Strands and MCP elicitation #213, hitl: pause Strands tool calls with interrupt() on BeforeToolCallEvent #1234, hitl: map approval onto ADK FunctionTool(require_confirmation=...) #1235). MCP elicitation is recorded as unsupported (docs(hitl): record MCP elicitation as unsupported for client-side approval #1236). approval= works on a discovered ToolSet (hitl: approval= on a discovered ToolSet, not just @donkey.tool #1153).
   • Identity: donkey.as_user() (identity: donkey.as_user() — RFC 8693 token exchange and header placement #215). A missing or expired user token fails typed (identity: a missing or expired user token fails typed, never falls back to service identity #216).
   • Kill switch: clean stop (killswitch: recognise the kill-switch rejection and stop cleanly #220) and the kill reason (killswitch: carry the kill reason — manual, anomaly, or eval drift #314).
   • Tools / MCP: donkey.tools.discover() (tools: donkey.tools.discover() returns governed MCP tools as native framework tools #221), filtering and descriptor token accounting (tools: allow/deny filtering and descriptor token accounting #222, tools: ToolSet.filter() — allow/deny/predicate filtering and descriptor token accounting #42, tools: log descriptor cost on bind and warn above a threshold #1257), live-verified against a Mule-hosted MCP server (tools: verify discover() and binding against a Mule-hosted MCP server #1312).
   • Scanner: donkey scan (scanner: donkey scan derives a deterministic scan model of agents, tools and MCP servers #217) and donkey publish to Exchange / Agent Registry (scanner: donkey publish publishes agent assets to Exchange #1260, scanner: donkey publish registers the manifest with Exchange / Agent Registry #218).
   • A2A: donkey.serve() (a2a: donkey.serve() — an A2A listener in one line, wrapping the official a2a-sdk #224), governance-aware inbound (a2a: governance-aware inbound — correlation, tags, spans and typed refusals on served tasks #225), donkey dev (a2a: donkey dev — a gateway in front of the laptop, real or simulated #227, a2a: donkey dev Option B — simulated A2A ingress in front of donkey.serve() #1284) and donkey expose (a2a: donkey expose — the gateway instance, policies and registry entry for an A2A agent or MCP server #226).
   • Second deep adapter (adapters: a second deep adapter, chosen by Phase 1 demand #223), correlation-ID propagation across MCP and A2A (telemetry: adopt an inbound correlation ID and propagate it across MCP and A2A hops #308), and gateway-side routing/fallback without double-retry (skeleton: surface gateway-side routing and fallback, and never double-retry it #309).
   • Conformance: the Phase 2 scenario bodies are wired (conformance: wire the Phase 2–2.8 scenario bodies as their features land #444), and the 13 retired scenarios are restored (test(conformance): restore the 13 retired scenarios once their surfaces are verified #991).

   Still open in this milestone

   • tools: a typed refusal for a tool outside the consumer's MCP access profile #312, typed refusal for a tool outside the MCP access profile. The wire shape is live-verified (verified-apis.md §9) and the design is posted on the issue. What remains is the implementation and the per-framework probes for whole-server bindings.
   • scanner: the scan-and-publish GitHub Action #219, the scan-and-publish GitHub Action. It's merged and publishing live from CI (demo 16). It is waiting on a release tag that includes the action, so the docs and the demo can move off @develop. The GitLab and Bitbucket variants (Publish from GitLab CI with a CI/CD component #1264, Publish from Bitbucket Pipelines with a Pipe #1265) are in Phase 2.1.
   • hitl: carry the gateway's step-up challenges (OBO + CIBA) as typed approvals #214, OBO + CIBA step-up as typed approvals. The CIBA shapes are captured and classified (classify: type the OBO policy's CIBA authorization_pending instead of AuthError #1320). It is still blocked on verify: the Trusted Agent Identity token-exchange endpoint and header #255 (the token-exchange endpoint and header, in Verification).

   The self-managed scanner epic (#1102) moved to Phase 2.1 while #1101 (GA) is open.

   Exit criteria

   • A framework's official docs link to the SDK. No evidence yet.
   • Production use with OTel attached. No evidence yet.
   • Refusal handlers, registry, HITL and scanner pass conformance against the simulator. The scenarios are wired and restored (conformance: wire the Phase 2–2.8 scenario bodies as their features land #444, test(conformance): restore the 13 retired scenarios once their surfaces are verified #991). I'll tick this once the 0.2.0 release candidate's conformance run confirms it.

   Next: land #312, cut the 0.2.0 release tag (which unblocks #219), and decide whether #214 ships in 0.2.0 or moves to 0.2.1 if #255 doesn't verify in time.
5. tommasobolis commented on Oct 29, 2026

   

   tommasobolis

   on Oct 29, 2026

   Collaborator

   More actions

   Related: #1414 — the 0.2.0 pre-release code review epic; its must-fix children gate closing this Phase 2 epic.
6. tommasobolis commented on Oct 30, 2026

   

   tommasobolis

   on Oct 30, 2026

   Collaborator

   More actions

   Phase 2 shipped as donkey-kit 0.2.0, now on PyPI (promotion #1522). Every child issue is closed.
7. tommasobolis

   closed this as completedon Oct 30, 2026