Skip to content

docs(README): note dual token-shape support + LOG_LEVEL tuning #66

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mabry1985 merged 1 commit into from
Apr 19, 2026
Merged

docs(README): note dual token-shape support + LOG_LEVEL tuning #66

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,7 +161,9 @@ Quinn has 4 A2A skills: `qa_report`, `board_audit`, `bug_triage`, `pr_review`.

Quinn advertises `capabilities.streaming: true` and `pushNotifications: true` and serves the full A2A spec surface (`message/send`, `message/stream`, `tasks/get`, `tasks/cancel`, `tasks/resubscribe`, `tasks/pushNotificationConfig/{set,get,list,delete}`). Every SSE event carries a `kind` discriminator (`task` / `status-update` / `artifact-update`) with camelCase wire fields per the spec — required for `@a2a-js/sdk` to route events.

Push-notification callback URLs are SSRF-validated. Trusted internal docker-network agents can be allowlisted via `PUSH_NOTIFICATION_ALLOWED_HOSTS` / `PUSH_NOTIFICATION_ALLOWED_CIDRS` env vars (default-deny otherwise).
Push-notification callback URLs are SSRF-validated. Trusted internal docker-network agents can be allowlisted via `PUSH_NOTIFICATION_ALLOWED_HOSTS` / `PUSH_NOTIFICATION_ALLOWED_CIDRS` env vars (default-deny otherwise). The token-parsing accepts both spec-legal shapes — top-level `token` (most SDKs) and structured `authentication.credentials` (RFC-8821 form) — so Workstacean and @a2a-js/sdk callers both work out of the box.

Operator tuning: `LOG_LEVEL=INFO` (the default) surfaces every push-config registration and webhook delivery attempt with task id + state + response code — concrete evidence for every callback, not silence.

### A2A extensions

Expand Down
Loading