git-a2a

Import a Git repository together with the agents that own it.

git-a2a is an open standard plus a static Go CLI for micro-agent architectures. A repository publishes one a2amodule.yml: what the module exports, which agents own it, how to contact them, and which other modules it consumes. The CLI resolves one Git commit, wires every detected ecosystem, maintains a2amodule.lock, and projects the useful ownership context into agent tools.

Read the human specification, the command reference, or the normative spec/_.hint with hint spec.

See the feature end to end in the public acme-lib-utils library and consumer-app consumer repositories. The demo walkthrough explains what to inspect and which commands to run.

What you can do

Quick start

git-a2a init --id acme-app
git-a2a add https://github.com/acme/lib-utils.git
git-a2a sync
git-a2a who acme-lib-utils --intent change
git-a2a status
git-a2a update --review

Owners start with git-a2a init --example lib, add an agent with git-a2a agent add, then run git-a2a validate and git-a2a card export.

Vendored dependencies

A consumer can materialize a locked dependency inside its repository with add --vendor submodule or add --vendor copy; set --vendor changes that choice later. The lock still names one Git commit for every ecosystem, while native npm, Cargo, Go, Pub, Mix, uv, and Composer wiring and generated CMake, Gradle, MSBuild, Maven, or Meson integrations resolve through the vendored directory. git-a2a fetch restores missing cache and vendored content from the lock in a fresh checkout without resolving a new commit. See the consumer workflow and the live consumer-app submodule example.

Works with

The reference CLI implements a2amodule schema 1 and passes conformance version 1 on Linux and Windows.

Installation

Go-native channels are the simplest and come first. Every checkmark means the channel was exercised against a public stable artifact on its native platform. These commands follow the latest stable release; pin an explicit version in CI.

The checksum-verifying standalone installers support GIT_A2A_VERSION, --version, --dir, and --dry-run. The macOS binaries are not yet Apple-notarized; use the Homebrew formula for a checksum-verified first launch without a Gatekeeper quarantine prompt.

Linux .deb, .rpm, and .apk packages are attached to every GitHub Release:

sudo dpkg -i git-a2a_*.deb
sudo rpm -i git-a2a_*.rpm
sudo apk add --allow-untrusted git-a2a_*.apk

The scratch container contains only the binary:

docker run --pull=always --rm ghcr.io/neprel/git-a2a:latest version

Every channel executes the same Go binary. git-a2a version --check is the only automatic release lookup and prints the correct manager-specific update command. git-a2a upgrade is available only to the standalone binary channel; it never overwrites a package-manager install. Release archives cover Darwin, Linux, and Windows on amd64/arm64 and include checksums and SBOMs. Maintainer setup is in docs/releasing.md.

Verify a download

Every tag-triggered release asset has GitHub build provenance bound to this repository's pinned release workflow. After downloading an asset with gh release download, verify that identity:

gh attestation verify PATH/TO/ASSET \
  --repo neprel/git-a2a \
  --signer-workflow neprel/git-a2a/.github/workflows/release.yml
sha256sum --ignore-missing -c checksums.txt

The GHCR image is signed keylessly at its immutable digest. Resolve the digest for the version you intend to run, then require GitHub's OIDC issuer and the tag-triggered release workflow:

cosign verify \
  --certificate-identity-regexp '^https://github\.com/neprel/git-a2a/\.github/workflows/release\.yml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+(-rc\.[0-9]+)?$' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  ghcr.io/neprel/git-a2a@sha256:DIGEST

Documentation