The OidcAuthorizer (security remediation plan §6): privileged-operation authorization deferred to JWT scopes minted by the organization's identity provider, validated with Nimbus JOSE+JWT against a cached JWKS. Optional: fleets on the mtls profile use the MembershipAuthorizer and never load this module.

The fleet console as a served surface: a read-only observability peer presenting membership, discovery, and space state over HTTP. A HAL+JSON API (application/hal+json links, Spring HATEOAS compatible), a Server-Sent Events activity ...

Spring Boot autoconfiguration for AgentSpaces: properties-driven peer, group, and space wiring, a SmartLifecycle for ticking and card refresh, and a bean post-processor that binds annotated agent beans. Compiles against the provided-scope ...

Translates AgentSpaces AgentCards to A2A agent cards and serves them over HTTP, so A2A clients can discover a fleet's agents through one gateway.