Aroha 2.0

What's new

Spending limits, enforced in one call

verifyHttpSpendRequest, in TypeScript and Python, does the whole job for an API that spends money. It checks the agent's proof over this exact request, the chain back to the customer you enrolled, and every limit on every link: currency, merchants, merchant category, approval threshold, spend and session limits. Then it charges the running total against every link at once, or not at all. If your own side effect fails, charge.release() gives the money back.

const r = await verifyHttpSpendRequest(req.headers["aroha-mandate"], {
  audience: "https://invoices.example.com",
  method: req.method, url: req.url, body: rawBody,
  expectedRoot: await enrolledDid(enrollments, customerId),
  isRevoked: httpRevocationCheck(REGISTRY_URL),
  amountUsd: invoice.amountUsd, currency: "USD",
  nonces, ledger,
});
if (!r.ok) return reply(res, r.status, { error: r.code });  // refused: nothing charged

try { await billing.send(invoice); }
catch { await r.charge.release(); }                           // the side effect failed: give it back

The integration guide has a runnable version, with a test for every refusal.

A copied token is useless

Agents can present a mandate to a plain HTTP API in an Aroha-Mandate header, together with a holder proof: the agent's own signature over the method, path, body hash, audience, a single-use nonce and an expiry of five minutes or less. Someone who copies the token cannot use it. TypeScript and Python produce byte-identical proofs, checked against shared test vectors.

Customers enroll once

Enrollment binds a customer's identity to their account with a single-use, expiring challenge that their own key signs for your service. Verification then pins the chain to that customer. An unknown customer is a clean refusal, not an exception.

Identities that can be rotated and recovered

New did:aroha:E… identifiers pre-commit to their next key and keep a signed key event log. A person controls their agents and can recover or revoke them. Existing identifiers migrate with a doubly signed link.

Aroha as a remote MCP server

@aroha-sdk/mcp-server now serves the 2026-07-28 MCP revision over Streamable HTTP as an OAuth 2.1 protected resource, gives each user their own signing key, and supports enterprise-managed sign-in (ID-JAG) on the resource-server side. It is tested against a reference identity provider, not yet against a production one. Testing it as a connector for ChatGPT and dots, Claude and Duet, and Muse comes next.

A runtime that asks first

In the Aroha runtime, local tools now ask before they run unless Aroha can vouch for them. An approval no longer becomes a silent, permanent allow: the person chooses once, for this conversation, for a day or always, and every kept answer is a signed, revocable permission listed in Settings.

Framework bridges, tested against the frameworks

The Python bridges for LangChain and LangGraph, CrewAI, AutoGen, Google ADK and the OpenAI Agents SDK now run against the real frameworks in CI. Doing that found and fixed bugs that made several of them unusable. The A2A bridge speaks A2A 1.0 and interoperates with the official SDK in both directions.

Measured

How it is measured, and how to reproduce it: benchmark methodology.

Breaking changes

• Mandate tokens are version 2. They carry their signed chain, and the signature covers a canonical form. Verifiers older than 2.0 cannot read them; version 1 tokens still verify.
• Omitted limits inherit. A child mandate that leaves out a limit its parent sets now gets the parent's limit, instead of none.
• Envelopes live five minutes at most, and nonces are tracked per sender.
• Package changes: @aroha-sdk/registry moves the contract, IPFS and server code to subpath imports; @aroha-sdk/mcp-bridge 3.0 requires a root policy when it requires a mandate; @aroha-sdk/a2a-bridge uses A2A 1.0 message shapes.

Upgrade steps for each are in the changelog.

Availability

Since October 7, 2026, the protocol, SDKs and specification are licensed under Apache-2.0. Earlier releases were MIT.

Known limits

• No independent security review has started. The scope is written; no auditor is engaged yet.
• Revocation is checked by verifiers when they act. Push notification of revocations is not built yet.
• The runtime signs receipts for actions it runs, not yet for actions it refuses.
• The project has one maintainer today. Review and release rules are described on the Trust page, including which are enforced.

Get started

npm install @aroha-sdk/core @aroha-sdk/credentials
pip install "aroha>=2"

Then follow the quickstart, or hand your coding agent the integration guide.