External agents (A2A) Shipped, default off

The gateway is built and was proven end to end against a real standalone foreign agent. It is off in every deployment until deliberately enabled, and the route is structurally absent until then. What has not happened yet: enabling it on a real deployment, and proving it against a third-party vendor's agent rather than a hand-built one.

• Inbound work becomes a real ticket. A foreign agent's request is queued under its own synthetic identity, so budgets, dead-lettering and run tracing apply to it exactly as they do to an internal bot.
• Per-agent credentials and capability scopes. No shared global secret, and the published agent card is curated by the same access-role policy that governs everything else.
• Cost is real or honestly flagged. A foreign call never books as a silent zero, because a free-looking integration is how budgets get blown.
• Internal coordination stays internal. In-swarm bots use the internal mesh; this protocol is for agents outside the trust boundary. The two are not merged for convenience.