A2A without a server: how OpenAmer peers talk to each other over GitHub

Description and use

A brokerless mesh where a GitHub repo acts as a relay, enabling NAT‑behind agents to exchange signed, privacy‑redacted messages without exposing inbound ports.

Problem

Agents behind NAT cannot expose inbound ports, yet need to exchange signed messages and delegate work.

Outcome

A brokerless, eventually consistent mesh that allows laptops behind NAT to exchange signed, privacy‑redacted messages without exposing any inbound ports.

Workflow

• Generate Ed25519 keypair and fingerprint with openamer a2a init
• Publish presence with openamer a2a announce
• Sign a task note addressed to the peer’s mailbox
• Upload the signed envelope to the relay directory via the GitHub Contents API
• Trigger the remote worker with repository_dispatch
• Poll the repo for a signed reply in the mailbox
• Verify the reply’s signature and freshness before processing

Evidence

OpenAmer takes the second path: the GitHub repo is the relay.

Source

A node posts a signed, privacy‑redacted envelope as a JSON file under a relay directory (directory/a2a/relay/), addressed to a mailbox path; the intended peer pulls it.

Source

The mesh is eventually consistent, not real-time.

Source