From 584c74baaab4a107c5a5de080bdce8d543c75c02 Mon Sep 17 00:00:00 2001 From: GitHub Action Date: Mon, 12 Oct 2026 17:53:48 +0000 Subject: [PATCH 1/4] [Automated] Draft docs (kagent): feat: a2a task push notifications Signed-off-by: GitHub Action --- .../content/kagent/1.x/examples/a2a-agents.md | 53 ++++++++++++++++++- .../kagent/1.x/observability/launch-ui.md | 2 + 2 files changed, 53 insertions(+), 2 deletions(-) diff --git a/docs-site/content/kagent/1.x/examples/a2a-agents.md b/docs-site/content/kagent/1.x/examples/a2a-agents.md index 9e42bedb..0fb47cd9 100644 --- a/docs-site/content/kagent/1.x/examples/a2a-agents.md +++ b/docs-site/content/kagent/1.x/examples/a2a-agents.md @@ -32,7 +32,7 @@ A caller addresses the Agent rather than one conversation. The message's `contex ### A2A methods -The following methods are used in this example. The service defines more, including `ListTasks` and the push notification configuration calls, but an agent card that reports `pushNotifications` as `false` does not support being called back. +The following methods are used in this example. The service defines more methods, including `ListTasks` and the push notification configuration calls that manage callbacks for a task. | Method | What it does | | ------ | ------------ | @@ -41,6 +41,9 @@ The following methods are used in this example. The service defines more, includ | `SendStreamingMessage` | Sends a message and streams events as the agent works. | | `GetTask` | Reads a task that a previous call created. | | `CancelTask` | Stops a task that is still running. | +| `CreateTaskPushNotificationConfig` | Adds or replaces a callback for a task that is still active. | +| `ListTaskPushNotificationConfigs` | Lists the active callbacks for one task. | +| `DeleteTaskPushNotificationConfig` | Removes a task callback. | ## Before you begin @@ -72,7 +75,7 @@ An A2A client typically starts by reading the agent card, which tells it what th "version": "v1", "capabilities": { "streaming": true, - "pushNotifications": false, + "pushNotifications": true, "extensions": [ { "uri": "https://kagent.dev/extensions/hitl/v1", @@ -89,6 +92,7 @@ An A2A client typically starts by reading the agent card, which tells it what th 2. Read the card for what a caller acts on. * Both `name` and `description` come from the {{< gloss "AgentTemplate" >}}AgentTemplate{{< /gloss >}}. `name` replaces hyphens with underscores, and `description` is `spec.description` verbatim, so a caller sees the description you wrote. * The `supportedInterfaces` URL is the controller's in-cluster address rather than the Actor's, because a caller reaches the agent through the controller. The card advertises JSON-RPC first, then gRPC. The gRPC interface carries the `tenant` value to send. + * The `capabilities.pushNotifications` value advertises task callbacks. Each callback belongs to one task, not to the whole Session. * The `capabilities.extensions` list advertises human-in-the-loop support, which a client opts into per call. > [!NOTE] @@ -195,6 +199,51 @@ A task outlives the call that created it, so a caller that lost its connection c A task that is still running reports `TASK_STATE_WORKING` and has no artifacts yet. To stop a task that is still running, call `CancelTask` with the same `id`. +## Register task callbacks {#task-callbacks} + +A task callback lets a webhook learn when a task needs input or reaches a final state. The callback receives a status update for future `INPUT_REQUIRED`, `AUTH_REQUIRED`, `COMPLETED`, `FAILED`, `CANCELED`, and `REJECTED` states. After the callback arrives, the receiver calls authenticated `GetTask` to read the current state and artifacts. + +Before you register callbacks for a receiver outside the cluster, expose a stable HTTPS URL for the controller or UI so that the receiver can read `/.well-known/jwks.json`. The receiver uses that JSON Web Key Set (JWKS) to verify the short-lived Ed25519 JSON Web Token (JWT) that kagent sends in the `Authorization` header. To keep the issuer stable, set `controller.push.signing.issuer`. When `controller.push.signing.issuer` is empty, Helm uses `ui.externalUrl`, then the in-cluster A2A gateway URL. + +1. To register a callback before a new task is dispatched, add `--push-url` to the kagent CLI invocation. The command returns immediately with the task ID and callback ID. + ```bash + kagent agent invoke \ + --session $SESSION_ID \ + --task "Run the long task." \ + --push-url https://receiver.example/callback \ + -o json + ``` + + Save the task ID and callback ID from the output. + ```bash + export PUSH_TASK_ID= + export PUSH_CALLBACK_ID= + ``` + +2. To add a callback to a task that is already active, create one explicitly. + ```bash + kagent agent session push create \ + $SESSION_ID $PUSH_TASK_ID \ + --id audit-webhook \ + --url https://receiver.example/callback + ``` + + The server rejects new callbacks after the task reaches a terminal state. + +3. List the callbacks for the task. + ```bash + kagent agent session push list $SESSION_ID $PUSH_TASK_ID + ``` + +4. Delete a callback that should no longer receive task updates. + ```bash + kagent agent session push delete $SESSION_ID $PUSH_TASK_ID audit-webhook + ``` + +Receivers must not send a token or credential when they register a callback. kagent signs each delivery attempt with a fresh five-minute JWT whose audience is the exact callback URL, including the query string. Before you acknowledge the request with a 2xx response, verify the JWT signature, issuer, audience, expiry, and `taskId` claim. + +By default, callback URLs must use HTTPS. Callback URLs must not resolve to private, loopback, link-local, unspecified, or multicast addresses. For trusted test receivers, operators can set `controller.push.allowHTTP=true` or `controller.push.allowPrivateNetworks=true`. kagent does not follow redirects, and failed attempts are retried from the database-backed queue. + ## When an agent needs a person An agent can stop mid-task to ask a question or to request approval for a tool call. The task then reports `TASK_STATE_INPUT_REQUIRED` and waits until a caller answers it. Every kagent agent can raise the question kind, because the runtime gives each one a built-in `ask_user` tool, so a system prompt that tells an agent to ask before it answers is enough to see a pause. diff --git a/docs-site/content/kagent/1.x/observability/launch-ui.md b/docs-site/content/kagent/1.x/observability/launch-ui.md index 412b3b7c..207d9b25 100644 --- a/docs-site/content/kagent/1.x/observability/launch-ui.md +++ b/docs-site/content/kagent/1.x/observability/launch-ui.md @@ -107,6 +107,8 @@ A checkpoint appears in the transcript as a mark carrying the snapshot name and - **Rename** replaces the snapshot name that kagent generates on creation from the Session ID and the turn the checkpoint pins. Clearing the name restores that generated default. - **Delete** removes the checkpoint and releases the snapshot it pinned. Agent Substrate is then free to collect that snapshot. +The bell icon on the latest message for a task opens **Task notifications**. Use it to add, edit, or remove callback URLs while the task is active. New callbacks receive only future updates for tasks that need input or reach a final state. For callback delivery and security details, see [Register task callbacks]({{< link path="examples/a2a-agents#task-callbacks" >}}). + > [!NOTE] > A checkpoint is always taken at the latest turn boundary, so the UI offers **Fork** on your own most recent message and not on earlier ones. From 8708a2cae23ece514f607af043498ae8d0da0a3a Mon Sep 17 00:00:00 2001 From: Rachael Graham Date: Mon, 12 Oct 2026 15:23:58 -0500 Subject: [PATCH 2/4] Correct the push callback signing claims, and move the UI paragraph The draft presented JWT signing as unconditional, but the chart leaves it off: `controller.push.signing.secretName` defaults to empty, the worker attaches an `Authorization` header only when a signer exists, and the controller serves 404 at `/.well-known/jwks.json` until one is configured. A receiver following the draft would have waited for a token that kagent never sends. Say that signing is opt-in, name the Secret and the PKCS#8 Ed25519 key it holds, and leave key rotation with the operator. The draft also told readers to publish the controller or the UI for JWKS. Only the controller serves that path; `ui.externalUrl` supplies the issuer string alone, so an issuer that falls back to the UI names a host with no key behind it. Set the issuer to a URL that reaches the controller. The remaining changes are smaller. The security prose moved under its own heading rather than trailing the steps. The methods table intro no longer claims the example calls the three `TaskPushNotificationConfig` methods, and names `GetTaskPushNotificationConfig` alongside its siblings. The section says why it uses the CLI on a page that is otherwise grpcurl. A `PUSH_CALLBACK_ID` export that no later step read is gone. In the UI page, the Task notifications paragraph no longer splits the checkpoint bullets from the checkpoint note, and it says what a new callback does and does not receive without attaching the qualifier to the wrong noun. Anchors and the cross-page link verified against a local 1.x build. The steps remain unrun; no cluster. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Rachael Graham --- .../content/kagent/1.x/examples/a2a-agents.md | 24 +++++++++++++------ .../kagent/1.x/observability/launch-ui.md | 4 ++-- 2 files changed, 19 insertions(+), 9 deletions(-) diff --git a/docs-site/content/kagent/1.x/examples/a2a-agents.md b/docs-site/content/kagent/1.x/examples/a2a-agents.md index 0fb47cd9..751f1f8f 100644 --- a/docs-site/content/kagent/1.x/examples/a2a-agents.md +++ b/docs-site/content/kagent/1.x/examples/a2a-agents.md @@ -32,7 +32,7 @@ A caller addresses the Agent rather than one conversation. The message's `contex ### A2A methods -The following methods are used in this example. The service defines more methods, including `ListTasks` and the push notification configuration calls that manage callbacks for a task. +This example calls each method in the following table except the three `TaskPushNotificationConfig` calls, which manage a task's callbacks and which the kagent CLI wraps. The service defines more, including `ListTasks` and `GetTaskPushNotificationConfig`, which reads one callback by ID. | Method | What it does | | ------ | ------------ | @@ -203,7 +203,7 @@ A task that is still running reports `TASK_STATE_WORKING` and has no artifacts y A task callback lets a webhook learn when a task needs input or reaches a final state. The callback receives a status update for future `INPUT_REQUIRED`, `AUTH_REQUIRED`, `COMPLETED`, `FAILED`, `CANCELED`, and `REJECTED` states. After the callback arrives, the receiver calls authenticated `GetTask` to read the current state and artifacts. -Before you register callbacks for a receiver outside the cluster, expose a stable HTTPS URL for the controller or UI so that the receiver can read `/.well-known/jwks.json`. The receiver uses that JSON Web Key Set (JWKS) to verify the short-lived Ed25519 JSON Web Token (JWT) that kagent sends in the `Authorization` header. To keep the issuer stable, set `controller.push.signing.issuer`. When `controller.push.signing.issuer` is empty, Helm uses `ui.externalUrl`, then the in-cluster A2A gateway URL. +The kagent CLI wraps the three push notification configuration methods, so the steps that follow use the CLI rather than building each request by hand. The CLI defaults to port 8083, which the prerequisites already forward. 1. To register a callback before a new task is dispatched, add `--push-url` to the kagent CLI invocation. The command returns immediately with the task ID and callback ID. ```bash @@ -214,13 +214,12 @@ Before you register callbacks for a receiver outside the cluster, expose a stabl -o json ``` - Save the task ID and callback ID from the output. + Save the task ID, so that later steps can address the task. ```bash export PUSH_TASK_ID= - export PUSH_CALLBACK_ID= ``` -2. To add a callback to a task that is already active, create one explicitly. +2. To add a second callback to a task that is still active, create one explicitly. The server rejects new callbacks after the task reaches a terminal state. ```bash kagent agent session push create \ $SESSION_ID $PUSH_TASK_ID \ @@ -228,8 +227,6 @@ Before you register callbacks for a receiver outside the cluster, expose a stabl --url https://receiver.example/callback ``` - The server rejects new callbacks after the task reaches a terminal state. - 3. List the callbacks for the task. ```bash kagent agent session push list $SESSION_ID $PUSH_TASK_ID @@ -240,6 +237,19 @@ Before you register callbacks for a receiver outside the cluster, expose a stabl kagent agent session push delete $SESSION_ID $PUSH_TASK_ID audit-webhook ``` +### Secure callback deliveries + +A callback URL is a public endpoint that receives task state from kagent. Before you register a callback in production, decide how the receiver establishes that a delivery came from kagent. + +> [!IMPORTANT] +> kagent signs deliveries only when an operator configures a signing key, and `controller.push.signing.secretName` is empty by default. Until an operator sets it, kagent posts each callback without an `Authorization` header, and the controller serves `404` at `/.well-known/jwks.json`. A receiver cannot distinguish an unsigned kagent delivery from any other caller, so treat the default configuration as suitable for a trusted network only. + +To sign deliveries, an operator creates a Secret that holds an unencrypted PKCS#8 Ed25519 private key in a `private-key.pem` entry, and names that Secret in `controller.push.signing.secretName`. kagent generates no key of its own, so key creation, persistence, and rotation stay with the operator. + +Receivers verify a signed delivery against the JSON Web Key Set (JWKS) that the controller serves at `/.well-known/jwks.json`, which exposes the public verification key alone. The controller serves that path on the same port as its gRPC, A2A, and MCP endpoints, so a receiver outside the cluster needs a stable HTTPS URL that routes to the controller. The UI does not proxy the path, so publishing only the UI leaves a receiver with no key to verify against. + +Set `controller.push.signing.issuer` to the URL that reaches the controller, so that the issuer a receiver trusts matches the host it fetches the JWKS from. When `controller.push.signing.issuer` is empty, Helm falls back to `ui.externalUrl` and then to the in-cluster A2A gateway URL, and either fallback can name a host that does not serve the JWKS. + Receivers must not send a token or credential when they register a callback. kagent signs each delivery attempt with a fresh five-minute JWT whose audience is the exact callback URL, including the query string. Before you acknowledge the request with a 2xx response, verify the JWT signature, issuer, audience, expiry, and `taskId` claim. By default, callback URLs must use HTTPS. Callback URLs must not resolve to private, loopback, link-local, unspecified, or multicast addresses. For trusted test receivers, operators can set `controller.push.allowHTTP=true` or `controller.push.allowPrivateNetworks=true`. kagent does not follow redirects, and failed attempts are retried from the database-backed queue. diff --git a/docs-site/content/kagent/1.x/observability/launch-ui.md b/docs-site/content/kagent/1.x/observability/launch-ui.md index 207d9b25..a2bb769f 100644 --- a/docs-site/content/kagent/1.x/observability/launch-ui.md +++ b/docs-site/content/kagent/1.x/observability/launch-ui.md @@ -107,11 +107,11 @@ A checkpoint appears in the transcript as a mark carrying the snapshot name and - **Rename** replaces the snapshot name that kagent generates on creation from the Session ID and the turn the checkpoint pins. Clearing the name restores that generated default. - **Delete** removes the checkpoint and releases the snapshot it pinned. Agent Substrate is then free to collect that snapshot. -The bell icon on the latest message for a task opens **Task notifications**. Use it to add, edit, or remove callback URLs while the task is active. New callbacks receive only future updates for tasks that need input or reach a final state. For callback delivery and security details, see [Register task callbacks]({{< link path="examples/a2a-agents#task-callbacks" >}}). - > [!NOTE] > A checkpoint is always taken at the latest turn boundary, so the UI offers **Fork** on your own most recent message and not on earlier ones. +The bell icon on the latest message of a task opens **Task notifications**. Use it to add, edit, or remove the callback URLs that kagent posts task updates to. A new callback receives only the updates that its task sends after you register it, and only when the task needs input or reaches a final state. After the task finishes, you can view and remove its callbacks but not add or edit them. For how kagent delivers and signs a callback, see [Register task callbacks]({{< link path="examples/a2a-agents#task-callbacks" >}}). + ## Attach files to a message In the chat interface for agents on the `kagent` runtime, you can attach files to send with a message. An agent reads any files that you attach, so you can ask the agent about a log, a manifest, or a screenshot without pasting the contents into the message box. From ce0fed5d5bce4ced3d3a08225e696042ff24419a Mon Sep 17 00:00:00 2001 From: Rachael Graham Date: Mon, 12 Oct 2026 15:26:48 -0500 Subject: [PATCH 3/4] Split the A2A methods sentence so the clause has one antecedent "...including `ListTasks` and `GetTaskPushNotificationConfig`, which reads one callback by ID" put a relative clause after a coordinated pair. The singular verb was correct, because only `GetTaskPushNotificationConfig` reads a callback, but the clause still looked like it reached both names, so the sentence read as a subject-verb disagreement. Two sentences give the clause one antecedent and remove the question. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Rachael Graham --- docs-site/content/kagent/1.x/examples/a2a-agents.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs-site/content/kagent/1.x/examples/a2a-agents.md b/docs-site/content/kagent/1.x/examples/a2a-agents.md index 751f1f8f..49b03b4a 100644 --- a/docs-site/content/kagent/1.x/examples/a2a-agents.md +++ b/docs-site/content/kagent/1.x/examples/a2a-agents.md @@ -32,7 +32,7 @@ A caller addresses the Agent rather than one conversation. The message's `contex ### A2A methods -This example calls each method in the following table except the three `TaskPushNotificationConfig` calls, which manage a task's callbacks and which the kagent CLI wraps. The service defines more, including `ListTasks` and `GetTaskPushNotificationConfig`, which reads one callback by ID. +This example calls each method in the following table except the three `TaskPushNotificationConfig` calls, which manage a task's callbacks and which the kagent CLI wraps. The service defines more, including `ListTasks`. `GetTaskPushNotificationConfig` reads a single callback by ID. | Method | What it does | | ------ | ------------ | From 29dadb810c001f69a7ec585c4d7a5f46d9853d55 Mon Sep 17 00:00:00 2001 From: Rachael Graham Date: Mon, 12 Oct 2026 15:59:30 -0500 Subject: [PATCH 4/4] local kind testing results Signed-off-by: Rachael Graham --- .../content/kagent/1.x/examples/a2a-agents.md | 52 +++++++++++++++---- .../kagent/1.x/observability/launch-ui.md | 2 +- 2 files changed, 43 insertions(+), 11 deletions(-) diff --git a/docs-site/content/kagent/1.x/examples/a2a-agents.md b/docs-site/content/kagent/1.x/examples/a2a-agents.md index 49b03b4a..c2f66c9f 100644 --- a/docs-site/content/kagent/1.x/examples/a2a-agents.md +++ b/docs-site/content/kagent/1.x/examples/a2a-agents.md @@ -214,12 +214,12 @@ The kagent CLI wraps the three push notification configuration methods, so the s -o json ``` - Save the task ID, so that later steps can address the task. +2. Save the task ID from the command output so that later steps can address the task. ```bash export PUSH_TASK_ID= ``` -2. To add a second callback to a task that is still active, create one explicitly. The server rejects new callbacks after the task reaches a terminal state. +3. To add a second callback to a task that is still active, create one explicitly. The server rejects new callbacks after the task reaches a terminal state. ```bash kagent agent session push create \ $SESSION_ID $PUSH_TASK_ID \ @@ -227,12 +227,12 @@ The kagent CLI wraps the three push notification configuration methods, so the s --url https://receiver.example/callback ``` -3. List the callbacks for the task. +4. List the callbacks for the task. ```bash kagent agent session push list $SESSION_ID $PUSH_TASK_ID ``` -4. Delete a callback that should no longer receive task updates. +5. Delete a callback that should no longer receive task updates. ```bash kagent agent session push delete $SESSION_ID $PUSH_TASK_ID audit-webhook ``` @@ -242,17 +242,49 @@ The kagent CLI wraps the three push notification configuration methods, so the s A callback URL is a public endpoint that receives task state from kagent. Before you register a callback in production, decide how the receiver establishes that a delivery came from kagent. > [!IMPORTANT] -> kagent signs deliveries only when an operator configures a signing key, and `controller.push.signing.secretName` is empty by default. Until an operator sets it, kagent posts each callback without an `Authorization` header, and the controller serves `404` at `/.well-known/jwks.json`. A receiver cannot distinguish an unsigned kagent delivery from any other caller, so treat the default configuration as suitable for a trusted network only. +> kagent signs deliveries only when the installation names a signing key, and `controller.push.signing.secretName` is empty by default. Until you set it, kagent posts each callback without an `Authorization` header, and the controller serves `404` at `/.well-known/jwks.json`. A receiver cannot distinguish an unsigned kagent delivery from any other caller, so treat the default configuration as suitable for a trusted network only. -To sign deliveries, an operator creates a Secret that holds an unencrypted PKCS#8 Ed25519 private key in a `private-key.pem` entry, and names that Secret in `controller.push.signing.secretName`. kagent generates no key of its own, so key creation, persistence, and rotation stay with the operator. +kagent does not generate its own signing key, so you are responsible for creating the key, keeping it, and rotating it. The following steps turn signing on. -Receivers verify a signed delivery against the JSON Web Key Set (JWKS) that the controller serves at `/.well-known/jwks.json`, which exposes the public verification key alone. The controller serves that path on the same port as its gRPC, A2A, and MCP endpoints, so a receiver outside the cluster needs a stable HTTPS URL that routes to the controller. The UI does not proxy the path, so publishing only the UI leaves a receiver with no key to verify against. +1. Generate an Ed25519 private key in unencrypted PKCS#8 PEM form. + ```bash + openssl genpkey -algorithm ed25519 -out private-key.pem + ``` + + > [!NOTE] + > The `openssl` binary that ships with macOS is LibreSSL, which rejects this command with `Algorithm ed25519 not found`. Install OpenSSL 3, or generate the key on another machine. + +2. Store the key in a Secret. kagent reads the `private-key.pem` entry, so the entry name is not optional. + ```bash + kubectl create secret generic kagent-push-signing -n kagent \ + --from-file=private-key.pem=private-key.pem + ``` + +3. Name the Secret in `controller.push.signing.secretName`, and set `controller.push.signing.issuer` to a URL that reaches the controller. Use the Helm release name and version that you installed kagent with. + ```bash + helm upgrade kagent oci://ghcr.io/kagent-dev/kagent/helm/kagent \ + --namespace kagent --reuse-values \ + --set controller.push.signing.secretName=kagent-push-signing \ + --set controller.push.signing.issuer=https://kagent.example + ``` + + The issuer that a receiver trusts must match the host that it fetches the JWKS from. When `controller.push.signing.issuer` is empty, Helm falls back to `ui.externalUrl` and then to the in-cluster A2A gateway URL. Either fallback can name a host that does not serve the JWKS. + +4. Confirm that the controller publishes a verification key. Before you set the Secret, this path returns `404`. + ```bash + curl -s http://localhost:8083/.well-known/jwks.json + ``` + + Example output, which carries the public key alone: + ```json + {"keys":[{"kty":"OKP","crv":"Ed25519","alg":"EdDSA","use":"sig","kid":"B1BP8zPNOTEGYyBUVgUAeTyA5hPlnrNc0OB416NY-CM","x":"xIc8dv_I-NrYSvWKg4aKm_X1CjHmiUBSMf9cDXEKesM"}]} + ``` -Set `controller.push.signing.issuer` to the URL that reaches the controller, so that the issuer a receiver trusts matches the host it fetches the JWKS from. When `controller.push.signing.issuer` is empty, Helm falls back to `ui.externalUrl` and then to the in-cluster A2A gateway URL, and either fallback can name a host that does not serve the JWKS. +Receivers verify a signed delivery against the JSON Web Key Set (JWKS). The controller serves the path on the same port as its gRPC, A2A, and MCP endpoints, so a receiver outside of the cluster needs a stable HTTPS URL that routes to the controller. The UI does not proxy the path, so publishing only the UI leaves a receiver with no key to verify against. -Receivers must not send a token or credential when they register a callback. kagent signs each delivery attempt with a fresh five-minute JWT whose audience is the exact callback URL, including the query string. Before you acknowledge the request with a 2xx response, verify the JWT signature, issuer, audience, expiry, and `taskId` claim. +Receivers must not send a token or credential when they register a callback. kagent signs each delivery attempt with a fresh five-minute JWT whose audience is the exact callback URL, including the query string. Before you acknowledge the request with a 2xx response, verify the JWT signature, issuer, audience, expiry, and `taskId` claim. The `taskId` claim repeats the `statusUpdate.taskId` value in the body, so a receiver that compares them rejects a token replayed against a different task. -By default, callback URLs must use HTTPS. Callback URLs must not resolve to private, loopback, link-local, unspecified, or multicast addresses. For trusted test receivers, operators can set `controller.push.allowHTTP=true` or `controller.push.allowPrivateNetworks=true`. kagent does not follow redirects, and failed attempts are retried from the database-backed queue. +By default, callback URLs must use HTTPS. Callback URLs must not resolve to private, loopback, link-local, unspecified, or multicast addresses. To reach a test receiver inside the cluster, set `controller.push.allowHTTP=true` or `controller.push.allowPrivateNetworks=true`. kagent does not follow redirects, and failed attempts are retried from the database-backed queue. ## When an agent needs a person diff --git a/docs-site/content/kagent/1.x/observability/launch-ui.md b/docs-site/content/kagent/1.x/observability/launch-ui.md index a2bb769f..98cf6f5a 100644 --- a/docs-site/content/kagent/1.x/observability/launch-ui.md +++ b/docs-site/content/kagent/1.x/observability/launch-ui.md @@ -110,7 +110,7 @@ A checkpoint appears in the transcript as a mark carrying the snapshot name and > [!NOTE] > A checkpoint is always taken at the latest turn boundary, so the UI offers **Fork** on your own most recent message and not on earlier ones. -The bell icon on the latest message of a task opens **Task notifications**. Use it to add, edit, or remove the callback URLs that kagent posts task updates to. A new callback receives only the updates that its task sends after you register it, and only when the task needs input or reaches a final state. After the task finishes, you can view and remove its callbacks but not add or edit them. For how kagent delivers and signs a callback, see [Register task callbacks]({{< link path="examples/a2a-agents#task-callbacks" >}}). +The bell icon on the latest message of a task opens **Task notifications**. Use it to add, edit, or remove the callback URLs that kagent posts task updates to. A new callback receives only the updates that its task sends after you register it, and only when the task needs input or reaches a final state. After the task finishes, you can view and remove its callbacks, but you cannot add or edit them. For how kagent delivers and signs a callback, see [Register task callbacks]({{< link path="examples/a2a-agents#task-callbacks" >}}). ## Attach files to a message