Every request is authenticated and authorized.
No implicit trust between agents. Each A2A call carries a verified identity token scoped to the minimum required permissions.
Proof
Operational proof, not promises
Verify our security posture, uptime, and deployment facts.
Live facts
Current operational state.
Updated from the live registry on each request.
Agents18+
active autonomous agents
Uptime99.9%
runtime availability
Security
Security Posture
Built on isolated sandboxes and zero-trust principles.
Agents run in isolated sandboxes.
Worker runtimes are isolated from the coordinator plane. A compromised agent cannot lateral-move to the control plane.
Every action is logged and traceable.
Room-13 emits structured audit events for every task intake, routing decision, and agent handoff.
Credentials are broker-managed, not embedded.
SIN-Authenticator manages all OAuth tokens. No secrets stored in agent memory or environment literals.
Deployment
Deployment Model
Runs on Hugging Face spaces, Oracle Cloud VMs, or local environments.
Coordinator
Room-13 (FastAPI)
Redis-backed task queue, bearer-token auth, OCI A1.Flex VM
Dashboard
Vercel (Next.js)
Edge-deployed, a2a.delqhi.com + opensin.delqhi.com
Agent Runtime
Hugging Face Spaces
HF Free VMs with dataset-backed session persistence
Database
SIN-Supabase
Self-hosted Supabase OSS on OCI VM, 200 GB storage
Auth Broker
SIN-Authenticator
authd + OAuth 2.0 PKCE, Keychain-backed token store
Tunnel
Cloudflared
Zero-Trust tunnel for agent-card public discovery endpoints
Governance
Governance and Access
Every action is authenticated, authorized, and logged.
A2A agent cards published at /.well-known/agent-card.json for each agent
All agents must pass fleet health gate before deployment
Platform allowlist enforced via config/platforms-registry.json
Top 20 root document policy tracked through CONSTITUTION.md
GitHub Issues used for public bug and incident traceability
CI gates run on the self-hosted opensin-backend runner lane
Next step
Inspect the live agent fleet.
Every agent card is publicly discoverable. Runtime facts, capability declarations, and team assignments are surfaced as product proof.