> For the complete documentation index, see [llms.txt](https://dsg-3.gitbook.io/dsg-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dsg-3.gitbook.io/dsg-docs/control-plane/dsg-one-control-plane-current-aws-state/dsg-os-a2a-production-activation-13-oct-2026.md).

# DSG OS A2A — Production Activation (13 Oct 2026)

13 October 2026 — owner-gated DSG OS A2A production activation, independently verified AWS runtime and scoped evidence boundary.

**Production activation: VERIFIED / PASS.** This is a specific DSG OS A2A *browser-observe* route release, **not** a claim that A2A peer-result execution, Cinema connect/execute, Marketplace seller/order flows, XR, or the whole system passed.

## Verifiable release receipts

| Check                                 | Outcome                                                                                                | Evidence                                                                                                                                                                       |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Scoped activation implementation      | PR #693 merged; PR #694 merged                                                                         | [PR #693](https://github.com/tdealer01-crypto/DSG-Private-Production-Runtime/pull/693), [PR #694](https://github.com/tdealer01-crypto/DSG-Private-Production-Runtime/pull/694) |
| Owner identity and manual release     | `tdealer01-crypto` via authenticated GitHub CLI on Android/Termux                                      | [Owner GitHub Actions Run #38394446106](https://github.com/tdealer01-crypto/DSG-Private-Production-Runtime/actions/runs/38394446106)                                           |
| Owner-gated workflow                  | SUCCESS, one dispatch                                                                                  | [Run #38394446106](https://github.com/tdealer01-crypto/DSG-Private-Production-Runtime/actions/runs/38394446106)                                                                |
| Exact immutable image                 | `sha256:6d57382a283edee6c2099ee631db915ae567fe8fde3f9c8071576957a0130914`                              | Independent `docker inspect` on AWS EC2                                                                                                                                        |
| Running services                      | 5/5 healthy: Spacetime, DSG ONE V1, Cinema, Desktop UI, Desktop Relay                                  | Independent AWS SSM readback `6ddac896-b9b5-4e50-993d-0650ff9b709b`                                                                                                            |
| Active A2A route                      | `route.a2a.dsg-os.browser-observe` present in deployment and signed entitlement                        | Independent AWS SSM readback                                                                                                                                                   |
| Internal authenticated A2A Agent Card | HTTP 200, name `DSG Spacetime Governance`                                                              | Independent AWS SSM readback                                                                                                                                                   |
| Public MCP anonymous POST             | HTTP 401                                                                                               | Independent AWS SSM readback                                                                                                                                                   |
| HMAC-SHA256                           | 256-bit runtime key derived with domain separation from **existing** DSG Authority internal credential | Independently checked in running container; no key material displayed                                                                                                          |
| New SSM A2A secret                    | **Not created**                                                                                        | Activation workflow receipt `new_ssm_secret=false`                                                                                                                             |
| Automatic rollback                    | **Not executed**                                                                                       | Activation receipt `rollback_executed=false`                                                                                                                                   |
| Parallel post-activation health       | PASS, 10 checks                                                                                        | GitHub workflow log `DSG_OS_A2A_PARALLEL_HEALTH=PASS`                                                                                                                          |

Owner activation log receipt:

```
DSG_OS_A2A_PREFLIGHT=PASS signed_route=true owner_key_source=existing_authority no_new_ssm_secret=true
DSG_OS_A2A_PARALLEL_HEALTH=PASS checks=10 image_and_peers_and_http_concurrent=true
DSG_OS_A2A_ACTIVATION=PASS route=route.a2a.dsg-os.browser-observe digest=sha256:6d57382a283edee6c2099ee631db915ae567fe8fde3f9c8071576957a0130914 unchanged_peers=4 new_secret_created=false rollback_executed=false
DSG_OS_A2A_OWNER_ACTIVATION=PASS existing_authority=true new_ssm_secret=false
```

## Scope and remaining acceptance

**Completed:** GitHub owner dispatch → additive Ed25519-signed route and entitlement → immutable Spacetime image deployed → authenticated internal A2A discovery, public OAuth anonymous deny and concurrent health checks → independent AWS readback.

**Pending independently:** a genuine A2A peer request executed under an authorized principal, signed contract, resulting peer state, evidence-chain receipt and independent verification. The route grants **browser status observation only**. It does not authorize browser navigation, clicks, connect or execute; these require their own policies and approvals.

The Floot [DSG ONE Spacetime Marketplace Agent Lab](https://dsg-spacetime-marketplace.floot.app/agent-lab) is an **informational presentation** of this timestamped acceptance. Its public unauthenticated probes cannot impersonate the internal A2A authority or prove signed peer E2E. The canonical public entry point remains [dsg.pics](https://dsg.pics/). No private tokens or signing keys appear here.

**Do not re-run or relabel the completed production activation solely because independent peer E2E remains pending.**