[drk-ram]

What changed

Adds negotiateHandshake and isSupportedAcsVersion in reference-implementations/agt/packages/guardian/src/handshake.ts and wires them in server.ts so handshake/hello and steps/* requests with incompatible acs_version or acs_versions_supported return -32001 UNSUPPORTED_VERSION, and ClientHello payloads whose transports_supported exclude "http" return -32003 CAPABILITY_NOT_NEGOTIATED instead of returning selected_transport: "http" for an unadvertised transport.

Which issue does this implement

Fixes #139
Fixes #165

• This is an editorial correction (typo, grammar, link, formatting) with no change in
  meaning, so it needs no issue

Base branch

• integration, because this touches the specification, schemas, a reference
  implementation, an adapter, tests, or CI
• main, because every changed path is on the documentation lane allowlist in
  CONTRIBUTING.md

Type of change

• Specification change (schema, hooks, events, AgBOM)
• Reference implementation or adapter
• Documentation
• Tooling or CI
• Governance (licensing, security policy, contributor docs)

I tested this

• I synced my branch with the base branch before opening this
• uv run pytest -v passes on my machine
• uv run mkdocs build --strict passes on my machine

Checklist

• Commits are signed off with git commit -s (required by the DCO)
• Prose follows STYLE.md
• No secrets, tokens, or internal URLs in the diff

Security

• This change has no security impact

[github-actions]

This pull request's description says it closes #139 #165, which is on the project roadmap. When it merges, GitHub closes that issue and the roadmap counts it as delivered. Please confirm the change delivers the whole issue before merging.

[drk-ram]

@bar-capsule @rocklambros Rebased onto integration in c587b8f following the version rule on #196: isSupportedAcsVersion (/^0\.1\.\d+$/) accepts any 0.1.x patch (e.g. 0.1.0, 0.1.4) and refuses a different minor (0.2.0) or major (1.0.0) with -32001 UNSUPPORTED_VERSION, and packages/guardian/test/handshake.test.ts + packages/guardian/test/server.test.ts now explicitly pin 0.1.4 (accepted) and 0.2.0 (refused with -32001).

[bar-capsule]

@drk-ram thanks, that matches #196. Two more rules from my answer on #255, which came after your push:
1: negotiated_version comes from the client's list. A client that offers only 0.1.1 negotiates 0.1.1; today buildServerHello always sends 0.1.0.
2: Every step's params.acs_version must equal the session's negotiated_version, not just any 0.1.x, and anything else gets -32001. That needs the Guardian to keep the negotiated version per session.

A small one: derive the accepted minor from the Guardian's own version rather than hard-coding 0.1, since the #32 change moves acs_version to 0.2.0.

With those and tests that pin them, this is ready from my side.

[drk-ram]

@bar-capsule Pushed 660b055 with all three updates and tests:

1. negotiateHandshake selects negotiated_version from the client's acs_versions_supported list (so a client offering ["0.1.1"] negotiates "0.1.1").
2. The Guardian tracks negotiated_version per session_id and requires every step's params.acs_version to equal the session's negotiated_version, returning -32001 UNSUPPORTED_VERSION otherwise.
3. isSupportedAcsVersion derives the accepted minor/major from the Guardian's own NEGOTIATED_VERSION rather than hard-coding 0.1.