Open Multi-Agent Files

Features

• Observability v2: trace spans and run identity (#371, [#373] by @JackChen-me). Every run now carries a stable runId, attempt, traceId, and rootSpanId, and emits the new TraceRecord v2 schema: a proper span tree covering run, coordinator, task, agent, LLM, tool, retry, delegation, consensus, and checkpoint, with DAG, synthesis, and restore relationships expressed as links. The existing seven-field onTrace callback keeps working unchanged. See docs/observability.md (github.com).

• Observability v2: sink and exporter lifecycle (#374 by @JackChen-me). The new @open-multi-agent/core/observability subpath ships the public TraceSink / TraceExporter contract plus BatchingTraceSink (bounded queue, batched export, backoff retries, priority-aware drop), CompositeSink, FilteringSink, SensitiveDataProcessor, and LegacyCallbackTraceSink. Tracing stays metadata-only by default: prompts, completions, tool payloads, credentials, and reasoning content are never captured.

• Observability v2: trace stores (#375, [#384] by @JackChen-me). A storage-independent TraceStore contract (append, get, query, delete, retention) with two references: the zero-dependency InMemoryTraceStore, and FileTraceStore behind @open-multi-agent/core/observability/file, an append-only NDJSON store with crash-safe compaction and explicit flush, close, and diagnostics. FileTraceStore targets local development, tests, CLIs, and modest single-process services.

• New package: @open-multi-agent/otel 0.1.0 (#376, [#385] by @JackChen-me). A separately installable adapter that maps TraceRecord v2 spans onto OpenTelemetry. Its only peer dependency is @opentelemetry/api ^1.9.0 (npm 7+ installs it automatically), it never initializes or replaces the global TracerProvider, and it versions independently of core. It requires core 1.11.0; core 1.10.0 does not contain the v2 APIs. Core itself remains installable and runnable without any OpenTelemetry packages. See docs/observability-migration.md (github.com).

• Per-call tool gate (#377 by @scarab-systems). Optional onToolCall on AgentConfig / OrchestratorConfig runs after Zod validation and before execution, returning allow or deny per call. A deny becomes a normal error ToolResult (never a throw), and a throwing or invalid gate fails closed. Documented with a runnable risk-gated bash example in [#383]. See docs/tool-configuration.md (github.com).

• Generic process backend (#378 by @scarab-systems). The new @open-multi-agent/core/process subpath runs a local command as an agent: protocol-neutral, with stdin or argument prompt delivery, cancellation, and redacted stderr on failure. It complements the existing protocol-aware ACP backend. See docs/external-agents.md (github.com).

• Bash command risk classifier (#382 by @JackChen-me). classifyBashCommand behind the @open-multi-agent/core/classifiers subpath returns a safe / review / high level with a reason, splitting compound commands and taking the highest risk. It is a dependency-free heuristic meant to pair with the tool gate, explicitly not a security boundary.

• create-oma-app 0.4.0: production starters (#370 by @JackChen-me). npm create oma-app@latest now offers production-ready pr-review and security starters alongside demo, with cloud or Ollama provider selection. Starters generate Markdown, JSON, and OMA DAG dashboard reports, analyze GitHub strictly read-only, and redact secrets before model analysis.

• Adaptive customer support recipe (#386 by @JackChen-me). A new cookbook example where runTeam engages only the specialists relevant to each ticket instead of the full roster.

Fixes

• Cancelled and timed-out runs no longer report success (#371 by @JackChen-me). Cancellation and whole-run timeout paths could previously surface as successful results; they now report their real outcome through the normalized status.

Compatibility notes

• onTrace remains fully supported and is not deprecated. LegacyCallbackTraceSink can now be configured directly as a sink, preserving the seven legacy event shapes without also wiring onTrace.
• Results now always include identity and status. The new fields stay optional in TypeScript for this release, and success is still present, derived from status.code === 'ok'.
• Dependency ownership is now expressed per package: OpenTelemetry packages belong exclusively to @open-multi-agent/otel, and core must stay importable without them.

Install

npm install @open-multi-agent/core@1.11.0
npm install @open-multi-agent/otel@0.1.0   # optional OpenTelemetry adapter, requires core 1.11.0

New project: npm create oma-app@latest (scaffold updated to create-oma-app@0.4.0, which pins core 1.11.0).

Thanks to @scarab-systems and @JackChen-me.