M28f implementation record — NeMo Agent Toolkit adoption kit

Selected kit and topology

The selected client is a Linux AArch64 Jetson Orin Nano running NeMo Agent Toolkit 1.9.0, nvidia-nat-mcp and nvidia-nat-a2a 1.9.0, MCP SDK 1.29.1 and A2A SDK 0.3.26. The cohesix-nemo-kit 0.1.0 wheel SHA-256 is f9bda287604ee085f470195288ba7fefa88d507659430b06f11298ee4b83caad. The version-pinned Linux dependency-lock file SHA-256 is 2d98723f2a4e539ef91048922b25230cb23cd73c76d390915b0781014181c2d8. The installer verified both digests, created a fresh non-editable venv, installed the pinned dependencies and wheel, and passed pip check. The portable install summary identifies the installed versions and private discovery-record digests. This is a tested version lock and selected wheel digest, not a claim that every upstream wheel has its own pinned distribution hash.

The kit uses Toolkit’s own streamable-HTTP MCP client and per-user A2A client and task helpers. Its small A2A plugin adds the gateway’s authenticated Agent Card request and structured job data part required by the installed Toolkit release. Both clients use separate per-subject private 0600 settings and gateway credential references. The verified delegated ticket, not Toolkit’s user_id or model output, decides scope. The selected MCP tools are available_selected_jobs, preflight_selected_job, submit_selected_job, inspect_job and recover_job; the A2A card advertises the selected CUDA and PEFT skills. The package exposes separate MCP and A2A agent processes. A combined protected process was not selected or claimed.

The gateway and a dedicated agent connected to an exact-source QEMU KVM Queen on the Jetson. Target source commit 7bb8080f10be98a3ee2436ff3b9a7512e9390fd9 used the selected manifest SHA-256 91e305af3b758474941822978dca331fb40b4b692086f59f82843c9e7b42653c. The live PID and [BUILD] identity were checked with rootserver SHA-256 6fc5e4f3837acc66d69a8b0f3e5bf73ea165b047e6de3d2ff988e864a727749d. The pinned model endpoint was a loopback-forwarded local MLX server with mlx-community/Qwen3-4B-Instruct-2507-4bit, revision 50d427756c6b1b2fe0c0a10f67fbda1fc8e82c1b. It supplied planner text only; the Jetson CUDA provider and Cohesix signed outcomes remained separate.

Live workflows and refusals

The native MCP client preflighted and submitted real systemd CUDA ticket m28f-reference-systemd-02. Its first response was uncertain, so the client recovered the same admission ID without another effect. The standing record was confirmed and acknowledged, result SHA-256 41007ca1717b795f26e0f169e79024429f9bb06a60b4de4fee2be1bc5bbecb91; the independent CUDA byte verifier passed. An earlier ticket ending -01 failed because its short inventory decision expired; that trial remains adverse diagnostic evidence.

The native A2A client delegated HF PEFT task m28f-a2a-peft-01. The provider ran validation, training, evaluation, scan, stage, load, canary and promotion; the serving generation advanced from 8 to 9. The A2A task reported completed with provider_verified=false. Independently, coh peft release verify accepted signed graph SHA-256 006becded8c2dd33ca7c9eae1b5b4a8a60a8d40fabc4349ed7bb5110d9fcd393. MCP recovered that original PEFT ID and A2A looked up the original CUDA ID, showing one shared operation identity across both protocols. The initial verifier preparation needed a corrected signed request and a fresh trust observation; rejected diagnostic attempts remain private and were not counted as success.

A second A2A PEFT candidate, m28f-a2a-peft-reject-01, changed the enrolled evaluation-loss bound and failed policy-binding validation before training. Its signed failed graph SHA-256 was 8bc5a029267bf9361d93f196b0bec4efe27fa0b2c21b3f9e7f70a14c9fcc03a2. The shared verifier refused it, and accepted generation 9 remained healthy. This establishes a failed-candidate refusal, not a measured inferior adapter. An unauthorized MCP action was denied; a second subject could not inspect the first subject’s task. Neither refusal caused a target effect.

The one-slot m28f-budget scope admitted A2A CUDA ID m28f-reference-systemd-03, then lost its Root write result. The original reservation remained reserved, with no target result and no permitted effect replay. An MCP attempt under m28f-reference-systemd-04 was denied by the same exhausted budget, including after gateway and agent restart. The A2A cancellation helper returned an unknown outcome. The first job remains unresolved and reserved; it is neither a confirmed success nor a confirmed cancellation or released allocation. This adverse observation demonstrates conservative cross-protocol budget enforcement, not recovery completion.

Native Toolkit comparison and reproducibility

The kit’s model-backed MCP agent invoked selected discovery, and its A2A agent called the authenticated task helper and reported the original PEFT task. Both ran from the pinned Toolkit environment. The effectful CUDA and PEFT commands above used the same installed Toolkit native clients with immutable private request files; planner text did not generate their tickets.

The fixed one-question dataset asked for the state and original ID of the completed PEFT task. Predeclared gates required the direct model to admit unknown state and the governed agent to identify the correct completed task within 30 seconds, with get_task under one second. Native nat eval and profiler recorded:

The governed path spent more end-to-end time on model planning and client setup; the measured A2A control span met the fixed budget. A preceding diagnostic direct run falsely asserted task completion; it was retained as an adverse model result. One task gives no quality distribution or tail-latency claim. The direct path needs only the model credential but has no gateway receipt or original-ID recovery. The governed path needs the private gateway credential pair and a selected ticket; its signed verifier supplies useful provider evidence. Native reconnect and original-ID lookup required no resubmission. The unresolved budget attempt still requires operator reconciliation. The model change from an inadequate 0.6B diagnostic model to the selected 4B revision and the signed PEFT request correction were manual setup work, not unattended recovery.

The kit instructions give a second developer or agent the wheel-install, credential, request, native workflow and evaluation commands. The evaluator for this record was Codex using a new verified Jetson venv and the documented private reference; there is no separate human reproduction claim. The sealed live summary contains the exact IDs, package/image/model identities and SHA-256 of each retained private evidence file. Credentials, request bodies, model traces and native records remain in the private Jetson test bed and are not published in this repository.

Focused completion checks and boundary

The final checks were the eight focused tests/test_nemo_agent_toolkit.py cases, four tests/test_provider_matrix.py cases, matrix validation, fresh locked installation with pip check, native client discovery, model-backed agents and direct/governed native Toolkit evaluation. The selected m28f-nemo-install and m28f-nemo-live collectors both passed, the latter with proof_class=live_target and independently verified provider outcomes. The full test suite was not run. The component scope is Linux AArch64 Toolkit clients, selected Jetson CUDA/PEFT providers and a KVM Queen. Physical Pi, combined MCP/A2A process, mixed MLX/CUDA jobs, weight distribution, NeMo Framework training, external NeMo catalog publication and assembled Release B remain outside this completion claim.