A local agent platform can call registered code directly. A remote agent needs a contract for identity, messages, dispatch, cancellation, and results. Starlight’s core protocol provides that boundary using JSON-RPC over WebSocket.
Two version numbers describe different contracts
These numbers are not interchangeable. An article about the current alpha should not direct readers to an older release and expect the same CLI or API. The canonical specification is now spec/STARLIGHT_CORE_PROTOCOL.md.
Keep one coordinator for local and remote work
The public package exposes AgentPlatform; lower-level primitives such as Coordinator, ProtocolHub, Sentinel, and Starlight are available through /core. When adding a ProtocolHub to a platform, share platform.coordinator so the network entry point and local registrations coordinate the same work.
Authentication is part of the connection lifecycle
Network authentication is mandatory by default. The starlight-core CLI requires STARLIGHT_AUTH_TOKEN, except when an explicit anonymous loopback development mode is selected. Use the remote-agent guide for setup and protect the transport appropriately in your deployment; possession of a token does not encrypt a plain WebSocket connection.
Today’s refinement hardens authentication sequencing, disconnect handling, shutdown, cancellation, and serialization. A client waits for authentication before sending supported work. Inspect both successful and rejected connections when testing your own integration.
Replay protection has a scope
Replay state is bounded and process-local. It is not a durable exactly-once guarantee across restarts. Likewise, cancellation and capacity accounting do not roll back external effects. Agents that publish, charge, write, or notify need a domain-level strategy for reconciling an uncertain outcome.
Use conformance evidence carefully
The repository’s validation covers runtime and CLI behavior, schemas, types, a protocol conformance kit, multi-process execution, and installed-package checks. This is useful implementation evidence. It is not certification of every possible agent or a production-readiness guarantee.
- Use the current JavaScript/Node reference implementation.
- Read the supported method definitions in the core spec before implementing a client.
- Test malformed input, authentication failure, timeout, cancellation, and reconnect.
- Record the exact implementation revision with your results.
- Treat alternate-language clients as separate implementations requiring their own verification.
A protocol makes boundaries explicit
Starlight does not need claims about universal compatibility or speculative compliance levels to be useful. Its value is a defined boundary through which trusted agents can receive bounded work and return inspectable evidence.
Continue the series
- Starlight Part 1: From Browser Automation to a General Agent Platform
- Starlight Part 2: Reading Execution Evidence Instead of Trusting a Green Badge
- Starlight Part 3: Bounded Missions, Cancellation, and Safe Retry Decisions
- Starlight Part 4: Building a Domain Agent with an Explicit Contract
Reviewed implementation and setup
