From 3a95be76c8dca57004e8b7f52818f5ad4c718c0b Mon Sep 17 00:00:00 2001
From: GMX <hellxaviave@gmail.com>
Date: Mon, 13 Apr 2026 09:33:38 +0200
Subject: [PATCH] feat(gateway): add GatewayService v1 for module-to-module
 communication
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

  Introduces a central broker that fully isolates modules — they only
  talk to the Gateway + Redis, never to each other directly.

  RPCs:
  - StartStream: Module B requests execution of Module A (ACK + task_id)
  - ProduceStream: BiDi for Module A to emit output / receive input,
    persisted to Redis Streams
  - ConsumeStream: BiDi for Module B to read Module A's output and send
    data back through the Gateway
  - SendSignal: out-of-band control signals (cancel, pause) via Redis
    pub/sub

  Gateway injects ModuleStartInfo as the first entry of the Redis
  output stream.

refactor(gateway)!: simplify to single Stream RPC and add cache-invalidation signals
  Collapse ProduceStream and ConsumeStream into a single

  Stream(StreamRequest) -> stream StreamOutput between consumer and
  Gateway. Producers no longer connect back through the Gateway; outputs
  land in Redis and are replayed to consumers in seq order.

  - Drop ProduceStream / ConsumeStream RPCs and their message families
    (GatewayResponse, StreamStatus, StreamError, ServerHeartbeat).
  - Lifecycle rides as sentinels in StreamOutput.data (module_start_info
    first, end_of_stream last); StreamState enum removed.
  - Document stateless (from_seq=0) vs. stateful (from_seq=highest_seq)
    consumer resume contract, gap detection, and Redis retention bounds.
  - Errors surface only via gRPC status codes.
  - Extend SignalAction with server-wide INVALIDATE_ALL / _CHANNELS /
    _MODELS / _SETUP / _TOOLS / _SHARED; drop PAUSE; strip SIGNAL_ACTION_
    prefix. Renumber StartStream{Request,Response} fields; rename
    Module A/B to producer/consumer in docstrings.

  Other proto changes bundled here: remove deprecated module_registry/v1
  and task_manager/v1 packages (discovery/registration moved into
  registry/v1); minor touch-ups across cost, filesystem, module
  (information, monitoring, service), setup, storage, user_profile, and
  buf.lock.

  BREAKING CHANGE: removes ProduceStream/ConsumeStream RPCs and the
  GatewayResponse/StreamStatus/StreamError/ServerHeartbeat/StreamState
  messages; renames SIGNAL_ACTION_* enum values; renumbers StartStream
  request/response fields; deletes module_registry.v1 and task_manager.v1.

feat(gateway): rename the stream reponse/request

feat(gateway): add task_id to the streamoutput

feat(gateway): update amp to 1.0.0.dev2 - fix stream rpc

feat(proto): add user info and secret retrieval messages and RPCs

feat(user_profile): add CheckResourceAccess RPC

Add a CheckResourceAccess RPC to UserProfileService that returns whether
the calling task (resolved from the request metadata) is authorized to
access a given resource.

Access is reported as a boolean flag with an OK status rather than a
PERMISSION_DENIED error, keeping "denied" a normal answer and reserving
non-OK statuses for actual failures. Introduces the ResourceType enum and
the CheckResourceAccess request/response messages.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(gateway): add AssociateTask RPC to mint sub-task_ids

Add GatewayService.AssociateTask, which generates and registers a new
sub-task_id linked to a running parent task (and its mission) before it
is dispatched via StartStream. Introduces AssociateTaskRequest
(parent_task_id) and AssociateTaskResponse (task_id, parent_task_id).

Also apply buf format normalization to filesystem, registry, and setup
protos (single-line field options, import ordering, 2-space indent).

feat(context): allow user and organisation scoping in filesystem and storage

Extend the context validation patterns to accept `users:` and
`organizations:` prefixes (in addition to missions/setups) for filesystem
file queries (FileFilter, GetFilesRequest) and storage ListRecordsRequest.
DeleteFilesRequest stays restricted to missions/setups.
---
 Taskfile.yml                                  |   1 +
 .../cost/v1/cost_service.proto                |   4 +-
 .../filesystem/v1/filesystem.proto            |   8 +-
 .../filesystem/v1/filesystem_service.proto    |   9 +-
 .../gateway/v1/gateway.proto                  | 210 ++++++++++++++++++
 .../gateway/v1/gateway_service.proto          |  60 +++++
 .../module/v1/information.proto               |  48 ++--
 .../module/v1/module_service.proto            |   7 +-
 .../module/v1/monitoring.proto                |  59 +----
 .../module_registry/v1/discover.proto         |  94 --------
 .../module_registry/v1/metadata.proto         |  44 ----
 .../v1/module_registry_service.proto          |  48 ----
 .../module_registry/v1/registration.proto     |  75 -------
 .../module_registry/v1/status.proto           |  91 --------
 .../registry/v1/registry_models.proto         |  39 +---
 .../registry/v1/registry_requests.proto       |  53 ++---
 .../registry/v1/registry_service.proto        |   2 +-
 .../setup/v1/setup.proto                      |  36 +--
 .../setup/v1/setup_service.proto              |  16 +-
 .../storage/v1/data.proto                     |   8 +-
 .../storage/v1/storage_service.proto          |   4 +-
 .../task_manager/v1/task_manager_dto.proto    | 105 ---------
 .../v1/task_manager_message.proto             | 115 ----------
 .../v1/task_manager_service.proto             |  35 ---
 .../user_profile/v1/user_profile.proto        | 120 +++++++++-
 .../v1/user_profile_service.proto             |  11 +
 proto/buf.lock                                |   4 +-
 27 files changed, 498 insertions(+), 808 deletions(-)
 create mode 100644 proto/agentic_mesh_protocol/gateway/v1/gateway.proto
 create mode 100644 proto/agentic_mesh_protocol/gateway/v1/gateway_service.proto
 delete mode 100644 proto/agentic_mesh_protocol/module_registry/v1/discover.proto
 delete mode 100644 proto/agentic_mesh_protocol/module_registry/v1/metadata.proto
 delete mode 100644 proto/agentic_mesh_protocol/module_registry/v1/module_registry_service.proto
 delete mode 100644 proto/agentic_mesh_protocol/module_registry/v1/registration.proto
 delete mode 100644 proto/agentic_mesh_protocol/module_registry/v1/status.proto
 delete mode 100644 proto/agentic_mesh_protocol/task_manager/v1/task_manager_dto.proto
 delete mode 100644 proto/agentic_mesh_protocol/task_manager/v1/task_manager_message.proto
 delete mode 100644 proto/agentic_mesh_protocol/task_manager/v1/task_manager_service.proto

diff --git a/Taskfile.yml b/Taskfile.yml
index 7487cbd..be3a0be 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -171,6 +171,7 @@ tasks:
     cmds:
       - task: clean
       - rm -rf node_modules/
+      - rm -rf .task
 
   # Validation
   validate:
diff --git a/proto/agentic_mesh_protocol/cost/v1/cost_service.proto b/proto/agentic_mesh_protocol/cost/v1/cost_service.proto
index 78193e5..06b20e8 100644
--- a/proto/agentic_mesh_protocol/cost/v1/cost_service.proto
+++ b/proto/agentic_mesh_protocol/cost/v1/cost_service.proto
@@ -23,10 +23,10 @@ service CostService {
   // AddCost records a new cost entry for a mission.
   rpc AddCost(AddCostRequest) returns (AddCostResponse);
 
-  // GetCost retrieves cost entries by name within a mission.
+  // DEPRECATED: GetCost — unused in SDK, no callers.
   rpc GetCost(GetCostRequest) returns (GetCostResponse);
 
-  // GetCosts retrieves multiple cost entries with filtering and pagination.
+  // DEPRECATED: GetCosts — unused in SDK, no callers.
   rpc GetCosts(GetCostsRequest) returns (GetCostsResponse);
 
   // GetCostConfig retrieves cost configuration for a setup version.
diff --git a/proto/agentic_mesh_protocol/filesystem/v1/filesystem.proto b/proto/agentic_mesh_protocol/filesystem/v1/filesystem.proto
index 1960bff..75fa638 100644
--- a/proto/agentic_mesh_protocol/filesystem/v1/filesystem.proto
+++ b/proto/agentic_mesh_protocol/filesystem/v1/filesystem.proto
@@ -139,7 +139,7 @@ message FileFilter {
   // context: Filter by context (required for scoping)
   string context = 4 [
     (buf.validate.field).required = true,
-    (buf.validate.field).string.pattern = "^(missions:|setups:).*$"
+    (buf.validate.field).string.pattern = "^(missions:|setups:|users:|organizations:).*$"
   ];
 
   // created_after: Filter files created after this timestamp
@@ -254,9 +254,7 @@ message UploadFilesResponse {
 // GetFileRequest is the request message for retrieving a specific file.
 message GetFileRequest {
   // context: Context ID for the file
-  string context = 1 [
-    (buf.validate.field).string.pattern = "^(missions:|setups:).*$"
-  ];
+  string context = 1 [(buf.validate.field).string.pattern = "^(missions:|setups:).*$"];
 
   // file_id: File ID
   string file_id = 2 [
@@ -324,7 +322,7 @@ message GetFilesRequest {
   // context: Context ID for the files
   string context = 1 [
     (buf.validate.field).required = true,
-    (buf.validate.field).string.pattern = "^(missions:|setups:).*$"
+    (buf.validate.field).string.pattern = "^(missions:|setups:|users:|organizations:).*$"
   ];
 
   // filters: How to identify the files
diff --git a/proto/agentic_mesh_protocol/filesystem/v1/filesystem_service.proto b/proto/agentic_mesh_protocol/filesystem/v1/filesystem_service.proto
index 8bb3078..1e471c7 100644
--- a/proto/agentic_mesh_protocol/filesystem/v1/filesystem_service.proto
+++ b/proto/agentic_mesh_protocol/filesystem/v1/filesystem_service.proto
@@ -27,15 +27,10 @@ service FilesystemService {
   // atomically - if one fails, others may still succeed.
   rpc UploadFiles(UploadFilesRequest) returns (UploadFilesResponse);
 
-  // GetFile fetches detailed information about a single file,
-  // with optional content inclusion. Supports lookup by either
-  // unique ID or name within a context.
+  // DEPRECATED: GetFile — unused in SDK, no callers.
   rpc GetFile(GetFileRequest) returns (GetFileResponse);
 
-  // GetFiles provides efficient retrieval of multiple files using
-  // file IDs, file names, or path prefix, with support for
-  // pagination for large result sets, optional content inclusion,
-  // and total count of matching files.
+  // DEPRECATED: GetFiles — unused in SDK, no callers.
   rpc GetFiles(GetFilesRequest) returns (GetFilesResponse);
 
   // UpdateFile allows updating various aspects of a file including
diff --git a/proto/agentic_mesh_protocol/gateway/v1/gateway.proto b/proto/agentic_mesh_protocol/gateway/v1/gateway.proto
new file mode 100644
index 0000000..a52b550
--- /dev/null
+++ b/proto/agentic_mesh_protocol/gateway/v1/gateway.proto
@@ -0,0 +1,210 @@
+// Copyright 2026 DigitalKin Inc.
+//
+// Licensed under the GNU General Public License, Version 3.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.gnu.org/licenses/gpl-3.0.html
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package agentic_mesh_protocol.gateway.v1;
+
+import "buf/validate/validate.proto";
+import "google/protobuf/struct.proto";
+
+// SignalAction
+// Control signals for tasks and server-wide cache invalidation.
+enum SignalAction {
+  // Default unspecified value.
+  UNSPECIFIED = 0;
+  // Cancel a running task (requires task_id).
+  CANCEL = 1;
+  // ── SDK / Infrastructure cache invalidation (server-wide) ──
+  // Wipe all caches (combines all INVALIDATE_* below).
+  INVALIDATE_ALL = 2;
+  // Clear gRPC channel pool, stubs, CircuitBreaker, Bulkhead.
+  INVALIDATE_CHANNELS = 3;
+  // Clear Pydantic model class cache (schema filtering).
+  INVALIDATE_MODELS = 4;
+  // ── Runtime / Archetype cache invalidation (server-wide) ──
+  // Clear setup JSON cache fetched from services-provider.
+  INVALIDATE_SETUP = 5;
+  // Clear resolved tool definitions cache.
+  INVALIDATE_TOOLS = 6;
+  // Clear BaseModule._shared (litellm, toolkits, user_profile, etc.).
+  INVALIDATE_SHARED = 7;
+}
+
+// ═══════════════════════════════════════════════════════════════════
+// AssociateTask — unary: register a sub-task under a running parent
+// ═══════════════════════════════════════════════════════════════════
+
+// AssociateTaskRequest
+// A running producer asks the Gateway to mint a sub-task linked to the
+// task currently processing a message. The Gateway generates a new
+// task_id, resolves the parent's mission, persists the parent→child
+// association, and returns the new id — ready to pass to StartStream.
+message AssociateTaskRequest {
+  // Parent task currently processing the message that spawns the sub-task.
+  string parent_task_id = 1 [(buf.validate.field).required = true];
+}
+
+// AssociateTaskResponse
+// The newly minted sub-task, registered and linked to the parent.
+message AssociateTaskResponse {
+  // Generated sub-task identifier. Pass this to StartStream to dispatch.
+  string task_id = 1;
+  // Parent task the sub-task is linked to (echoed from the request).
+  string parent_task_id = 2;
+}
+
+// ═══════════════════════════════════════════════════════════════════
+// StartStream — unary: consumer asks Gateway to dispatch a task
+// ═══════════════════════════════════════════════════════════════════
+
+// StartStreamRequest
+// Consumer asks the Gateway to start the producer.
+// The Gateway resolves the setup, dispatches the producer, and returns ACK.
+// module_start_info is injected by the Gateway as the first entry.
+message StartStreamRequest {
+  // Unique identifier for the task being started.
+  string task_id = 1 [(buf.validate.field).required = true];
+  // Setup ID resolved for the producer (prefixed "setups:").
+  string setup_id = 2 [
+    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).string.prefix = "setups:",
+    (buf.validate.field).required = true
+  ];
+  // Mission ID for multi-tenant isolation (prefixed "missions:").
+  string mission_id = 3 [
+    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).string.prefix = "missions:",
+    (buf.validate.field).required = true
+  ];
+}
+
+// StartStreamResponse
+// ACK only. module_start_info arrives via Stream (seq=1).
+message StartStreamResponse {
+  // Whether the Gateway accepted the start request.
+  bool accepted = 1;
+  // Task ID that was started (echoed from the request).
+  string task_id = 2;
+}
+
+// ═══════════════════════════════════════════════════════════════════
+// Stream — BiDi: consumer ↔ Gateway
+// ═══════════════════════════════════════════════════════════════════
+
+// StreamClient
+// Client (UI / caller module) → Gateway → SDK module.
+//
+// FIRST MESSAGE — initiates the stream and carries the query:
+//   task_id  = required, identifies the running task
+//   from_seq = resume point (see modes below); 0 means "from the start"
+//   data     = required, the query payload delivered to the SDK module
+//              as its first input
+//
+// SUBSEQUENT MESSAGES — additional upstream input (optional):
+//   data     = required, forwarded to the SDK module
+//   task_id  = ignored (bound on the first message)
+//   from_seq = ignored
+//
+// ── Two client profiles for the resume contract ──
+//
+// STATELESS (external UI / web clients with no Redis/seq tracking):
+//   - On every connection: send from_seq = 0.
+//   - Server replays the full stream from seq=1 to end_of_stream.
+//   - Ignore the seq field on StreamServer.
+//   - On disconnect mid-task: reconnect with from_seq=0 and re-receive
+//     everything from the beginning (server delivers duplicates from
+//     the client's point of view; that's the explicit cost of being
+//     stateless).
+//
+//   Pseudo-code:
+//     stub.Stream(iter([StreamClient(task_id=tid, from_seq=0, data=query)]))
+//     for out in stream:
+//         handle(out.data)        // ignore out.seq
+//
+// STATEFUL (clients that resume cleanly across disconnects):
+//   - Track highest_seq = max seq received from StreamServer.
+//   - On reconnect: send from_seq = highest_seq (data may be empty if
+//     the query was already delivered before disconnect).
+//   - Server delivers entries with seq > from_seq only — no duplicates.
+//   - Optional gap detection: if next_seq != prev_seq + 1, the stream
+//     was truncated upstream (Redis stream trim, server-side overflow);
+//     the client decides whether to abort, alert, or accept the gap.
+//
+// Resume window: bounded by Redis stream retention (XADD + MAXLEN). If
+// the client's from_seq predates the oldest retained entry, the server
+// delivers from the oldest available entry — the client detects the
+// gap via the seq jump.
+message StreamClient {
+  // Resume point on first message. Two valid modes:
+  //   0   — STATELESS / fresh: replay the entire stream from seq=1.
+  //   N>0 — STATEFUL / resume: deliver only entries with seq > N.
+  // Ignored on subsequent (upstream-data) messages.
+  uint64 from_seq = 1;
+  // Required on first message. Identifies the task being consumed.
+  string task_id = 2 [(buf.validate.field).required = true];
+  // Upstream payload. On the first message: the query, delivered to
+  // the SDK module as its first input. On subsequent messages: any
+  // additional upstream input (e.g. follow-up turn).
+  google.protobuf.Struct data = 3;
+}
+
+// StreamServer
+// Gateway → client. One per Redis stream entry, in seq order.
+//
+// LIFECYCLE — encoded as sentinels in data.root.protocol:
+//   - First entry: { "root": { "protocol": "stream.start", ... } }
+//     (a.k.a. module_start_info — task/setup/mission IDs).
+//   - Last entry:  { "root": { "protocol": "stream.end",   ... } }
+//   - Errors:      { "root": { "protocol": "stream.error",
+//                      code, message, fatal } }
+//                  followed by stream.end if fatal=true.
+//   - Clean stream close follows stream.end.
+//
+// Errors NEVER surface as gRPC status codes on the Stream RPC — they
+// are in-band sentinels so clients see one uniform observation surface.
+message StreamServer {
+  // Monotonic from 1, assigned by the Gateway on Redis persist.
+  // STATEFUL clients track this and send the highest value back as
+  // StreamClient.from_seq on reconnection. STATELESS clients can
+  // ignore it — the server emits it unconditionally.
+  uint64 seq = 1;
+  // Required on first message. Identifies the task being consumed.
+  string task_id = 2 [(buf.validate.field).required = true];
+  // Output payload from the SDK module (or a lifecycle sentinel).
+  // The "protocol" field inside disambiguates payload type.
+  google.protobuf.Struct data = 3 [(buf.validate.field).required = true];
+}
+
+// ═══════════════════════════════════════════════════════════════════
+// SendSignal — unary: control signal via Redis pub/sub
+// ═══════════════════════════════════════════════════════════════════
+
+// ClientSignalRequest
+// Control signal: per-task (CANCEL) or server-wide (INVALIDATE_*).
+message ClientSignalRequest {
+  // Task ID (required for CANCEL, ignored for INVALIDATE_*).
+  string task_id = 1;
+  // Control action to dispatch.
+  SignalAction action = 2 [(buf.validate.field).required = true];
+}
+
+// ClientSignalResponse
+// Acknowledges that the Gateway published the control signal.
+message ClientSignalResponse {
+  // Whether the signal was successfully published.
+  bool success = 1;
+  // Task ID the signal was published for (echoed from the request).
+  string task_id = 2;
+}
diff --git a/proto/agentic_mesh_protocol/gateway/v1/gateway_service.proto b/proto/agentic_mesh_protocol/gateway/v1/gateway_service.proto
new file mode 100644
index 0000000..dafe489
--- /dev/null
+++ b/proto/agentic_mesh_protocol/gateway/v1/gateway_service.proto
@@ -0,0 +1,60 @@
+// Copyright 2026 DigitalKin Inc.
+//
+// Licensed under the GNU General Public License, Version 3.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     https://www.gnu.org/licenses/gpl-3.0.html
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+
+package agentic_mesh_protocol.gateway.v1;
+
+import "agentic_mesh_protocol/gateway/v1/gateway.proto";
+
+// GatewayService
+// External surface for consumers of a producer module.
+// The Gateway exposes only what external clients need:
+//
+//   1. AssociateTask — mint + register a sub-task under a running parent.
+//   2. StartStream   — kick off a task; returns ACK immediately.
+//   3. Stream        — BiDi: read output, send upstream input.
+//   4. SendSignal    — out-of-band control (CANCEL, INVALIDATE_*)
+service GatewayService {
+  // AssociateTask: generate + register a sub-task_id linked to a running
+  // parent task (and its mission), before it is started. Returns the new
+  // task_id, which is then passed to StartStream to dispatch the producer.
+  rpc AssociateTask(AssociateTaskRequest) returns (AssociateTaskResponse);
+
+  // StartStream: register a task and dispatch the producer via Redis.
+  // Returns ACK + task_id; output flows over Stream.
+  rpc StartStream(StartStreamRequest) returns (StartStreamResponse);
+
+  // Stream: BiDi between client (UI / caller module) and Gateway.
+  //
+  // Flow:
+  //   1. Server emits StreamServer{module_start_info} immediately
+  //      (seeded by StartStream into Redis at seq=1).
+  //   2. Client sends StreamClient{task_id, from_seq, data=<query>}.
+  //      The data Struct carries the query, delivered to the SDK module
+  //      as its first input. task_id + from_seq identify the stream and
+  //      its resume point.
+  //   3. Server yields StreamServer{seq, data} per Redis entry as the
+  //      module produces output.
+  //   4. Client may send more StreamClient{data} messages for additional
+  //      upstream input (task_id and from_seq ignored after the first).
+  //   5. Server emits StreamServer{end_of_stream} and closes cleanly.
+  //
+  // Errors flow as in-band sentinels in StreamServer.data.root.protocol —
+  // never via gRPC status on Stream.
+  rpc Stream(stream StreamServer) returns (stream StreamClient);
+
+  // SendSignal: out-of-band control
+  rpc SendSignal(ClientSignalRequest) returns (ClientSignalResponse);
+}
diff --git a/proto/agentic_mesh_protocol/module/v1/information.proto b/proto/agentic_mesh_protocol/module/v1/information.proto
index 88ac1c4..b20f0b2 100644
--- a/proto/agentic_mesh_protocol/module/v1/information.proto
+++ b/proto/agentic_mesh_protocol/module/v1/information.proto
@@ -36,12 +36,7 @@ message GetModuleInputRequest {
   bool llm_format = 2;
 }
 
-// GetModuleSelectSchemaRequest
-//
-// Fields:
-//
-// - module_id: Database ID of the Module to get select schema
-// - llm_format: Define if the select schema should be in LLM format or raw pydantic format
+// GetModuleSelectInputRequest
 message GetModuleSelectInputRequest {
   // module_id: Database ID of the Module to get select input schema
   string module_id = 1 [
@@ -102,6 +97,23 @@ message GetModuleSecretRequest {
   bool llm_format = 2;
 }
 
+// GetModuleUserInfoRequest
+//
+// Fields:
+//
+// - module_id: Database ID of the Module to get secret schema
+// - llm_format: Define if the secret schema should be in LLM format or raw pydantic format
+message GetModuleUserInfoRequest {
+  // module_id: Database ID of the Module to get secret schema
+  string module_id = 1 [
+    (buf.validate.field).string.min_len = 1,
+    (buf.validate.field).string.prefix = "modules:",
+    (buf.validate.field).required = true
+  ];
+  // llm_format: Define if the secret schema should be in LLM format or raw pydantic format
+  bool llm_format = 2;
+}
+
 // GetModuleInputResponse
 //
 // Returns:
@@ -115,16 +127,11 @@ message GetModuleInputResponse {
   google.protobuf.Struct input_schema = 2 [(buf.validate.field).required = true];
 }
 
-// GetModuleInputSelectResponse
-//
-// Returns:
-//
-// - success: Flag to indicate if the input schema request was successful
-// - input_schema: Input schema of the Module
+// GetModuleSelectInputResponse
 message GetModuleSelectInputResponse {
-  // success: Flag to indicate if the input schema request was successful
+  // success: Flag to indicate if the select input schema request was successful
   bool success = 1;
-  // input_schema: Input schema of the Module
+  // select_input_schema: Select input schema of the Module
   google.protobuf.Struct select_input_schema = 2 [(buf.validate.field).required = true];
 }
 
@@ -167,6 +174,19 @@ message GetModuleSecretResponse {
   google.protobuf.Struct secret_schema = 2 [(buf.validate.field).required = true];
 }
 
+// GetModuleUserInfoResponse
+//
+// Returns:
+//
+// - success: Flag to indicate if the user info schema request was successful
+// - user_info_schema: User info schema of the Module
+message GetModuleUserInfoResponse {
+  // success: Flag to indicate if the user info schema request was successful
+  bool success = 1;
+  // user_info_schema: User info schema of the Module
+  google.protobuf.Struct user_info_schema = 2 [(buf.validate.field).required = true];
+}
+
 // GetConfigSetupModuleRequest
 //
 // Fields:
diff --git a/proto/agentic_mesh_protocol/module/v1/module_service.proto b/proto/agentic_mesh_protocol/module/v1/module_service.proto
index 9b28dcf..7ab7a7c 100644
--- a/proto/agentic_mesh_protocol/module/v1/module_service.proto
+++ b/proto/agentic_mesh_protocol/module/v1/module_service.proto
@@ -18,7 +18,6 @@ package agentic_mesh_protocol.module.v1;
 
 import "agentic_mesh_protocol/module/v1/information.proto";
 import "agentic_mesh_protocol/module/v1/lifecycle.proto";
-import "agentic_mesh_protocol/module/v1/monitoring.proto";
 
 // ModuleService
 // It represents a functional unit within an agent in the multi-agent system (SMA).
@@ -33,10 +32,6 @@ service ModuleService {
   rpc StartModule(StartModuleRequest) returns (stream StartModuleResponse);
   // StopModule
   rpc StopModule(StopModuleRequest) returns (StopModuleResponse);
-  // GetModuleStatus
-  rpc GetModuleStatus(GetModuleStatusRequest) returns (GetModuleStatusResponse);
-  // GetModuleJobs
-  rpc GetModuleJobs(GetModuleJobsRequest) returns (GetModuleJobsResponse);
   // GetModuleInput
   rpc GetModuleInput(GetModuleInputRequest) returns (GetModuleInputResponse);
   // GetModuleSelectInput
@@ -47,6 +42,8 @@ service ModuleService {
   rpc GetModuleSetup(GetModuleSetupRequest) returns (GetModuleSetupResponse);
   // GetModuleSecret
   rpc GetModuleSecret(GetModuleSecretRequest) returns (GetModuleSecretResponse);
+  // GetModuleUserInfo
+  rpc GetModuleUserInfo(GetModuleUserInfoRequest) returns (GetModuleUserInfoResponse);
   // GetConfigSetupModule
   rpc GetConfigSetupModule(GetConfigSetupModuleRequest) returns (GetConfigSetupModuleResponse);
   // ConfigSetupModule
diff --git a/proto/agentic_mesh_protocol/module/v1/monitoring.proto b/proto/agentic_mesh_protocol/module/v1/monitoring.proto
index 4fd9d08..19dc537 100644
--- a/proto/agentic_mesh_protocol/module/v1/monitoring.proto
+++ b/proto/agentic_mesh_protocol/module/v1/monitoring.proto
@@ -57,60 +57,5 @@ message JobInfo {
   ];
 }
 
-// GetModuleStatusRequest
-//
-// Fields:
-//
-// - job_id: Database ID of the Job Module to get status
-message GetModuleStatusRequest {
-  // job_id: Database ID of the Job Module to get status
-  string job_id = 1 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).string.prefix = "jobs:",
-    (buf.validate.field).required = true
-  ];
-}
-
-// GetModuleStatusResponse
-//
-// Returns:
-//
-// - success: Flag to indicate if the status request was successful
-// - status: Status of the Module
-// - job_id: Database ID of the job inside the Module that was queried
-message GetModuleStatusResponse {
-  // success: Flag to indicate if the status request was successful
-  bool success = 1;
-  // status: Status of the Module
-  ModuleStatus status = 2 [
-    (buf.validate.field).enum.defined_only = true,
-    (buf.validate.field).required = true
-  ];
-  // job_id: Database ID of the job inside the Module that was queried
-  string job_id = 3 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).string.prefix = "jobs:",
-    (buf.validate.field).required = true
-  ];
-}
-
-// GetModuleJobsRequest
-// TODO: adapt depending on the real way we will get the jobs
-//
-// Fields:
-//
-// - job_id: Database ID of the Job Module to get status
-message GetModuleJobsRequest {}
-
-// GetModuleJobsResponse
-//
-// Returns:
-//
-// - success: Flag to indicate if the status request was successful
-// - jobs: List of jobs with their respective IDs and statuses
-message GetModuleJobsResponse {
-  // success: Flag to indicate if the status request was successful
-  bool success = 1;
-  // jobs: List of jobs with their respective IDs and statuses
-  repeated JobInfo jobs = 3;
-}
+// REMOVED: GetModuleStatusRequest, GetModuleStatusResponse — RPCs deleted.
+// REMOVED: GetModuleJobsRequest, GetModuleJobsResponse — RPCs deleted.
diff --git a/proto/agentic_mesh_protocol/module_registry/v1/discover.proto b/proto/agentic_mesh_protocol/module_registry/v1/discover.proto
deleted file mode 100644
index 8840b11..0000000
--- a/proto/agentic_mesh_protocol/module_registry/v1/discover.proto
+++ /dev/null
@@ -1,94 +0,0 @@
-// Copyright 2025 DigitalKin Inc.
-//
-// Licensed under the GNU General Public License, Version 3.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.gnu.org/licenses/gpl-3.0.html
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package agentic_mesh_protocol.module_registry.v1;
-
-import "agentic_mesh_protocol/module_registry/v1/metadata.proto";
-import "buf/validate/validate.proto";
-
-// DiscoverSearchRequest
-message DiscoverSearchRequest {
-  // module_type: Type of the module to search for (trigger, tool, kin, view).
-  optional string module_type = 1 [
-    (buf.validate.field).string.in = "trigger",
-    (buf.validate.field).string.in = "tool",
-    (buf.validate.field).string.in = "kin",
-    (buf.validate.field).string.in = "view",
-    (buf.validate.field).required = true
-  ];
-  // name: Module's name to search
-  optional string name = 2 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-  // tags: List of tags to filter modules with.
-  repeated Tag tags = 3;
-  // description: Module's description to search.
-  optional string description = 4 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-}
-
-// DiscoverSearchResponse
-message DiscoverSearchResponse {
-  // modules: List of matching modules.
-  repeated DiscoverInfoResponse modules = 1;
-}
-
-// DiscoverInfoRequest
-message DiscoverInfoRequest {
-  // module_id: Id of the module.
-  string module_id = 1 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-}
-
-// DiscoverInfoResponse
-message DiscoverInfoResponse {
-  // module_id: Id of the module.
-  string module_id = 1 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-  // module_type: Type of the module (trigger, tool, kin, view).
-  string module_type = 2 [
-    (buf.validate.field).string.in = "trigger",
-    (buf.validate.field).string.in = "tool",
-    (buf.validate.field).string.in = "kin",
-    (buf.validate.field).string.in = "view",
-    (buf.validate.field).required = true
-  ];
-  // address: Address used to communicate with the module.
-  string address = 3 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-  // port: Port used to communicate with the module.
-  int32 port = 4 [
-    (buf.validate.field).int32.gte = 1,
-    (buf.validate.field).int32.lte = 65535,
-    (buf.validate.field).required = true
-  ];
-  // version: Current module version.
-  string version = 5 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-  // metadata: user defined module name, description and tags
-  optional Metadata metadata = 6;
-}
diff --git a/proto/agentic_mesh_protocol/module_registry/v1/metadata.proto b/proto/agentic_mesh_protocol/module_registry/v1/metadata.proto
deleted file mode 100644
index 19483ee..0000000
--- a/proto/agentic_mesh_protocol/module_registry/v1/metadata.proto
+++ /dev/null
@@ -1,44 +0,0 @@
-// Copyright 2025 DigitalKin Inc.
-//
-// Licensed under the GNU General Public License, Version 3.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.gnu.org/licenses/gpl-3.0.html
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package agentic_mesh_protocol.module_registry.v1;
-
-import "buf/validate/validate.proto";
-
-// Tag
-message Tag {
-  // tag: Describe a Module function.
-  string tag = 1 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-}
-
-// Metadata
-message Metadata {
-  // name: Module's name
-  string name = 1 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-  // tags: List of tag to describe a module functionalities.
-  repeated Tag tags = 2;
-  // description: Module's description for search and indexing
-  optional string description = 3 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-}
diff --git a/proto/agentic_mesh_protocol/module_registry/v1/module_registry_service.proto b/proto/agentic_mesh_protocol/module_registry/v1/module_registry_service.proto
deleted file mode 100644
index fdc752f..0000000
--- a/proto/agentic_mesh_protocol/module_registry/v1/module_registry_service.proto
+++ /dev/null
@@ -1,48 +0,0 @@
-// Copyright 2025 DigitalKin Inc.
-//
-// Licensed under the GNU General Public License, Version 3.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.gnu.org/licenses/gpl-3.0.html
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package agentic_mesh_protocol.module_registry.v1;
-
-import "agentic_mesh_protocol/module_registry/v1/discover.proto";
-import "agentic_mesh_protocol/module_registry/v1/registration.proto";
-import "agentic_mesh_protocol/module_registry/v1/status.proto";
-
-// ModuleRegistryService
-// It manages the registration, discovery, and status tracking of modules within a multi-agent system (MAS).
-// In the context of MAS, this service allows autonomous agents to register their modules, making their capabilities
-// discoverable by other agents. It facilitates dynamic collaboration by enabling agents to find and interact
-// with available modules in real-time. Additionally, it ensures that the status of each module is kept up to date,
-// supporting the overall adaptability and coordination of the multi-agent environment.
-service ModuleRegistryService {
-  // RegisterModule
-  rpc RegisterModule(RegisterRequest) returns (RegisterResponse) {}
-  // DeregisterModule
-  rpc DeregisterModule(DeregisterRequest) returns (DeregisterResponse) {}
-
-  // DiscoverInfoModule
-  rpc DiscoverInfoModule(DiscoverInfoRequest) returns (DiscoverInfoResponse) {}
-  // DiscoverSearchModule
-  rpc DiscoverSearchModule(DiscoverSearchRequest) returns (DiscoverSearchResponse) {}
-
-  // GetModuleStatus
-  rpc GetModuleStatus(ModuleStatusRequest) returns (ModuleStatusResponse) {}
-  // ListModuleStatus
-  rpc ListModuleStatus(ListModulesStatusRequest) returns (ListModulesStatusResponse) {}
-  // GetAllModuleStatus
-  rpc GetAllModuleStatus(GetAllModulesStatusRequest) returns (stream ModuleStatusResponse) {}
-  // UpdateModuleStatus
-  rpc UpdateModuleStatus(UpdateStatusRequest) returns (UpdateStatusResponse) {}
-}
diff --git a/proto/agentic_mesh_protocol/module_registry/v1/registration.proto b/proto/agentic_mesh_protocol/module_registry/v1/registration.proto
deleted file mode 100644
index f8508eb..0000000
--- a/proto/agentic_mesh_protocol/module_registry/v1/registration.proto
+++ /dev/null
@@ -1,75 +0,0 @@
-// Copyright 2025 DigitalKin Inc.
-//
-// Licensed under the GNU General Public License, Version 3.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.gnu.org/licenses/gpl-3.0.html
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package agentic_mesh_protocol.module_registry.v1;
-
-import "agentic_mesh_protocol/module_registry/v1/metadata.proto";
-import "buf/validate/validate.proto";
-
-// RegisterRequest
-message RegisterRequest {
-  // module_id: Id of the module
-  string module_id = 1 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-  // module_type: Type of the module (trigger, tool, kin, view)
-  string module_type = 2 [
-    (buf.validate.field).string.in = "trigger",
-    (buf.validate.field).string.in = "tool",
-    (buf.validate.field).string.in = "kin",
-    (buf.validate.field).string.in = "view",
-    (buf.validate.field).required = true
-  ];
-  // address: Address used to communicate with the module
-  string address = 3 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-  // port: Port used to communicate with the module
-  int32 port = 4 [(buf.validate.field).int32 = {
-    gte: 1
-    lte: 65535
-  }];
-  // version: Current module version.
-  string version = 5 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-  // metadata: user defined module name, description and tags
-  optional Metadata metadata = 6;
-}
-
-// RegisterResponse
-message RegisterResponse {
-  // success: True if the registration was successful
-  bool success = 1;
-}
-
-// DeregisterRequest
-message DeregisterRequest {
-  // module_id: Id of the module
-  string module_id = 1 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-}
-
-// DeregisterResponse
-message DeregisterResponse {
-  // success: True if the registration was successful
-  bool success = 1;
-}
diff --git a/proto/agentic_mesh_protocol/module_registry/v1/status.proto b/proto/agentic_mesh_protocol/module_registry/v1/status.proto
deleted file mode 100644
index 34383a1..0000000
--- a/proto/agentic_mesh_protocol/module_registry/v1/status.proto
+++ /dev/null
@@ -1,91 +0,0 @@
-// Copyright 2025 DigitalKin Inc.
-//
-// Licensed under the GNU General Public License, Version 3.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.gnu.org/licenses/gpl-3.0.html
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package agentic_mesh_protocol.module_registry.v1;
-
-import "buf/validate/validate.proto";
-
-// ModuleStatus mirroring a module instance state,
-enum ModuleStatus {
-  // MODULE_STATUS_UNSPECIFIED is the default unspecified value.
-  MODULE_STATUS_UNSPECIFIED = 0;
-  // MODULE_STATUS_RUNNING indicates the module is alive.
-  MODULE_STATUS_RUNNING = 1;
-  // MODULE_STATUS_IDLE indicates the module is waiting for an event / update.
-  MODULE_STATUS_IDLE = 2;
-  // MODULE_STATUS_ENDED indicates the module signals the end of task or have been killed.
-  MODULE_STATUS_ENDED = 3;
-}
-
-// ModuleStatusRequest
-message ModuleStatusRequest {
-  // module_id: Database ID of the job inside the Module.
-  string module_id = 1 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).string.prefix = "modules:",
-    (buf.validate.field).required = true
-  ];
-}
-
-// ModuleStatusResponse
-message ModuleStatusResponse {
-  // module_id: Database ID of the job inside the Module.
-  string module_id = 1 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).string.prefix = "modules:",
-    (buf.validate.field).required = true
-  ];
-  // status: Representation of the Module current state (running, idle, ended...).
-  ModuleStatus status = 2;
-  // message: (Optional) Details about the status.
-  optional string message = 3;
-}
-
-// GetAllModulesStatusRequest
-message GetAllModulesStatusRequest {}
-
-// ListModulesStatusRequest
-message ListModulesStatusRequest {
-  // list_size: (Optional) The maximum number of module status to return in the response.
-  optional int32 list_size = 1;
-  // offset: (Optional) define the start index to start the list.
-  optional int32 offset = 2;
-}
-
-// ListModulesStatusResponse
-message ListModulesStatusResponse {
-  // list_size: length of the modules_status list.
-  int32 list_size = 1;
-  // modules_statuses: List of modules with their respective IDs and statuses.
-  repeated ModuleStatusResponse modules_statuses = 2;
-}
-
-// UpdateStatusRequest
-message UpdateStatusRequest {
-  // module_id: Id of the module
-  string module_id = 1 [
-    (buf.validate.field).string.min_len = 1,
-    (buf.validate.field).required = true
-  ];
-  // status: Set new fixed value for the current module.
-  ModuleStatus status = 2;
-}
-
-// UpdateStatusResponse
-message UpdateStatusResponse {
-  // success: True if the status was updated
-  bool success = 1;
-}
diff --git a/proto/agentic_mesh_protocol/registry/v1/registry_models.proto b/proto/agentic_mesh_protocol/registry/v1/registry_models.proto
index 7d8734e..691f084 100644
--- a/proto/agentic_mesh_protocol/registry/v1/registry_models.proto
+++ b/proto/agentic_mesh_protocol/registry/v1/registry_models.proto
@@ -17,11 +17,10 @@ syntax = "proto3";
 package agentic_mesh_protocol.registry.v1;
 
 import "agentic_mesh_protocol/registry/v1/registry_enums.proto";
+import "buf/validate/validate.proto";
 import "google/protobuf/struct.proto";
 import "google/protobuf/timestamp.proto";
 
-import "buf/validate/validate.proto";
-
 // -------------------------
 // DOMAIN MODELS
 // -------------------------
@@ -89,25 +88,15 @@ message ModuleDescriptor {
 
   // Schemas for machine introspection
   // Input schema
-  google.protobuf.Struct input_schema = 11 [
-    (buf.validate.field).required = true
-  ];
+  google.protobuf.Struct input_schema = 11 [(buf.validate.field).required = true];
   // Output schema
-  google.protobuf.Struct output_schema = 12 [
-    (buf.validate.field).required = true
-  ];
+  google.protobuf.Struct output_schema = 12 [(buf.validate.field).required = true];
   // Setup schema
-  google.protobuf.Struct setup_schema = 13 [
-    (buf.validate.field).required = true
-  ];
+  google.protobuf.Struct setup_schema = 13 [(buf.validate.field).required = true];
   // Secret schema
-  google.protobuf.Struct secret_schema = 14 [
-    (buf.validate.field).required = true
-  ];
+  google.protobuf.Struct secret_schema = 14 [(buf.validate.field).required = true];
   // Cost schema
-  google.protobuf.Struct cost_schema = 15 [
-    (buf.validate.field).required = true
-  ];
+  google.protobuf.Struct cost_schema = 15 [(buf.validate.field).required = true];
 
   // Documentation
   string documentation = 16 [
@@ -116,13 +105,9 @@ message ModuleDescriptor {
   ];
 
   // Created at
-  google.protobuf.Timestamp created_at = 17 [
-    (buf.validate.field).required = true
-  ];
+  google.protobuf.Timestamp created_at = 17 [(buf.validate.field).required = true];
   // Updated at
-  google.protobuf.Timestamp updated_at = 18 [
-    (buf.validate.field).required = true
-  ];
+  google.protobuf.Timestamp updated_at = 18 [(buf.validate.field).required = true];
 }
 
 // Represents your "setups" + current "setup_versions"
@@ -191,12 +176,8 @@ message SetupDescriptor {
     (buf.validate.field).string.min_len = 1
   ];
   // Configuration
-  google.protobuf.Struct config = 12 [
-    (buf.validate.field).required = true
-  ];
+  google.protobuf.Struct config = 12 [(buf.validate.field).required = true];
 
   // Resolved module info (so agents don't need another round-trip)
-  ModuleDescriptor module = 13 [
-    (buf.validate.field).required = true
-  ];
+  ModuleDescriptor module = 13 [(buf.validate.field).required = true];
 }
diff --git a/proto/agentic_mesh_protocol/registry/v1/registry_requests.proto b/proto/agentic_mesh_protocol/registry/v1/registry_requests.proto
index 44797b0..0f0e57e 100644
--- a/proto/agentic_mesh_protocol/registry/v1/registry_requests.proto
+++ b/proto/agentic_mesh_protocol/registry/v1/registry_requests.proto
@@ -18,7 +18,6 @@ package agentic_mesh_protocol.registry.v1;
 
 import "agentic_mesh_protocol/registry/v1/registry_enums.proto";
 import "agentic_mesh_protocol/registry/v1/registry_models.proto";
-
 import "buf/validate/validate.proto";
 
 // -------------------------
@@ -55,9 +54,7 @@ message RegisterModuleRequest {
 // RegisterModuleResponse
 message RegisterModuleResponse {
   // Module descriptor
-  ModuleDescriptor module = 1 [
-    (buf.validate.field).required = true
-  ];
+  ModuleDescriptor module = 1 [(buf.validate.field).required = true];
 }
 
 // HeartbeatRequest
@@ -92,23 +89,15 @@ message DiscoverSetupsRequest {
     (buf.validate.field).string.min_len = 1
   ];
   // Visibility
-  repeated Visibility visibility = 2 [
-    (buf.validate.field).repeated.items.enum.not_in = 0
-  ];
+  repeated Visibility visibility = 2 [(buf.validate.field).repeated.items.enum.not_in = 0];
   // Status
-  repeated SetupStatus status = 3 [
-    (buf.validate.field).repeated.items.enum.not_in = 0
-  ]; // typically READY / CONFIGURATION_SUCCEEDED
+  repeated SetupStatus status = 3 [(buf.validate.field).repeated.items.enum.not_in = 0]; // typically READY / CONFIGURATION_SUCCEEDED
 
   // e.g. agent, tool
-  repeated ModuleType module_types = 4 [
-    (buf.validate.field).repeated.items.enum.not_in = 0
-  ];
+  repeated ModuleType module_types = 4 [(buf.validate.field).repeated.items.enum.not_in = 0];
 
   // Simple text search
-  string query = 5 [
-    (buf.validate.field).string.min_len = 1
-  ]; // matches on name / documentation depending on implementation
+  string query = 5 [(buf.validate.field).string.min_len = 1]; // matches on name / documentation depending on implementation
 
   // Filter on specific modules if needed
   repeated string module_ids = 6 [
@@ -123,17 +112,13 @@ message DiscoverSetupsRequest {
     (buf.validate.field).int32.lte = 100
   ];
   // Offset
-  int32 offset = 8 [
-    (buf.validate.field).int32.gte = 0
-  ];
+  int32 offset = 8 [(buf.validate.field).int32.gte = 0];
 }
 
 // DiscoverSetupsResponse
 message DiscoverSetupsResponse {
   // Setups
-  repeated SetupDescriptor setups = 1 [
-    (buf.validate.field).repeated.items.required = true
-  ];
+  repeated SetupDescriptor setups = 1;
 }
 
 // Discover raw modules (rarely used by agents directly).
@@ -144,22 +129,14 @@ message DiscoverModulesRequest {
     (buf.validate.field).string.min_len = 1
   ];
   // Module types
-  repeated ModuleType module_types = 2 [
-    (buf.validate.field).repeated.items.enum.not_in = 0
-  ];
+  repeated ModuleType module_types = 2 [(buf.validate.field).repeated.items.enum.not_in = 0];
   // Status
-  repeated ModuleStatus status = 3 [
-    (buf.validate.field).repeated.items.enum.not_in = 0
-  ];
+  repeated ModuleStatus status = 3 [(buf.validate.field).repeated.items.enum.not_in = 0];
   // Visibility
-  repeated Visibility visibility = 4 [
-    (buf.validate.field).repeated.items.enum.not_in = 0
-  ];
+  repeated Visibility visibility = 4 [(buf.validate.field).repeated.items.enum.not_in = 0];
 
   // Simple text search
-  string query = 5 [
-    (buf.validate.field).string.min_len = 1
-  ]; // matches on name / documentation
+  string query = 5 [(buf.validate.field).string.min_len = 1]; // matches on name / documentation
 
   // Pagination
   // Limit
@@ -168,17 +145,13 @@ message DiscoverModulesRequest {
     (buf.validate.field).int32.lte = 100
   ];
   // Offset
-  int32 offset = 7 [
-    (buf.validate.field).int32.gte = 0
-  ];
+  int32 offset = 7 [(buf.validate.field).int32.gte = 0];
 }
 
 // DiscoverModulesResponse
 message DiscoverModulesResponse {
   // Modules
-  repeated ModuleDescriptor modules = 1 [
-    (buf.validate.field).repeated.items.required = true
-  ];
+  repeated ModuleDescriptor modules = 1;
 }
 
 // -------------------------
diff --git a/proto/agentic_mesh_protocol/registry/v1/registry_service.proto b/proto/agentic_mesh_protocol/registry/v1/registry_service.proto
index d8b622f..169659a 100644
--- a/proto/agentic_mesh_protocol/registry/v1/registry_service.proto
+++ b/proto/agentic_mesh_protocol/registry/v1/registry_service.proto
@@ -36,7 +36,7 @@ service RegistryService {
   // 2. DISCOVERY
   // -----------------------
 
-  // Discover setups that are available (agents / tools).
+  // DEPRECATED: DiscoverSetups — unused in SDK, no callers.
   rpc DiscoverSetups(DiscoverSetupsRequest) returns (DiscoverSetupsResponse);
 
   // Discover raw modules (rarely used by agents directly).
diff --git a/proto/agentic_mesh_protocol/setup/v1/setup.proto b/proto/agentic_mesh_protocol/setup/v1/setup.proto
index cffe0dd..228374c 100644
--- a/proto/agentic_mesh_protocol/setup/v1/setup.proto
+++ b/proto/agentic_mesh_protocol/setup/v1/setup.proto
@@ -34,24 +34,24 @@ import "google/protobuf/timestamp.proto";
 // - CONFIGURATION_FAILED: Setup configuration failed
 // - CONFIGURATION_SUCCEEDED: Setup configuration succeeded
 enum SetupStatus {
-    // DRAFT: Setup is a draft
-    DRAFT = 0;
-    // VALIDATING: Setup is being validated
-    VALIDATING = 1;
-    // READY: Setup is ready
-    READY = 2;
-    // PAUSED: Setup is paused
-    PAUSED = 4;
-    // FAILED: Setup failed
-    FAILED = 5;
-    // ARCHIVED: Setup has been archived
-    ARCHIVED = 6;
-    // NEEDS_CONFIGURATION: Setup needs configuration
-    NEEDS_CONFIGURATION = 7;
-    // CONFIGURATION_FAILED: Setup configuration failed
-    CONFIGURATION_FAILED = 8;
-    // CONFIGURATION_SUCCEEDED: Setup configuration succeeded
-    CONFIGURATION_SUCCEEDED = 9;    
+  // DRAFT: Setup is a draft
+  DRAFT = 0;
+  // VALIDATING: Setup is being validated
+  VALIDATING = 1;
+  // READY: Setup is ready
+  READY = 2;
+  // PAUSED: Setup is paused
+  PAUSED = 4;
+  // FAILED: Setup failed
+  FAILED = 5;
+  // ARCHIVED: Setup has been archived
+  ARCHIVED = 6;
+  // NEEDS_CONFIGURATION: Setup needs configuration
+  NEEDS_CONFIGURATION = 7;
+  // CONFIGURATION_FAILED: Setup configuration failed
+  CONFIGURATION_FAILED = 8;
+  // CONFIGURATION_SUCCEEDED: Setup configuration succeeded
+  CONFIGURATION_SUCCEEDED = 9;
 }
 
 // SetupVersion
diff --git a/proto/agentic_mesh_protocol/setup/v1/setup_service.proto b/proto/agentic_mesh_protocol/setup/v1/setup_service.proto
index 43713fc..e9302ef 100644
--- a/proto/agentic_mesh_protocol/setup/v1/setup_service.proto
+++ b/proto/agentic_mesh_protocol/setup/v1/setup_service.proto
@@ -21,25 +21,25 @@ import "agentic_mesh_protocol/setup/v1/setup.proto";
 // SetupService
 // Provides operations for setups and setup versions.
 service SetupService {
-  // CreateSetup creates a new setup.
+  // DEPRECATED: CreateSetup — unused in SDK.
   rpc CreateSetup(CreateSetupRequest) returns (CreateSetupResponse);
   // GetSetup retrieves a setup by its unique identifier.
   rpc GetSetup(GetSetupRequest) returns (GetSetupResponse);
-  // UpdateSetup updates an existing setup.
+  // DEPRECATED: UpdateSetup — unused in SDK.
   rpc UpdateSetup(UpdateSetupRequest) returns (UpdateSetupResponse);
-  // DeleteSetup deletes a setup.
+  // DEPRECATED: DeleteSetup — unused in SDK.
   rpc DeleteSetup(DeleteSetupRequest) returns (DeleteSetupResponse);
 
-  // CreateSetupVersion creates a new setup version.
+  // DEPRECATED: CreateSetupVersion — unused in SDK.
   rpc CreateSetupVersion(CreateSetupVersionRequest) returns (CreateSetupVersionResponse);
   // GetSetupVersion retrieves a setup version by its unique identifier.
   rpc GetSetupVersion(GetSetupVersionRequest) returns (GetSetupVersionResponse);
-  // SearchSetupVersions searches for setup versions based on provided filters.
+  // DEPRECATED: SearchSetupVersions — unused in SDK.
   rpc SearchSetupVersions(SearchSetupVersionsRequest) returns (SearchSetupVersionsResponse);
-  // UpdateSetupVersion updates an existing setup version.
+  // DEPRECATED: UpdateSetupVersion — unused in SDK.
   rpc UpdateSetupVersion(UpdateSetupVersionRequest) returns (UpdateSetupVersionResponse);
-  // DeleteSetupVersion deletes a setup version.
+  // DEPRECATED: DeleteSetupVersion — unused in SDK.
   rpc DeleteSetupVersion(DeleteSetupVersionRequest) returns (DeleteSetupVersionResponse);
-  // ListSetups retrieves a paginated list of setups, filtered by organisation or owner.
+  // DEPRECATED: ListSetups — unused in SDK.
   rpc ListSetups(ListSetupsRequest) returns (ListSetupsResponse);
 }
diff --git a/proto/agentic_mesh_protocol/storage/v1/data.proto b/proto/agentic_mesh_protocol/storage/v1/data.proto
index c1784c1..fb828af 100644
--- a/proto/agentic_mesh_protocol/storage/v1/data.proto
+++ b/proto/agentic_mesh_protocol/storage/v1/data.proto
@@ -131,10 +131,10 @@ message RemoveRecordRequest {
     (buf.validate.field).required = true,
     (buf.validate.field).string.pattern = "^(missions|setup_versions):.+"
   ];
-  // collection: Name of a group of records (unique by context)
-  string collection = 3 [(buf.validate.field).required = true];
+  // collection: Name of a group of records (unique by mission_id)
+  string collection = 2 [(buf.validate.field).required = true];
   // record_id: Unique identifier for the record within collection
-  string record_id = 4 [(buf.validate.field).required = true];
+  string record_id = 3 [(buf.validate.field).required = true];
 }
 
 // RemoveRecordResponse: Response to removed record
@@ -148,7 +148,7 @@ message ListRecordsRequest {
   // context: Mission ID linked to the data
   string context = 1 [
     (buf.validate.field).required = true,
-    (buf.validate.field).string.pattern = "^(missions|setup_versions):.+"
+    (buf.validate.field).string.pattern = "^(missions|setup_versions|users|organizations):.+"
   ];
   // collection: Name of a group of records (unique by context)
   string collection = 2 [(buf.validate.field).required = true];
diff --git a/proto/agentic_mesh_protocol/storage/v1/storage_service.proto b/proto/agentic_mesh_protocol/storage/v1/storage_service.proto
index d0588d1..b35e6f3 100644
--- a/proto/agentic_mesh_protocol/storage/v1/storage_service.proto
+++ b/proto/agentic_mesh_protocol/storage/v1/storage_service.proto
@@ -32,9 +32,9 @@ service StorageService {
   // RemoveRecord: Delete a record from storage
   rpc RemoveRecord(RemoveRecordRequest) returns (RemoveRecordResponse);
 
-  // ListRecords: List records with filtering and pagination
+  // DEPRECATED: ListRecords — unused in SDK, no callers.
   rpc ListRecords(ListRecordsRequest) returns (ListRecordsResponse);
 
-  // RemoveCollection: Delete all records in a given collection
+  // DEPRECATED: RemoveCollection — unused in SDK, no callers.
   rpc RemoveCollection(RemoveCollectionRequest) returns (RemoveCollectionResponse);
 }
diff --git a/proto/agentic_mesh_protocol/task_manager/v1/task_manager_dto.proto b/proto/agentic_mesh_protocol/task_manager/v1/task_manager_dto.proto
deleted file mode 100644
index d62cd08..0000000
--- a/proto/agentic_mesh_protocol/task_manager/v1/task_manager_dto.proto
+++ /dev/null
@@ -1,105 +0,0 @@
-// Copyright 2025 DigitalKin Inc.
-//
-// Licensed under the GNU General Public License, Version 3.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.gnu.org/licenses/gpl-3.0.html
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package agentic_mesh_protocol.task_manager.v1;
-
-import "agentic_mesh_protocol/task_manager/v1/task_manager_message.proto";
-import "buf/validate/validate.proto";
-
-// SendSignalsRequest
-// Request to send signals to tasks (create, stop, etc.).
-// The action field on each task determines the signal type.
-//
-// Fields:
-// - tasks: List of tasks with their signal action.
-message SendSignalsRequest {
-  // tasks is the list of tasks with their signal action.
-  repeated Task tasks = 1 [
-    (buf.validate.field).required = true,
-    (buf.validate.field).repeated.min_items = 1
-  ];
-}
-
-// SendSignalsResponse
-// Response after sending signals to tasks.
-//
-// Fields:
-// - success: Whether the operation was successful.
-// - tasks: Tasks with updated state after signal processing.
-message SendSignalsResponse {
-  // success indicates whether the operation was successful.
-  bool success = 1 [(buf.validate.field).required = true];
-  // tasks is the list of tasks with updated state.
-  repeated Task tasks = 2 [(buf.validate.field).required = true];
-}
-
-// ListHeartbeatsRequest
-// Request to list heartbeats for one or more tasks.
-//
-// Fields:
-// - task_ids: List of task identifiers to get heartbeats for.
-message ListHeartbeatsRequest {
-  // task_ids is the list of task identifiers to get heartbeats for.
-  repeated string task_ids = 1 [
-    (buf.validate.field).required = true,
-    (buf.validate.field).repeated.min_items = 1,
-    (buf.validate.field).repeated.items.cel = {
-      id: "task_id_length"
-      expression: "this.size() >= 1"
-      message: "task_id must be at least 1 characters long"
-    }
-  ];
-}
-
-// ListHeartbeatsResponse
-// Response containing tasks with their current state.
-//
-// Fields:
-// - tasks: Tasks with their current status.
-// - total_count: Total number of tasks available.
-message ListHeartbeatsResponse {
-  // total_count is the total number of tasks available.
-  int32 total_count = 1 [
-    (buf.validate.field).required = true,
-    (buf.validate.field).int32.gte = 0
-  ];
-  // tasks is the list of tasks with their current status.
-  repeated Task tasks = 2 [(buf.validate.field).required = true];
-}
-
-// GetSignalsRequest
-// Request to retrieve pending signals for a task.
-// Used by task executors to poll for signals.
-//
-// Fields:
-// - task_id: Task to check for signals.
-message GetSignalsRequest {
-  // bulk query for task_ids' signals.
-  repeated string task_ids = 1 [
-    (buf.validate.field).required = true,
-    (buf.validate.field).repeated.min_items = 1
-  ];
-}
-
-// GetSignalsResponse
-// Response containing tasks with pending signals.
-//
-// Fields:
-// - tasks: Tasks with their pending signal state.
-message GetSignalsResponse {
-  // tasks is the list of tasks with pending signal state.
-  repeated Task tasks = 1 [(buf.validate.field).required = true];
-}
diff --git a/proto/agentic_mesh_protocol/task_manager/v1/task_manager_message.proto b/proto/agentic_mesh_protocol/task_manager/v1/task_manager_message.proto
deleted file mode 100644
index 2b3250d..0000000
--- a/proto/agentic_mesh_protocol/task_manager/v1/task_manager_message.proto
+++ /dev/null
@@ -1,115 +0,0 @@
-// Copyright 2025 DigitalKin Inc.
-//
-// Licensed under the GNU General Public License, Version 3.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.gnu.org/licenses/gpl-3.0.html
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package agentic_mesh_protocol.task_manager.v1;
-
-import "buf/validate/validate.proto";
-import "google/protobuf/struct.proto";
-import "google/protobuf/timestamp.proto";
-
-// Task
-// Represents a unit of work dispatched to a module.
-// Includes full task state, signaling, and error info.
-//
-// Fields:
-// - task_id: Unique identifier of the task.
-// - mission_id: Mission this task belongs to.
-// - setup_id: Setup configuration to use.
-// - setup_version_id: Setup version to use.
-// - status: Current lifecycle status.
-// - action: Latest signal action type.
-// - created_at: When the task was created.
-// - heartbeat_at: When the task sent its last heartbeat.
-// - payload: Optional structured payload.
-message Task {
-  // task_id is the unique identifier of the task.
-  string task_id = 1 [
-    (buf.validate.field).required = true,
-    (buf.validate.field).cel = {
-      id: "task_id_length"
-      expression: "this.size() >= 1"
-      message: "task_id must be at least 1 characters long"
-    }
-  ];
-  // mission_id is the mission this task belongs to.
-  string mission_id = 2 [
-    (buf.validate.field).required = true,
-    (buf.validate.field).cel = {
-      id: "mission_id_prefix"
-      expression: "this.startsWith('missions:')"
-      message: "mission_id must start with 'missions:'"
-    },
-    (buf.validate.field).cel = {
-      id: "mission_id_length"
-      expression: "this.size() >= 10"
-      message: "mission_id must be at least 1 characters long"
-    }
-  ];
-  // setup_id is the setup configuration to use.
-  string setup_id = 3 [
-    (buf.validate.field).required = true,
-    (buf.validate.field).cel = {
-      id: "setup_id_prefix"
-      expression: "this.startsWith('setups:')"
-      message: "setup_id must start with 'setups:'"
-    },
-    (buf.validate.field).cel = {
-      id: "setup_id_length"
-      expression: "this.size() >= 8"
-      message: "setup_id must be at least 1 characters long"
-    }
-  ];
-  // setup_version_id is the setup version to use.
-  string setup_version_id = 4 [
-    (buf.validate.field).required = true,
-    (buf.validate.field).cel = {
-      id: "setup_version_id_prefix"
-      expression: "this.startsWith('setup_versions:')"
-      message: "setup_version_id must start with 'setup_versions:'"
-    },
-    (buf.validate.field).cel = {
-      id: "setup_version_id_length"
-      expression: "this.size() >= 16"
-      message: "setup_version_id must be at least 1 characters long"
-    }
-  ];
-  // action is the latest signal action type.
-  string action = 5 [
-    (buf.validate.field).required = true,
-    (buf.validate.field).cel = {
-      id: "action_length"
-      expression: "this.size() >= 1"
-      message: "action must be at least 1 characters long"
-    }
-  ];
-  // cancellation_reason is the reason for cancellation.
-  string cancellation_reason = 6 [
-    (buf.validate.field).required = true,
-    (buf.validate.field).cel = {
-      id: "cancellation_reason_length"
-      expression: "this.size() >= 1"
-      message: "action must be at least 1 characters long"
-    }
-  ];
-  // created_at is when the task was created.
-  google.protobuf.Timestamp created_at = 7 [
-    (buf.validate.field).required = true
-  ];
-  // heartbeat_at is when the task last sent a heartbeat.
-  optional google.protobuf.Timestamp heartbeat_at = 8;
-  // payload is an optional structured payload.
-  optional google.protobuf.Struct payload = 9;
-}
diff --git a/proto/agentic_mesh_protocol/task_manager/v1/task_manager_service.proto b/proto/agentic_mesh_protocol/task_manager/v1/task_manager_service.proto
deleted file mode 100644
index 486fdc3..0000000
--- a/proto/agentic_mesh_protocol/task_manager/v1/task_manager_service.proto
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright 2025 DigitalKin Inc.
-//
-// Licensed under the GNU General Public License, Version 3.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     https://www.gnu.org/licenses/gpl-3.0.html
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-syntax = "proto3";
-
-package agentic_mesh_protocol.task_manager.v1;
-
-import "agentic_mesh_protocol/task_manager/v1/task_manager_dto.proto";
-
-// TaskManagerService provides task orchestration
-// and monitoring for the agentic mesh.
-service TaskManagerService {
-  // SendSignals sends signals to tasks (create, stop, etc.).
-  rpc SendSignals(SendSignalsRequest)
-    returns (SendSignalsResponse);
-
-  // ListHeartbeats retrieves heartbeats for a task.
-  rpc ListHeartbeats(ListHeartbeatsRequest)
-    returns (ListHeartbeatsResponse);
-
-  // GetSignals retrieves pending signals for a task.
-  rpc GetSignals(GetSignalsRequest)
-    returns (GetSignalsResponse);
-}
diff --git a/proto/agentic_mesh_protocol/user_profile/v1/user_profile.proto b/proto/agentic_mesh_protocol/user_profile/v1/user_profile.proto
index 71ea9a4..7ff392a 100644
--- a/proto/agentic_mesh_protocol/user_profile/v1/user_profile.proto
+++ b/proto/agentic_mesh_protocol/user_profile/v1/user_profile.proto
@@ -57,7 +57,7 @@ message UserProfile {
     (buf.validate.field).required = true,
     (buf.validate.field).string.prefix = "users:"
   ];
-  // organisation_id: Organisation ID linked to the user
+  // organisation_id: Organization ID linked to the user
   string organisation_id = 2 [
     (buf.validate.field).required = true,
     (buf.validate.field).string.prefix = "organisations:"
@@ -72,13 +72,9 @@ message UserProfile {
   // last_name: User last name
   string last_name = 5 [(buf.validate.field).required = true];
   // creation_date: Profile creation date
-  google.protobuf.Timestamp creation_date = 6 [
-    (buf.validate.field).required = true
-  ];
+  google.protobuf.Timestamp creation_date = 6 [(buf.validate.field).required = true];
   // update_date: Profile last update date
-  google.protobuf.Timestamp update_date = 7 [
-    (buf.validate.field).required = true
-  ];
+  google.protobuf.Timestamp update_date = 7 [(buf.validate.field).required = true];
   // locale: User locale preference
   string locale = 8 [(buf.validate.field).required = true];
   // subscription: User subscription information
@@ -105,3 +101,113 @@ message GetUserProfileResponse {
   // user_profile: Retrieved user profile
   UserProfile user_profile = 2 [(buf.validate.field).required = true];
 }
+
+// GetSetupSecretRequest
+// This request is used to resolve the secret object attached to a setup,
+// for the user resolved from the mission.
+//
+// Fields:
+// - setup_id: The unique identifier of the setup whose secrets are resolved.
+// - mission_id: The mission scope used to resolve the user the secrets belong to.
+message GetSetupSecretRequest {
+  // setup_id: The unique identifier of the setup.
+  string setup_id = 1 [(buf.validate.field).required = true];
+  // mission_id: The mission scope used to resolve the user the secrets belong to.
+  string mission_id = 2 [
+    (buf.validate.field).required = true,
+    (buf.validate.field).string.prefix = "missions:"
+  ];
+}
+
+// GetSetupSecretResponse
+// Returns the resolved secret object, conforming to the secret_schema of the
+// setup's module (see module.v1 ModuleService.GetModuleSecret).
+//
+// Fields:
+// - success: description flag of the operation.
+// - secret: The secret values as a structured object matching the secret_schema.
+message GetSetupSecretResponse {
+  // success: description flag of the operation.
+  bool success = 1;
+  // secret: The secret values as a structured object matching the secret_schema.
+  google.protobuf.Struct secret = 2 [(buf.validate.field).required = true];
+}
+
+// GetSetupUserInfoRequest
+// This request is used to retrieve the user information attached to a setup,
+// for the user resolved from the mission, needed for a kin to run.
+//
+// Fields:
+// - setup_id: The unique identifier of the setup whose user info is resolved.
+// - mission_id: The mission scope used to resolve the user.
+message GetSetupUserInfoRequest {
+  // setup_id: The unique identifier of the setup.
+  string setup_id = 1 [(buf.validate.field).required = true];
+  // mission_id: The mission scope used to resolve the user.
+  string mission_id = 2 [
+    (buf.validate.field).required = true,
+    (buf.validate.field).string.prefix = "missions:"
+  ];
+}
+
+// GetSetupUserInfoResponse
+// Returns the user information associated with the setup owner.
+//
+// Fields:
+// - success: description flag of the operation.
+// - user_info: The user profile information needed for the kin to run.
+message GetSetupUserInfoResponse {
+  // success: description flag of the operation.
+  bool success = 1;
+  // secret: The secret values as a structured object matching the secret_schema.
+  google.protobuf.Struct secret = 2 [(buf.validate.field).required = true];
+}
+
+// ResourceType: Enumerates the kinds of resources whose access can be checked.
+// Enum values can be added over time without breaking existing clients.
+enum ResourceType {
+  // RESOURCE_TYPE_UNSPECIFIED: Default value, must not be used in requests.
+  RESOURCE_TYPE_UNSPECIFIED = 0;
+  // RESOURCE_TYPE_SETUP: A setup resource (setups:).
+  RESOURCE_TYPE_SETUP = 1;
+  // RESOURCE_TYPE_MODULE: A module resource (modules:).
+  RESOURCE_TYPE_MODULE = 2;
+  // RESOURCE_TYPE_MISSION: A mission resource (missions:).
+  RESOURCE_TYPE_MISSION = 3;
+  // RESOURCE_TYPE_STORAGE_RECORD: A storage record resource.
+  RESOURCE_TYPE_STORAGE_RECORD = 4;
+  // RESOURCE_TYPE_FILE: A filesystem file resource.
+  RESOURCE_TYPE_FILE = 5;
+}
+
+// CheckResourceAccessRequest
+// This request is used to check whether the calling task is authorized to
+// access a given resource.
+//
+// The task identifier is NOT carried in this message: it is provided through
+// the gRPC request metadata (e.g. the "task-id" header) and resolved
+// server-side, so authorization context is decoupled from the payload.
+//
+// Fields:
+// - resource_type: The type of the resource whose access is being checked.
+// - resource_id: The unique identifier of the resource whose access is being checked.
+message CheckResourceAccessRequest {
+  // resource_type: The type of the resource whose access is being checked.
+  ResourceType resource_type = 1 [(buf.validate.field).required = true];
+  // resource_id: The unique identifier of the resource whose access is being checked.
+  string resource_id = 2 [(buf.validate.field).required = true];
+}
+
+// CheckResourceAccessResponse
+// Returns whether the calling task is allowed to access the requested resource.
+//
+// A denied access is a normal, expected answer and is reported through the
+// allowed flag with an OK gRPC status. Non-OK statuses are reserved for actual
+// failures (missing task metadata, unknown resource, internal errors).
+//
+// Fields:
+// - allowed: True if the task is authorized to access the resource, false otherwise.
+message CheckResourceAccessResponse {
+  // allowed: True if the task is authorized to access the resource, false otherwise.
+  bool allowed = 1;
+}
diff --git a/proto/agentic_mesh_protocol/user_profile/v1/user_profile_service.proto b/proto/agentic_mesh_protocol/user_profile/v1/user_profile_service.proto
index a08ade9..ad0850f 100644
--- a/proto/agentic_mesh_protocol/user_profile/v1/user_profile_service.proto
+++ b/proto/agentic_mesh_protocol/user_profile/v1/user_profile_service.proto
@@ -22,4 +22,15 @@ import "agentic_mesh_protocol/user_profile/v1/user_profile.proto";
 service UserProfileService {
   // GetUserProfile: Get a user profile by user ID
   rpc GetUserProfile(GetUserProfileRequest) returns (GetUserProfileResponse);
+
+  // GetSetupSecret resolves the secret object attached to a setup, conforming to the module's secret_schema.
+  rpc GetSetupSecret(GetSetupSecretRequest) returns (GetSetupSecretResponse);
+
+  // GetSetupUserInfo retrieves the user information attached to a setup, needed for a kin to run.
+  rpc GetSetupUserInfo(GetSetupUserInfoRequest) returns (GetSetupUserInfoResponse);
+
+  // CheckResourceAccess checks whether the calling task (resolved from the request
+  // metadata) is authorized to access the given resource. Access is returned as a
+  // boolean flag with an OK status; non-OK statuses signal failures, not denials.
+  rpc CheckResourceAccess(CheckResourceAccessRequest) returns (CheckResourceAccessResponse);
 }
diff --git a/proto/buf.lock b/proto/buf.lock
index d15a117..709ae02 100644
--- a/proto/buf.lock
+++ b/proto/buf.lock
@@ -2,5 +2,5 @@
 version: v2
 deps:
   - name: buf.build/bufbuild/protovalidate
-    commit: 80ab13bee0bf4272b6161a72bf7034e0
-    digest: b5:1aa6a965be5d02d64e1d81954fa2e78ef9d1e33a0c30f92bc2626039006a94deb3a5b05f14ed8893f5c3ffce444ac008f7e968188ad225c4c29c813aa5f2daa1
+    commit: 50325440f8f24053b047484a6bf60b76
+    digest: b5:74cb6f5c0853c3c10aafc701614194bbd63326bdb8ef4068214454b8894b03ba4113e04b3a33a8321cdf05336e37db4dc14a5e2495db8462566914f36086ba31