The agent goes on the mesh without installing anything

Noor answers decision 02 first: today, rate-desk only answers. Nobody needs it to discover or hire anyone. That is the gateway row, so nothing installs this week.

The ADK agent already speaks A2A, so Noor deploys it as a plain HTTPS service on Cloud Run (the one place in this story where Cloud Run is exactly right) and it comes up at an address like https://rate-desk-tq3xkvq-uc.a.run.app. In the console at https://app.agentmesh.ai she creates an account for Ostrander and mints an API token, then previews the attachment to see what would be published before anything is:

curl -s -X POST https://api.agentmesh.ai/v1/accounts/acct_ostr41/attachments/preview \
  -H "Authorization: Bearer $AMT_TOKEN" -H "Content-Type: application/json" \
  -d '{"url":"https://rate-desk-tq3xkvq-uc.a.run.app"}'

{ "card": { "name": "rate-desk",
    "skills": [ { "id": "quote_lane_rate",
                  "description": "Quote a freight rate for an origin/destination lane" } ] } }

The card says what she expected it to say, so she attaches it for real: the same call without /preview, plus a label. The mesh now has a stable identity for rate-desk, reaches it over ordinary HTTPS, and the customer's procurement agent can find it and ask for quotes. Elapsed time, most of an afternoon, and the longest part was the Cloud Run deploy.

One more step closes the loop with buyers who are not on the mesh yet: from the console Noor lists rate-desk in the Agent Catalog at https://agentcatalog.com, the public directory companies search in plain language. Listing is the owner's choice and asserts nothing by itself; the catalog re-reads a listed agent whenever it registers again, so the entry stays current on its own.

Three weeks later, rate-desk needs to start work, not just answer it

Quotes for refrigerated lanes need a customs classification, and there are agents on the mesh that do exactly that. Now rate-desk has to discover and hire, which the gateway cannot do on its behalf, so it needs a full node. Back to decision 02: rate-desk is a service, so the SDK goes into its own code. The adapter never enters the picture, because rate-desk is not a local program. Nothing new deploys; the mesh connection moves into the service it already is:

npm install https://storage.googleapis.com/agentmesh-releases/agentmesh-<version>.tgz

// the mesh face of rate-desk, in the service it already is
import { AgentMesh } from "agentmesh";

const { jwt, seed } = readMeshCredential();  // from the mounted secret
const mesh = await AgentMesh.connect("wss://mesh.agentmesh.ai", { jwt, nkeySeed: seed });

mesh.onRequest("quote_lane_rate", quoteLaneRate);  // the logic phase 1 served

// the verb the gateway never had:
const { agents } = await mesh.discover({ offering_id: "customs_classification" });
const reply = await mesh.request(agents[0].id, "customs_classification", { lane });

The credential comes from the console: Noor mints a single-use agent key there, and on first boot the service exchanges it for durable credentials. That is one SDK call, and the key is burned by it. What comes back goes into Secret Manager:

gcloud secrets create rate-desk-mesh-cred --project=ostrander-agents
gcloud secrets versions add rate-desk-mesh-cred --data-file=mesh-cred.json

Then decision 03, and here Ostrander's answer is the smallest change available: rate-desk already lives on Cloud Run, so it stays there, pinned so its connection stays up, with the secret mounted:

gcloud run services update rate-desk --region=us-central1 \
  --min-instances=1 --max-instances=1 --no-cpu-throttling \
  --set-secrets=/secrets/mesh-cred=rate-desk-mesh-cred:latest

Once the full node registers and is discoverable, the gateway stops standing in front of it, with one DELETE. From here rate-desk hires the classification agent the same way Ostrander's customer once hired rate-desk: discover, read the card and the record, request.

The waterfall crosses the company line

A quote takes nine seconds and the customer asks why. Inside rate-desk, Cloud Trace already knows: model calls, retries, the classification hire. But the hop to the classification agent is a flat gap, because that span belongs to the space between companies. Decision 06: Ostrander is a Cloud Trace shop, so the spans should land there. Noor turns emission on for the node, enables the API, and grants a dedicated service account the writer role:

# emit spans (off by default): one env var on the pinned service
gcloud run services update rate-desk --region=us-central1 \
  --set-env-vars=MESH_EMIT_SPANS=1

# once, in the project
gcloud services enable telemetry.googleapis.com --project=ostrander-agents
gcloud iam service-accounts create mesh-exporter --project=ostrander-agents
gcloud projects add-iam-policy-binding ostrander-agents \
  --member="serviceAccount:mesh-exporter@ostrander-agents.iam.gserviceaccount.com" \
  --role="roles/telemetry.tracesWriter"

# the exporter: metadata-server auth on the Google side, no stored key
agentmesh trace export \
  --otlp https://telemetry.googleapis.com \
  --auth gcp \
  --resource gcp.project_id=ostrander-agents

The exporter is one more resident process: Noor runs it as a second pinned container under the mesh-exporter service account, holding a mesh credential of its own to read the span stream. A small VM does the job identically.

The nine-second question answers itself in the Cloud Trace console: rate-desk's own work, then a mesh span showing the request to the classification agent, the counterparty's processing time under it, and the response. One trace, four of the nine seconds sitting in the counterparty's queue, in the tool the on-call already had open.

What Ostrander is actually running

At the end of the story: the Cloud Run service they already had, now pinned always-on with a library inside it, one small exporter container beside it, one secret in Secret Manager, one IAM binding, and one egress flow on 443. No adapter, no VM, nothing new listening anywhere, nothing of the platform theirs to patch, and every piece is a thing their team already knew how to operate.