diff --git a/.specify/feature.json b/.specify/feature.json
index aac2774b..35781f75 100644
--- a/.specify/feature.json
+++ b/.specify/feature.json
@@ -1,3 +1,3 @@
 {
-  "feature_directory": "specs/013-a2a-agent-peers"
+  "feature_directory": "specs/014-a2a-protocol-upgrade"
 }
diff --git a/README.md b/README.md
index 2825021d..0f8e6e15 100644
--- a/README.md
+++ b/README.md
@@ -94,22 +94,31 @@ that is templates.
   Edit any of those and the card follows. It is served at the A2A standard
   path, `/a2a/agents/<id>/.well-known/agent-card.json`, and needs a
   credential — there is no anonymous discovery.
-- **Connecting a peer** happens in the admin console, on an agent's **Peers**
-  tab. Pick another agent, read its card, confirm. Connections are one-way:
-  connecting B to A says nothing about what B may ask of A.
+- **Connecting a peer** happens in the admin console, on an agent's **A2A**
+  tab (formerly Peers — old `?tab=peers` links still land). Pick another
+  agent of this ranch, or **import an external A2A agent by its address** —
+  paste the URL, read its card, optionally give the access credential it
+  expects, confirm. Re-importing the same address updates the entry in place.
+  Connections are one-way: connecting B to A says nothing about what B may
+  ask of A.
 - **Delegating** is a tool the API serves to the runtime, so no agent image
-  changes. A pod reads its tool list once at boot, so **restart the agent
-  after connecting or removing a peer** — the console says so too.
+  changes. A pod reads its tool list once at boot, so a new peer needs a
+  restart — the tab shows **armed / pending restart** and the banner carries
+  a one-click **Restart now**. The tool also carries the delegation policy:
+  an agent that cannot answer must try a plausible peer before saying
+  "I don't know".
 - **Watching it happen**: a delegation appears in the chat's thinking
   timeline while it runs, naming the peer, what its card promised, why it was
-  chosen and how long the wait is. Past delegations are listed on the Peers
-  tab.
-- **Limits**: peers are agents of the same installation; a chain may be three
-  hops long; an agent already in a chain refuses to re-enter it.
+  chosen and how long the wait is. Past delegations are listed on the A2A
+  tab; external peers are marked in both places.
+- **Limits**: a chain may be three hops long; an agent already in a chain
+  refuses to re-enter it. External addresses must be publicly reachable —
+  private hosts are refused (`A2A_ALLOW_PRIVATE_PEERS=true` lifts that for
+  local development).
 
 Set `PUBLIC_API_URL` to the origin other agents reach this API on — every
-card URL is built from it. See `specs/013-a2a-agent-peers/` for the full
-specification.
+card URL is built from it. See `specs/013-a2a-agent-peers/` and
+`specs/014-a2a-protocol-upgrade/` for the full specifications.
 
 ## Project Structure
 
diff --git a/admin/slices/agent/agent/components/agent/workspace/Canvas.vue b/admin/slices/agent/agent/components/agent/workspace/Canvas.vue
index ea5960a2..06273d8c 100644
--- a/admin/slices/agent/agent/components/agent/workspace/Canvas.vue
+++ b/admin/slices/agent/agent/components/agent/workspace/Canvas.vue
@@ -63,7 +63,7 @@ const restartUnderway = computed(
 
       <AgentKnowledgeTab v-else-if="tab === 'knowledge'" :agent="agent" />
 
-      <PeerTab v-else-if="tab === 'peers'" :agent="agent" />
+      <PeerTab v-else-if="tab === 'a2a'" :agent="agent" />
 
       <Card v-else-if="tab === 'files'">
         <CardHeader>
diff --git a/admin/slices/agent/agent/components/agent/workspace/sections.ts b/admin/slices/agent/agent/components/agent/workspace/sections.ts
index 5bd1a77d..db6c504c 100644
--- a/admin/slices/agent/agent/components/agent/workspace/sections.ts
+++ b/admin/slices/agent/agent/components/agent/workspace/sections.ts
@@ -5,13 +5,15 @@
  *
  * The `value` strings are a URL contract: `?tab=<value>` deep links predate
  * this screen, so the original nine are byte-identical — including `chat`,
- * which is the default tab again. `logs` is the one new value.
+ * which is the default tab again. `logs` is the one new value, and `peers`
+ * became `a2a` (CLEAN-95) with a legacy alias in `toAgentTab`, so the old
+ * links keep landing.
  */
 
 /** Tabs that can say how much they hold before you open them. */
 export type SectionCountKey =
   | 'knowledge'
-  | 'peers'
+  | 'a2a'
   | 'files'
   | 'secrets'
   | 'channels';
@@ -42,10 +44,10 @@ export const AGENT_TABS = [
     primary: true,
   },
   {
-    value: 'peers',
-    title: 'Peers',
-    desc: 'Other agents this one can delegate to.',
-    countKey: 'peers',
+    value: 'a2a',
+    title: 'A2A',
+    desc: 'Agent-to-agent: card, peers & delegations.',
+    countKey: 'a2a',
     primary: true,
   },
   {
@@ -124,9 +126,12 @@ const TAB_VALUES: readonly string[] = AGENT_TABS.map((t) => t.value);
  * the default rather than erroring — a stale link should land somewhere
  * sensible, not on a broken screen.
  */
+// Renamed values old deep links may still carry (CLEAN-95).
+const LEGACY_TAB_ALIASES: Record<string, AgentTab> = { peers: 'a2a' };
+
 export function toAgentTab(value: unknown): AgentTab {
   const v = Array.isArray(value) ? value[0] : value;
-  return typeof v === 'string' && TAB_VALUES.includes(v)
-    ? (v as AgentTab)
-    : DEFAULT_TAB;
+  if (typeof v !== 'string') return DEFAULT_TAB;
+  if (v in LEGACY_TAB_ALIASES) return LEGACY_TAB_ALIASES[v];
+  return TAB_VALUES.includes(v) ? (v as AgentTab) : DEFAULT_TAB;
 }
diff --git a/admin/slices/agent/agent/composables/useAgentSectionCounts.ts b/admin/slices/agent/agent/composables/useAgentSectionCounts.ts
index 09dbf6e9..177eb174 100644
--- a/admin/slices/agent/agent/composables/useAgentSectionCounts.ts
+++ b/admin/slices/agent/agent/composables/useAgentSectionCounts.ts
@@ -117,7 +117,7 @@ export function useAgentSectionCounts(
       files: files.value,
       secrets: secrets.value,
       channels: channels.value,
-      peers: peers.value,
+      a2a: peers.value,
     };
   });
 
diff --git a/admin/slices/agent/peer/components/peer/CardView.vue b/admin/slices/agent/peer/components/peer/CardView.vue
index a73ea567..78c17c67 100644
--- a/admin/slices/agent/peer/components/peer/CardView.vue
+++ b/admin/slices/agent/peer/components/peer/CardView.vue
@@ -52,12 +52,12 @@ function skillTag(tags: string[]): string | null {
           </Badge>
         </li>
       </ul>
-      <!-- A skill-less agent is a valid peer; saying so beats an empty box,
-           because "nothing advertised" is exactly what a caller needs to know
-           before wondering why it is never chosen. -->
+      <!-- A skill-less agent is a valid peer; saying so beats an empty box.
+           Just the fact here — the surfaces that embed this view carry the
+           what-to-do-about-it guidance (CLEAN-95). -->
       <p v-else class="text-sm text-muted-foreground">
-        Nothing advertised. Another agent has no way to tell when to ask this
-        one — give it template skills or a knowledge base.
+        Nothing advertised — this text is all a delegating agent gets to
+        match a question against.
       </p>
     </div>
 
diff --git a/admin/slices/agent/peer/components/peer/Delegations.vue b/admin/slices/agent/peer/components/peer/Delegations.vue
index 6211f3ef..11ed97c8 100644
--- a/admin/slices/agent/peer/components/peer/Delegations.vue
+++ b/admin/slices/agent/peer/components/peer/Delegations.vue
@@ -50,7 +50,9 @@ const rows = computed(() => store.delegations(props.agentId));
 const shown = computed(() =>
   rows.value.filter(
     (d) =>
-      (!props.peerFilter || d.peerAgentId === props.peerFilter.id) &&
+      // The connection id works for both origins — external peers have no
+      // agent id in this installation (CLEAN-95).
+      (!props.peerFilter || d.peerId === props.peerFilter.id) &&
       (outcomeFilter.value === 'all' ||
         (outcomeFilter.value === 'answered'
           ? d.status === 'answered'
@@ -192,8 +194,17 @@ function toggle(id: string) {
           @click="toggle(row.id)"
         >
           <div class="flex items-center gap-2.5">
-            <Badge variant="secondary" class="flex-none">
-              {{ row.peerName }}
+            <Badge
+              variant="secondary"
+              class="flex-none"
+              :title="row.peerAgentId === null ? 'External agent' : undefined"
+            >
+              {{ row.peerName
+              }}<span
+                v-if="row.peerAgentId === null"
+                class="ml-1 text-sky-700 dark:text-sky-400"
+                >· ext</span
+              >
             </Badge>
             <span
               class="min-w-0 flex-1 text-sm"
@@ -212,7 +223,7 @@ function toggle(id: string) {
           <div
             class="mt-1.5 flex items-center gap-2.5 text-xs text-muted-foreground"
           >
-            <DateTimeAgo :date="row.startedAt" class="!items-start" />
+            <DateTimeAgoInline :date="row.startedAt" />
             <span>·</span>
             <span class="tabular-nums">{{ duration(row.durationMs) }}</span>
             <span
diff --git a/admin/slices/agent/peer/components/peer/Picker.vue b/admin/slices/agent/peer/components/peer/Picker.vue
index e18068cc..4f048a6f 100644
--- a/admin/slices/agent/peer/components/peer/Picker.vue
+++ b/admin/slices/agent/peer/components/peer/Picker.vue
@@ -7,7 +7,7 @@ import {
   DialogRoot,
   DialogTitle,
 } from 'reka-ui';
-import { IconCheck, IconSearch } from '@tabler/icons-vue';
+import { IconCheck, IconChevronDown, IconSearch } from '@tabler/icons-vue';
 import { toast } from 'vue-sonner';
 import { AGENT_STATUS_VARIANT } from '#agent/utils/agentFormat';
 import type { AgentStatusTypes } from '#agent/domain';
@@ -17,13 +17,20 @@ import {
   type IAgentPeerCandidate,
 } from '#peer/stores/peer';
 
+/* IAgentCard is also the shape previewByUrl returns — one preview, two
+ * sources (CLEAN-95). */
+
 /**
- * Pick an agent, read its card, then connect (CLEAN-74).
+ * Pick an agent, read its card, then connect (CLEAN-74, CLEAN-94).
  *
  * The preview step is the point of this component. Connecting a peer decides
  * what another agent will be told it can ask for, so the operator sees the
  * exact text first — a name alone would make "why did it pick the wrong one"
  * unanswerable later.
+ *
+ * The preview expands under the clicked row, accordion-style: at ten
+ * candidates a panel below the list sits under the fold, and a click that
+ * renders off-screen reads as a click that did nothing (CLEAN-94).
  */
 const props = defineProps<{ open: boolean; agentId: string }>();
 const emit = defineEmits<{ 'update:open': [value: boolean]; connected: [] }>();
@@ -60,12 +67,22 @@ watch(
     selected.value = null;
     preview.value = null;
     error.value = null;
+    url.value = '';
+    urlToken.value = '';
+    urlPreview.value = null;
+    urlError.value = null;
     void store.loadCandidates(props.agentId);
   },
 );
 
-async function select(candidate: IAgentPeerCandidate) {
-  if (candidate.connected) return;
+async function toggle(candidate: IAgentPeerCandidate) {
+  if (candidate.connected || connecting.value) return;
+  if (selected.value?.id === candidate.id) {
+    selected.value = null;
+    preview.value = null;
+    error.value = null;
+    return;
+  }
   selected.value = candidate;
   preview.value = null;
   error.value = null;
@@ -96,9 +113,75 @@ async function connect() {
   }
 }
 
+// ── Import an external agent by address (CLEAN-95) ──────────────
+const url = ref('');
+const urlToken = ref('');
+const urlPreview = ref<IAgentCard | null>(null);
+const urlPreviewing = ref(false);
+const urlImporting = ref(false);
+const urlError = ref<string | null>(null);
+
+// A changed address invalidates the card already shown for the old one.
+watch(url, () => {
+  urlPreview.value = null;
+  urlError.value = null;
+});
+
+async function previewUrl() {
+  if (!url.value.trim()) return;
+  urlPreviewing.value = true;
+  urlError.value = null;
+  urlPreview.value = null;
+  try {
+    urlPreview.value = await store.previewByUrl(
+      props.agentId,
+      url.value.trim(),
+      urlToken.value.trim() || undefined,
+    );
+  } catch (err) {
+    urlError.value =
+      err instanceof Error ? err.message : 'Could not read that address';
+  } finally {
+    urlPreviewing.value = false;
+  }
+}
+
+async function importUrl() {
+  if (!urlPreview.value) return;
+  urlImporting.value = true;
+  urlError.value = null;
+  try {
+    const imported = await store.importByUrl(
+      props.agentId,
+      url.value.trim(),
+      urlToken.value.trim() || undefined,
+    );
+    toast.success(`«${imported.peerName}» connected — card read`);
+    emit('connected');
+  } catch (err) {
+    urlError.value =
+      err instanceof Error ? err.message : 'Could not import that agent';
+  } finally {
+    urlImporting.value = false;
+  }
+}
+
 function statusVariant(status: string) {
   return AGENT_STATUS_VARIANT[status as AgentStatusTypes] ?? 'outline';
 }
+
+/**
+ * The moment of maximum leverage for an empty card is BEFORE Connect: the
+ * operator is looking at exactly the text the delegating model will read,
+ * and can still fix the agent first (CLEAN-95). Connecting stays allowed —
+ * sometimes the card fills up later — but never unknowingly.
+ */
+const previewAdvertisesNothing = computed(
+  () => Boolean(preview.value) && preview.value!.skills.length === 0,
+);
+const urlPreviewAdvertisesNothing = computed(
+  () => Boolean(urlPreview.value) && urlPreview.value!.skills.length === 0,
+);
 </script>
 
 <template>
@@ -114,8 +197,8 @@ function statusVariant(status: string) {
           Add peer
         </DialogTitle>
         <DialogDescription class="mt-1 text-sm text-muted-foreground">
-          Agents on this ranch this one isn't connected to yet. Connecting is
-          one-way.
+          Agents on this ranch this one isn't connected to yet. Click an agent
+          to read its card, then connect.
         </DialogDescription>
 
         <div class="mt-3.5 flex min-h-0 flex-1 flex-col gap-3.5 overflow-y-auto">
@@ -142,7 +225,7 @@ function statusVariant(status: string) {
                   selected?.id === candidate.id ? 'bg-muted/60' : '',
                 ]"
                 :disabled="candidate.connected"
-                @click="select(candidate)"
+                @click="toggle(candidate)"
               >
                 <span class="flex min-w-0 items-center gap-2">
                   <span class="truncate font-semibold">
@@ -159,7 +242,61 @@ function statusVariant(status: string) {
                   <IconCheck class="size-3.5" />
                   connected
                 </span>
+                <!-- The affordance the row was missing: says what a click
+                     does, and doubles as the open/closed indicator. -->
+                <span
+                  v-else
+                  class="flex shrink-0 items-center gap-1 rounded-full border px-2.5 py-1 text-xs font-medium text-muted-foreground"
+                >
+                  Info
+                  <IconChevronDown
+                    class="size-3.5 transition-transform"
+                    :class="selected?.id === candidate.id && 'rotate-180'"
+                  />
+                </span>
               </button>
+
+              <!-- Accordion body: the card opens right where the click
+                   happened, not below the whole list. -->
+              <div
+                v-if="selected?.id === candidate.id"
+                class="mb-3 space-y-3 rounded-xl border bg-muted/40 p-3"
+              >
+                <div v-if="previewing" class="space-y-2">
+                  <Skeleton class="h-4 w-40" />
+                  <Skeleton class="h-4 w-64" />
+                  <Skeleton class="h-6 w-52" />
+                </div>
+                <template v-else>
+                  <PeerCardView :card="preview" compact />
+                  <div
+                    v-if="previewAdvertisesNothing"
+                    class="rounded-md border border-amber-500/30 bg-amber-500/10 px-2.5 py-2 text-xs text-amber-700 dark:text-amber-500"
+                  >
+                    You can connect «{{ candidate.name }}», but with an empty
+                    card the delegating agent will only ask it when the user
+                    names it outright — topic matching has nothing to grip.
+                    Better first: give it a description (Edit on its page), a
+                    template with skills, or
+                    <NuxtLink
+                      :to="`/agents/${candidate.id}?tab=knowledge`"
+                      class="font-medium underline"
+                      >bind it a knowledge base</NuxtLink
+                    >, then Re-read the card here.
+                  </div>
+                  <Button
+                    size="sm"
+                    class="rounded-full"
+                    :disabled="connecting || !preview"
+                    @click="connect"
+                  >
+                    {{
+                      connecting ? 'Connecting…' : `Connect «${candidate.name}»`
+                    }}
+                  </Button>
+                </template>
+                <p v-if="error" class="text-sm text-destructive">{{ error }}</p>
+              </div>
             </li>
           </ul>
 
@@ -170,26 +307,68 @@ function statusVariant(status: string) {
             No unconnected agents left on this ranch.
           </p>
 
-          <div v-if="selected" class="space-y-3 rounded-xl border bg-muted/40 p-3">
-            <div v-if="previewing" class="space-y-2">
-              <Skeleton class="h-4 w-40" />
-              <Skeleton class="h-4 w-64" />
-              <Skeleton class="h-6 w-52" />
+          <!-- ═══ Import by URL (CLEAN-95) ═══ -->
+          <div class="border-t pt-3.5">
+            <p class="text-sm font-semibold">Import an external agent</p>
+            <p class="mt-0.5 text-xs text-muted-foreground">
+              Any A2A 1.0 agent outside this ranch, by its address. Importing
+              the same address again updates the entry — no duplicates.
+            </p>
+            <div class="mt-2.5 space-y-2">
+              <Input
+                v-model="url"
+                placeholder="https://other.ranch/a2a/agents/agent-…"
+                class="font-mono text-xs"
+              />
+              <Input
+                v-model="urlToken"
+                type="password"
+                placeholder="Access credential (optional)"
+                class="text-xs"
+              />
+              <Button
+                size="sm"
+                variant="outline"
+                class="rounded-full"
+                :disabled="urlPreviewing || !url.trim()"
+                @click="previewUrl"
+              >
+                {{ urlPreviewing ? 'Reading…' : 'Read card' }}
+              </Button>
             </div>
-            <template v-else>
-              <PeerCardView :card="preview" compact />
+
+            <div
+              v-if="urlPreview"
+              class="mt-2.5 space-y-3 rounded-xl border bg-muted/40 p-3"
+            >
+              <PeerCardView :card="urlPreview" compact />
+              <div
+                v-if="urlPreviewAdvertisesNothing"
+                class="rounded-md border border-amber-500/30 bg-amber-500/10 px-2.5 py-2 text-xs text-amber-700 dark:text-amber-500"
+              >
+                This card advertises nothing, so the delegating agent will
+                only ask «{{ urlPreview.name }}» when the user names it
+                outright. Ask its owner to publish a description and skills,
+                then Re-read the card here.
+              </div>
               <Button
                 size="sm"
                 class="rounded-full"
-                :disabled="connecting || !preview"
-                @click="connect"
+                :disabled="urlImporting"
+                @click="importUrl"
               >
-                {{ connecting ? 'Connecting…' : `Connect «${selected.name}»` }}
+                {{
+                  urlImporting
+                    ? 'Connecting…'
+                    : `Connect «${urlPreview.name}»`
+                }}
               </Button>
-            </template>
-          </div>
+            </div>
 
-          <p v-if="error" class="text-sm text-destructive">{{ error }}</p>
+            <p v-if="urlError" class="mt-2 text-sm text-destructive">
+              {{ urlError }}
+            </p>
+          </div>
         </div>
 
         <div class="mt-3.5 flex justify-end">
diff --git a/admin/slices/agent/peer/components/peer/Row.vue b/admin/slices/agent/peer/components/peer/Row.vue
index f3ce52ba..e9553605 100644
--- a/admin/slices/agent/peer/components/peer/Row.vue
+++ b/admin/slices/agent/peer/components/peer/Row.vue
@@ -40,7 +40,35 @@ type StatusMeta = {
   border: string;
 };
 
+const stale = computed(
+  () =>
+    Date.now() - new Date(props.peer.cardReadAt).getTime() > STALE_AFTER_MS,
+);
+
+const STALE_META: StatusMeta = {
+  label: 'stale card',
+  dot: 'bg-amber-500',
+  pulse: false,
+  badge:
+    'border-transparent bg-amber-500/15 text-amber-700 dark:text-amber-500',
+  border: '',
+};
+
 const meta = computed<StatusMeta>(() => {
+  // An imported foreign agent has no live pod status here; the origin is the
+  // status, and only card staleness can degrade it (CLEAN-95).
+  if (props.peer.origin === 'external') {
+    if (stale.value) return STALE_META;
+    return {
+      label: 'external',
+      dot: 'bg-sky-500',
+      pulse: false,
+      badge:
+        'border-transparent bg-sky-500/15 text-sky-700 dark:text-sky-400',
+      border: '',
+    };
+  }
+
   const bad = {
     dot: 'bg-destructive',
     badge:
@@ -55,16 +83,7 @@ const meta = computed<StatusMeta>(() => {
       label: props.peer.peerStatus,
       pulse: props.peer.peerStatus === 'failed',
     };
-  const age = Date.now() - new Date(props.peer.cardReadAt).getTime();
-  if (age > STALE_AFTER_MS)
-    return {
-      label: 'stale card',
-      dot: 'bg-amber-500',
-      pulse: false,
-      badge:
-        'border-transparent bg-amber-500/15 text-amber-700 dark:text-amber-500',
-      border: '',
-    };
+  if (stale.value) return STALE_META;
   return {
     label: 'online',
     dot: 'bg-emerald-500',
@@ -76,6 +95,7 @@ const meta = computed<StatusMeta>(() => {
 });
 
 const failReason = computed<string | null>(() => {
+  if (props.peer.origin === 'external') return null;
   if (!props.peer.peerExists)
     return (
       'This agent no longer exists on this ranch. Delegations to it fail — ' +
@@ -107,11 +127,15 @@ const failReason = computed<string | null>(() => {
           :class="[meta.dot, meta.pulse && 'animate-pulse']"
         />
         <NuxtLink
+          v-if="peer.peerAgentId"
           :to="`/agents/${peer.peerAgentId}`"
           class="text-sm font-bold hover:underline"
         >
           {{ peer.peerName }}
         </NuxtLink>
+        <span v-else class="text-sm font-bold" :title="peer.cardUrl">
+          {{ peer.peerName }}
+        </span>
         <Badge variant="outline" :class="meta.badge">{{ meta.label }}</Badge>
         <span class="text-xs text-muted-foreground">
           {{ taskCount }} {{ taskCount === 1 ? 'task' : 'tasks' }}
@@ -180,14 +204,27 @@ const failReason = computed<string | null>(() => {
           </Badge>
           <Badge v-if="overflow" variant="outline">+{{ overflow }}</Badge>
         </template>
-        <span v-else class="text-xs text-muted-foreground">
-          Advertises nothing — this agent has no way to tell when to ask it.
-        </span>
+        <!-- Consequence + the way to fix it, not just the fact (CLEAN-95).
+             An empty card means delegation only reaches this peer by name. -->
         <span
-          class="ml-auto flex items-center gap-1 text-xs text-muted-foreground"
+          v-else
+          class="text-xs text-amber-700 dark:text-amber-500"
         >
-          card read
-          <DateTimeAgo :date="peer.cardReadAt" class="!items-start" />
+          Advertises nothing — reachable by name only, never by topic.
+          <template v-if="peer.peerAgentId">
+            Give it a description or
+            <NuxtLink
+              :to="`/agents/${peer.peerAgentId}?tab=knowledge`"
+              class="font-medium underline"
+              >a knowledge base</NuxtLink
+            >, then Re-read.
+          </template>
+          <template v-else>
+            Ask its owner to publish a description and skills, then Re-read.
+          </template>
+        </span>
+        <span class="ml-auto whitespace-nowrap text-xs text-muted-foreground">
+          card read <DateTimeAgoInline :date="peer.cardReadAt" />
         </span>
       </div>
     </div>
diff --git a/admin/slices/agent/peer/components/peer/Tab.vue b/admin/slices/agent/peer/components/peer/Tab.vue
index 9c3edb14..9327715a 100644
--- a/admin/slices/agent/peer/components/peer/Tab.vue
+++ b/admin/slices/agent/peer/components/peer/Tab.vue
@@ -33,6 +33,12 @@ const delegations = computed(() => store.delegations(props.agent.id));
 const pendingRestart = computed(() =>
   agentStore.isPendingRestart(props.agent.id),
 );
+const peersState = computed(() => store.peersState(props.agent.id));
+/** null while unknown — the chip only renders on a definite answer. */
+const armed = computed(() =>
+  peers.value.length && peersState.value ? peersState.value.armed : null,
+);
+const restarting = ref(false);
 
 const address = computed(
   () => ownCard.value?.supportedInterfaces?.[0]?.url ?? null,
@@ -46,9 +52,10 @@ const needAttention = computed(
       .length,
 );
 
+// The connection id is the stable per-peer key for both origins — external
+// peers have no agent id here (CLEAN-95).
 function taskCount(peer: IAgentPeer): number {
-  return delegations.value.filter((d) => d.peerAgentId === peer.peerAgentId)
-    .length;
+  return delegations.value.filter((d) => d.peerId === peer.id).length;
 }
 
 /**
@@ -83,8 +90,33 @@ const warnings = computed<Record<string, string>>(() => {
 onMounted(() => {
   void store.load(props.agent.id);
   void store.loadDelegations(props.agent.id);
+  void store.loadState(props.agent.id);
 });
 
+// The pod re-reads its tool list at boot, so a completed restart is the
+// moment the armed indicator can flip — re-read it then.
+watch(
+  () => props.agent.status,
+  (status, prev) => {
+    if (status === 'running' && prev !== 'running') {
+      void store.loadState(props.agent.id);
+    }
+  },
+);
+
+async function restartNow() {
+  restarting.value = true;
+  try {
+    await agentStore.restart(props.agent.id);
+  } catch (err) {
+    toast.error(
+      err instanceof Error ? err.message : 'Could not restart the agent',
+    );
+  } finally {
+    restarting.value = false;
+  }
+}
+
 let copiedTimer: ReturnType<typeof setTimeout> | undefined;
 onUnmounted(() => clearTimeout(copiedTimer));
 
@@ -102,9 +134,9 @@ async function copyAddress() {
 
 function toggleFilter(peer: IAgentPeer) {
   peerFilter.value =
-    peerFilter.value?.id === peer.peerAgentId
+    peerFilter.value?.id === peer.id
       ? null
-      : { id: peer.peerAgentId, name: peer.peerName };
+      : { id: peer.id, name: peer.peerName };
 }
 
 async function refresh(peer: IAgentPeer) {
@@ -128,7 +160,7 @@ async function confirmRemoval() {
   actionError.value = null;
   try {
     await store.remove(props.agent.id, peer.id);
-    if (peerFilter.value?.id === peer.peerAgentId) peerFilter.value = null;
+    if (peerFilter.value?.id === peer.id) peerFilter.value = null;
     confirmingRemoval.value = null;
     toast.success(`«${peer.peerName}» disconnected`);
   } catch (err) {
@@ -142,6 +174,13 @@ async function confirmRemoval() {
 function onConnected() {
   adding.value = false;
 }
+
+// Tab state lives in `?tab=` (useAgentTab), so any component under the page
+// can send the operator to the fix — here: bind a knowledge base.
+const { setTab } = useAgentTab();
+function goToKnowledge() {
+  setTab('knowledge');
+}
 </script>
 
 <template>
@@ -169,13 +208,39 @@ function onConnected() {
           <p v-if="ownCard.description" class="text-sm">
             {{ ownCard.description }}
           </p>
+          <!-- Not just a warning: the operator's next question is always
+               "so where do I fix it?" — answer it in place (CLEAN-95). -->
           <div
             v-if="nothingAdvertised"
-            class="inline-flex items-center gap-2 rounded-lg border border-destructive/30 bg-destructive/10 px-3 py-2 text-sm text-destructive"
+            class="max-w-xl space-y-2 rounded-lg border border-amber-500/30 bg-amber-500/10 px-3 py-2.5"
           >
-            <span class="size-1.5 flex-none rounded-full bg-destructive" />
-            Card advertises nothing — give it skills or a knowledge base so
-            peers know when to ask
+            <p class="text-sm font-medium text-amber-700 dark:text-amber-500">
+              This card advertises nothing yet
+            </p>
+            <p class="text-sm text-amber-700/90 dark:text-amber-500/90">
+              A delegating agent matches questions against this exact text.
+              Empty card = it will only ask this agent when the user names it
+              outright — never by topic. The card fills itself from:
+            </p>
+            <ul class="list-disc space-y-0.5 pl-5 text-sm text-amber-700/90 dark:text-amber-500/90">
+              <li>
+                <b>Description</b> — the agent's description field
+                (<b>Edit</b>, top right of this page)
+              </li>
+              <li><b>Skills</b> — the skills of its template</li>
+              <li>
+                <b>Knowledge</b> — every bound knowledge base becomes a
+                "can answer about …" skill
+              </li>
+            </ul>
+            <Button
+              size="sm"
+              variant="outline"
+              class="rounded-full"
+              @click="goToKnowledge"
+            >
+              Bind a knowledge base
+            </Button>
           </div>
           <ul v-else class="flex flex-wrap gap-1.5">
             <li v-for="skill in ownCard.skills" :key="skill.id">
@@ -211,15 +276,25 @@ function onConnected() {
       </div>
     </div>
 
-    <!-- A pod reads its tool list once, at boot. Without this line an
+    <!-- A pod reads its tool list once, at boot. Without this banner an
          operator connects a peer, asks a question, gets nothing, and has
-         no way to know why. -->
-    <p
-      v-if="pendingRestart"
-      class="rounded-lg border border-amber-500/30 bg-amber-500/10 px-3 py-2 text-sm text-amber-600 dark:text-amber-500"
+         no way to know why. The button is the one click that arms it. -->
+    <div
+      v-if="pendingRestart || armed === false"
+      class="flex flex-wrap items-center justify-between gap-3 rounded-lg border border-amber-500/30 bg-amber-500/10 px-3 py-2"
     >
-      Restart the agent to apply: it reads the list of peers when it starts.
-    </p>
+      <p class="text-sm text-amber-600 dark:text-amber-500">
+        Restart the agent to apply: it reads the list of peers when it starts.
+      </p>
+      <Button
+        size="sm"
+        class="h-7 flex-none rounded-full"
+        :disabled="restarting"
+        @click="restartNow"
+      >
+        {{ restarting ? 'Restarting…' : 'Restart now' }}
+      </Button>
+    </div>
 
     <Separator />
 
@@ -228,7 +303,28 @@ function onConnected() {
       <section>
         <div class="mb-3.5 flex items-baseline justify-between gap-3">
           <div>
-            <h3 class="font-semibold tracking-tight">Peer network</h3>
+            <div class="flex items-center gap-2">
+              <h3 class="font-semibold tracking-tight">Peer network</h3>
+              <!-- Whether the RUNNING pod actually holds this peer set — the
+                   difference between "connected on screen" and "the agent can
+                   ask" (CLEAN-95). -->
+              <Badge
+                v-if="armed !== null"
+                variant="outline"
+                :class="
+                  armed
+                    ? 'border-transparent bg-emerald-500/15 text-emerald-700 dark:text-emerald-500'
+                    : 'border-transparent bg-amber-500/15 text-amber-700 dark:text-amber-500'
+                "
+                :title="
+                  peersState?.servedAt
+                    ? `Peer list last loaded ${formatDateTime(peersState.servedAt)}`
+                    : 'The running agent has not loaded any peer list yet'
+                "
+              >
+                {{ armed ? 'armed' : 'pending restart' }}
+              </Badge>
+            </div>
             <p class="mt-0.5 text-xs text-muted-foreground">
               One-way: {{ agent.name }} delegates → peers. They can't ask back.
             </p>
@@ -267,7 +363,7 @@ function onConnected() {
             :busy="busyPeerId === peer.id"
             :warning="warnings[peer.id] ?? null"
             :task-count="taskCount(peer)"
-            :selected="peerFilter?.id === peer.peerAgentId"
+            :selected="peerFilter?.id === peer.id"
             @refresh="refresh(peer)"
             @remove="confirmingRemoval = peer"
             @select="toggleFilter(peer)"
diff --git a/admin/slices/agent/peer/data/peer.gateway.ts b/admin/slices/agent/peer/data/peer.gateway.ts
index a359ccce..c85e36df 100644
--- a/admin/slices/agent/peer/data/peer.gateway.ts
+++ b/admin/slices/agent/peer/data/peer.gateway.ts
@@ -12,6 +12,7 @@ import type {
   IAgentDelegation,
   IAgentPeer,
   IAgentPeerCandidate,
+  IPeersState,
 } from '../domain/peer.types';
 
 interface HeyApiResult {
@@ -88,6 +89,50 @@ export class PeerGateway extends BaseGateway {
     });
   }
 
+  /** Import an external A2A agent by address (CLEAN-95). Re-importing the
+   *  same address updates the stored entry instead of duplicating it. */
+  importByUrl(
+    agentId: string,
+    url: string,
+    token?: string,
+  ): Promise<IAgentPeer> {
+    return this.execute(async () => {
+      const res = await PeersService.connectAgentPeer({
+        path: { agentId },
+        body: { url, ...(token !== undefined ? { token } : {}) },
+      });
+      return unwrapOrThrow(res, 'Importing the agent') as IAgentPeer;
+    });
+  }
+
+  /** Read an external card without saving anything — the preview an
+   *  operator reviews before Connect (CLEAN-95). */
+  previewByUrl(
+    agentId: string,
+    url: string,
+    token?: string,
+  ): Promise<IAgentCard | null> {
+    return this.execute(async () => {
+      const res = await PeersService.previewAgentPeerUrl({
+        path: { agentId },
+        body: { url, ...(token !== undefined ? { token } : {}) },
+      });
+      return ((unwrapOrThrow(res, 'Reading the card') as AgentCardDto) ??
+        null) as IAgentCard | null;
+    });
+  }
+
+  /** Whether the running pod has loaded the current peer set (CLEAN-95). */
+  peersState(agentId: string): Promise<IPeersState> {
+    return this.execute(async () => {
+      const res = await PeersService.getAgentPeersState({ path: { agentId } });
+      return (unwrapOrThrow(res, 'Reading the peer state') ?? {
+        armed: false,
+        servedAt: null,
+      }) as IPeersState;
+    });
+  }
+
   refresh(agentId: string, peerId: string): Promise<IAgentPeer> {
     return this.execute(async () => {
       const res = await PeersService.refreshAgentPeer({
diff --git a/admin/slices/agent/peer/domain/peer.service.ts b/admin/slices/agent/peer/domain/peer.service.ts
index f4332cc9..54a49777 100644
--- a/admin/slices/agent/peer/domain/peer.service.ts
+++ b/admin/slices/agent/peer/domain/peer.service.ts
@@ -4,6 +4,7 @@ import type {
   IAgentDelegation,
   IAgentPeer,
   IAgentPeerCandidate,
+  IPeersState,
 } from './peer.types';
 
 /** Pass-through to the gateway, in the slice shape the console uses everywhere. */
@@ -26,6 +27,26 @@ export class PeerService {
     return this.gateway.connect(agentId, peerAgentId);
   }
 
+  importByUrl(
+    agentId: string,
+    url: string,
+    token?: string,
+  ): Promise<IAgentPeer> {
+    return this.gateway.importByUrl(agentId, url, token);
+  }
+
+  previewByUrl(
+    agentId: string,
+    url: string,
+    token?: string,
+  ): Promise<IAgentCard | null> {
+    return this.gateway.previewByUrl(agentId, url, token);
+  }
+
+  peersState(agentId: string): Promise<IPeersState> {
+    return this.gateway.peersState(agentId);
+  }
+
   refresh(agentId: string, peerId: string): Promise<IAgentPeer> {
     return this.gateway.refresh(agentId, peerId);
   }
diff --git a/admin/slices/agent/peer/domain/peer.types.ts b/admin/slices/agent/peer/domain/peer.types.ts
index 2b9b4065..cfe66292 100644
--- a/admin/slices/agent/peer/domain/peer.types.ts
+++ b/admin/slices/agent/peer/domain/peer.types.ts
@@ -27,12 +27,16 @@ export interface IAgentCard {
   skills: IAgentSkill[];
 }
 
-/** One directed connection: this agent may delegate to `peerAgentId`. */
+/** One directed connection: this agent may delegate to the peer. */
 export interface IAgentPeer {
   id: string;
   agentId: string;
-  peerAgentId: string;
+  /** Null for external peers — they have no agent id here (CLEAN-95). */
+  peerAgentId: string | null;
+  /** 'internal' | 'external' — imported by URL vs an agent of this ranch. */
+  origin: 'internal' | 'external';
   peerName: string;
+  /** External rows carry 'external' — no live pod status is knowable. */
   peerStatus: string;
   peerExists: boolean;
   /** Read at connect time or last refresh — never live. */
@@ -42,6 +46,12 @@ export interface IAgentPeer {
   createdAt: string;
 }
 
+/** Whether the running pod has loaded the current peer set (CLEAN-95). */
+export interface IPeersState {
+  armed: boolean;
+  servedAt: string | null;
+}
+
 export interface IAgentPeerCandidate {
   id: string;
   name: string;
@@ -51,7 +61,10 @@ export interface IAgentPeerCandidate {
 
 export interface IAgentDelegation {
   id: string;
-  peerAgentId: string;
+  /** The connection the task went through; null once it was removed. */
+  peerId: string | null;
+  /** Null for delegations to external peers (CLEAN-95). */
+  peerAgentId: string | null;
   peerName: string;
   task: string;
   reason: string;
diff --git a/admin/slices/agent/peer/stores/peer.ts b/admin/slices/agent/peer/stores/peer.ts
index 9e1306fc..c8e037fa 100644
--- a/admin/slices/agent/peer/stores/peer.ts
+++ b/admin/slices/agent/peer/stores/peer.ts
@@ -6,6 +6,7 @@ import type {
   IAgentDelegation,
   IAgentPeer,
   IAgentPeerCandidate,
+  IPeersState,
 } from '#peer/domain';
 
 export type {
@@ -14,6 +15,7 @@ export type {
   IAgentPeer,
   IAgentPeerCandidate,
   IAgentSkill,
+  IPeersState,
 } from '#peer/domain';
 
 const getService = createServiceGetter<PeerService>('$peerService');
@@ -34,6 +36,7 @@ export const usePeerStore = defineStore('peer', () => {
   const cardByAgent = ref<Record<string, IAgentCard | null>>({});
   const candidatesByAgent = ref<Record<string, IAgentPeerCandidate[]>>({});
   const delegationsByAgent = ref<Record<string, IAgentDelegation[]>>({});
+  const stateByAgent = ref<Record<string, IPeersState | null>>({});
 
   const loading = ref(false);
   const error = ref<string | null>(null);
@@ -54,6 +57,21 @@ export const usePeerStore = defineStore('peer', () => {
     return delegationsByAgent.value[agentId] ?? [];
   }
 
+  function peersState(agentId: string): IPeersState | null {
+    return stateByAgent.value[agentId] ?? null;
+  }
+
+  /** Armed/pending indicator (CLEAN-95). Silent failure: the indicator must
+   *  never take the tab down with it. */
+  async function loadState(agentId: string): Promise<void> {
+    try {
+      const state = await getService().peersState(agentId);
+      stateByAgent.value = { ...stateByAgent.value, [agentId]: state };
+    } catch {
+      stateByAgent.value = { ...stateByAgent.value, [agentId]: null };
+    }
+  }
+
   function fail(err: unknown, fallback: string): never {
     error.value = err instanceof Error ? err.message : fallback;
     throw err;
@@ -92,6 +110,15 @@ export const usePeerStore = defineStore('peer', () => {
     return getService().card(peerAgentId);
   }
 
+  /** Same review step for an external address (CLEAN-95): read, never save. */
+  function previewByUrl(
+    agentId: string,
+    url: string,
+    token?: string,
+  ): Promise<IAgentCard | null> {
+    return getService().previewByUrl(agentId, url, token);
+  }
+
   async function connect(agentId: string, peerAgentId: string): Promise<void> {
     const created = await getService().connect(agentId, peerAgentId);
     peersByAgent.value = {
@@ -100,6 +127,28 @@ export const usePeerStore = defineStore('peer', () => {
     };
     markConnected(agentId, peerAgentId, true);
     useAgentStore().markPendingRestart(agentId);
+    void loadState(agentId);
+  }
+
+  /** Import an external agent by address (CLEAN-95). A re-import of a known
+   *  address comes back as the same row id — replaced in place, no dupes. */
+  async function importByUrl(
+    agentId: string,
+    url: string,
+    token?: string,
+  ): Promise<IAgentPeer> {
+    const imported = await getService().importByUrl(agentId, url, token);
+    const current = peers(agentId);
+    const known = current.some((p) => p.id === imported.id);
+    peersByAgent.value = {
+      ...peersByAgent.value,
+      [agentId]: known
+        ? current.map((p) => (p.id === imported.id ? imported : p))
+        : [...current, imported],
+    };
+    useAgentStore().markPendingRestart(agentId);
+    void loadState(agentId);
+    return imported;
   }
 
   async function refresh(agentId: string, peerId: string): Promise<void> {
@@ -120,8 +169,11 @@ export const usePeerStore = defineStore('peer', () => {
       ...peersByAgent.value,
       [agentId]: peers(agentId).filter((p) => p.id !== peerId),
     };
-    if (removed) markConnected(agentId, removed.peerAgentId, false);
+    if (removed?.peerAgentId) {
+      markConnected(agentId, removed.peerAgentId, false);
+    }
     useAgentStore().markPendingRestart(agentId);
+    void loadState(agentId);
   }
 
   async function loadDelegations(agentId: string, limit = 20): Promise<void> {
@@ -161,16 +213,21 @@ export const usePeerStore = defineStore('peer', () => {
     cardByAgent,
     candidatesByAgent,
     delegationsByAgent,
+    stateByAgent,
     loading,
     error,
     peers,
     card,
     candidates,
     delegations,
+    peersState,
     load,
     loadCandidates,
+    loadState,
     previewCard,
+    previewByUrl,
     connect,
+    importByUrl,
     refresh,
     remove,
     loadDelegations,
diff --git a/admin/slices/common/components/date/TimeAgoInline.vue b/admin/slices/common/components/date/TimeAgoInline.vue
new file mode 100644
index 00000000..0b142675
--- /dev/null
+++ b/admin/slices/common/components/date/TimeAgoInline.vue
@@ -0,0 +1,19 @@
+<script lang="ts" setup>
+import { useTimeAgoIntl } from '@vueuse/core';
+
+/**
+ * One-line relative time for inline meta ("card read 5 minutes ago") where
+ * the two-line DateTimeAgo would wrap. The absolute date lives in the title
+ * tooltip. Same Intl source as DateTimeAgo, so the wording matches.
+ */
+const { date } = defineProps<{ date: string }>();
+const { locale } = useI18n();
+// Getter (not a plain Date) so it re-evaluates if `date` changes.
+const timeAgo = useTimeAgoIntl(() => new Date(date || Date.now()), {
+    locale: locale.value,
+});
+</script>
+<template>
+    <span v-if="date" :title="formatDateTime(date)">{{ timeAgo }}</span>
+    <span v-else>—</span>
+</template>
diff --git a/admin/slices/setup/api/data/repositories/api/schemas.gen.ts b/admin/slices/setup/api/data/repositories/api/schemas.gen.ts
index f1295efe..dd472f65 100644
--- a/admin/slices/setup/api/data/repositories/api/schemas.gen.ts
+++ b/admin/slices/setup/api/data/repositories/api/schemas.gen.ts
@@ -3172,7 +3172,16 @@ export const AgentPeerDtoSchema = {
     },
     peerAgentId: {
       type: "string",
-      description: "The agent whose card is held (the peer).",
+      description:
+        "The agent whose card is held (the peer), or null when the peer was imported from outside this installation.",
+      nullable: true,
+    },
+    origin: {
+      type: "string",
+      description:
+        "Where this connection points: 'internal' (another agent of this installation) or 'external' (imported by card URL, CLEAN-95).",
+      enum: ["internal", "external"],
+      example: "internal",
     },
     peerName: {
       type: "string",
@@ -3223,6 +3232,7 @@ export const AgentPeerDtoSchema = {
     "id",
     "agentId",
     "peerAgentId",
+    "origin",
     "peerName",
     "peerStatus",
     "peerExists",
@@ -3264,11 +3274,60 @@ export const ConnectPeerDtoSchema = {
     peerAgentId: {
       type: "string",
       description:
-        "The agent to connect. Must be another agent of this installation: foreign card URLs are not accepted in this feature, and an agent cannot be its own peer. Format: `agent-<uuid>`.",
+        "An agent of this installation to connect. Format: `agent-<uuid>`. Mutually exclusive with `url`.",
       example: "agent-3f2504e0-4f89-11d3-9a0c-0305e82c3301",
     },
+    url: {
+      type: "string",
+      description:
+        "A2A address of an agent outside this installation — the agent base URL or its `…/.well-known/agent-card.json` form. Importing an address that is already connected updates that entry in place. Mutually exclusive with `peerAgentId`.",
+      example: "https://other.example/a2a/agents/agent-1a2b…",
+    },
+    token: {
+      type: "string",
+      description:
+        "Bearer credential the external agent expects, when it needs one. Stored write-only — no response ever returns it. On re-import: omitted keeps the stored credential, empty string clears it.",
+    },
   },
-  required: ["peerAgentId"],
+} as const;
+
+export const PreviewPeerUrlDtoSchema = {
+  type: "object",
+  properties: {
+    url: {
+      type: "string",
+      description:
+        "A2A address of the agent to preview — base URL or its well-known card form.",
+      example: "https://other.example/a2a/agents/agent-1a2b…",
+    },
+    token: {
+      type: "string",
+      description:
+        "Bearer credential for the card read, when the agent needs one. Used for this read only; nothing is stored.",
+    },
+  },
+  required: ["url"],
+} as const;
+
+export const PeersStateDtoSchema = {
+  type: "object",
+  properties: {
+    armed: {
+      type: "boolean",
+      description:
+        "True when the running pod's last-served peer set matches the current one — delegation is armed.",
+      example: true,
+    },
+    servedAt: {
+      type: "string",
+      description:
+        "When the pod last received the peer list over MCP; null if never (agent not restarted since its first peer was connected).",
+      format: "date-time",
+      nullable: true,
+      example: "2026-09-16T12:00:00.000Z",
+    },
+  },
+  required: ["armed", "servedAt"],
 } as const;
 
 export const AgentDelegationDtoSchema = {
@@ -3277,9 +3336,17 @@ export const AgentDelegationDtoSchema = {
     id: {
       type: "string",
     },
+    peerId: {
+      type: "string",
+      description:
+        "The connection the task went through — the stable per-peer key for both origins; null once that connection was removed (CLEAN-95).",
+      nullable: true,
+    },
     peerAgentId: {
       type: "string",
-      description: "The peer that was asked.",
+      description:
+        "The peer agent that was asked, or null when the peer is external to this installation (CLEAN-95).",
+      nullable: true,
     },
     peerName: {
       type: "string",
@@ -3334,6 +3401,7 @@ export const AgentDelegationDtoSchema = {
   },
   required: [
     "id",
+    "peerId",
     "peerAgentId",
     "peerName",
     "task",
diff --git a/admin/slices/setup/api/data/repositories/api/sdk.gen.ts b/admin/slices/setup/api/data/repositories/api/sdk.gen.ts
index 6096670b..4eba3d9d 100644
--- a/admin/slices/setup/api/data/repositories/api/sdk.gen.ts
+++ b/admin/slices/setup/api/data/repositories/api/sdk.gen.ts
@@ -220,6 +220,10 @@ import type {
   ConnectAgentPeerResponse,
   ListAgentPeerCandidatesData,
   ListAgentPeerCandidatesResponse,
+  PreviewAgentPeerUrlData,
+  PreviewAgentPeerUrlResponse,
+  GetAgentPeersStateData,
+  GetAgentPeersStateResponse,
   RefreshAgentPeerData,
   RefreshAgentPeerResponse,
   RemoveAgentPeerData,
@@ -2978,7 +2982,7 @@ export class PeersService {
   }
 
   /**
-   * Connect another agent as a peer: mints a credential for this pair, reads the peer card with it, and stores the snapshot. Nothing is kept if the card cannot be read, so a saved connection always works. The agent picks the tool up on its next restart.
+   * Connect a peer. Either `peerAgentId` (another agent of this installation — mints a pair credential and reads the card with it) or `url` (an external A2A agent imported by address, optionally with a credential; re-importing the same address updates the entry in place). Nothing is kept if the card cannot be read. The agent picks the tool up on its next restart.
    */
   public static connectAgentPeer<ThrowOnError extends boolean = false>(
     options: Options<ConnectAgentPeerData, ThrowOnError>,
@@ -3013,6 +3017,42 @@ export class PeersService {
     });
   }
 
+  /**
+   * Read an external agent's card without saving anything — the preview an operator reviews before Connect. The same validation the import runs: canonical address, protocol version, own-installation refusal.
+   */
+  public static previewAgentPeerUrl<ThrowOnError extends boolean = false>(
+    options: Options<PreviewAgentPeerUrlData, ThrowOnError>,
+  ) {
+    return (options.client ?? _heyApiClient).post<
+      PreviewAgentPeerUrlResponse,
+      unknown,
+      ThrowOnError
+    >({
+      url: "/agents/{agentId}/peers/preview",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers,
+      },
+    });
+  }
+
+  /**
+   * Whether the running pod has loaded the current peer set. A pod reads its tool list once at boot, so connecting or removing a peer leaves this false ("pending restart") until the agent comes back up.
+   */
+  public static getAgentPeersState<ThrowOnError extends boolean = false>(
+    options: Options<GetAgentPeersStateData, ThrowOnError>,
+  ) {
+    return (options.client ?? _heyApiClient).get<
+      GetAgentPeersStateResponse,
+      unknown,
+      ThrowOnError
+    >({
+      url: "/agents/{agentId}/peers/state",
+      ...options,
+    });
+  }
+
   /**
    * Re-read the peer's card and replace the stored snapshot. A failed read keeps the old snapshot: stale is better than nothing.
    */
diff --git a/admin/slices/setup/api/data/repositories/api/types.gen.ts b/admin/slices/setup/api/data/repositories/api/types.gen.ts
index 6f24e8e6..38a7ef3b 100644
--- a/admin/slices/setup/api/data/repositories/api/types.gen.ts
+++ b/admin/slices/setup/api/data/repositories/api/types.gen.ts
@@ -1445,9 +1445,13 @@ export type AgentPeerDto = {
    */
   agentId: string;
   /**
-   * The agent whose card is held (the peer).
+   * The agent whose card is held (the peer), or null when the peer was imported from outside this installation.
    */
-  peerAgentId: string;
+  peerAgentId: string | null;
+  /**
+   * Where this connection points: 'internal' (another agent of this installation) or 'external' (imported by card URL, CLEAN-95).
+   */
+  origin: "internal" | "external";
   /**
    * The peer's current name. Falls back to the name on the stored card when the agent itself is gone.
    */
@@ -1490,17 +1494,51 @@ export type AgentPeerCandidateDto = {
 
 export type ConnectPeerDto = {
   /**
-   * The agent to connect. Must be another agent of this installation: foreign card URLs are not accepted in this feature, and an agent cannot be its own peer. Format: `agent-<uuid>`.
+   * An agent of this installation to connect. Format: `agent-<uuid>`. Mutually exclusive with `url`.
    */
-  peerAgentId: string;
+  peerAgentId?: string;
+  /**
+   * A2A address of an agent outside this installation — the agent base URL or its `…/.well-known/agent-card.json` form. Importing an address that is already connected updates that entry in place. Mutually exclusive with `peerAgentId`.
+   */
+  url?: string;
+  /**
+   * Bearer credential the external agent expects, when it needs one. Stored write-only — no response ever returns it. On re-import: omitted keeps the stored credential, empty string clears it.
+   */
+  token?: string;
+};
+
+export type PreviewPeerUrlDto = {
+  /**
+   * A2A address of the agent to preview — base URL or its well-known card form.
+   */
+  url: string;
+  /**
+   * Bearer credential for the card read, when the agent needs one. Used for this read only; nothing is stored.
+   */
+  token?: string;
+};
+
+export type PeersStateDto = {
+  /**
+   * True when the running pod's last-served peer set matches the current one — delegation is armed.
+   */
+  armed: boolean;
+  /**
+   * When the pod last received the peer list over MCP; null if never (agent not restarted since its first peer was connected).
+   */
+  servedAt: string | null;
 };
 
 export type AgentDelegationDto = {
   id: string;
   /**
-   * The peer that was asked.
+   * The connection the task went through — the stable per-peer key for both origins; null once that connection was removed (CLEAN-95).
+   */
+  peerId: string | null;
+  /**
+   * The peer agent that was asked, or null when the peer is external to this installation (CLEAN-95).
    */
-  peerAgentId: string;
+  peerAgentId: string | null;
   peerName: string;
   /**
    * The self-contained task the peer received.
@@ -4471,6 +4509,64 @@ export type ListAgentPeerCandidatesResponses = {
 export type ListAgentPeerCandidatesResponse =
   ListAgentPeerCandidatesResponses[keyof ListAgentPeerCandidatesResponses];
 
+export type PreviewAgentPeerUrlData = {
+  body: PreviewPeerUrlDto;
+  path: {
+    agentId: string;
+  };
+  query?: never;
+  url: "/agents/{agentId}/peers/preview";
+};
+
+export type PreviewAgentPeerUrlErrors = {
+  /**
+   * Missing, malformed or expired console bearer token.
+   */
+  401: unknown;
+  /**
+   * No agent or connection with this id.
+   */
+  404: unknown;
+  /**
+   * The address could not be reached; nothing was saved.
+   */
+  502: unknown;
+};
+
+export type PreviewAgentPeerUrlResponses = {
+  200: AgentCardDto;
+};
+
+export type PreviewAgentPeerUrlResponse =
+  PreviewAgentPeerUrlResponses[keyof PreviewAgentPeerUrlResponses];
+
+export type GetAgentPeersStateData = {
+  body?: never;
+  path: {
+    agentId: string;
+  };
+  query?: never;
+  url: "/agents/{agentId}/peers/state";
+};
+
+export type GetAgentPeersStateErrors = {
+  /**
+   * Missing, malformed or expired console bearer token.
+   */
+  401: unknown;
+  /**
+   * No agent or connection with this id.
+   */
+  404: unknown;
+};
+
+export type GetAgentPeersStateResponses = {
+  200: PeersStateDto;
+};
+
+export type GetAgentPeersStateResponse =
+  GetAgentPeersStateResponses[keyof GetAgentPeersStateResponses];
+
 export type RefreshAgentPeerData = {
   body?: never;
   path: {
diff --git a/api/prisma/migrations/20260916161006_a2a_v2_external_peers/migration.sql b/api/prisma/migrations/20260916161006_a2a_v2_external_peers/migration.sql
new file mode 100644
index 00000000..adef5ccb
--- /dev/null
+++ b/api/prisma/migrations/20260916161006_a2a_v2_external_peers/migration.sql
@@ -0,0 +1,21 @@
+-- AlterTable
+ALTER TABLE "Agent" ADD COLUMN     "peersServedAt" TIMESTAMP(3),
+ADD COLUMN     "peersServedHash" TEXT;
+
+-- AlterTable
+ALTER TABLE "AgentDelegation" ALTER COLUMN "peerAgentId" DROP NOT NULL;
+
+-- AlterTable
+ALTER TABLE "AgentPeer" ADD COLUMN     "origin" TEXT NOT NULL DEFAULT 'internal',
+ADD COLUMN     "outboundToken" TEXT,
+ALTER COLUMN "peerAgentId" DROP NOT NULL,
+ALTER COLUMN "token" DROP NOT NULL;
+
+-- CreateIndex
+CREATE INDEX "AgentPeer_agentId_cardUrl_idx" ON "AgentPeer"("agentId", "cardUrl");
+
+-- External dedup: one row per (agentId, cardUrl) among imported peers.
+-- Partial: internal rows may legitimately share a cardUrl shape and are
+-- already unique on (agentId, peerAgentId).
+CREATE UNIQUE INDEX "AgentPeer_agentId_cardUrl_external_key"
+  ON "AgentPeer"("agentId", "cardUrl") WHERE "origin" = 'external';
diff --git a/api/src/slices/agent/agent/agent.prisma b/api/src/slices/agent/agent/agent.prisma
index 534f8ac7..8f9f9247 100644
--- a/api/src/slices/agent/agent/agent.prisma
+++ b/api/src/slices/agent/agent/agent.prisma
@@ -46,6 +46,11 @@ model Agent {
   allowedOrigins  String[]       @default([])
   knowledgeIds    String[]       @default([])
   isAdmin         Boolean        @default(false)
+  // When the running pod last received this agent's peer list over MCP, and
+  // the hash of the peer row ids it received. armed = stored hash equals the
+  // hash of the current peer set; recorded by AskAgentTool (CLEAN-95).
+  peersServedAt   DateTime?
+  peersServedHash String?
   createdAt       DateTime       @default(now())
   updatedAt       DateTime       @updatedAt
 
diff --git a/api/src/slices/agent/peer/askAgent.tool.spec.ts b/api/src/slices/agent/peer/askAgent.tool.spec.ts
index aa812535..d17450e0 100644
--- a/api/src/slices/agent/peer/askAgent.tool.spec.ts
+++ b/api/src/slices/agent/peer/askAgent.tool.spec.ts
@@ -1,5 +1,10 @@
 import { AskAgentTool } from './askAgent.tool';
-import { DelegationErrorCodes, DelegationStatuses } from './domain/peer.types';
+import {
+  DelegationErrorCodes,
+  DelegationStatuses,
+  PeerOrigins,
+  hashPeerIds,
+} from './domain/peer.types';
 import type { IAgentPeerData, IA2aAgentCard } from './domain';
 import type { IPeerGateway } from './domain/peer.gateway';
 import type { DelegationService } from './domain/delegation.service';
@@ -40,7 +45,9 @@ const connection = (name = 'Support Bot', id = 'peer-1'): IAgentPeerData => ({
   id,
   agentId: 'a',
   peerAgentId: `agent-${name}`,
+  origin: PeerOrigins.Internal,
   token: 'ap_' + 'x'.repeat(43),
+  outboundToken: null,
   cardSnapshot: card(name),
   cardUrl: 'https://api.test/card',
   cardReadAt: '2026-09-14T10:00:00.000Z',
@@ -48,6 +55,18 @@ const connection = (name = 'Support Bot', id = 'peer-1'): IAgentPeerData => ({
   updatedAt: '2026-09-14T10:00:00.000Z',
 });
 
+/** An imported foreign agent: no agent id here, named by its connection id. */
+const externalConnection = (
+  name = 'Foreign Bot',
+  id = 'peer-ext-1',
+): IAgentPeerData => ({
+  ...connection(name, id),
+  peerAgentId: null,
+  origin: PeerOrigins.External,
+  token: null,
+  outboundToken: 'ext-secret',
+});
+
 const agentRequest = (sub = 'agent:a') =>
   ({ user: { sub, email: '', roles: [] } }) as unknown as Request;
 
@@ -60,6 +79,7 @@ function makeHarness(
 ) {
   const peerMocks = {
     listByAgent: jest.fn(async () => options.connections ?? [connection()]),
+    recordPeersServed: jest.fn(async () => undefined),
   };
 
   const run = jest.fn(
@@ -144,6 +164,39 @@ describe('AskAgentTool — the description the model reads', () => {
     );
   });
 
+  it('carries the give-up rule, placed before the not-a-first-resort caveat', async () => {
+    const { tool } = makeHarness();
+
+    const description = (await tool.describeForRequest(agentRequest())) ?? '';
+
+    // FR-011: the model must try a plausible peer before saying I don't know.
+    const giveUp = description.search(/before you answer that you do not know/i);
+    const caveat = description.search(/not a first resort/i);
+    expect(giveUp).toBeGreaterThanOrEqual(0);
+    expect(caveat).toBeGreaterThan(giveUp);
+    expect(description).toMatch(/without having asked a matching peer/i);
+  });
+
+  it('tells the model to always ask a peer the user named', async () => {
+    const { tool } = makeHarness();
+
+    const description = (await tool.describeForRequest(agentRequest())) ?? '';
+
+    expect(description).toMatch(/names a peer.*always ask that peer/is);
+  });
+
+  it('lists an external peer exactly like an internal one, by connection id', async () => {
+    const { tool } = makeHarness({
+      connections: [externalConnection('Foreign Bot', 'peer-ext-1')],
+    });
+
+    const description = (await tool.describeForRequest(agentRequest())) ?? '';
+
+    expect(description).toContain('"Foreign Bot"');
+    expect(description).toContain('peer: peer-ext-1');
+    expect(description).toContain('Foreign Bot answers order questions.');
+  });
+
   it('warns that the peer cannot see the conversation', async () => {
     const { tool } = makeHarness();
 
@@ -173,6 +226,41 @@ describe('AskAgentTool — the description the model reads', () => {
   });
 });
 
+describe('AskAgentTool — recording what the pod was served (CLEAN-95)', () => {
+  it('records the membership hash when the description is served', async () => {
+    const { tool, peers } = makeHarness({
+      connections: [connection('A', 'p1'), connection('B', 'p2')],
+    });
+
+    await tool.describeForRequest(agentRequest());
+
+    expect(peers.recordPeersServed).toHaveBeenCalledWith(
+      'a',
+      hashPeerIds(['p1', 'p2']),
+    );
+  });
+
+  it('records on the listing check too, even with zero peers', async () => {
+    const { tool, peers } = makeHarness({ connections: [] });
+
+    await tool.isListedForRequest(agentRequest());
+
+    expect(peers.recordPeersServed).toHaveBeenCalledWith('a', hashPeerIds([]));
+  });
+
+  it('hash covers membership only: same set, same hash, any order', () => {
+    expect(hashPeerIds(['p2', 'p1'])).toBe(hashPeerIds(['p1', 'p2']));
+    expect(hashPeerIds(['p1'])).not.toBe(hashPeerIds(['p1', 'p2']));
+  });
+
+  it('a failed write never breaks the tool list', async () => {
+    const { tool, peers } = makeHarness();
+    peers.recordPeersServed.mockRejectedValueOnce(new Error('db down'));
+
+    await expect(tool.isListedForRequest(agentRequest())).resolves.toBe(true);
+  });
+});
+
 describe('AskAgentTool — calling it', () => {
   it('refuses a caller that is not an agent runtime', async () => {
     const { tool, args } = makeHarness();
diff --git a/api/src/slices/agent/peer/askAgent.tool.ts b/api/src/slices/agent/peer/askAgent.tool.ts
index 92e22137..4060b844 100644
--- a/api/src/slices/agent/peer/askAgent.tool.ts
+++ b/api/src/slices/agent/peer/askAgent.tool.ts
@@ -9,7 +9,11 @@ import { IPeerGateway } from './domain/peer.gateway';
 import { DelegationService } from './domain/delegation.service';
 import { A2aServerService } from './domain/a2a.server.service';
 import { causeText } from './domain/delegationStep';
-import { DelegationStatuses, type IAgentPeerData } from './domain/peer.types';
+import {
+  DelegationStatuses,
+  hashPeerIds,
+  type IAgentPeerData,
+} from './domain/peer.types';
 
 interface ToolResult {
   content: { type: 'text'; text: string }[];
@@ -36,12 +40,17 @@ const BASE_DESCRIPTION =
   'Ask one of your connected peer agents to do a task you cannot do yourself, ' +
   'then use their reply in your answer and say it came from them. Call this ' +
   "when the user asks about something a peer's skills cover and your own " +
-  'tools do not. Do NOT call it for anything you can do yourself — a peer is ' +
-  'a colleague, not a first resort. The peer does not see this conversation, ' +
-  'so send it a self-contained task in plain text. If several independent ' +
-  'questions go to different peers, call this tool once for each in the same ' +
-  'turn. Give a one-line `reason` naming the skill that made you pick that ' +
-  'peer: it is shown to the person watching.';
+  'tools do not. Before you answer that you do not know, cannot help, or ' +
+  'lack a tool: check your peers below. If any peer’s description or ' +
+  'skills plausibly covers the question, call this tool first — «I ' +
+  'don’t know» without having asked a matching peer is a wrong ' +
+  'answer. When the user names a peer or asks about a peer’s own data, ' +
+  'always ask that peer. Do NOT call it for anything you can do yourself ' +
+  '— a peer is a colleague, not a first resort. The peer does not see ' +
+  'this conversation, so send it a self-contained task in plain text. If ' +
+  'several independent questions go to different peers, call this tool once ' +
+  'for each in the same turn. Give a one-line `reason` naming the skill that ' +
+  'made you pick that peer: it is shown to the person watching.';
 
 const NO_PEERS_DESCRIPTION =
   'Ask one of your connected peer agents to do a task you cannot do yourself. ' +
@@ -93,6 +102,25 @@ export class AskAgentTool
     private readonly a2aServer: A2aServerService,
   ) {}
 
+  /** Best-effort serve-state write; the tool list must survive its failure. */
+  private async recordServed(
+    agentId: string,
+    connections: { id: string }[],
+  ): Promise<void> {
+    try {
+      await this.peers.recordPeersServed(
+        agentId,
+        hashPeerIds(connections.map((c) => c.id)),
+      );
+    } catch (err) {
+      this.logger.warn(
+        `Could not record peers-served state for agent=${agentId}: ${
+          err instanceof Error ? err.message : String(err)
+        }`,
+      );
+    }
+  }
+
   /**
    * An agent with no peers must not see this tool at all. A description saying
    * "you have none" would still be an advertisement for colleagues that do not
@@ -102,6 +130,10 @@ export class AskAgentTool
     const agentId = extractAgentId(httpRequest);
     if (!agentId) return false;
     const connections = await this.peers.listByAgent(agentId);
+    // This IS the moment the running pod learns its peer set — record it,
+    // even when the set is empty, so the console can say "armed" honestly
+    // (CLEAN-95). Best-effort: an indicator must never break a tools/list.
+    await this.recordServed(agentId, connections);
     return connections.length > 0;
   }
 
@@ -110,6 +142,7 @@ export class AskAgentTool
     if (!agentId) return null;
 
     const connections = await this.peers.listByAgent(agentId);
+    await this.recordServed(agentId, connections);
     if (connections.length === 0) return null;
 
     return [
@@ -193,13 +226,15 @@ export class AskAgentTool
  */
 function describePeer(connection: IAgentPeerData): string {
   const card = connection.cardSnapshot;
-  const name = card?.name ?? connection.peerAgentId;
+  const name = card?.name ?? connection.peerAgentId ?? connection.id;
   const description = card?.description ?? '';
   const skills = (card?.skills ?? [])
     .map((s) => `${s.name} (${s.description})`)
     .join('; ');
 
-  const parts = [`- "${name}" (peer: ${connection.peerAgentId})`];
+  // External peers have no agent id here; the connection id names them just
+  // as reliably — matchPeer resolves both (CLEAN-95).
+  const parts = [`- "${name}" (peer: ${connection.peerAgentId ?? connection.id})`];
   if (description) parts.push(` — ${description}`);
   if (skills) parts.push(` Skills: ${skills}`);
   return parts.join('');
diff --git a/api/src/slices/agent/peer/data/peer.gateway.spec.ts b/api/src/slices/agent/peer/data/peer.gateway.spec.ts
index dcd2153e..670f8bf9 100644
--- a/api/src/slices/agent/peer/data/peer.gateway.spec.ts
+++ b/api/src/slices/agent/peer/data/peer.gateway.spec.ts
@@ -1,5 +1,6 @@
 import { PeerGateway } from './peer.gateway';
 import { PeerMapper } from './peer.mapper';
+import { PeerOrigins } from '../domain';
 import type { IA2aAgentCard } from '../domain';
 
 // In-memory Prisma stub in the shape of shareLink.gateway.spec's. It enforces
@@ -124,6 +125,7 @@ function makeGateway() {
     gateway.create({
       agentId,
       peerAgentId,
+      origin: PeerOrigins.Internal,
       token,
       cardSnapshot: card(peerAgentId),
       cardUrl: `https://api.test/a2a/agents/${peerAgentId}/.well-known/agent-card.json`,
diff --git a/api/src/slices/agent/peer/data/peer.gateway.ts b/api/src/slices/agent/peer/data/peer.gateway.ts
index 6d635d1a..38ecdebe 100644
--- a/api/src/slices/agent/peer/data/peer.gateway.ts
+++ b/api/src/slices/agent/peer/data/peer.gateway.ts
@@ -5,7 +5,9 @@ import {
   IAgentPeerData,
   ICreatePeerInput,
   IPeerGateway,
+  IPeersServedState,
   IUpdateSnapshotInput,
+  PeerOrigins,
 } from '../domain';
 import { PeerMapper } from './peer.mapper';
 
@@ -41,6 +43,16 @@ export class PeerGateway extends IPeerGateway {
     return record ? this.mapper.toEntity(record) : null;
   }
 
+  async findByCardUrl(
+    agentId: string,
+    cardUrl: string,
+  ): Promise<IAgentPeerData | null> {
+    const record = await this.prisma.agentPeer.findFirst({
+      where: { agentId, cardUrl, origin: PeerOrigins.External },
+    });
+    return record ? this.mapper.toEntity(record) : null;
+  }
+
   async findByToken(token: string): Promise<IAgentPeerData | null> {
     const record = await this.prisma.agentPeer.findUnique({ where: { token } });
     return record ? this.mapper.toEntity(record) : null;
@@ -54,7 +66,9 @@ export class PeerGateway extends IPeerGateway {
       data: {
         agentId: input.agentId,
         peerAgentId: input.peerAgentId,
+        origin: input.origin,
         token: input.token,
+        outboundToken: input.outboundToken ?? null,
         cardSnapshot: input.cardSnapshot as unknown as Prisma.InputJsonValue,
         cardUrl: input.cardUrl,
         cardReadAt: input.cardReadAt,
@@ -73,6 +87,10 @@ export class PeerGateway extends IPeerGateway {
         cardSnapshot: input.cardSnapshot as unknown as Prisma.InputJsonValue,
         cardUrl: input.cardUrl,
         cardReadAt: input.cardReadAt,
+        // undefined = keep the stored credential; null = clear it.
+        ...(input.outboundToken !== undefined
+          ? { outboundToken: input.outboundToken }
+          : {}),
       },
     });
     return this.mapper.toEntity(record);
@@ -81,4 +99,23 @@ export class PeerGateway extends IPeerGateway {
   async delete(id: string): Promise<void> {
     await this.prisma.agentPeer.delete({ where: { id } });
   }
+
+  async recordPeersServed(agentId: string, hash: string): Promise<void> {
+    await this.prisma.agent.update({
+      where: { id: agentId },
+      data: { peersServedAt: new Date(), peersServedHash: hash },
+    });
+  }
+
+  async readPeersServed(agentId: string): Promise<IPeersServedState | null> {
+    const agent = await this.prisma.agent.findUnique({
+      where: { id: agentId },
+      select: { peersServedAt: true, peersServedHash: true },
+    });
+    if (!agent?.peersServedAt || !agent.peersServedHash) return null;
+    return {
+      servedAt: agent.peersServedAt.toISOString(),
+      hash: agent.peersServedHash,
+    };
+  }
 }
diff --git a/api/src/slices/agent/peer/data/peer.mapper.ts b/api/src/slices/agent/peer/data/peer.mapper.ts
index 4a375557..139bbf57 100644
--- a/api/src/slices/agent/peer/data/peer.mapper.ts
+++ b/api/src/slices/agent/peer/data/peer.mapper.ts
@@ -1,5 +1,6 @@
 import { Injectable } from '@nestjs/common';
 import { AgentPeer } from '@prisma/client';
+import { PeerOrigins, type PeerOrigin } from '../domain';
 import type { IAgentPeerData } from '../domain';
 import type { IA2aAgentCard } from '../domain';
 
@@ -12,7 +13,10 @@ export class PeerMapper {
       id: record.id,
       agentId: record.agentId,
       peerAgentId: record.peerAgentId,
+      // Rows written before CLEAN-95 carry the column default.
+      origin: (record.origin as PeerOrigin) ?? PeerOrigins.Internal,
       token: record.token,
+      outboundToken: record.outboundToken,
       // Stored as Json: Prisma types it as JsonValue, but every write goes
       // through this slice and writes a card, so the cast is the boundary
       // where that guarantee is stated once.
diff --git a/api/src/slices/agent/peer/delegation.prisma b/api/src/slices/agent/peer/delegation.prisma
index b660a6c9..d8d01d4f 100644
--- a/api/src/slices/agent/peer/delegation.prisma
+++ b/api/src/slices/agent/peer/delegation.prisma
@@ -19,7 +19,9 @@ model AgentDelegation {
   // The connection used; null once that connection is gone.
   peerId        String?
   peer          AgentPeer? @relation(fields: [peerId], references: [id], onDelete: SetNull)
-  peerAgentId   String
+  // Null for delegations to external peers — they have no agent id here
+  // (CLEAN-95); the connection id above stays the stable key.
+  peerAgentId   String?
   peerName      String
   // A2A contextId — the same value across follow-ups within one turn.
   contextId     String
diff --git a/api/src/slices/agent/peer/domain/a2a.client.spec.ts b/api/src/slices/agent/peer/domain/a2a.client.spec.ts
index 235764b9..4628e8ed 100644
--- a/api/src/slices/agent/peer/domain/a2a.client.spec.ts
+++ b/api/src/slices/agent/peer/domain/a2a.client.spec.ts
@@ -1,4 +1,8 @@
-import { A2aClient } from './a2a.client';
+import {
+  A2aClient,
+  assertPublicPeerAddress,
+  assertResolvesPublic,
+} from './a2a.client';
 import { DelegationErrorCodes, PeerCardUnreachableError } from './peer.types';
 import { A2aTaskStates, type IA2aSendMessageParams } from './a2a.types';
 
@@ -82,6 +86,8 @@ describe('A2aClient.fetchCard', () => {
       CARD_URL,
       expect.objectContaining({
         headers: expect.objectContaining({ Authorization: `Bearer ${TOKEN}` }),
+        // Redirects are an SSRF-guard bypass; the client refuses them.
+        redirect: 'error',
       }),
     );
   });
@@ -94,6 +100,23 @@ describe('A2aClient.fetchCard', () => {
     ).rejects.toBeInstanceOf(PeerCardUnreachableError);
   });
 
+  it('sends no Authorization header at all without a credential (CLEAN-95)', async () => {
+    fetchMock.mockResolvedValue(respond({ json: card }));
+
+    await new A2aClient().fetchCard(CARD_URL);
+
+    const headers = fetchMock.mock.calls[0][1].headers as Record<string, string>;
+    expect(headers).not.toHaveProperty('Authorization');
+  });
+
+  it('marks not-a-card answers as invalid, not unreachable (CLEAN-95)', async () => {
+    fetchMock.mockResolvedValue(respond({ json: { hello: 'world' } }));
+
+    await expect(new A2aClient().fetchCard(CARD_URL, TOKEN)).rejects.toMatchObject(
+      { kind: 'invalid' },
+    );
+  });
+
   it('names a timeout as a timeout rather than an abort', async () => {
     const timeout = Object.assign(new Error('aborted'), {
       name: 'TimeoutError',
@@ -158,6 +181,7 @@ describe('A2aClient.sendMessage', () => {
     const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
     expect(url).toBe(RPC_URL);
     expect(init.method).toBe('POST');
+    expect(init.redirect).toBe('error');
     expect(init.headers).toMatchObject({
       Authorization: `Bearer ${TOKEN}`,
       'Content-Type': 'application/json',
@@ -255,3 +279,65 @@ describe('A2aClient.sendMessage', () => {
     spy.mockRestore();
   });
 });
+
+describe('SSRF guard (CLEAN-95)', () => {
+  const bad = (url: string) =>
+    expect(() => assertPublicPeerAddress(url)).toThrow(
+      PeerCardUnreachableError,
+    );
+  const good = (url: string) =>
+    expect(() => assertPublicPeerAddress(url)).not.toThrow();
+
+  it('refuses private and local literals in every spelling', () => {
+    bad('http://127.0.0.1/x');
+    bad('http://10.1.2.3/x');
+    bad('http://172.20.0.1/x');
+    bad('http://192.168.1.1/x');
+    bad('http://169.254.169.254/latest/meta-data');
+    bad('http://0.0.0.0/x');
+    bad('http://localhost/x');
+    bad('http://foo.internal/x');
+    bad('http://[::1]/x');
+    bad('http://[0:0:0:0:0:0:0:1]/x');
+    bad('http://[::ffff:127.0.0.1]/x');
+    bad('http://[fe80::1]/x');
+    bad('http://[fd00::1]/x');
+  });
+
+  it('refuses curl-style numeric shorthand instead of normalising it', () => {
+    bad('http://2130706433/x');
+    bad('http://0x7f000001/x');
+    bad('http://017700000001/x');
+    bad('http://127.1/x');
+  });
+
+  it('lets public addresses and names through', () => {
+    good('https://other.example/a2a/agents/x');
+    good('http://8.8.8.8/x');
+    good('http://[2001:db8::1]/x');
+  });
+
+  it('the pre-flight resolver refuses a name that points at a private address', async () => {
+    // localhost is the one name every environment resolves privately —
+    // bypass the literal layer by calling the resolver directly.
+    await expect(
+      assertResolvesPublic('http://localhost/x'),
+    ).rejects.toBeInstanceOf(PeerCardUnreachableError);
+  });
+
+  it('resolution failure passes — the fetch itself will name the problem', async () => {
+    await expect(
+      assertResolvesPublic('http://definitely-not-a-real-host.invalid/x'),
+    ).resolves.toBeUndefined();
+  });
+
+  it('never blocks anything when the dev override is on', () => {
+    process.env.A2A_ALLOW_PRIVATE_PEERS = 'true';
+    try {
+      good('http://127.0.0.1/x');
+      good('http://localhost:4444/a2a/agents/mock-1');
+    } finally {
+      delete process.env.A2A_ALLOW_PRIVATE_PEERS;
+    }
+  });
+});
diff --git a/api/src/slices/agent/peer/domain/a2a.client.ts b/api/src/slices/agent/peer/domain/a2a.client.ts
index 0ffac5a1..4f799577 100644
--- a/api/src/slices/agent/peer/domain/a2a.client.ts
+++ b/api/src/slices/agent/peer/domain/a2a.client.ts
@@ -1,5 +1,7 @@
 import { Injectable, Logger } from '@nestjs/common';
 import * as crypto from 'crypto';
+import * as dns from 'dns/promises';
+import * as net from 'net';
 import {
   A2A_VERSION,
   A2A_VERSION_HEADER,
@@ -39,14 +41,19 @@ export class A2aClient {
    * a snapshot missing skills or an interface is useless later, and failing
    * now names the problem while an operator is still looking at the screen.
    */
-  async fetchCard(cardUrl: string, token: string): Promise<IA2aAgentCard> {
+  async fetchCard(cardUrl: string, token?: string): Promise<IA2aAgentCard> {
     let response: Response;
     try {
       response = await fetch(cardUrl, {
         headers: {
-          Authorization: `Bearer ${token}`,
+          // External agents may serve their card openly (CLEAN-95): no
+          // credential means no Authorization header, not an empty one.
+          ...(token ? { Authorization: `Bearer ${token}` } : {}),
           Accept: 'application/json',
         },
+        // A redirect would let a vetted public URL bounce the request onto a
+        // private address AFTER the SSRF guard ran. No card needs one.
+        redirect: 'error',
         signal: AbortSignal.timeout(CARD_TIMEOUT_MS),
       });
     } catch (err) {
@@ -70,6 +77,7 @@ export class A2aClient {
       throw new PeerCardUnreachableError(
         `The card at ${cardUrl} is not valid JSON`,
         response.status,
+        'invalid',
       );
     }
 
@@ -77,6 +85,7 @@ export class A2aClient {
       throw new PeerCardUnreachableError(
         `The document at ${cardUrl} is not an agent card`,
         response.status,
+        'invalid',
       );
     }
 
@@ -87,13 +96,12 @@ export class A2aClient {
    * Hands a task to a peer and waits for the finished task.
    *
    * SECURITY NOTE. `interfaceUrl` comes from a stored card snapshot, and a
-   * card is remote content. Today that is safe because the picker only ever
-   * offers agents of this installation, so every snapshot was read from this
-   * API's own route — the URL is ours. The moment foreign peers become
-   * connectable (a card URL typed by an operator, deliberately out of scope
-   * here), this value turns attacker-influenced and this call becomes an SSRF
-   * primitive: it would then need an allowlist, or at least a block on
-   * private address ranges, before the first request goes out.
+   * card is remote content. For internal rows every snapshot was read from
+   * this API's own route — the URL is ours. External rows (CLEAN-95) are
+   * exactly the foreseen case: the callers guard both the imported card URL
+   * and the card's interface URL with `assertPublicPeerAddress` before any
+   * request goes out. Literal-address checks only; DNS rebinding is accepted
+   * as out of scope for v1.
    *
    * A peer that answers with a message instead of a task is treated as an
    * error: this client asked for blocking work and has nothing to poll with,
@@ -101,7 +109,7 @@ export class A2aClient {
    */
   async sendMessage(
     interfaceUrl: string,
-    token: string,
+    token: string | undefined,
     params: IA2aSendMessageParams,
     timeoutMs: number,
   ): Promise<IA2aTask> {
@@ -110,7 +118,7 @@ export class A2aClient {
       response = await fetch(interfaceUrl, {
         method: 'POST',
         headers: {
-          Authorization: `Bearer ${token}`,
+          ...(token ? { Authorization: `Bearer ${token}` } : {}),
           'Content-Type': 'application/json',
           [A2A_VERSION_HEADER]: A2A_VERSION,
         },
@@ -120,6 +128,8 @@ export class A2aClient {
           method: A2aMethods.SendMessage,
           params,
         }),
+        // Same reason as fetchCard: a redirect is an SSRF-guard bypass.
+        redirect: 'error',
         signal: AbortSignal.timeout(timeoutMs + CLIENT_TIMEOUT_MARGIN_MS),
       });
     } catch (err) {
@@ -173,6 +183,118 @@ export class A2aClient {
   }
 }
 
+/**
+ * SSRF guard for operator-supplied peer addresses (CLEAN-95). External card
+ * URLs and the interface URLs inside fetched cards are remote content, so a
+ * request to them must never be allowed to reach loopback, RFC1918 ranges or
+ * the cloud metadata endpoint.
+ *
+ * Layers: (1) this literal check — private names, IP literals in any
+ * spelling (IPv6 accepts global unicast 2000::/3 only, which also refuses
+ * `::ffff:` mapped v4 and unabbreviated loopback; curl-style numeric
+ * shorthand like `2130706433` or `0x7f000001` is refused outright);
+ * (2) `assertResolvesPublic` below, a pre-flight DNS check for hostnames;
+ * (3) `redirect: 'error'` on every outbound fetch. Residual risk, accepted
+ * and documented: the connection itself may re-resolve (DNS rebinding
+ * TOCTOU). `A2A_ALLOW_PRIVATE_PEERS=true` lifts the guard for local
+ * development, where the mock peer IS loopback.
+ */
+export function assertPublicPeerAddress(rawUrl: string): void {
+  if (process.env.A2A_ALLOW_PRIVATE_PEERS === 'true') return;
+
+  const host = hostOf(rawUrl);
+
+  const privateName =
+    host === 'localhost' ||
+    host.endsWith('.localhost') ||
+    host.endsWith('.local') ||
+    host.endsWith('.internal');
+
+  if (privateName || isPrivateIpLiteral(host) || isNumericShorthand(host)) {
+    throw new PeerCardUnreachableError(
+      `The address ${host} is a private or local host — external peers must be publicly reachable`,
+      undefined,
+      'invalid',
+    );
+  }
+}
+
+/**
+ * Second SSRF layer: a public-looking hostname may resolve to a private
+ * address. Resolution FAILURE passes — the fetch that follows will report it
+ * honestly — but a resolved private address refuses before any request.
+ */
+export async function assertResolvesPublic(rawUrl: string): Promise<void> {
+  if (process.env.A2A_ALLOW_PRIVATE_PEERS === 'true') return;
+
+  const host = hostOf(rawUrl);
+  if (net.isIP(host)) return; // literals were vetted synchronously
+
+  let addresses: Array<{ address: string }>;
+  try {
+    addresses = await dns.lookup(host, { all: true });
+  } catch {
+    return;
+  }
+
+  for (const { address } of addresses) {
+    if (isPrivateIpLiteral(address)) {
+      throw new PeerCardUnreachableError(
+        `${host} resolves to a private address (${address}) — external peers must be publicly reachable`,
+        undefined,
+        'invalid',
+      );
+    }
+  }
+}
+
+function hostOf(rawUrl: string): string {
+  try {
+    return new URL(rawUrl).hostname
+      .toLowerCase()
+      .replace(/^\[|\]$/g, '')
+      .replace(/\.$/, '');
+  } catch {
+    throw new PeerCardUnreachableError(
+      `Not a valid URL: ${rawUrl}`,
+      undefined,
+      'invalid',
+    );
+  }
+}
+
+/** True for any IP literal that is not plainly public. */
+function isPrivateIpLiteral(host: string): boolean {
+  const kind = net.isIP(host);
+  if (kind === 6) {
+    // Allow global unicast (2000::/3) only. Everything else — loopback in
+    // any spelling, link-local, ULA, mapped v4, `::` — is refused.
+    const first = parseInt(host.split(':', 1)[0] || '0', 16);
+    return Number.isNaN(first) || first < 0x2000 || first > 0x3fff;
+  }
+  if (kind === 4) {
+    const [a, b] = host.split('.').map(Number);
+    return (
+      a === 0 ||
+      a === 10 ||
+      a === 127 ||
+      (a === 100 && b >= 64 && b <= 127) ||
+      (a === 169 && b === 254) ||
+      (a === 172 && b >= 16 && b <= 31) ||
+      (a === 192 && b === 168)
+    );
+  }
+  return false;
+}
+
+/** `2130706433`, `0x7f000001`, `017700000001`, `127.1` — curl-style IPv4
+ *  shorthand that `net.isIP` does not recognise but `fetch` would connect
+ *  to. Never a legitimate agent address; refused rather than normalised. */
+function isNumericShorthand(host: string): boolean {
+  if (net.isIP(host) === 4) return false;
+  return /^[\d.]+$/.test(host) || /^0x[0-9a-f]+$/i.test(host);
+}
+
 function isCard(value: unknown): value is IA2aAgentCard {
   if (!value || typeof value !== 'object') return false;
   const card = value as Record<string, unknown>;
diff --git a/api/src/slices/agent/peer/domain/agentCard.service.ts b/api/src/slices/agent/peer/domain/agentCard.service.ts
index be49bd85..06d2872a 100644
--- a/api/src/slices/agent/peer/domain/agentCard.service.ts
+++ b/api/src/slices/agent/peer/domain/agentCard.service.ts
@@ -44,6 +44,13 @@ export class AgentCardService {
     return `${url}/${A2A_CARD_PATH}`;
   }
 
+  /** This installation's own A2A prefix. An "external" import pointing here
+   *  is an internal agent in disguise and must be refused (CLEAN-95). */
+  async ownA2aBase(): Promise<string> {
+    const base = await this.infra.getApiPublicUrl();
+    return `${base}/a2a/agents/`;
+  }
+
   async build(agentId: string): Promise<IA2aAgentCard> {
     const agent = await this.agents.findById(agentId);
     if (!agent) throw new NotFoundException('Agent not found');
diff --git a/api/src/slices/agent/peer/domain/delegation.service.spec.ts b/api/src/slices/agent/peer/domain/delegation.service.spec.ts
index 5fbdbf3c..09b163c8 100644
--- a/api/src/slices/agent/peer/domain/delegation.service.spec.ts
+++ b/api/src/slices/agent/peer/domain/delegation.service.spec.ts
@@ -3,6 +3,7 @@ import { A2aTaskStates, type IA2aAgentCard, type IA2aTask } from './a2a.types';
 import {
   DelegationError,
   DelegationErrorCodes,
+  PeerOrigins,
   type IAgentPeerData,
 } from './peer.types';
 import type { IPeerGateway } from './peer.gateway';
@@ -43,7 +44,9 @@ const connection = (
   id: 'peer-1',
   agentId: 'a',
   peerAgentId: 'b',
+  origin: PeerOrigins.Internal,
   token: 'ap_' + 'x'.repeat(43),
+  outboundToken: null,
   cardSnapshot: card('Support Bot', [
     {
       id: 'knowledge:9a',
@@ -505,3 +508,79 @@ describe('DelegationService.run — the visible step', () => {
     expect(sent[1].data.step.delegation.status).toBe('failed');
   });
 });
+
+describe('DelegationService.run — external peers (CLEAN-95)', () => {
+  const externalConnection = (): IAgentPeerData =>
+    connection({
+      id: 'peer-ext',
+      peerAgentId: null,
+      origin: PeerOrigins.External,
+      token: null,
+      outboundToken: 'ext-secret-1',
+      cardSnapshot: {
+        ...connection().cardSnapshot,
+        name: 'Foreign Bot',
+        supportedInterfaces: [
+          {
+            url: 'https://other.example/a2a/agents/agent-x',
+            protocolBinding: 'JSONRPC',
+            protocolVersion: '1.0',
+          },
+        ],
+      },
+      cardUrl:
+        'https://other.example/a2a/agents/agent-x/.well-known/agent-card.json',
+    });
+
+  it('authenticates with the outbound credential, never a pair token', async () => {
+    const { run, sendMessage } = makeHarness({
+      connections: [externalConnection()],
+    });
+
+    await run({ peer: 'Foreign Bot' });
+
+    expect(sendMessage).toHaveBeenCalledWith(
+      'https://other.example/a2a/agents/agent-x',
+      'ext-secret-1',
+      expect.anything(),
+      120_000,
+    );
+  });
+
+  it('records the audit row with a null peer agent id', async () => {
+    const { run, delegations } = makeHarness({
+      connections: [externalConnection()],
+    });
+
+    await run({ peer: 'Foreign Bot' });
+
+    expect(delegations.create).toHaveBeenCalledWith(
+      expect.objectContaining({ peerId: 'peer-ext', peerAgentId: null }),
+    );
+  });
+
+  it('refuses a private interface URL before any request goes out (SSRF)', async () => {
+    const sneaky = externalConnection();
+    sneaky.cardSnapshot.supportedInterfaces[0].url =
+      'http://169.254.169.254/latest/meta-data';
+    const { run, sendMessage } = makeHarness({ connections: [sneaky] });
+
+    const outcome = await run({ peer: 'Foreign Bot' });
+
+    expect(sendMessage).not.toHaveBeenCalled();
+    expect(outcome).toMatchObject({ kind: 'done', status: 'failed' });
+  });
+
+  it('an internal peer keeps using its pair token', async () => {
+    const { run, sendMessage } = makeHarness();
+
+    await run();
+
+    expect(sendMessage).toHaveBeenCalledWith(
+      expect.any(String),
+      'ap_' + 'x'.repeat(43),
+      expect.anything(),
+      120_000,
+    );
+  });
+});
diff --git a/api/src/slices/agent/peer/domain/delegation.service.ts b/api/src/slices/agent/peer/domain/delegation.service.ts
index 2b94b981..4ea4f38e 100644
--- a/api/src/slices/agent/peer/domain/delegation.service.ts
+++ b/api/src/slices/agent/peer/domain/delegation.service.ts
@@ -3,7 +3,11 @@ import * as crypto from 'crypto';
 import { IBridleGateway } from '#/bridle/domain/bridle.gateway';
 import { IPeerGateway } from './peer.gateway';
 import { IDelegationGateway } from './delegation.gateway';
-import { A2aClient } from './a2a.client';
+import {
+  A2aClient,
+  assertPublicPeerAddress,
+  assertResolvesPublic,
+} from './a2a.client';
 import { buildDelegationStep, causeText } from './delegationStep';
 import {
   A2aRoles,
@@ -16,6 +20,7 @@ import {
   DelegationError,
   DelegationErrorCodes,
   DelegationStatuses,
+  PeerOrigins,
   type DelegationErrorCode,
   type DelegationStatus,
   type IAgentPeerData,
@@ -79,11 +84,13 @@ export class DelegationService {
     if (!peer) {
       return {
         kind: 'no_match',
-        peers: connections.map((c) => c.cardSnapshot?.name ?? c.peerAgentId),
+        peers: connections.map(
+          (c) => c.cardSnapshot?.name ?? c.peerAgentId ?? c.cardUrl,
+        ),
       };
     }
 
-    const peerName = peer.cardSnapshot?.name ?? peer.peerAgentId;
+    const peerName = peer.cardSnapshot?.name ?? peer.peerAgentId ?? peer.cardUrl;
     const contextId = input.contextId ?? `ctx-${crypto.randomUUID()}`;
     const matchedSkills = matchSkills(peer, `${input.reason} ${input.task}`);
 
@@ -114,9 +121,18 @@ export class DelegationService {
     let excerpt: string | null = null;
 
     try {
+      const interfaceUrl = peer.cardSnapshot.supportedInterfaces[0].url;
+      if (peer.origin === PeerOrigins.External) {
+        // The interface URL inside a foreign card is remote content — never
+        // let it point the platform at a private address (SSRF, CLEAN-95).
+        assertPublicPeerAddress(interfaceUrl);
+        await assertResolvesPublic(interfaceUrl);
+      }
       const task = await this.client.sendMessage(
-        peer.cardSnapshot.supportedInterfaces[0].url,
-        peer.token,
+        interfaceUrl,
+        peer.origin === PeerOrigins.External
+          ? (peer.outboundToken ?? undefined)
+          : (peer.token ?? undefined),
         {
           message: {
             messageId: `m-${crypto.randomUUID()}`,
@@ -214,7 +230,8 @@ function matchPeer(
   return (
     connections.find(
       (c) =>
-        c.id.toLowerCase() === needle || c.peerAgentId.toLowerCase() === needle,
+        c.id.toLowerCase() === needle ||
+        (c.peerAgentId ?? '').toLowerCase() === needle,
     ) ??
     connections.find(
       (c) => (c.cardSnapshot?.name ?? '').trim().toLowerCase() === needle,
diff --git a/api/src/slices/agent/peer/domain/peer.gateway.ts b/api/src/slices/agent/peer/domain/peer.gateway.ts
index 2bf3617c..8d03cf23 100644
--- a/api/src/slices/agent/peer/domain/peer.gateway.ts
+++ b/api/src/slices/agent/peer/domain/peer.gateway.ts
@@ -1,10 +1,15 @@
-import type { IAgentPeerData } from './peer.types';
+import type { IAgentPeerData, PeerOrigin } from './peer.types';
 import type { IA2aAgentCard } from './a2a.types';
 
 export interface ICreatePeerInput {
   agentId: string;
-  peerAgentId: string;
-  token: string;
+  /** Null for external rows (CLEAN-95). */
+  peerAgentId: string | null;
+  origin: PeerOrigin;
+  /** Pair credential — internal rows only. */
+  token: string | null;
+  /** Bearer presented to the external agent, when it needs one. */
+  outboundToken?: string | null;
   cardSnapshot: IA2aAgentCard;
   cardUrl: string;
   cardReadAt: Date;
@@ -14,6 +19,14 @@ export interface IUpdateSnapshotInput {
   cardSnapshot: IA2aAgentCard;
   cardUrl: string;
   cardReadAt: Date;
+  /** Replace the outbound credential; omit to keep the stored one. */
+  outboundToken?: string | null;
+}
+
+/** What the running pod last received, for the armed/pending indicator. */
+export interface IPeersServedState {
+  servedAt: string;
+  hash: string;
 }
 
 /**
@@ -31,6 +44,11 @@ export abstract class IPeerGateway {
     agentId: string,
     peerAgentId: string,
   ): Promise<IAgentPeerData | null>;
+  /** External row imported at this canonical URL, if any (CLEAN-95). */
+  abstract findByCardUrl(
+    agentId: string,
+    cardUrl: string,
+  ): Promise<IAgentPeerData | null>;
   /** Resolves a presented `ap_` credential to the pair it was issued for. */
   abstract findByToken(token: string): Promise<IAgentPeerData | null>;
   /** `@@unique([agentId, peerAgentId])` turns a double-connect into P2002. */
@@ -41,4 +59,9 @@ export abstract class IPeerGateway {
   ): Promise<IAgentPeerData>;
   /** Deleting the row is what revokes the credential. */
   abstract delete(id: string): Promise<void>;
+
+  // ── Armed/pending (CLEAN-95) ──────────────────────────────────
+  /** Record that the running pod just received this agent's peer list. */
+  abstract recordPeersServed(agentId: string, hash: string): Promise<void>;
+  abstract readPeersServed(agentId: string): Promise<IPeersServedState | null>;
 }
diff --git a/api/src/slices/agent/peer/domain/peer.service.spec.ts b/api/src/slices/agent/peer/domain/peer.service.spec.ts
index 7c1bfbe4..b9a1da91 100644
--- a/api/src/slices/agent/peer/domain/peer.service.spec.ts
+++ b/api/src/slices/agent/peer/domain/peer.service.spec.ts
@@ -1,5 +1,10 @@
 import { PeerService } from './peer.service';
-import { PeerCardUnreachableError, PEER_TOKEN_RE } from './peer.types';
+import {
+  PeerCardUnreachableError,
+  PEER_TOKEN_RE,
+  PeerOrigins,
+  hashPeerIds,
+} from './peer.types';
 import type { IPeerGateway } from './peer.gateway';
 import type { AgentCardService } from './agentCard.service';
 import type { A2aClient } from './a2a.client';
@@ -35,6 +40,9 @@ function makeHarness(
   options: {
     agents?: Array<{ id: string; name: string; status: string }>;
     fetchCardThrows?: Error;
+    /** Card returned for external imports; defaults to a valid 1.0 card. */
+    externalCard?: IA2aAgentCard;
+    served?: { servedAt: string; hash: string } | null;
   } = {},
 ) {
   const agents = options.agents ?? [
@@ -61,6 +69,17 @@ function makeHarness(
       async (token: string) =>
         Object.values(rows).find((r) => r.token === token) ?? null,
     ),
+    findByCardUrl: jest.fn(
+      async (agentId: string, cardUrl: string) =>
+        Object.values(rows).find(
+          (r) =>
+            r.agentId === agentId &&
+            r.cardUrl === cardUrl &&
+            r.origin === PeerOrigins.External,
+        ) ?? null,
+    ),
+    recordPeersServed: jest.fn(async () => undefined),
+    readPeersServed: jest.fn(async () => options.served ?? null),
     create: jest.fn(async (input: Record<string, any>) => {
       const id = `peer-${(seq += 1)}`;
       rows[id] = {
@@ -77,6 +96,9 @@ function makeHarness(
         cardSnapshot: input.cardSnapshot,
         cardUrl: input.cardUrl,
         cardReadAt: input.cardReadAt.toISOString(),
+        ...(input.outboundToken !== undefined
+          ? { outboundToken: input.outboundToken }
+          : {}),
       });
       return rows[id];
     }),
@@ -98,10 +120,14 @@ function makeHarness(
       async (id: string) =>
         `https://api.test/a2a/agents/${id}/.well-known/agent-card.json`,
     ),
+    ownA2aBase: jest.fn(async () => 'https://api.test/a2a/agents/'),
   } as unknown as AgentCardService;
 
-  const fetchCard = jest.fn(async (_url: string, _token: string) => {
+  const fetchCard = jest.fn(async (url: string, _token?: string) => {
     if (options.fetchCardThrows) throw options.fetchCardThrows;
+    if (!url.startsWith('https://api.test/')) {
+      return options.externalCard ?? card('Foreign Bot');
+    }
     return card('Support Bot');
   });
   const client = { fetchCard } as unknown as A2aClient;
@@ -293,3 +319,183 @@ describe('PeerService.list', () => {
     expect(view.peerName).toBe('Support Bot');
   });
 });
+
+describe('PeerService — importing an external agent by URL (CLEAN-95)', () => {
+  const EXT_BASE = 'https://other.example/a2a/agents/agent-x';
+  const EXT_CARD = `${EXT_BASE}/.well-known/agent-card.json`;
+
+  it('canonicalizes both address forms to the well-known card URL', async () => {
+    const { service, fetchCard, rows } = makeHarness();
+
+    await service.connectByUrl('a', EXT_BASE);
+    expect(fetchCard).toHaveBeenLastCalledWith(EXT_CARD, undefined);
+
+    const { service: s2, fetchCard: f2 } = makeHarness();
+    await s2.connectByUrl('a', EXT_CARD);
+    expect(f2).toHaveBeenLastCalledWith(EXT_CARD, undefined);
+
+    expect(Object.values(rows)[0].cardUrl).toBe(EXT_CARD);
+  });
+
+  it('stores an external row: no pair token, no peer agent id', async () => {
+    const { service, rows } = makeHarness();
+
+    const view = await service.connectByUrl('a', EXT_BASE, 'tk-1');
+
+    const row = Object.values(rows)[0];
+    expect(row.origin).toBe(PeerOrigins.External);
+    expect(row.peerAgentId).toBeNull();
+    expect(row.token).toBeNull();
+    expect(row.outboundToken).toBe('tk-1');
+    expect(view.origin).toBe(PeerOrigins.External);
+    expect(view.peerStatus).toBe('external');
+    expect(view.peerExists).toBe(true);
+  });
+
+  it('re-imports the same canonical URL in place — one row, updated', async () => {
+    const { service, rows } = makeHarness();
+
+    const first = await service.connectByUrl('a', EXT_BASE, 'tk-1');
+    const second = await service.connectByUrl('a', EXT_CARD, 'tk-2');
+
+    expect(second.id).toBe(first.id);
+    expect(Object.keys(rows)).toHaveLength(1);
+    expect(Object.values(rows)[0].outboundToken).toBe('tk-2');
+  });
+
+  it('keeps the credential when omitted, clears it on empty string', async () => {
+    const { service, rows } = makeHarness();
+
+    await service.connectByUrl('a', EXT_BASE, 'tk-1');
+    await service.connectByUrl('a', EXT_BASE);
+    expect(Object.values(rows)[0].outboundToken).toBe('tk-1');
+
+    await service.connectByUrl('a', EXT_BASE, '');
+    expect(Object.values(rows)[0].outboundToken).toBeNull();
+  });
+
+  it('refuses an address of this installation with PEER_SELF_URL', async () => {
+    const { service, fetchCard } = makeHarness();
+
+    await expect(
+      service.connectByUrl('a', 'https://api.test/a2a/agents/b'),
+    ).rejects.toMatchObject({ response: { code: 'PEER_SELF_URL' } });
+    expect(fetchCard).not.toHaveBeenCalled();
+  });
+
+  it('rejects garbage and private addresses as PEER_URL_INVALID', async () => {
+    const { service } = makeHarness();
+
+    await expect(service.connectByUrl('a', 'not a url')).rejects.toMatchObject(
+      { response: { code: 'PEER_URL_INVALID' } },
+    );
+    await expect(
+      service.connectByUrl('a', 'ftp://other.example/x'),
+    ).rejects.toMatchObject({ response: { code: 'PEER_URL_INVALID' } });
+    // SSRF guard: loopback and RFC1918 hosts never get a request.
+    await expect(
+      service.connectByUrl('a', 'https://192.168.1.10/a2a/agents/x'),
+    ).rejects.toMatchObject({ response: { code: 'PEER_URL_INVALID' } });
+  });
+
+  it('persists nothing when the card cannot be fetched', async () => {
+    const { service, rows } = makeHarness({
+      fetchCardThrows: new PeerCardUnreachableError('refused'),
+    });
+
+    await expect(service.connectByUrl('a', EXT_BASE)).rejects.toMatchObject({
+      response: { code: 'PEER_URL_UNREACHABLE' },
+    });
+    expect(Object.keys(rows)).toHaveLength(0);
+  });
+
+  it('tells "not a card" (400) apart from "unreachable" (502)', async () => {
+    const invalid = makeHarness({
+      fetchCardThrows: new PeerCardUnreachableError('not a card', 200, 'invalid'),
+    });
+
+    await expect(
+      invalid.service.connectByUrl('a', EXT_BASE),
+    ).rejects.toMatchObject({ response: { code: 'PEER_URL_INVALID' } });
+  });
+
+  it('refuses a card speaking another protocol version', async () => {
+    const externalCard = card('Foreign Bot');
+    externalCard.supportedInterfaces[0].protocolVersion = '2.0';
+    const { service, rows } = makeHarness({ externalCard });
+
+    await expect(service.connectByUrl('a', EXT_BASE)).rejects.toMatchObject({
+      response: { code: 'PEER_VERSION' },
+    });
+    expect(Object.keys(rows)).toHaveLength(0);
+  });
+});
+
+describe('PeerService — previewing an external URL (CLEAN-95)', () => {
+  const EXT_BASE = 'https://other.example/a2a/agents/agent-x';
+
+  it('returns the card and persists nothing', async () => {
+    const { service, rows, peers } = makeHarness();
+
+    const card = await service.previewByUrl('a', EXT_BASE, 'tk-1');
+
+    expect(card.name).toBe('Foreign Bot');
+    expect(Object.keys(rows)).toHaveLength(0);
+    expect((peers as unknown as { create: jest.Mock }).create).not.toHaveBeenCalled();
+  });
+
+  it('runs the same refusals as the import', async () => {
+    const { service } = makeHarness();
+
+    await expect(
+      service.previewByUrl('a', 'https://api.test/a2a/agents/b'),
+    ).rejects.toMatchObject({ response: { code: 'PEER_SELF_URL' } });
+  });
+});
+
+describe('PeerService — refreshing an external row (CLEAN-95)', () => {
+  const EXT_BASE = 'https://other.example/a2a/agents/agent-x';
+  const EXT_CARD = `${EXT_BASE}/.well-known/agent-card.json`;
+
+  it('re-reads the stored card URL with the outbound credential', async () => {
+    const { service, fetchCard } = makeHarness();
+    const imported = await service.connectByUrl('a', EXT_BASE, 'tk-1');
+
+    await service.refresh('a', imported.id);
+
+    expect(fetchCard).toHaveBeenLastCalledWith(EXT_CARD, 'tk-1');
+  });
+});
+
+describe('PeerService — armed state (CLEAN-95)', () => {
+  it('is armed when the served hash matches the current peer set', async () => {
+    const harness = makeHarness({ served: null });
+    const view = await harness.service.connect('a', 'b');
+    const hash = hashPeerIds([view.id]);
+
+    const cold = await harness.service.peersState('a');
+    expect(cold).toEqual({ armed: false, servedAt: null });
+
+    const warm = makeHarness({
+      served: { servedAt: '2026-09-16T10:00:00.000Z', hash },
+    });
+    // Recreate the same single row so the hashes line up.
+    const again = await warm.service.connect('a', 'b');
+    expect(hashPeerIds([again.id])).toBe(hash);
+
+    const state = await warm.service.peersState('a');
+    expect(state.armed).toBe(true);
+    expect(state.servedAt).toBe('2026-09-16T10:00:00.000Z');
+  });
+
+  it('falls out of armed when membership changes after the serve', async () => {
+    const harness = makeHarness({
+      served: { servedAt: '2026-09-16T10:00:00.000Z', hash: hashPeerIds([]) },
+    });
+
+    expect((await harness.service.peersState('a')).armed).toBe(true);
+
+    await harness.service.connect('a', 'b');
+    expect((await harness.service.peersState('a')).armed).toBe(false);
+  });
+});
diff --git a/api/src/slices/agent/peer/domain/peer.service.ts b/api/src/slices/agent/peer/domain/peer.service.ts
index a574ffe7..f99e090e 100644
--- a/api/src/slices/agent/peer/domain/peer.service.ts
+++ b/api/src/slices/agent/peer/domain/peer.service.ts
@@ -10,15 +10,24 @@ import * as crypto from 'crypto';
 import { IAgentGateway } from '#/agent/agent/domain';
 import { IPeerGateway } from './peer.gateway';
 import { AgentCardService } from './agentCard.service';
-import { A2aClient } from './a2a.client';
 import {
+  A2aClient,
+  assertPublicPeerAddress,
+  assertResolvesPublic,
+} from './a2a.client';
+import { A2A_CARD_PATH, A2A_VERSION } from './a2a.types';
+import {
+  EXTERNAL_PEER_STATUS,
   PEER_TOKEN_BYTES,
   PEER_TOKEN_PREFIX,
   PeerCardUnreachableError,
   PeerErrorCodes,
+  PeerOrigins,
+  hashPeerIds,
   type IAgentPeerCandidate,
   type IAgentPeerData,
   type IAgentPeerView,
+  type IPeersState,
 } from './peer.types';
 
 /**
@@ -99,6 +108,7 @@ export class PeerService {
     let row = await this.peers.create({
       agentId,
       peerAgentId,
+      origin: PeerOrigins.Internal,
       token,
       cardSnapshot: await this.cards.build(peerAgentId),
       cardUrl,
@@ -120,16 +130,143 @@ export class PeerService {
     return this.toView(row);
   }
 
+  /**
+   * Imports (or re-imports) an agent living outside this installation
+   * (CLEAN-95). The card is read before anything persists, and a canonical
+   * URL that is already connected is UPDATED in place — snapshot, address
+   * form, credential — never duplicated.
+   */
+  async connectByUrl(
+    agentId: string,
+    rawUrl: string,
+    outboundToken?: string,
+  ): Promise<IAgentPeerView> {
+    // Empty string clears a stored credential on re-import; undefined keeps it.
+    const token =
+      outboundToken === undefined ? undefined : outboundToken.trim() || null;
+
+    const { cardUrl, card } = await this.readExternalCard(
+      agentId,
+      rawUrl,
+      token ?? undefined,
+    );
+
+    const existing = await this.peers.findByCardUrl(agentId, cardUrl);
+    const row = existing
+      ? await this.peers.updateSnapshot(existing.id, {
+          cardSnapshot: card,
+          cardUrl,
+          cardReadAt: new Date(),
+          ...(token !== undefined ? { outboundToken: token } : {}),
+        })
+      : await this.peers.create({
+          agentId,
+          peerAgentId: null,
+          origin: PeerOrigins.External,
+          token: null,
+          outboundToken: token ?? null,
+          cardSnapshot: card,
+          cardUrl,
+          cardReadAt: new Date(),
+        });
+
+    this.logger.log(
+      `External peer ${existing ? 're-imported' : 'imported'}: agent=${agentId} url=${cardUrl}`,
+    );
+    return this.toView(row);
+  }
+
+  /**
+   * Reads an external card WITHOUT saving anything — the preview an operator
+   * reviews before Connect (FR-002). The same read connectByUrl performs, so
+   * what they approve is literally what gets stored.
+   */
+  async previewByUrl(
+    agentId: string,
+    rawUrl: string,
+    outboundToken?: string,
+  ) {
+    const { card } = await this.readExternalCard(
+      agentId,
+      rawUrl,
+      outboundToken?.trim() || undefined,
+    );
+    return card;
+  }
+
+  /** Shared validate-and-fetch for preview and import: canonicalize, SSRF
+   *  guards, own-installation refusal, card read, protocol version check. */
+  private async readExternalCard(
+    agentId: string,
+    rawUrl: string,
+    token?: string,
+  ) {
+    const caller = await this.agents.findById(agentId);
+    if (!caller) {
+      throw new NotFoundException({
+        code: PeerErrorCodes.NotFound,
+        message: 'Agent not found',
+      });
+    }
+
+    const cardUrl = this.canonicalCardUrl(rawUrl);
+    try {
+      assertPublicPeerAddress(cardUrl);
+      await assertResolvesPublic(cardUrl);
+    } catch (err) {
+      throw this.invalidUrl(err instanceof Error ? err.message : String(err));
+    }
+
+    const ownBase = await this.cards.ownA2aBase();
+    if (cardUrl.startsWith(ownBase)) {
+      throw new BadRequestException({
+        code: PeerErrorCodes.SelfUrl,
+        message:
+          'This address belongs to an agent of this installation — pick it ' +
+          'in the agent list instead of importing it by URL.',
+      });
+    }
+
+    let card;
+    try {
+      card = await this.client.fetchCard(cardUrl, token);
+    } catch (err) {
+      throw this.importUnreadable(err, cardUrl);
+    }
+
+    const version = card.supportedInterfaces?.[0]?.protocolVersion;
+    if (version !== A2A_VERSION) {
+      throw new BadRequestException({
+        code: PeerErrorCodes.Version,
+        message: `This agent speaks A2A ${version ?? 'unknown'}; only ${A2A_VERSION} is supported`,
+      });
+    }
+
+    return { cardUrl, card };
+  }
+
   /**
    * Re-reads a peer's card. A failed read keeps the old snapshot: a stale
    * description is worth more than none, and the operator is told what failed.
    */
   async refresh(agentId: string, peerId: string): Promise<IAgentPeerView> {
     const row = await this.requireOwned(agentId, peerId);
-    const cardUrl = await this.cards.cardUrlFor(row.peerAgentId);
+    const external = row.origin === PeerOrigins.External;
+    const cardUrl = external
+      ? row.cardUrl
+      : await this.cards.cardUrlFor(row.peerAgentId!);
+    const credential = external
+      ? (row.outboundToken ?? undefined)
+      : (row.token ?? undefined);
 
     try {
-      const card = await this.client.fetchCard(cardUrl, row.token);
+      if (external) {
+        // The stored address was vetted at import, but its DNS may have
+        // moved to a private range since (SSRF, CLEAN-95).
+        assertPublicPeerAddress(cardUrl);
+        await assertResolvesPublic(cardUrl);
+      }
+      const card = await this.client.fetchCard(cardUrl, credential);
       const updated = await this.peers.updateSnapshot(row.id, {
         cardSnapshot: card,
         cardUrl,
@@ -141,6 +278,19 @@ export class PeerService {
     }
   }
 
+  /** Whether the running pod has loaded the current peer set (CLEAN-95). */
+  async peersState(agentId: string): Promise<IPeersState> {
+    const [rows, served] = await Promise.all([
+      this.peers.listByAgent(agentId),
+      this.peers.readPeersServed(agentId),
+    ]);
+    return {
+      armed:
+        served !== null && served.hash === hashPeerIds(rows.map((r) => r.id)),
+      servedAt: served?.servedAt ?? null,
+    };
+  }
+
   /** Deleting the row is what revokes the credential — there is no other copy. */
   async remove(agentId: string, peerId: string): Promise<void> {
     const row = await this.requireOwned(agentId, peerId);
@@ -173,6 +323,55 @@ export class PeerService {
     );
   }
 
+  /**
+   * Accepts both address forms an operator may paste — the agent base URL or
+   * its `…/.well-known/agent-card.json` — and returns the card URL, which is
+   * the identity external dedup runs on (same shape internal rows store).
+   */
+  private canonicalCardUrl(rawUrl: string): string {
+    let url: URL;
+    try {
+      url = new URL(rawUrl.trim());
+    } catch {
+      throw this.invalidUrl('not an absolute URL');
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+      throw this.invalidUrl('only http(s) addresses are supported');
+    }
+    url.hash = '';
+    url.search = '';
+    let path = url.pathname.replace(/\/+$/, '');
+    if (!path.endsWith(`/${A2A_CARD_PATH}`)) {
+      path = `${path}/${A2A_CARD_PATH}`;
+    }
+    url.pathname = path;
+    return url.toString();
+  }
+
+  private invalidUrl(detail: string): BadRequestException {
+    return new BadRequestException({
+      code: PeerErrorCodes.UrlInvalid,
+      message: `This does not look like an A2A agent address: ${detail}`,
+    });
+  }
+
+  /** Import-time read failures: 400 for "reached it, not a card", 502 for
+   *  "could not reach it" — the operator fixes different things for each. */
+  private importUnreadable(err: unknown, cardUrl: string): Error {
+    const detail = err instanceof Error ? err.message : String(err);
+    this.logger.warn(`External card read failed at ${cardUrl}: ${detail}`);
+    if (err instanceof PeerCardUnreachableError && err.kind === 'invalid') {
+      return new BadRequestException({
+        code: PeerErrorCodes.UrlInvalid,
+        message: detail,
+      });
+    }
+    return new BadGatewayException({
+      code: PeerErrorCodes.UrlUnreachable,
+      message: detail,
+    });
+  }
+
   private cardUnreachable(err: unknown, peerName: string): BadGatewayException {
     const detail =
       err instanceof PeerCardUnreachableError
@@ -193,11 +392,30 @@ export class PeerService {
    * credential that has left the building.
    */
   private async toView(row: IAgentPeerData): Promise<IAgentPeerView> {
-    const peerAgent = await this.agents.findById(row.peerAgentId);
+    if (row.origin === PeerOrigins.External) {
+      // No live status is knowable for a foreign agent; existence was proven
+      // by the card read, so the row never shows as "gone".
+      return {
+        id: row.id,
+        agentId: row.agentId,
+        peerAgentId: null,
+        origin: row.origin,
+        peerName: row.cardSnapshot?.name ?? 'External agent',
+        peerStatus: EXTERNAL_PEER_STATUS,
+        peerExists: true,
+        card: row.cardSnapshot,
+        cardUrl: row.cardUrl,
+        cardReadAt: row.cardReadAt,
+        createdAt: row.createdAt,
+      };
+    }
+
+    const peerAgent = await this.agents.findById(row.peerAgentId!);
     return {
       id: row.id,
       agentId: row.agentId,
       peerAgentId: row.peerAgentId,
+      origin: row.origin,
       peerName: peerAgent?.name ?? row.cardSnapshot?.name ?? 'Unknown agent',
       peerStatus: peerAgent?.status ?? 'unknown',
       peerExists: Boolean(peerAgent),
diff --git a/api/src/slices/agent/peer/domain/peer.types.ts b/api/src/slices/agent/peer/domain/peer.types.ts
index 82a90dac..35acfec3 100644
--- a/api/src/slices/agent/peer/domain/peer.types.ts
+++ b/api/src/slices/agent/peer/domain/peer.types.ts
@@ -7,6 +7,7 @@
 // mid-turn cannot change how A behaves until someone presses Refresh) and a
 // credential scoped to exactly this (caller, peer) pair.
 
+import * as crypto from 'crypto';
 import type { IA2aAgentCard } from './a2a.types';
 
 /** Token prefix. Makes a peer credential impossible to confuse with a share
@@ -44,6 +45,19 @@ export const DEFAULT_A2A_TIMEOUT_MS = 120_000;
 /** How much of a peer's reply travels into the visible step and the audit row. */
 export const DELEGATION_EXCERPT_CHARS = 300;
 
+/** Where a peer connection points (CLEAN-95). Internal rows reference another
+ *  agent of this installation; external rows know only a card URL. */
+export const PeerOrigins = {
+  Internal: 'internal',
+  External: 'external',
+} as const;
+
+export type PeerOrigin = (typeof PeerOrigins)[keyof typeof PeerOrigins];
+
+/** `peerStatus` shown for external rows — the console cannot know a foreign
+ *  pod's live status, so the origin doubles as the status. */
+export const EXTERNAL_PEER_STATUS = 'external';
+
 /** Machine-readable codes carried in the error body so the console can tell
  *  the failure modes apart without parsing messages. */
 export const PeerErrorCodes = {
@@ -52,6 +66,12 @@ export const PeerErrorCodes = {
   NotFound: 'PEER_NOT_FOUND',
   CardUnreachable: 'PEER_CARD_UNREACHABLE',
   Unauthorized: 'A2A_UNAUTHORIZED',
+  // External import (CLEAN-95).
+  Body: 'PEER_BODY',
+  UrlInvalid: 'PEER_URL_INVALID',
+  UrlUnreachable: 'PEER_URL_UNREACHABLE',
+  Version: 'PEER_VERSION',
+  SelfUrl: 'PEER_SELF_URL',
 } as const;
 
 export type PeerErrorCode =
@@ -63,10 +83,14 @@ export interface IAgentPeerData {
   id: string;
   /** The caller: the agent that holds the card. */
   agentId: string;
-  /** The peer: the agent whose card is held. */
-  peerAgentId: string;
-  /** Pair credential. Never leaves the API — no DTO carries it. */
-  token: string;
+  /** The peer agent, or null for an external row known only by URL. */
+  peerAgentId: string | null;
+  origin: PeerOrigin;
+  /** Pair credential (internal rows only). Never leaves the API — no DTO
+   *  carries it. */
+  token: string | null;
+  /** Bearer presented to an external agent. Write-only, like `token`. */
+  outboundToken: string | null;
   cardSnapshot: IA2aAgentCard;
   cardUrl: string;
   cardReadAt: string;
@@ -78,9 +102,12 @@ export interface IAgentPeerData {
 export interface IAgentPeerView {
   id: string;
   agentId: string;
-  peerAgentId: string;
+  /** Null for external rows. */
+  peerAgentId: string | null;
+  origin: PeerOrigin;
   peerName: string;
-  /** AgentStatusTypes as a plain string; 'running' ⇒ delegation can succeed. */
+  /** AgentStatusTypes as a plain string; 'running' ⇒ delegation can succeed.
+   *  External rows carry EXTERNAL_PEER_STATUS — no live status is knowable. */
   peerStatus: string;
   /** False when the peer agent is gone (only reachable for a remote peer). */
   peerExists: boolean;
@@ -90,6 +117,24 @@ export interface IAgentPeerView {
   createdAt: string;
 }
 
+/** Whether the running pod has loaded the current peer set (CLEAN-95). */
+export interface IPeersState {
+  armed: boolean;
+  servedAt: string | null;
+}
+
+/**
+ * Identity of a peer SET, order-independent. Membership is the only thing a
+ * restart is needed for — the tool re-reads descriptions on every list — so
+ * the hash covers row ids and nothing else.
+ */
+export function hashPeerIds(ids: string[]): string {
+  return crypto
+    .createHash('sha256')
+    .update([...ids].sort().join('\n'))
+    .digest('hex');
+}
+
 /** An agent offered in the "add peer" picker. */
 export interface IAgentPeerCandidate {
   id: string;
@@ -137,7 +182,8 @@ export interface IAgentDelegationData {
   agentId: string;
   /** Null once the connection it was made through has been removed. */
   peerId: string | null;
-  peerAgentId: string;
+  /** Null for delegations to external peers (CLEAN-95). */
+  peerAgentId: string | null;
   peerName: string;
   contextId: string;
   /** The caller's thinking turn, when one was known at the time. */
@@ -157,7 +203,7 @@ export interface IAgentDelegationData {
 export interface ICreateDelegationData {
   agentId: string;
   peerId: string;
-  peerAgentId: string;
+  peerAgentId: string | null;
   peerName: string;
   contextId: string;
   turnId?: string | null;
@@ -177,11 +223,14 @@ export interface IFinishDelegationData {
 
 // ── Errors raised by the outbound client ────────────────────────
 
-/** The peer's card could not be read at connect or refresh time. */
+/** The peer's card could not be read at connect or refresh time.
+ *  `kind` separates "could not reach it" from "reached it, not a card" so an
+ *  external import can answer 502 vs 400 honestly (CLEAN-95). */
 export class PeerCardUnreachableError extends Error {
   constructor(
     message: string,
     public readonly status?: number,
+    public readonly kind: 'unreachable' | 'invalid' = 'unreachable',
   ) {
     super(message);
     this.name = 'PeerCardUnreachableError';
diff --git a/api/src/slices/agent/peer/dtos/agentDelegation.dto.ts b/api/src/slices/agent/peer/dtos/agentDelegation.dto.ts
index 863980d9..efda9ede 100644
--- a/api/src/slices/agent/peer/dtos/agentDelegation.dto.ts
+++ b/api/src/slices/agent/peer/dtos/agentDelegation.dto.ts
@@ -8,8 +8,23 @@ export class AgentDelegationDto {
   @ApiProperty()
   id: string;
 
-  @ApiProperty({ description: 'The peer that was asked.' })
-  peerAgentId: string;
+  @ApiProperty({
+    description:
+      'The connection the task went through — the stable per-peer key for ' +
+      'both origins; null once that connection was removed (CLEAN-95).',
+    nullable: true,
+    type: String,
+  })
+  peerId: string | null;
+
+  @ApiProperty({
+    description:
+      'The peer agent that was asked, or null when the peer is external ' +
+      'to this installation (CLEAN-95).',
+    nullable: true,
+    type: String,
+  })
+  peerAgentId: string | null;
 
   @ApiProperty({ example: 'Support Bot' })
   peerName: string;
diff --git a/api/src/slices/agent/peer/dtos/agentPeer.dto.ts b/api/src/slices/agent/peer/dtos/agentPeer.dto.ts
index 4907ad2b..1e1fc6e5 100644
--- a/api/src/slices/agent/peer/dtos/agentPeer.dto.ts
+++ b/api/src/slices/agent/peer/dtos/agentPeer.dto.ts
@@ -15,8 +15,23 @@ export class AgentPeerDto {
   @ApiProperty({ description: 'The agent that holds the card (the caller).' })
   agentId: string;
 
-  @ApiProperty({ description: 'The agent whose card is held (the peer).' })
-  peerAgentId: string;
+  @ApiProperty({
+    description:
+      'The agent whose card is held (the peer), or null when the peer was ' +
+      'imported from outside this installation.',
+    nullable: true,
+    type: String,
+  })
+  peerAgentId: string | null;
+
+  @ApiProperty({
+    description:
+      "Where this connection points: 'internal' (another agent of this " +
+      "installation) or 'external' (imported by card URL, CLEAN-95).",
+    enum: ['internal', 'external'],
+    example: 'internal',
+  })
+  origin: 'internal' | 'external';
 
   @ApiProperty({
     description:
diff --git a/api/src/slices/agent/peer/dtos/connectPeer.dto.ts b/api/src/slices/agent/peer/dtos/connectPeer.dto.ts
index 9c37f1cd..66eed6e5 100644
--- a/api/src/slices/agent/peer/dtos/connectPeer.dto.ts
+++ b/api/src/slices/agent/peer/dtos/connectPeer.dto.ts
@@ -1,20 +1,75 @@
-import { ApiProperty } from '@nestjs/swagger';
-import { Matches } from 'class-validator';
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import {
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  Matches,
+  MaxLength,
+} from 'class-validator';
 
 /**
- * Body of "connect this agent as a peer" (CLEAN-74).
- *
- * Agent ids are `agent-${uuid}` (see agent.mapper), not bare UUIDs — `@IsUUID()`
- * was rejecting every Connect click with 400 `peerAgentId must be a UUID`.
+ * One-of body (CLEAN-95): pick an agent of this installation by id, or import
+ * an external A2A agent by its address. Exactly one of the two must be given;
+ * the controller enforces the exclusivity so the error can carry `PEER_BODY`
+ * instead of a generic validation message.
  */
 export class ConnectPeerDto {
-  @ApiProperty({
+  @ApiPropertyOptional({
     description:
-      'The agent to connect. Must be another agent of this installation: ' +
-      'foreign card URLs are not accepted in this feature, and an agent ' +
-      'cannot be its own peer. Format: `agent-<uuid>`.',
+      'An agent of this installation to connect. Format: `agent-<uuid>`. ' +
+      'Mutually exclusive with `url`.',
     example: 'agent-3f2504e0-4f89-11d3-9a0c-0305e82c3301',
   })
+  @IsOptional()
   @Matches(/^agent-[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/)
-  peerAgentId: string;
+  peerAgentId?: string;
+
+  @ApiPropertyOptional({
+    description:
+      'A2A address of an agent outside this installation — the agent base ' +
+      'URL or its `…/.well-known/agent-card.json` form. Importing an address ' +
+      'that is already connected updates that entry in place. Mutually ' +
+      'exclusive with `peerAgentId`.',
+    example: 'https://other.example/a2a/agents/agent-1a2b…',
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(2000)
+  url?: string;
+
+  @ApiPropertyOptional({
+    description:
+      'Bearer credential the external agent expects, when it needs one. ' +
+      'Stored write-only — no response ever returns it. On re-import: ' +
+      'omitted keeps the stored credential, empty string clears it.',
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(4096)
+  token?: string;
+}
+
+/** Read an external agent's card without saving anything — the preview an
+ *  operator reviews before Connect (CLEAN-95, FR-002). */
+export class PreviewPeerUrlDto {
+  @ApiProperty({
+    description:
+      'A2A address of the agent to preview — base URL or its well-known ' +
+      'card form.',
+    example: 'https://other.example/a2a/agents/agent-1a2b…',
+  })
+  @IsString()
+  @IsNotEmpty()
+  @MaxLength(2000)
+  url: string;
+
+  @ApiPropertyOptional({
+    description:
+      'Bearer credential for the card read, when the agent needs one. Used ' +
+      'for this read only; nothing is stored.',
+  })
+  @IsOptional()
+  @IsString()
+  @MaxLength(4096)
+  token?: string;
 }
diff --git a/api/src/slices/agent/peer/dtos/index.ts b/api/src/slices/agent/peer/dtos/index.ts
index 9d7cb5fb..37c821b2 100644
--- a/api/src/slices/agent/peer/dtos/index.ts
+++ b/api/src/slices/agent/peer/dtos/index.ts
@@ -4,3 +4,4 @@ export * from './agentPeerCandidate.dto';
 export * from './connectPeer.dto';
 export * from './agentDelegation.dto';
 export * from './listDelegations.query.dto';
+export * from './peersState.dto';
diff --git a/api/src/slices/agent/peer/dtos/peersState.dto.ts b/api/src/slices/agent/peer/dtos/peersState.dto.ts
new file mode 100644
index 00000000..2850d2b6
--- /dev/null
+++ b/api/src/slices/agent/peer/dtos/peersState.dto.ts
@@ -0,0 +1,28 @@
+import { ApiProperty } from '@nestjs/swagger';
+
+/**
+ * Whether the running pod has loaded the agent's current peer set (CLEAN-95).
+ * A pod reads its tool list once, at boot; `armed=false` means the peers on
+ * screen and the peers the agent can actually ask have drifted apart, and a
+ * restart is the one click that reconciles them.
+ */
+export class PeersStateDto {
+  @ApiProperty({
+    description:
+      "True when the running pod's last-served peer set matches the current " +
+      'one — delegation is armed.',
+    example: true,
+  })
+  armed: boolean;
+
+  @ApiProperty({
+    description:
+      'When the pod last received the peer list over MCP; null if never ' +
+      '(agent not restarted since its first peer was connected).',
+    format: 'date-time',
+    nullable: true,
+    type: String,
+    example: '2026-09-16T12:00:00.000Z',
+  })
+  servedAt: string | null;
+}
diff --git a/api/src/slices/agent/peer/peer.controller.spec.ts b/api/src/slices/agent/peer/peer.controller.spec.ts
index 00dd17ad..49e9a796 100644
--- a/api/src/slices/agent/peer/peer.controller.spec.ts
+++ b/api/src/slices/agent/peer/peer.controller.spec.ts
@@ -28,6 +28,7 @@ function makeController(options: { peers?: Partial<PeerService> } = {}) {
     id: 'peer-1',
     agentId: 'a',
     peerAgentId: 'b',
+    origin: 'internal',
     peerName: 'Support Bot',
     peerStatus: 'running',
     peerExists: true,
@@ -38,6 +39,8 @@ function makeController(options: { peers?: Partial<PeerService> } = {}) {
     // Not part of the DTO. Present here on purpose: if a route ever spreads
     // the row instead of the view, this is what leaks.
     token: 'ap_' + 'x'.repeat(43),
+    // Same trap for the external credential (CLEAN-95).
+    outboundToken: 'EXT_SECRET_bearer',
   };
 
   // Raw mocks first, cast only where the constructor needs a type. Reading a
@@ -49,6 +52,9 @@ function makeController(options: { peers?: Partial<PeerService> } = {}) {
       { id: 'b', name: 'Support Bot', status: 'running', connected: true },
     ]),
     connect: jest.fn(async () => poisoned),
+    connectByUrl: jest.fn(async () => ({ ...poisoned, origin: 'external' })),
+    previewByUrl: jest.fn(async () => ({ name: 'Foreign Bot', skills: [] })),
+    peersState: jest.fn(async () => ({ armed: false, servedAt: null })),
     refresh: jest.fn(async () => poisoned),
     remove: jest.fn(async () => undefined),
     ...options.peers,
@@ -115,6 +121,67 @@ describe('PeerController — routes', () => {
 
     expect(peers.connect).toHaveBeenCalledWith('a', 'b');
     expect(JSON.stringify(created)).not.toContain('ap_');
+    expect(JSON.stringify(created)).not.toContain('EXT_SECRET');
+  });
+
+  it('routes an url body to the import path, with the optional credential', async () => {
+    const { controller, peers } = makeController();
+
+    const imported = await controller.connect('a', {
+      url: 'https://other.example/a2a/agents/x',
+      token: 'tk',
+    });
+
+    expect(peers.connectByUrl).toHaveBeenCalledWith(
+      'a',
+      'https://other.example/a2a/agents/x',
+      'tk',
+    );
+    expect(peers.connect).not.toHaveBeenCalled();
+    expect(JSON.stringify(imported)).not.toContain('EXT_SECRET');
+    expect(JSON.stringify(imported)).not.toContain('ap_');
+  });
+
+  it('refuses a body with both or neither of id and url, as PEER_BODY', async () => {
+    const { controller, peers } = makeController();
+
+    await expect(controller.connect('a', {})).rejects.toMatchObject({
+      response: { code: 'PEER_BODY' },
+    });
+    await expect(
+      controller.connect('a', {
+        peerAgentId: 'b',
+        url: 'https://other.example/a2a/agents/x',
+      }),
+    ).rejects.toMatchObject({ response: { code: 'PEER_BODY' } });
+    expect(peers.connect).not.toHaveBeenCalled();
+    expect(peers.connectByUrl).not.toHaveBeenCalled();
+  });
+
+  it('previews an external card without touching the connect paths', async () => {
+    const { controller, peers } = makeController();
+
+    await controller.previewPeerUrl('a', {
+      url: 'https://other.example/a2a/agents/x',
+      token: 'tk',
+    });
+
+    expect(peers.previewByUrl).toHaveBeenCalledWith(
+      'a',
+      'https://other.example/a2a/agents/x',
+      'tk',
+    );
+    expect(peers.connect).not.toHaveBeenCalled();
+    expect(peers.connectByUrl).not.toHaveBeenCalled();
+  });
+
+  it('reports the armed state the service computed', async () => {
+    const { controller, peers } = makeController();
+
+    const state = await controller.peersState('a');
+
+    expect(peers.peersState).toHaveBeenCalledWith('a');
+    expect(state).toEqual({ armed: false, servedAt: null });
   });
 
   it('refreshes and removes the connection the path names', async () => {
@@ -177,6 +244,19 @@ describe('PeerController — request validation', () => {
     expect(await validate(good)).toHaveLength(0);
   });
 
+  it('accepts an url body, with and without a credential', async () => {
+    const plain = plainToInstance(ConnectPeerDto, {
+      url: 'https://other.example/a2a/agents/x',
+    });
+    const withToken = plainToInstance(ConnectPeerDto, {
+      url: 'https://other.example/a2a/agents/x',
+      token: 'tk',
+    });
+
+    expect(await validate(plain)).toHaveLength(0);
+    expect(await validate(withToken)).toHaveLength(0);
+  });
+
   it('bounds the delegation limit', async () => {
     const tooMany = plainToInstance(ListDelegationsQueryDto, { limit: 1000 });
     const zero = plainToInstance(ListDelegationsQueryDto, { limit: 0 });
diff --git a/api/src/slices/agent/peer/peer.controller.ts b/api/src/slices/agent/peer/peer.controller.ts
index d2936620..8d2b1ad0 100644
--- a/api/src/slices/agent/peer/peer.controller.ts
+++ b/api/src/slices/agent/peer/peer.controller.ts
@@ -1,4 +1,5 @@
 import {
+  BadRequestException,
   Body,
   Controller,
   Delete,
@@ -23,6 +24,7 @@ import {
 import { JwtAuthGuard, Roles, RolesGuard } from '#/user/auth/guards';
 import { UserRoleTypes } from '#/user/user/domain';
 import { PeerService } from './domain/peer.service';
+import { PeerErrorCodes } from './domain/peer.types';
 import type { IAgentPeerView } from './domain/peer.types';
 import { AgentCardService } from './domain/agentCard.service';
 import { IDelegationGateway } from './domain/delegation.gateway';
@@ -33,6 +35,8 @@ import {
   AgentPeerDto,
   ConnectPeerDto,
   ListDelegationsQueryDto,
+  PeersStateDto,
+  PreviewPeerUrlDto,
 } from './dtos';
 
 /**
@@ -47,6 +51,7 @@ function toPeerDto(view: IAgentPeerView): AgentPeerDto {
     id: view.id,
     agentId: view.agentId,
     peerAgentId: view.peerAgentId,
+    origin: view.origin,
     peerName: view.peerName,
     peerStatus: view.peerStatus,
     peerExists: view.peerExists,
@@ -126,10 +131,12 @@ export class PeerController {
   @ApiOperation({
     operationId: 'connectAgentPeer',
     summary:
-      'Connect another agent as a peer: mints a credential for this pair, ' +
-      'reads the peer card with it, and stores the snapshot. Nothing is kept ' +
-      'if the card cannot be read, so a saved connection always works. The ' +
-      'agent picks the tool up on its next restart.',
+      'Connect a peer. Either `peerAgentId` (another agent of this ' +
+      'installation — mints a pair credential and reads the card with it) or ' +
+      '`url` (an external A2A agent imported by address, optionally with a ' +
+      'credential; re-importing the same address updates the entry in ' +
+      'place). Nothing is kept if the card cannot be read. The agent picks ' +
+      'the tool up on its next restart.',
   })
   @ApiOkResponse({ type: AgentPeerDto })
   @ApiConflictResponse({ description: 'Already a peer of this agent.' })
@@ -140,7 +147,51 @@ export class PeerController {
     @Param('agentId') agentId: string,
     @Body() body: ConnectPeerDto,
   ): Promise<AgentPeerDto> {
-    return toPeerDto(await this.peers.connect(agentId, body.peerAgentId));
+    const hasId = Boolean(body.peerAgentId);
+    const hasUrl = Boolean(body.url);
+    if (hasId === hasUrl) {
+      throw new BadRequestException({
+        code: PeerErrorCodes.Body,
+        message: 'Provide exactly one of `peerAgentId` or `url`',
+      });
+    }
+    const view = hasUrl
+      ? await this.peers.connectByUrl(agentId, body.url!, body.token)
+      : await this.peers.connect(agentId, body.peerAgentId!);
+    return toPeerDto(view);
+  }
+
+  @Post('peers/preview')
+  @HttpCode(200)
+  @ApiOperation({
+    operationId: 'previewAgentPeerUrl',
+    summary:
+      "Read an external agent's card without saving anything — the preview " +
+      'an operator reviews before Connect. The same validation the import ' +
+      'runs: canonical address, protocol version, own-installation refusal.',
+  })
+  @ApiOkResponse({ type: AgentCardDto })
+  @ApiBadGatewayResponse({
+    description: 'The address could not be reached; nothing was saved.',
+  })
+  async previewPeerUrl(
+    @Param('agentId') agentId: string,
+    @Body() body: PreviewPeerUrlDto,
+  ): Promise<AgentCardDto> {
+    return this.peers.previewByUrl(agentId, body.url, body.token);
+  }
+
+  @Get('peers/state')
+  @ApiOperation({
+    operationId: 'getAgentPeersState',
+    summary:
+      'Whether the running pod has loaded the current peer set. A pod reads ' +
+      'its tool list once at boot, so connecting or removing a peer leaves ' +
+      'this false ("pending restart") until the agent comes back up.',
+  })
+  @ApiOkResponse({ type: PeersStateDto })
+  async peersState(@Param('agentId') agentId: string): Promise<PeersStateDto> {
+    return this.peers.peersState(agentId);
   }
 
   @Post('peers/:peerId/refresh')
diff --git a/api/src/slices/agent/peer/peer.prisma b/api/src/slices/agent/peer/peer.prisma
index 5188863b..ec78ea24 100644
--- a/api/src/slices/agent/peer/peer.prisma
+++ b/api/src/slices/agent/peer/peer.prisma
@@ -16,26 +16,35 @@ import { AgentDelegation } from "./delegation"
 // editing its description mid-turn cannot change behaviour until someone
 // presses Refresh.
 model AgentPeer {
-  id           String   @id @default(uuid())
+  id            String    @id @default(uuid())
   // The caller.
-  agentId      String
-  agent        Agent    @relation("AgentPeerCaller", fields: [agentId], references: [id], onDelete: Cascade)
-  // The peer.
-  peerAgentId  String
-  peerAgent    Agent    @relation("AgentPeerTarget", fields: [peerAgentId], references: [id], onDelete: Cascade)
+  agentId       String
+  agent         Agent     @relation("AgentPeerCaller", fields: [agentId], references: [id], onDelete: Cascade)
+  // The peer. Null ⇔ origin='external': the agent lives outside this
+  // installation and is known only by its card URL (CLEAN-95).
+  peerAgentId   String?
+  peerAgent     Agent?    @relation("AgentPeerTarget", fields: [peerAgentId], references: [id], onDelete: Cascade)
+  // 'internal' | 'external'. External rows are imported by URL and deduped on
+  // (agentId, cardUrl) — see the partial unique index in the migration.
+  origin        String    @default("internal")
   // `ap_` + 32 random bytes base64url (~256 bits). Scoped to this pair only;
-  // deleting the row revokes it.
-  token        String   @unique
-  cardSnapshot Json
-  cardUrl      String
-  cardReadAt   DateTime
-  createdAt    DateTime @default(now())
-  updatedAt    DateTime @updatedAt
+  // deleting the row revokes it. Null on external rows: the foreign agent
+  // never calls us through this connection.
+  token         String?   @unique
+  // Bearer we present to an external agent. Write-only: no DTO carries it.
+  outboundToken String?
+  cardSnapshot  Json
+  cardUrl       String
+  cardReadAt    DateTime
+  createdAt     DateTime  @default(now())
+  updatedAt     DateTime  @updatedAt
 
   delegations AgentDelegation[]
 
-  // One connection per direction.
+  // One connection per direction (NULL peerAgentId rows don't collide here;
+  // external dedup is the partial unique index on (agentId, cardUrl)).
   @@unique([agentId, peerAgentId])
   @@index([agentId])
   @@index([peerAgentId])
+  @@index([agentId, cardUrl])
 }
diff --git a/api/src/slices/bridle/domain/bridle.types.ts b/api/src/slices/bridle/domain/bridle.types.ts
index ef855790..b75b5dc9 100644
--- a/api/src/slices/bridle/domain/bridle.types.ts
+++ b/api/src/slices/bridle/domain/bridle.types.ts
@@ -134,7 +134,8 @@ export interface IBridleOutgoingEvent {
  */
 export interface IBridleDelegationStep {
   delegationId: string;
-  peerAgentId: string;
+  /** Null when the peer is external — it has no agent id here (CLEAN-95). */
+  peerAgentId: string | null;
   peerName: string;
   /** The card skills that made this peer the choice. */
   matchedSkills: { id: string; name: string }[];
diff --git a/app/slices/setup/api/data/repositories/api/schemas.gen.ts b/app/slices/setup/api/data/repositories/api/schemas.gen.ts
index f1295efe..dd472f65 100644
--- a/app/slices/setup/api/data/repositories/api/schemas.gen.ts
+++ b/app/slices/setup/api/data/repositories/api/schemas.gen.ts
@@ -3172,7 +3172,16 @@ export const AgentPeerDtoSchema = {
     },
     peerAgentId: {
       type: "string",
-      description: "The agent whose card is held (the peer).",
+      description:
+        "The agent whose card is held (the peer), or null when the peer was imported from outside this installation.",
+      nullable: true,
+    },
+    origin: {
+      type: "string",
+      description:
+        "Where this connection points: 'internal' (another agent of this installation) or 'external' (imported by card URL, CLEAN-95).",
+      enum: ["internal", "external"],
+      example: "internal",
     },
     peerName: {
       type: "string",
@@ -3223,6 +3232,7 @@ export const AgentPeerDtoSchema = {
     "id",
     "agentId",
     "peerAgentId",
+    "origin",
     "peerName",
     "peerStatus",
     "peerExists",
@@ -3264,11 +3274,60 @@ export const ConnectPeerDtoSchema = {
     peerAgentId: {
       type: "string",
       description:
-        "The agent to connect. Must be another agent of this installation: foreign card URLs are not accepted in this feature, and an agent cannot be its own peer. Format: `agent-<uuid>`.",
+        "An agent of this installation to connect. Format: `agent-<uuid>`. Mutually exclusive with `url`.",
       example: "agent-3f2504e0-4f89-11d3-9a0c-0305e82c3301",
     },
+    url: {
+      type: "string",
+      description:
+        "A2A address of an agent outside this installation — the agent base URL or its `…/.well-known/agent-card.json` form. Importing an address that is already connected updates that entry in place. Mutually exclusive with `peerAgentId`.",
+      example: "https://other.example/a2a/agents/agent-1a2b…",
+    },
+    token: {
+      type: "string",
+      description:
+        "Bearer credential the external agent expects, when it needs one. Stored write-only — no response ever returns it. On re-import: omitted keeps the stored credential, empty string clears it.",
+    },
   },
-  required: ["peerAgentId"],
+} as const;
+
+export const PreviewPeerUrlDtoSchema = {
+  type: "object",
+  properties: {
+    url: {
+      type: "string",
+      description:
+        "A2A address of the agent to preview — base URL or its well-known card form.",
+      example: "https://other.example/a2a/agents/agent-1a2b…",
+    },
+    token: {
+      type: "string",
+      description:
+        "Bearer credential for the card read, when the agent needs one. Used for this read only; nothing is stored.",
+    },
+  },
+  required: ["url"],
+} as const;
+
+export const PeersStateDtoSchema = {
+  type: "object",
+  properties: {
+    armed: {
+      type: "boolean",
+      description:
+        "True when the running pod's last-served peer set matches the current one — delegation is armed.",
+      example: true,
+    },
+    servedAt: {
+      type: "string",
+      description:
+        "When the pod last received the peer list over MCP; null if never (agent not restarted since its first peer was connected).",
+      format: "date-time",
+      nullable: true,
+      example: "2026-09-16T12:00:00.000Z",
+    },
+  },
+  required: ["armed", "servedAt"],
 } as const;
 
 export const AgentDelegationDtoSchema = {
@@ -3277,9 +3336,17 @@ export const AgentDelegationDtoSchema = {
     id: {
       type: "string",
     },
+    peerId: {
+      type: "string",
+      description:
+        "The connection the task went through — the stable per-peer key for both origins; null once that connection was removed (CLEAN-95).",
+      nullable: true,
+    },
     peerAgentId: {
       type: "string",
-      description: "The peer that was asked.",
+      description:
+        "The peer agent that was asked, or null when the peer is external to this installation (CLEAN-95).",
+      nullable: true,
     },
     peerName: {
       type: "string",
@@ -3334,6 +3401,7 @@ export const AgentDelegationDtoSchema = {
   },
   required: [
     "id",
+    "peerId",
     "peerAgentId",
     "peerName",
     "task",
diff --git a/app/slices/setup/api/data/repositories/api/sdk.gen.ts b/app/slices/setup/api/data/repositories/api/sdk.gen.ts
index 6096670b..4eba3d9d 100644
--- a/app/slices/setup/api/data/repositories/api/sdk.gen.ts
+++ b/app/slices/setup/api/data/repositories/api/sdk.gen.ts
@@ -220,6 +220,10 @@ import type {
   ConnectAgentPeerResponse,
   ListAgentPeerCandidatesData,
   ListAgentPeerCandidatesResponse,
+  PreviewAgentPeerUrlData,
+  PreviewAgentPeerUrlResponse,
+  GetAgentPeersStateData,
+  GetAgentPeersStateResponse,
   RefreshAgentPeerData,
   RefreshAgentPeerResponse,
   RemoveAgentPeerData,
@@ -2978,7 +2982,7 @@ export class PeersService {
   }
 
   /**
-   * Connect another agent as a peer: mints a credential for this pair, reads the peer card with it, and stores the snapshot. Nothing is kept if the card cannot be read, so a saved connection always works. The agent picks the tool up on its next restart.
+   * Connect a peer. Either `peerAgentId` (another agent of this installation — mints a pair credential and reads the card with it) or `url` (an external A2A agent imported by address, optionally with a credential; re-importing the same address updates the entry in place). Nothing is kept if the card cannot be read. The agent picks the tool up on its next restart.
    */
   public static connectAgentPeer<ThrowOnError extends boolean = false>(
     options: Options<ConnectAgentPeerData, ThrowOnError>,
@@ -3013,6 +3017,42 @@ export class PeersService {
     });
   }
 
+  /**
+   * Read an external agent's card without saving anything — the preview an operator reviews before Connect. The same validation the import runs: canonical address, protocol version, own-installation refusal.
+   */
+  public static previewAgentPeerUrl<ThrowOnError extends boolean = false>(
+    options: Options<PreviewAgentPeerUrlData, ThrowOnError>,
+  ) {
+    return (options.client ?? _heyApiClient).post<
+      PreviewAgentPeerUrlResponse,
+      unknown,
+      ThrowOnError
+    >({
+      url: "/agents/{agentId}/peers/preview",
+      ...options,
+      headers: {
+        "Content-Type": "application/json",
+        ...options?.headers,
+      },
+    });
+  }
+
+  /**
+   * Whether the running pod has loaded the current peer set. A pod reads its tool list once at boot, so connecting or removing a peer leaves this false ("pending restart") until the agent comes back up.
+   */
+  public static getAgentPeersState<ThrowOnError extends boolean = false>(
+    options: Options<GetAgentPeersStateData, ThrowOnError>,
+  ) {
+    return (options.client ?? _heyApiClient).get<
+      GetAgentPeersStateResponse,
+      unknown,
+      ThrowOnError
+    >({
+      url: "/agents/{agentId}/peers/state",
+      ...options,
+    });
+  }
+
   /**
    * Re-read the peer's card and replace the stored snapshot. A failed read keeps the old snapshot: stale is better than nothing.
    */
diff --git a/app/slices/setup/api/data/repositories/api/types.gen.ts b/app/slices/setup/api/data/repositories/api/types.gen.ts
index 6f24e8e6..38a7ef3b 100644
--- a/app/slices/setup/api/data/repositories/api/types.gen.ts
+++ b/app/slices/setup/api/data/repositories/api/types.gen.ts
@@ -1445,9 +1445,13 @@ export type AgentPeerDto = {
    */
   agentId: string;
   /**
-   * The agent whose card is held (the peer).
+   * The agent whose card is held (the peer), or null when the peer was imported from outside this installation.
    */
-  peerAgentId: string;
+  peerAgentId: string | null;
+  /**
+   * Where this connection points: 'internal' (another agent of this installation) or 'external' (imported by card URL, CLEAN-95).
+   */
+  origin: "internal" | "external";
   /**
    * The peer's current name. Falls back to the name on the stored card when the agent itself is gone.
    */
@@ -1490,17 +1494,51 @@ export type AgentPeerCandidateDto = {
 
 export type ConnectPeerDto = {
   /**
-   * The agent to connect. Must be another agent of this installation: foreign card URLs are not accepted in this feature, and an agent cannot be its own peer. Format: `agent-<uuid>`.
+   * An agent of this installation to connect. Format: `agent-<uuid>`. Mutually exclusive with `url`.
    */
-  peerAgentId: string;
+  peerAgentId?: string;
+  /**
+   * A2A address of an agent outside this installation — the agent base URL or its `…/.well-known/agent-card.json` form. Importing an address that is already connected updates that entry in place. Mutually exclusive with `peerAgentId`.
+   */
+  url?: string;
+  /**
+   * Bearer credential the external agent expects, when it needs one. Stored write-only — no response ever returns it. On re-import: omitted keeps the stored credential, empty string clears it.
+   */
+  token?: string;
+};
+
+export type PreviewPeerUrlDto = {
+  /**
+   * A2A address of the agent to preview — base URL or its well-known card form.
+   */
+  url: string;
+  /**
+   * Bearer credential for the card read, when the agent needs one. Used for this read only; nothing is stored.
+   */
+  token?: string;
+};
+
+export type PeersStateDto = {
+  /**
+   * True when the running pod's last-served peer set matches the current one — delegation is armed.
+   */
+  armed: boolean;
+  /**
+   * When the pod last received the peer list over MCP; null if never (agent not restarted since its first peer was connected).
+   */
+  servedAt: string | null;
 };
 
 export type AgentDelegationDto = {
   id: string;
   /**
-   * The peer that was asked.
+   * The connection the task went through — the stable per-peer key for both origins; null once that connection was removed (CLEAN-95).
+   */
+  peerId: string | null;
+  /**
+   * The peer agent that was asked, or null when the peer is external to this installation (CLEAN-95).
    */
-  peerAgentId: string;
+  peerAgentId: string | null;
   peerName: string;
   /**
    * The self-contained task the peer received.
@@ -4471,6 +4509,64 @@ export type ListAgentPeerCandidatesResponses = {
 export type ListAgentPeerCandidatesResponse =
   ListAgentPeerCandidatesResponses[keyof ListAgentPeerCandidatesResponses];
 
+export type PreviewAgentPeerUrlData = {
+  body: PreviewPeerUrlDto;
+  path: {
+    agentId: string;
+  };
+  query?: never;
+  url: "/agents/{agentId}/peers/preview";
+};
+
+export type PreviewAgentPeerUrlErrors = {
+  /**
+   * Missing, malformed or expired console bearer token.
+   */
+  401: unknown;
+  /**
+   * No agent or connection with this id.
+   */
+  404: unknown;
+  /**
+   * The address could not be reached; nothing was saved.
+   */
+  502: unknown;
+};
+
+export type PreviewAgentPeerUrlResponses = {
+  200: AgentCardDto;
+};
+
+export type PreviewAgentPeerUrlResponse =
+  PreviewAgentPeerUrlResponses[keyof PreviewAgentPeerUrlResponses];
+
+export type GetAgentPeersStateData = {
+  body?: never;
+  path: {
+    agentId: string;
+  };
+  query?: never;
+  url: "/agents/{agentId}/peers/state";
+};
+
+export type GetAgentPeersStateErrors = {
+  /**
+   * Missing, malformed or expired console bearer token.
+   */
+  401: unknown;
+  /**
+   * No agent or connection with this id.
+   */
+  404: unknown;
+};
+
+export type GetAgentPeersStateResponses = {
+  200: PeersStateDto;
+};
+
+export type GetAgentPeersStateResponse =
+  GetAgentPeersStateResponses[keyof GetAgentPeersStateResponses];
+
 export type RefreshAgentPeerData = {
   body?: never;
   path: {
diff --git a/package.json b/package.json
index 3ce02e28..64fab2a1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ranch",
-  "version": "0.3.51",
+  "version": "0.3.52",
   "private": true,
   "packageManager": "bun@1.2.12",
   "workspaces": [
diff --git a/specs/014-a2a-protocol-upgrade/checklists/requirements.md b/specs/014-a2a-protocol-upgrade/checklists/requirements.md
new file mode 100644
index 00000000..b42af035
--- /dev/null
+++ b/specs/014-a2a-protocol-upgrade/checklists/requirements.md
@@ -0,0 +1,39 @@
+# Specification Quality Checklist: A2A v2 — external agents and delegation that fires
+
+**Purpose**: Validate specification completeness and quality before proceeding to planning
+**Created**: 2026-09-16
+**Feature**: [spec.md](../spec.md)
+
+## Content Quality
+
+- [x] No implementation details (languages, frameworks, APIs)
+- [x] Focused on user value and business needs
+- [x] Written for non-technical stakeholders
+- [x] All mandatory sections completed
+
+## Requirement Completeness
+
+- [x] No [NEEDS CLARIFICATION] markers remain — Q1–Q3 answered 2026-09-16, decisions inlined
+- [x] Requirements are testable and unambiguous
+- [x] Success criteria are measurable
+- [x] Success criteria are technology-agnostic (no implementation details)
+- [x] All acceptance scenarios are defined
+- [x] Edge cases are identified
+- [x] Scope is clearly bounded
+- [x] Dependencies and assumptions identified
+
+## Feature Readiness
+
+- [x] All functional requirements have clear acceptance criteria
+- [x] User scenarios cover primary flows
+- [x] Feature meets measurable outcomes defined in Success Criteria
+- [x] No implementation details leak into specification
+
+## Notes
+
+- Q1–Q3 resolved 2026-09-16: замещение = replace-on-reimport only; the core
+  delegation policy is "never say I don't know while a plausible peer is untried"
+  (FR-011); arming keeps the restart with a one-click action + armed/pending
+  indicator (hot reload out of scope).
+- Production evidence section records the 2026-09-16 baseline (0 delegations,
+  empty Skyhunter card) that SC-001/SC-002 measure against.
diff --git a/specs/014-a2a-protocol-upgrade/contracts/peers-v2-api.md b/specs/014-a2a-protocol-upgrade/contracts/peers-v2-api.md
new file mode 100644
index 00000000..d03b8710
--- /dev/null
+++ b/specs/014-a2a-protocol-upgrade/contracts/peers-v2-api.md
@@ -0,0 +1,81 @@
+# Contract: Peers v2 console API (CLEAN-95)
+
+Extends the CLEAN-74 contract ([013 contracts/a2a-api.md](../../013-a2a-agent-peers/contracts/a2a-api.md)).
+All routes below are console routes: Owner/Admin JWT, `{ success, data }` envelope.
+The bare A2A routes (`/a2a/agents/…`) are unchanged by this feature.
+
+## POST /agents/:agentId/peers — extended (one-of body)
+
+Internal (unchanged):
+
+```json
+{ "peerAgentId": "agent-3f2504e0-…" }
+```
+
+External import (new):
+
+```json
+{ "url": "https://other.example/a2a/agents/agent-…", "token": "optional bearer" }
+```
+
+Rules:
+- Exactly one of `peerAgentId` | `url`. Both or neither → 400 `PEER_BODY`.
+- `url` accepts the agent base address or its `…/.well-known/agent-card.json` form;
+  the canonical base is stored and echoed in `cardUrl`.
+- The card is fetched (with `token` when given) and version-checked **before** any row
+  is written. Failure persists nothing.
+- Canonical URL already imported for this agent → **200** with the updated row
+  (snapshot, address form, credential replaced) — never a duplicate, never 409.
+- Internal duplicates keep returning 409 `PEER_EXISTS`; internal self keeps 400
+  `PEER_SELF`.
+
+New error codes:
+
+| Code | HTTP | When |
+|---|---|---|
+| `PEER_BODY` | 400 | body has both or neither of `peerAgentId` / `url` |
+| `PEER_URL_INVALID` | 400 | not an absolute http(s) URL, or response is not an A2A card |
+| `PEER_URL_UNREACHABLE` | 502 | fetch failed / refused / timed out (fail fast) |
+| `PEER_VERSION` | 400 | card's protocol version is not 1.0 |
+| `PEER_SELF_URL` | 400 | canonical URL points at this installation's own A2A base — hint: pick the agent in the internal list |
+
+Response `data`: `AgentPeerDto` — now with `origin: "internal" | "external"`. External
+rows: no `peerAgentId`, `peerStatus: "external"`, `peerExists: true`. Neither `token`
+nor `outboundToken` ever appears in any response (poisoned-stub spec covers both).
+
+## GET /agents/:agentId/peers — unchanged route, extended rows
+
+Rows carry `origin`. Ordering and everything else unchanged.
+
+## GET /agents/:agentId/peers/state — new
+
+```json
+{ "success": true, "data": { "armed": false, "servedAt": "2026-09-16T12:00:00.000Z" } }
+```
+
+- `armed` — the running pod's last-served peer set matches the current one.
+- `servedAt` — when the pod last received the peer list over MCP; `null` if never.
+- Auth: Owner/Admin JWT, same as the peers list.
+
+## POST /agents/:agentId/peers/:peerId/refresh — unchanged route
+
+For external rows it re-reads `cardUrl` with the stored `outboundToken`. A 401/403
+from the external agent surfaces as `PEER_UNAUTHORIZED` («credential refused») instead
+of silently keeping the stale snapshot.
+
+## DELETE /agents/:agentId/peers/:peerId — unchanged route
+
+External rows: also discards the stored `outboundToken`. (Internal rows keep revoking
+the inbound pair credential, as today.)
+
+## GET /agents/:agentId/delegations — unchanged route, relaxed field
+
+`peerAgentId` becomes nullable in the row shape; external delegations carry `null`
+there and keep `peerId` (connection id) + `peerName`. Everything else unchanged.
+
+## MCP surface (served to the agent, not the console)
+
+`ask_agent` — same tool, description extended with the FR-011 policy paragraph
+(research R3) and per-peer lines covering both origins identically. Serving the list
+records `peersServedAt` / `peersServedHash` on the agent (research R4). No changes to
+the MCP protocol itself.
diff --git a/specs/014-a2a-protocol-upgrade/data-model.md b/specs/014-a2a-protocol-upgrade/data-model.md
new file mode 100644
index 00000000..427d1359
--- /dev/null
+++ b/specs/014-a2a-protocol-upgrade/data-model.md
@@ -0,0 +1,78 @@
+# Data Model: A2A v2
+
+Extends the CLEAN-74 model ([013 data-model](../013-a2a-agent-peers/data-model.md)).
+Everything here is additive; existing rows read as `origin='internal'`.
+
+## AgentPeer (changed)
+
+| Field | Type | Change | Notes |
+|---|---|---|---|
+| `id` | String @id | — | |
+| `agentId` | String FK → Agent | — | the caller |
+| `peerAgentId` | String? FK → Agent | **now nullable** | `null` ⇔ external row |
+| `origin` | String | **new** | `'internal'` \| `'external'`; default `'internal'` for the migration |
+| `token` | String? @unique | **now nullable** | inbound `ap_` pair credential; minted for internal rows only |
+| `outboundToken` | String? | **new** | bearer we present to an external agent; write-only — never in any DTO (poisoned-stub test extends to it) |
+| `cardUrl` | String | — | canonical base address for both origins |
+| `cardSnapshot` | Json | — | |
+| `cardReadAt` | DateTime | — | |
+| `createdAt` / `updatedAt` | DateTime | — | |
+
+**Invariants**
+- `origin='internal'` ⇒ `peerAgentId` set, `token` set, `outboundToken` null.
+- `origin='external'` ⇒ `peerAgentId` null, `token` null, `outboundToken` optional.
+- Uniqueness: internal `(agentId, peerAgentId)` (existing); external `(agentId, cardUrl)`
+  after canonicalization — re-import updates in place, never inserts a second row.
+- Self rows refused both ways: `peerAgentId === agentId` (existing `PEER_SELF`) and
+  canonical `cardUrl` pointing at this installation's own A2A base (`PEER_SELF_URL`).
+
+## Agent (changed)
+
+| Field | Type | Change | Notes |
+|---|---|---|---|
+| `peersServedAt` | DateTime? | **new** | last time the running pod received this agent's peer list over MCP |
+| `peersServedHash` | String? | **new** | hash of sorted peer row ids served at that moment |
+
+`armed` is **derived, not stored**: `peersServedHash === hash(current peer row ids)`.
+
+## Migration
+
+One additive Prisma migration: relax `AgentPeer.peerAgentId`/`AgentPeer.token` and
+`AgentDelegation.peerAgentId` to nullable, add `origin` (default `'internal'`),
+`outboundToken`, `peersServedAt`, `peersServedHash`, and the partial unique index on
+`(agentId, cardUrl)` where `origin = 'external'`.
+
+## DTO shapes (console)
+
+**AgentPeerDto** (extended): gains `origin: 'internal' | 'external'`. For external rows
+`peerAgentId` is absent, `peerExists` is always `true` (existence is the card fetch),
+`peerStatus` reports `'external'` — the console shows the origin badge instead of a
+live pod status it cannot know. Never contains `token` or `outboundToken`.
+
+**ConnectPeerDto** (one-of):
+- `{ peerAgentId: 'agent-<uuid>' }` — unchanged internal path, or
+- `{ url: string, token?: string }` — external import; `url` accepts base or
+  `…/.well-known/agent-card.json` form.
+Exactly one of `peerAgentId` / `url` must be present.
+
+**PeersStateDto** (new): `{ armed: boolean, servedAt: string | null }`.
+
+## State transitions
+
+- **Import (new URL)** → row created (`external`), card snapshot stored after a
+  successful fetch — fetch failure persists nothing.
+- **Import (known URL)** → same row updated: snapshot, address form, credential;
+  `updatedAt` bumps; peer membership unchanged ⇒ `armed` stays true.
+- **Connect / remove (either origin)** → membership changes ⇒ stored hash no longer
+  matches ⇒ `armed=false` (**pending restart**) until the pod's next `tools/list`.
+- **Restart now** → existing restart flow; on boot the pod calls `tools/list`, the
+  serve hook stores the fresh hash ⇒ `armed=true`.
+
+## Delegation record
+
+`AgentDelegation` keeps its shape with one relaxation: the denormalized `peerAgentId`
+becomes **nullable** — an external peer has no agent id in this installation. The
+record's link to the connection (`peerId`, already nullable on removal) stays the
+stable key: the feed's per-peer filter switches from matching `peerAgentId` to
+matching the connection id, which works for both origins. The console renders the
+peer-name link to `/agents/…` only when `peerAgentId` is present.
diff --git a/specs/014-a2a-protocol-upgrade/plan.md b/specs/014-a2a-protocol-upgrade/plan.md
new file mode 100644
index 00000000..e7eab12e
--- /dev/null
+++ b/specs/014-a2a-protocol-upgrade/plan.md
@@ -0,0 +1,111 @@
+# Implementation Plan: A2A v2 — external agents and delegation that fires
+
+**Branch**: `feat/CLEAN-95-a2a-protocol-upgrade` (spec dir `014-a2a-protocol-upgrade`) | **Date**: 2026-09-16 | **Spec**: [spec.md](./spec.md)
+
+**Input**: Feature specification from `/specs/014-a2a-protocol-upgrade/spec.md`
+
+## Summary
+
+Three moves on the existing CLEAN-74 A2A surface. (1) The delegation policy the model
+actually follows: the `ask_agent` tool description gains the "never say I don't know
+while a plausible peer is untried" rule (FR-011) — the tool description is the only
+lever this repo owns over the model's behaviour, and production shows zero delegations
+ever. (2) External peers: `AgentPeer` learns an `external` origin — imported by card
+URL with an optional outbound credential, replace-on-reimport by canonical URL, same
+feed and same visible step. (3) Operational honesty: the API records which peer set the
+running pod last received over MCP, the A2A tab shows **armed / pending restart**, and
+the restart banner gets a one-click Restart now. The tab itself is renamed A2A
+(label only, key stays `peers`).
+
+## Technical Context
+
+**Language/Version**: TypeScript 5.x end to end — NestJS 10 API (`api/`), Nuxt 3 / Vue 3
+admin console (`admin/`), bun as runtime and package manager
+
+**Primary Dependencies**: Prisma (PostgreSQL), zod (tool schema), reka-ui + Tailwind
+(admin), existing MCP server slice (`api/src/slices/mcp`), existing A2A client/server
+(`api/src/slices/agent/peer`)
+
+**Storage**: PostgreSQL — additive migration on `AgentPeer` (nullable `peerAgentId`,
+`origin`, `outboundToken`, nullable inbound `token`) plus peer-serve tracking on `Agent`
+
+**Testing**: jest unit specs colocated in the api slice (`bun run test`), `nuxt
+typecheck` for admin, manual quickstart for live scenarios (local + production)
+
+**Target Platform**: existing k8s deployment; no new services, no new images
+
+**Project Type**: web console + API monorepo (admin/ + api/; app/ untouched)
+
+**Performance Goals**: unchanged from CLEAN-74 — delegation step visible ≤ 1 s,
+connection-refused class failures surfaced < 5 s (SC-006)
+
+**Constraints**: A2A protocol 1.0 only; restart-to-apply stays (decided Q3); **no
+runtime-repo changes** — the model-facing lever is the MCP tool description served by
+this API; credentials write-only (poisoned-stub tests extend to `outboundToken`)
+
+**Scale/Scope**: single-digit peers per agent, feed capped at 20 rows; 4 admin
+components touched, 1 tab label, ~6 api files + 2 new columns
+
+## Constitution Check
+
+*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
+
+`.specify/memory/constitution.md` is the unfilled template — no project-specific gates
+exist. Applied house rules instead: additive-only migration, `{ success, data }`
+envelope for console routes (A2A routes stay bare per CLEAN-74), secrets never returned
+by any DTO, admin stays English-only. No violations; Complexity Tracking empty.
+
+## Project Structure
+
+### Documentation (this feature)
+
+```text
+specs/014-a2a-protocol-upgrade/
+├── plan.md              # This file
+├── research.md          # Phase 0 — decisions R1–R7
+├── data-model.md        # Phase 1 — AgentPeer/Agent changes, DTO shapes
+├── quickstart.md        # Phase 1 — validation guide (local mock + production)
+├── contracts/
+│   └── peers-v2-api.md  # Phase 1 — extended connect, peers state, error codes
+└── tasks.md             # Phase 2 (/speckit-tasks — not created here)
+```
+
+### Source Code (repository root)
+
+```text
+api/
+├── prisma/schema.prisma                          # AgentPeer + Agent columns (R1, R4)
+└── src/slices/agent/peer/
+    ├── askAgent.tool.ts                          # FR-011 policy text (R3)
+    ├── peer.controller.ts                        # connect-by-URL, peers state (R2, R4)
+    ├── dtos/connectPeer.dto.ts                   # one-of peerAgentId | url (+token)
+    ├── dtos/agentPeer.dto.ts                     # origin, external marker
+    ├── domain/peer.service.ts                    # import/replace/self-URL refusal (R2)
+    ├── domain/a2a.client.ts                      # optional bearer for external (R6)
+    ├── domain/delegation.service.ts              # outbound credential pick (R6)
+    └── data/peer.mapper.ts                       # origin mapping
+
+api/src/slices/mcp/services/handlers/
+    └── mcp-tools.handler.ts                      # (unchanged) — serve hook lives in
+                                                  # AskAgentTool.describeForRequest (R4)
+
+admin/slices/agent/agent/components/agent/workspace/
+    └── sections.ts                               # tab title 'Peers' → 'A2A' (R5)
+
+admin/slices/agent/peer/
+    ├── components/peer/Tab.vue                   # armed/pending line, Restart now
+    ├── components/peer/Picker.vue                # "By URL" import path + credential
+    ├── components/peer/Row.vue                   # external origin badge
+    ├── components/peer/Delegations.vue           # external marker in feed rows
+    ├── stores/peer.ts                            # importByUrl, peersState
+    ├── domain/peer.types.ts                      # origin field, state types
+    └── data/peer.gateway.ts                      # new endpoints
+```
+
+**Structure Decision**: everything lands in the two slices CLEAN-74 created
+(`api/src/slices/agent/peer`, `admin/slices/agent/peer`) plus one tab-label line in the
+agent workspace section registry. No new slices, no runtime-repo work.
+
+## Complexity Tracking
+
+No constitution violations — table intentionally empty.
diff --git a/specs/014-a2a-protocol-upgrade/quickstart.md b/specs/014-a2a-protocol-upgrade/quickstart.md
new file mode 100644
index 00000000..12f2a35a
--- /dev/null
+++ b/specs/014-a2a-protocol-upgrade/quickstart.md
@@ -0,0 +1,96 @@
+# Quickstart validation: CLEAN-95 A2A v2
+
+Prerequisites: local stack per `README.md` (`make dev`), the CLEAN-74 pair scenario
+still working (see [013 quickstart](../013-a2a-agent-peers/quickstart.md) §4).
+Contracts: [contracts/peers-v2-api.md](./contracts/peers-v2-api.md); model:
+[data-model.md](./data-model.md).
+
+## 1. Unit tests (fast loop)
+
+```bash
+cd api && bun run test -- peer askAgent a2a mcp-tools
+```
+
+Expected green, beyond the existing CLEAN-74 assertions:
+
+- `PeerService`: connect-by-URL canonicalizes both URL forms to one base; re-import of
+  the same canonical URL updates in place (same row id) and never inserts; own-base URL
+  → `PEER_SELF_URL`; fetch failure persists nothing; internal path byte-identical to
+  before.
+- `AgentPeerDto` poisoned-stub check extends to `outboundToken`.
+- `AskAgentTool`: description contains the give-up rule before the "not a first
+  resort" caveat; external peers listed identically to internal; serving the list
+  records `peersServedAt`/`peersServedHash`; hash changes on connect/remove, not on
+  re-import of the same membership.
+- `A2aClient`: no `Authorization` header when no token; `outboundToken` used for
+  external fetch and send; external 401 → `PEER_UNAUTHORIZED`.
+- Delegation rows for external peers: `peerAgentId` null, `peerId` set.
+
+## 2. Migration, typecheck, client regen
+
+```bash
+cd api && bun run migrate && bunx tsc --noEmit && bun run build && bun run generate:swagger
+cd ../admin && bun run build:api && bun run typecheck
+```
+
+Expected: additive migration only; SDK gains `getAgentPeersState` and the extended
+connect body; admin typechecks.
+
+## 3. External import against a mock A2A agent
+
+Run a throwaway A2A endpoint on another port (any static server returning a valid 1.0
+card at `/.well-known/agent-card.json` and a JSON-RPC echo on POST — a ~30-line
+script; keep it in the scratchpad, not the repo):
+
+```bash
+TOKEN=<console JWT>; A=<agent id>
+# import by well-known form — stored canonical base must drop the suffix
+curl -s -X POST -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
+  -d '{"url":"http://localhost:4444/a2a/agents/mock-1/.well-known/agent-card.json","token":"tk_demo"}' \
+  localhost:3333/agents/$A/peers | jq '.data | {origin, cardUrl, peerName}'
+# re-import same base URL → same row id, updated snapshot, 200
+# own installation URL → 400 PEER_SELF_URL
+# bad port → 502 PEER_URL_UNREACHABLE (fast, not 120 s)
+# state endpoint:
+curl -s -H "Authorization: Bearer $TOKEN" localhost:3333/agents/$A/peers/state | jq .data
+```
+
+Expected: `armed:false` right after import; after Restart now → `armed:true`.
+
+## 4. The console, end to end
+
+1. Agent workspace tab reads **A2A**; an old `…?tab=peers`-style link still lands there
+   (SC-007).
+2. Add peer → **By URL** path: paste the mock URL (+credential), preview shows the
+   mock's card, Connect. The row appears with the **external** badge; feed filter and
+   refresh work on it; the credential is nowhere in any response (check the network
+   tab).
+3. Header shows **pending restart** + the banner's **Restart now** button; click it;
+   when the agent is back the header shows **armed** (SC-005).
+4. Ask the agent a question the mock covers → delegation step + feed row, identical to
+   internal (FR-009). Kill the mock, ask again → fail-fast cause in the feed.
+5. Remove the external peer → row gone; re-import works from scratch.
+
+## 5. The delegation policy, live (SC-001 / SC-002)
+
+Local pair (or production after deploy — see §6): caller A + running peer B whose card
+carries a description and ≥1 skill.
+
+- 10× domain questions A cannot answer itself → ≥9 delegated, attributed answers.
+- 10× questions naming B outright → 10/10 delegated or a one-sentence why-not; **any
+  "I don't know" with B untried and plausible = failure** (FR-011).
+- Control: a question inside A's own competence → no delegation (the "not a first
+  resort" half still holds).
+
+## 6. Production validation (the CLEAN-95 baseline)
+
+On admin.ranch.cleanslice.org (creds `RANCH_PLATFORM_LOGIN` / `RANCH_PLATFORM_PASS`
+from local `.env`; never print them), agent `agent-0db1552e-d8c7-49ac-8184-04ad64a9c55a`:
+
+1. Give Skyhunter's template a description + at least one skill so its card advertises
+   something (the 2026-09-16 card was empty — that emptiness is half the baseline).
+2. Check `peers/state`: expected `armed:false` explains the historic zero delegations;
+   Restart now → `armed:true`.
+3. Re-ask the original failing question ("сколько crews в skyhunter") → delegation
+   step fires, answer attributed to Skyhunter, first row ever in Recent delegations.
+   Record the before/after on CLEAN-95.
diff --git a/specs/014-a2a-protocol-upgrade/research.md b/specs/014-a2a-protocol-upgrade/research.md
new file mode 100644
index 00000000..7193b9aa
--- /dev/null
+++ b/specs/014-a2a-protocol-upgrade/research.md
@@ -0,0 +1,124 @@
+# Research: A2A v2 — external agents and delegation that fires
+
+All Technical Context unknowns resolved. Decisions numbered R1–R7; each cites the code
+that grounds it.
+
+## R1 — External peers extend `AgentPeer`, not a new model
+
+**Decision**: one row type for both origins. `peerAgentId` becomes nullable (FK kept for
+internal rows), new columns: `origin` (`'internal' | 'external'`), `outboundToken
+String?` (credential we present to the external agent, write-only), inbound pair
+`token` becomes nullable (only internal rows mint one — an external agent never calls
+us through this row). `cardUrl` keeps holding the address for both origins. Dedup for
+external rows: unique `(agentId, canonical cardUrl)`.
+
+**Rationale**: everything downstream — `ask_agent` description, the tree, the feed, the
+mapper — iterates one list today (`peer.service.ts`, `askAgent.tool.ts`). A second model
+would double every surface for zero user-visible gain, and the spec explicitly keeps
+external peers behaviourally identical (FR-005, FR-009).
+
+**Alternatives considered**: separate `ExternalPeer` model — rejected (two lists, two
+feeds, two tool sections); storing externals as shadow `Agent` rows — rejected (leaks
+foreign agents into every agent listing, exactly what Q1 scoped out).
+
+## R2 — Import is the same connect endpoint with a one-of body
+
+**Decision**: `POST /agents/:id/peers` accepts `{ peerAgentId }` (unchanged) **or**
+`{ url, token? }`. The URL is canonicalized (accept both the agent base URL and its
+`…/.well-known/agent-card.json` form; store the base), the card is fetched and
+version-checked before anything persists (same order as `PeerService.connect` — the
+card read is the proof the connection works). A URL whose canonical form matches this
+installation's own A2A base (`API_PUBLIC_URL` + `/a2a/agents/`) is refused with
+`PEER_SELF_URL` and a hint to pick the agent in the internal list. Re-import of an
+existing `(agentId, canonical url)` **updates the row in place** — card snapshot,
+address, credential — and returns the updated peer (FR-004, Q1 decision).
+
+**Rationale**: one endpoint keeps the picker a single flow and the SDK surface small;
+canonical-URL dedup is the only identity an external agent reliably has.
+
+**Alternatives considered**: separate `POST /agents/:id/peers/import` — rejected, two
+code paths for one outcome; card-`name` identity for dedup — rejected, names collide
+and change; hard 409 on re-import — rejected by Q1 (замещение = replace).
+
+## R3 — FR-011 lives in the `ask_agent` tool description
+
+**Decision**: extend `BASE_DESCRIPTION` in `askAgent.tool.ts` with the give-up rule,
+placed before the "not a first resort" caveat so the two read as one policy:
+
+> Before you answer that you do not know, cannot help, or lack a tool: check your
+> peers below. If any peer's description or skills plausibly covers the question, call
+> this tool first — "I don't know" without having asked a matching peer is a wrong
+> answer. When the user names a peer or asks about a peer's own data, always ask that
+> peer.
+
+Peer entries keep name + description + skills (`describePeer`). No runtime-repo
+changes; no system-prompt injection; tool stays conditionally listed (absent with zero
+peers).
+
+**Rationale**: production baseline (2026-09-16: Rancher+Skyhunter, zero delegations)
+shows the model reaching for its own platform tools and answering "I don't know". The
+tool description is the only model-facing text this repo controls, it is re-served on
+every `tools/list`, and CLEAN-74 already built dynamic descriptions for exactly this
+purpose. The current text actively discourages use ("not a first resort") without the
+counter-rule for the give-up path.
+
+**Alternatives considered**: runtime system-prompt change — rejected here (crosses the
+repo boundary the spec kept out of scope; revisit only if SC-001/002 fail live);
+forcing tool choice — impossible over MCP; renaming the tool `delegate` — cosmetic, no
+evidence it moves behaviour.
+
+## R4 — Armed/pending is recorded where the tool list is served
+
+**Decision**: when `AskAgentTool.isListedForRequest` / `describeForRequest` serve an
+agent's peer list over MCP, persist on `Agent`: `peersServedAt DateTime?` and
+`peersServedHash String?` — hash of the sorted current peer row ids. New console
+endpoint `GET /agents/:id/peers/state` returns `{ armed, servedAt }` where `armed` =
+stored hash equals the hash of the current peer set. Admin shows **armed** /
+**pending restart** in the A2A tab header and turns the restart banner's text into a
+banner with a **Restart now** button (existing restart action + in-flight machinery in
+`agent` store).
+
+**Rationale**: the serve point is the single place that knows what the pod actually
+received; hashing row ids catches adds, removes and re-imports (updated row id
+survives, but `updatedAt` bumps are irrelevant — the tool re-reads descriptions per
+request; only membership needs the restart). Production's zero-delegation mystery
+("did the pod ever load the tool?") becomes visible at a glance (SC-005).
+
+**Alternatives considered**: comparing pod start time with peer `updatedAt` — rejected
+(deleted rows leave no timestamp; serve-hash handles membership exactly); runtime
+hot-reload — out of scope by Q3 decision.
+
+## R5 — Rename covers the key too; legacy deep links get an alias *(amended at /speckit-tasks per user)*
+
+**Decision**: in `admin/slices/agent/agent/components/agent/workspace/sections.ts`
+the tab becomes `value: 'a2a'`, `title: 'A2A'`, and the `SectionCountKey` member
+`'peers'` renames to `'a2a'` (counts wiring follows). The `value` strings are a URL
+contract (`?tab=<value>` — see the file's header comment), so the point where the
+workspace reads the query param normalizes the legacy `peers` value to `a2a`; SC-007
+(old links keep landing) holds through the alias, not through the old key. Copy inside
+the tab keeps "peer" as the concept name.
+
+**Rationale**: user chose key-consistency over key-stability at tasks time; the alias
+is one line at the single parse point and preserves the spec's link guarantee.
+
+## R6 — External transport reuses the existing A2A client with an optional bearer
+
+**Decision**: `A2aClient.fetchCard` / `sendMessage` make the token parameter optional —
+no `Authorization` header when the external agent needs none; external rows pass
+`outboundToken`, internal rows keep the pair `token`. `DelegationService` picks the
+credential by `origin`. Chain metadata (`ranch.chain`) is sent unchanged; a foreign
+server that ignores it is still bounded by our own depth cap on the way back in.
+
+**Rationale**: the client already speaks exactly the JSON-RPC dialect our server
+serves; the only real difference for a foreign endpoint is auth. Assumption from the
+spec holds: v1 credential = single static bearer pasted at import.
+
+## R7 — Failure causes extend the existing code table
+
+**Decision**: import failures get first-class codes surfaced through the standard
+envelope: `PEER_URL_INVALID`, `PEER_URL_UNREACHABLE`, `PEER_VERSION`,
+`PEER_SELF_URL`. Delegation failures reuse the existing `PEER_*` causes; external
+credential rejection maps onto the existing `PEER_UNAUTHORIZED` ("credential
+refused") — the feed and `Delegations.vue` cause table need no new rows for it.
+Connection-refused class errors keep the CLEAN-74 fail-fast behaviour (no full-timeout
+waits — FR-010/SC-006).
diff --git a/specs/014-a2a-protocol-upgrade/spec.md b/specs/014-a2a-protocol-upgrade/spec.md
new file mode 100644
index 00000000..fbedf316
--- /dev/null
+++ b/specs/014-a2a-protocol-upgrade/spec.md
@@ -0,0 +1,232 @@
+# Feature Specification: A2A v2 — external agents and delegation that fires
+
+**Feature Branch**: `014-a2a-protocol-upgrade` (git: `feat/CLEAN-95-a2a-protocol-upgrade`, Jira: CLEAN-95)
+
+**Created**: 2026-09-16
+
+**Status**: Draft
+
+**Input**: User description: "Комплексная таска по импруву a2a протокола: он сейчас костыльно работает и не в полном объёме. (1) в табах переименовать Peers → A2A; (2) реализовать корректный импорт внешних агентов по ссылке, замещение их; (3) агент не делегирует задачи, а пытается решить их сам (прод: Rancher + Skyhunter). Валидация на https://admin.ranch.cleanslice.org (креды RANCH_PLATFORM_LOGIN / RANCH_PLATFORM_PASS в `.env`)."
+
+## Evidence from production *(context, verified 2026-09-16)*
+
+On ranch.cleanslice.org, Rancher has exactly one peer — Skyhunter, `running` — and the
+delegation feed is empty: **not one delegation has ever fired**. Skyhunter's stored card
+advertises **zero skills** and the description "basic agent". Asked "сколько crews в
+skyhunter", Rancher answers "I don't know, I have no tool to look at Skyhunter's config"
+and offers its own platform tool (`Ranch__get_agent`) instead of asking the peer. Three
+compounding causes are in scope here: the ask tool may not be loaded by the running pod
+(restart-to-apply trap), the card gives the model nothing to match a question against,
+and the caller's own tools win by default when the card is silent.
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 - A connected peer actually gets asked (Priority: P1)
+
+An operator connects agent B as a peer of agent A and asks A a question that belongs to
+B — B's domain by card, or B named outright ("спроси у B…", "сколько crews в B"). A
+delegates the task to B over A2A, the thinking timeline shows the delegation step, and
+A's reply carries B's answer with attribution — instead of "I don't know" or a guess
+from A's own tools.
+
+**Why this priority**: This is the product's core promise; today it fires zero times in
+production. Everything else on this spec is scaffolding around this behaviour.
+
+**Independent Test**: On a stack with two agents, connect B to A with a card that names
+B's domain, ask A a domain question and a "спроси у B" question; both must produce a
+delegation row and an attributed answer.
+
+**Acceptance Scenarios**:
+
+1. **Given** A has peer B whose card carries a description and at least one skill,
+   **When** the operator asks A a question inside B's advertised domain that A cannot
+   answer from its own knowledge, **Then** A delegates to B, the delegation step is
+   visible, and the reply names B as the source.
+2. **Given** A has peer B, **When** the operator explicitly directs the question at B
+   ("ask B…", a question about B's own data), **Then** A delegates to B — or states in
+   one sentence why it could not (peer not running, refused) — and never silently
+   substitutes an answer from its own tools.
+3. **Given** A cannot answer a question from its own knowledge or tools, **When** any
+   connected peer's card plausibly covers it, **Then** A tries that peer **before**
+   replying "I don't know" — an "I don't know" alongside an untried plausible peer is
+   a defect (decided 2026-09-16: this is the core delegation policy).
+4. **Given** the operator has just connected B to A, **When** the connect completes,
+   **Then** the remaining step to "armed" is one click — the restart banner carries a
+   Restart now action — and the A2A tab shows whether the running agent has actually
+   loaded the peer (armed / pending restart). No-restart hot reload is out of scope
+   (decided 2026-09-16).
+5. **Given** B's card advertises nothing, **When** the operator looks at the A2A tab,
+   **Then** the existing "advertises nothing" warning explains that delegation will not
+   trigger on topic matching — and the ask tool still lists B by name and description so
+   explicit "ask B" requests can fire.
+
+---
+
+### User Story 2 - Import an external agent by link (Priority: P2)
+
+An operator pastes the A2A address of an agent living **outside this Ranch
+installation** (another Ranch, or any A2A-compliant framework) into the Add peer flow.
+The platform fetches the external agent's card, shows the same preview an internal
+candidate gets, accepts an optional access credential for that agent, and connects it as
+a peer. Importing the same address again replaces the stored entry instead of creating a
+duplicate — and nothing more (decided 2026-09-16: "замещение" is exactly
+replace-on-reimport; substituting internal agents with external ones is out of
+scope).
+
+**Why this priority**: The A2A address exists precisely so agents outside the
+installation can be reached; today the picker only accepts internal agents, so the
+protocol runs at half its purpose.
+
+**Independent Test**: Import a reachable external A2A agent by URL, delegate to it, see
+the delegation row; re-import the same URL and confirm the entry was updated, not
+duplicated.
+
+**Acceptance Scenarios**:
+
+1. **Given** the operator has an external agent's card URL, **When** they paste it into
+   the Add peer flow, **Then** the platform reads the card, shows name / description /
+   skills before anything is saved, and connects on confirm.
+2. **Given** the external agent requires an access credential, **When** the operator
+   provides it at import time, **Then** delegations authenticate with it and the
+   credential is never displayed back anywhere in the console.
+3. **Given** an external peer already exists, **When** the operator imports the same
+   address again, **Then** the existing entry is updated in place (card, credential) —
+   the peer list never shows two rows for one external agent.
+4. **Given** an external peer, **When** the operator looks at the A2A tab, **Then** the
+   entry is visibly marked as external (origin shown), and refresh / remove work exactly
+   like for internal peers; remove also discards the stored credential.
+5. **Given** an unreachable URL, a non-A2A response, or an unsupported protocol version,
+   **When** the operator tries to import, **Then** the flow fails before saving anything,
+   with a message naming the cause.
+
+---
+
+### User Story 3 - The tab is called A2A (Priority: P3)
+
+The agent workspace tab currently labeled "Peers" is renamed to "A2A", since it now
+holds the whole agent-to-agent surface: the agent's own card, peers (internal and
+external), and the delegation feed.
+
+**Why this priority**: Cheap clarity win; pure copy change with no behaviour attached.
+
+**Independent Test**: Open any agent workspace and see the tab labeled "A2A" with all
+existing content intact; no link or saved view breaks.
+
+**Acceptance Scenarios**:
+
+1. **Given** any agent workspace, **When** the operator looks at the tab bar, **Then**
+   the tab reads "A2A" and opens the same content the Peers tab held.
+2. **Given** a bookmarked or shared link to the old tab, **When** it is opened, **Then**
+   it still lands on the renamed tab.
+
+---
+
+### Edge Cases
+
+- External URL points at an agent of **this** installation: treated as internal —
+  refused with a hint to pick it in the internal list (prevents credential duplication).
+- External agent's card identity changes on re-import (different agent behind the same
+  URL): flagged to the operator before replacing.
+- External peer's credential expires: delegation fails with "credential refused" in the
+  feed; refresh card shows the same cause instead of silently keeping a stale snapshot.
+- Two peers (any origin) with near-identical descriptions: existing duplicate-description
+  warning keeps applying to imported cards.
+- External agent unreachable at delegation time: fail fast with cause, same as internal
+  "peer not running" — never wait out the full timeout when the endpoint refuses.
+- The peer answers with an empty or non-text artifact: recorded as answered with an
+  explicit "empty answer" note, not as a crash.
+- Question matches two peers' domains at once: the caller picks one and names it; the
+  delegation row records which; never asks both in parallel in v1.
+
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+- **FR-001**: The agent workspace tab is labeled "A2A" everywhere the console shows it;
+  existing links to the tab keep working. User-facing copy only — stored data and
+  existing integrations keep their current terms.
+- **FR-002**: The Add peer flow accepts an A2A address (agent base URL or its well-known
+  card URL) in addition to picking an internal agent, validates protocol compatibility,
+  and shows the standard card preview before anything is saved.
+- **FR-003**: The import flow accepts an optional access credential for the external
+  agent, stores it write-only (never returned to any console surface), uses it for card
+  reads and delegations, and discards it when the peer is removed.
+- **FR-004**: Importing an address that matches an existing external peer of the same
+  agent updates that entry in place — card snapshot, address, credential. The peer list
+  never holds two entries for one external agent.
+- **FR-005**: External peers are visibly distinguished from internal ones in the A2A tab
+  and in the delegation feed; refresh and remove behave identically for both origins.
+- **FR-006**: The delegation tool presented to the calling agent describes every peer by
+  name, description, and skills, for internal and external peers alike, so a domain
+  question can be matched against the card text.
+- **FR-007**: When a request explicitly names a peer or asks about that peer's own
+  data/domain, the caller delegates to that peer; if delegation is impossible, the reply
+  states the cause in one sentence. The caller never answers such requests from its own
+  tools without saying why the peer was not asked.
+- **FR-008**: After connecting or importing a peer, the path to "delegation armed" is
+  explicit: the console shows whether the running agent has loaded the peer, and the
+  remaining step (if any) is offered as a single click rather than a text instruction.
+- **FR-009**: Delegations to external peers produce the same visible step and the same
+  feed rows (outcome, duration, cause on failure) as internal ones.
+- **FR-010**: Every failed delegation and failed import names its cause (unreachable,
+  credential refused, protocol mismatch, peer not running, timeout); no silent failures
+  and no full-timeout waits on connection-refused class errors.
+- **FR-011**: The caller never replies "I don't know" (or an equivalent refusal) while
+  a connected peer's card plausibly covers the question and that peer has not been
+  tried in the current turn. Delegation is the mandatory step between "cannot answer
+  myself" and giving up.
+
+### Key Entities
+
+- **Peer connection (extended)**: an existing directed connection gains an **origin**
+  (internal / external); external entries carry the imported address and an optional
+  write-only access credential alongside the card snapshot and read timestamp.
+- **Agent card (unchanged shape)**: the A2A card as read from either an internal agent
+  or an external address; still shown verbatim to the operator before connecting.
+- **Delegation record (unchanged shape)**: gains nothing — but must be produced
+  identically for external peers.
+
+## Success Criteria *(mandatory)*
+
+### Measurable Outcomes
+
+- **SC-001**: On a stack reproducing the production pair (caller + one running peer
+  whose card names its domain), a domain question asked in the caller's chat produces a
+  delegated, attributed answer in at least 9 of 10 attempts; today's baseline is 0.
+- **SC-002**: A request that names the peer outright — or one the caller cannot answer
+  while a peer's card covers it — produces either a delegation or a one-sentence
+  explanation of why not, in 10 of 10 attempts; "I don't know" with an untried
+  plausible peer counts as a failure.
+- **SC-003**: An operator with an external agent's URL (and credential, when needed)
+  connects it in at most 3 interactions from the A2A tab, and the preview they see
+  before confirming matches what the delegating agent will read.
+- **SC-004**: Re-importing the same external address never produces a second entry —
+  100% of re-imports update in place.
+- **SC-005**: An operator can tell from the A2A tab alone whether delegation is armed
+  (peer loaded by the running agent) — verified by a usability walkthrough with no log
+  reading and no documentation.
+- **SC-006**: Zero delegation or import failures without a named cause across the
+  validation run; connection-refused failures surface in under 5 seconds.
+- **SC-007**: After the rename, no console surface still says "Peers" as the tab name,
+  and every pre-existing link to the tab still resolves.
+
+## Assumptions
+
+- External agents speak A2A protocol version 1.0 and expose their card at the standard
+  well-known location; agents that do not are rejected at import with a protocol-mismatch
+  message (no compatibility shims in v1).
+- External-agent authentication in v1 is a single static bearer-style credential pasted
+  by the operator at import time; credential exchange flows / federation handshakes are
+  out of scope.
+- Cross-installation loop and depth protection continues to rely on the existing chain
+  metadata when the external party is also a Ranch; foreign frameworks that strip the
+  metadata are bounded by the existing chain-depth cap on our side.
+- The rename is presentation-level; validation that no stored identifier changes is part
+  of the work.
+- Live validation runs against the production stack (admin.ranch.cleanslice.org, agent
+  `agent-0db1552e-d8c7-49ac-8184-04ad64a9c55a`) with the platform credentials from the
+  project's local `.env` (`RANCH_PLATFORM_LOGIN` / `RANCH_PLATFORM_PASS`; never printed
+  or committed), plus a local two-agent stack for the delegation scenarios.
+- The delegation-quality work (US1) may require changes on the runtime side (how the
+  ask tool and card text reach the model); this spec constrains the outcome, not the
+  split between repositories.
diff --git a/specs/014-a2a-protocol-upgrade/tasks.md b/specs/014-a2a-protocol-upgrade/tasks.md
new file mode 100644
index 00000000..da7afb62
--- /dev/null
+++ b/specs/014-a2a-protocol-upgrade/tasks.md
@@ -0,0 +1,252 @@
+# Tasks: A2A v2 — external agents and delegation that fires
+
+**Input**: Design documents from `/specs/014-a2a-protocol-upgrade/`
+
+**Prerequisites**: plan.md, spec.md, research.md (R1–R7, R5 amended: tab key → `a2a`
+with legacy alias), data-model.md, contracts/peers-v2-api.md, quickstart.md
+
+**Tests**: included — the peer slice is spec-per-file by house convention (CLEAN-74),
+and quickstart §1 names the expected assertions. Write each spec before or with its
+implementation; the poisoned-stub pattern guards secrets.
+
+**Organization**: grouped by user story; stories are independently testable. US1 is
+the MVP.
+
+## Format: `[ID] [P?] [Story] Description`
+
+## Phase 1: Setup
+
+- [X] T001 Baseline green: `cd api && bun run test -- peer askAgent a2a mcp-tools`,
+      `cd admin && bun run typecheck` — record any pre-existing failure before touching
+      code (stack: branch `feat/CLEAN-95-a2a-protocol-upgrade`)
+
+---
+
+## Phase 2: Foundational (Blocking Prerequisites)
+
+**Purpose**: schema and shared types every story reads. No story work before this.
+
+- [X] T002 Prisma schema (api/prisma/schema.prisma): `AgentPeer` — `peerAgentId` and
+      `token` nullable, add `origin String @default("internal")`, `outboundToken
+      String?`; `AgentDelegation.peerAgentId` nullable; `Agent` — add `peersServedAt
+      DateTime?`, `peersServedHash String?`; partial unique index `(agentId, cardUrl)`
+      where origin external. Additive migration via `cd api && bun run migrate`
+      (data-model.md invariants)
+- [X] T003 Domain types (api/src/slices/agent/peer/domain/peer.types.ts): `PeerOrigins`
+      (`internal`/`external`), `IAgentPeerData.origin`/`outboundToken?`, nullable
+      `peerAgentId`, `IPeersState { armed, servedAt }`
+- [X] T004 Mapper (api/src/slices/agent/peer/data/peer.mapper.ts): map `origin`,
+      default legacy rows to `internal`; never map `token`/`outboundToken` outward;
+      external rows → `peerStatus: 'external'`, `peerExists: true`
+- [X] T005 Peer gateway (api/src/slices/agent/peer/domain/peer.gateway.ts + data impl):
+      `findByCardUrl(agentId, canonicalUrl)`, `updateExternal(rowId, …)`, and
+      serve-state accessors `recordPeersServed(agentId, hash)` /
+      `readPeersServed(agentId)`
+
+**Checkpoint**: schema + types compiled; `bunx tsc --noEmit` green in api/
+
+---
+
+## Phase 3: User Story 1 — a connected peer actually gets asked (P1) 🎯 MVP
+
+**Goal**: the model delegates instead of "I don't know" (FR-006/007/011); the console
+shows armed/pending and offers Restart now (FR-008).
+
+**Independent Test**: quickstart §5 (10/10 policy runs on a local pair) + §4.3
+(armed → pending → Restart now → armed).
+
+### Tests for User Story 1
+
+- [X] T006 [P] [US1] Extend api/src/slices/agent/peer/askAgent.tool.spec.ts: the
+      description contains the give-up rule (R3 text) **before** the "not a first
+      resort" caveat; explicit-naming sentence present; serving the list records
+      `peersServedAt`/`peersServedHash`; hash covers membership (changes on
+      connect/remove, stable across same-membership re-serve)
+- [X] T007 [P] [US1] Extend api/src/slices/agent/peer/peer.controller.spec.ts:
+      `GET /agents/:id/peers/state` — Owner/Admin JWT required; `armed:true` iff
+      stored hash matches current peers; `servedAt:null` when never served
+
+### Implementation for User Story 1
+
+- [X] T008 [US1] askAgent.tool.ts: add the FR-011 policy paragraph to
+      `BASE_DESCRIPTION` (exact text in research R3); call
+      `recordPeersServed` from `describeForRequest`/`isListedForRequest` after a
+      successful listing
+- [X] T009 [US1] peer.service.ts + peer.controller.ts + dtos/peersState.dto.ts:
+      `peersState(agentId)` computing `armed` (hash of sorted current row ids vs
+      stored), new `GET /agents/:agentId/peers/state` route with the standard envelope
+      (contracts/peers-v2-api.md)
+- [X] T010 [US1] Regenerate clients: `cd api && bun run build && bun run
+      generate:swagger`, then `cd admin && bun run build:api` — SDK gains
+      `getAgentPeersState`
+- [X] T011 [US1] Admin data/domain (admin/slices/agent/peer/data/peer.gateway.ts,
+      domain/peer.service.ts, domain/peer.types.ts): `peersState(agentId)` returning
+      `{ armed, servedAt }`
+- [X] T012 [US1] Admin store (admin/slices/agent/peer/stores/peer.ts): hold
+      `stateByAgent`, load with the tab, re-load after connect/remove/restart
+- [X] T013 [US1] Tab.vue (admin/slices/agent/peer/components/peer/Tab.vue): header
+      shows **armed** / **pending restart** chip from `peersState`; restart banner
+      becomes actionable — **Restart now** button wired to the existing agent-store
+      restart action (in-flight state respected); banner and chip refresh when state
+      flips
+- [X] T014 [US1] `cd admin && bun run typecheck` green
+
+**Checkpoint**: US1 demo — connect a peer, chip says pending, Restart now, chip says
+armed, domain question delegates (quickstart §4.3 + §5)
+
+---
+
+## Phase 4: User Story 2 — import an external agent by link (P2)
+
+**Goal**: connect any A2A-1.0 agent by URL with optional credential;
+replace-on-reimport; identical feed/step (FR-002…005, 009, 010).
+
+**Independent Test**: quickstart §3 (mock external agent over curl) + §4.2/4.4/4.5
+(console flow).
+
+### Tests for User Story 2
+
+- [X] T015 [P] [US2] Extend api/src/slices/agent/peer/domain/peer.service.spec.ts:
+      canonicalization (base and `.well-known` forms → one stored base); re-import of
+      same canonical URL updates in place (same row id, no insert); own-installation
+      URL → `PEER_SELF_URL`; fetch/version failure persists nothing; internal path
+      unchanged
+- [X] T016 [P] [US2] Extend api/src/slices/agent/peer/domain/a2a.client.spec.ts: no
+      `Authorization` header without a token; external 401/403 →
+      `PEER_UNAUTHORIZED`; version check unchanged
+- [X] T017 [P] [US2] Extend api/src/slices/agent/peer/domain/delegation.service.spec.ts:
+      credential picked by origin (pair `token` internal, `outboundToken` external);
+      delegation row for external peer has `peerAgentId:null`, `peerId` set
+- [X] T018 [P] [US2] DTO specs (api/src/slices/agent/peer/dtos): ConnectPeerDto one-of
+      (`peerAgentId` xor `url`, else `PEER_BODY`); AgentPeerDto poisoned-stub extends
+      to `outboundToken`; delegation DTO tolerates null `peerAgentId`
+
+### Implementation for User Story 2
+
+- [X] T019 [US2] dtos/connectPeer.dto.ts: one-of body `{ peerAgentId } | { url,
+      token? }` with class-validator cross-field check (`PEER_BODY` on both/neither)
+- [X] T020 [US2] domain/a2a.client.ts: token parameter optional on
+      `fetchCard`/`sendMessage`; map foreign 401/403 to `PEER_UNAUTHORIZED`
+- [X] T021 [US2] domain/peer.service.ts: `connectByUrl(agentId, url, token?)` —
+      canonicalize (accept both forms, store base), refuse own A2A base
+      (`PEER_SELF_URL` + hint), fetch card first, then upsert by `(agentId,
+      canonicalUrl)` (update in place on re-import); extend `refresh` (external →
+      re-read with `outboundToken`, 401 surfaces as cause) and `remove` (drop
+      credential); error codes `PEER_URL_INVALID` / `PEER_URL_UNREACHABLE` /
+      `PEER_VERSION` / `PEER_SELF_URL` in domain/peer.types.ts
+- [X] T022 [US2] peer.controller.ts: route the one-of body; re-import returns 200 with
+      the updated row (contracts/peers-v2-api.md); delegations DTO field
+      `peerAgentId` nullable
+- [X] T023 [US2] domain/delegation.service.ts: pick outbound credential by origin;
+      record `peerAgentId:null` for external
+- [X] T024 [US2] Regenerate clients (api swagger → `cd admin && bun run build:api`)
+- [X] T025 [US2] Admin types/store/gateway (admin/slices/agent/peer/…): `origin` on
+      `IAgentPeer`, `importByUrl(agentId, url, token?)`, delegation `peerAgentId`
+      nullable; **feed filter keys switch from peer agent id to connection id**
+      (Tab.vue peerFilter, Delegations.vue match, Row.vue emit)
+- [X] T026 [US2] Picker.vue: second path in the dialog — "By URL" input + optional
+      credential field, preview via the fetched card before Connect, error causes
+      surfaced; internal list path untouched
+- [X] T027 [P] [US2] Row.vue: external badge (origin) instead of live status; no
+      `/agents/…` link for external rows
+- [X] T028 [P] [US2] Delegations.vue: external marker on feed rows; peer-name link
+      only when `peerAgentId` present
+- [X] T029 [US2] `cd admin && bun run typecheck` green
+
+**Checkpoint**: quickstart §3 end-to-end against the mock agent; re-import never
+duplicates; credential nowhere in responses
+
+---
+
+## Phase 5: User Story 3 — the tab is called A2A (P3)
+
+**Goal**: tab label **and key** become `a2a` (R5 amended); old `?tab=peers` links
+still land (SC-007).
+
+**Independent Test**: quickstart §4.1.
+
+### Implementation for User Story 3
+
+- [X] T030 [US3] sections.ts (admin/slices/agent/agent/components/agent/workspace/):
+      tab entry → `value: 'a2a'`, `title: 'A2A'`, desc updated; `SectionCountKey`
+      member `'peers'` → `'a2a'`; update the file's URL-contract header comment
+- [X] T031 [US3] Legacy alias: at the single point the workspace reads `?tab=`
+      (admin/slices/agent/agent/components/agent/workspace/Main.vue or its page),
+      normalize `peers` → `a2a` before matching sections
+- [X] T032 [US3] Sweep count/section wiring for the renamed key (grep `'peers'` under
+      admin/slices/agent/agent/ — counts provider, Rail.vue if it names the key) and
+      update; tab content components stay in the `peer` slice unrenamed
+- [X] T033 [US3] `cd admin && bun run typecheck` green; manual: open `…?tab=peers`
+      link → lands on the A2A tab
+
+**Checkpoint**: all three stories independently demoable
+
+---
+
+## Phase 6: Polish & Cross-Cutting
+
+- [X] T034 [P] Docs: README peer/A2A section — external import, armed/pending, tab
+      rename; note the `?tab=peers` alias
+- [X] T035 Full gates: `cd api && bun run test` (all), `bunx tsc --noEmit`, both
+      console typechecks, lint pass on touched slice files
+- [X] T036 Quickstart §1–§4 full local run (mock script stays in scratchpad)
+- [ ] T037 Live validation, quickstart §5–§6 on ranch.cleanslice.org: give Skyhunter a
+      described card, `peers/state` before/after Restart now, re-ask "сколько crews в
+      skyhunter", record before/after on CLEAN-95
+- [X] T038 Update specs/014-a2a-protocol-upgrade/checklists/requirements.md status and
+      close out tasks.md marks
+
+---
+
+## Dependencies & Execution Order
+
+- **Phase 2 blocks everything** (schema/types/mapper/gateway).
+- **US1 (Phase 3)**: independent of US2/US3. MVP — measured by SC-001/002/005.
+- **US2 (Phase 4)**: depends on Phase 2 only; touches the same admin components as US1
+  (Tab.vue) — rebase order: land US1's Tab.vue changes first or coordinate edits.
+- **US3 (Phase 5)**: independent; one registry file + alias, safe any time after T001.
+- **Polish (Phase 6)**: after the stories you intend to ship; T037 needs a deploy.
+
+### Parallel opportunities
+
+- T006 ∥ T007 (different spec files); T015–T018 all ∥ (four files).
+- T027 ∥ T028 after T025.
+- US3 (T030–T033) can run fully parallel to US1/US2 by a second implementer — only
+  T032's grep may brush counts wiring shared with Tab.vue.
+
+## Parallel Example: User Story 2
+
+```bash
+Task: "T015 peer.service.spec — canonicalize/upsert/self-url"
+Task: "T016 a2a.client.spec — optional bearer"
+Task: "T017 delegation.service.spec — credential by origin"
+Task: "T018 DTO specs — one-of + poisoned outboundToken"
+# then T019–T023 sequentially (same service/controller files), then T024 → T025 → T026–T028
+```
+
+## Implementation Strategy
+
+MVP = Phase 1 + 2 + US1, then **stop and validate** with quickstart §5 — SC-001/002
+are the reason this feature exists (production baseline: zero delegations). Ship US2
+next (external import is the protocol's second half), US3 last (pure copy/key change).
+Commit per phase with `feat(peer): … (CLEAN-95)` / `feat(admin): … (CLEAN-95)`; Jira
+checkpoint comments (large task); PR stacked on `feat/CLEAN-94-add-peer-inline-info`.
+
+---
+
+## Status at hand-off (2026-09-16)
+
+37 of 38 done. **T037 (production validation, quickstart §5–§6) is the one
+open item** — it needs this branch deployed; the before/after against the
+zero-delegation baseline goes on CLEAN-95.
+
+Verified beyond the unit suites: quickstart §3 ran live against the local dev
+API with a throwaway mock A2A agent — preview-without-save, import (both URL
+forms canonicalize to one row), credential never in any response,
+re-import-updates-in-place, peers/state pending, external refresh, delete.
+Negative paths live too: PEER_URL_INVALID (SSRF guard), PEER_BODY,
+PEER_URL_UNREACHABLE in 74 ms. A commit-time security review added the SSRF
+hardening pass (redirects refused, IPv6 global-unicast-only, numeric
+shorthand refused, pre-flight DNS check); `A2A_ALLOW_PRIVATE_PEERS=true` is
+set in the local gitignored `api/.env.dev` for §3/§4 runs and must NOT be set
+in production.