Skip to content

A2A Conformance Currency

This note owns the deliberately hand-maintained relationship between Fgentic's A2A wire claim and its Go implementation dependency. Protocol conformance is explicit rather than inferred from an SDK version, as required by ADR 0017. A change to either side must evaluate and update the other side through this note.

Current baseline

Concern Current baseline Source of truth
Specification A2A specification 1.0.1 The revision-pinned specification linked by ADR 0017 and the conformance claim in Security Boundaries
Service version A2A-Version: 1.0 and AgentCard protocolVersion: "1.0" ADR 0017; the literal request-header contract remains independent of the SDK version
Binding AgentCard protocolBinding: "JSONRPC" over JSON-RPC 2.0 ADR 0017
Go SDK github.com/a2aproject/a2a-go/v2 v2.4.0 The bridge's go.mod; this pin does not establish the protocol revision
Canonical operations SendMessage, GetTask, and CancelTask ADR 0017, using the A2A v1 names canonicalized by #242; the pre-v1 JSON-RPC method-name convention recorded historically in ADR 0004 is not the v1 operation set — mise run check:a2a-operation-names fails closed on any other surface still using it

The bridge uses non-streaming SendMessage, polls an acknowledged long-running task with GetTask, and uses CancelTask only on the bounded cancellation paths permitted by ADR 0017. Its client and contract tests are implementation evidence, not alternative sources for the protocol revision.

Revision watch

Review both upstream streams:

  1. A2A specification releases, including the revision-pinned specification and migration material attached to a release.
  2. a2aproject/a2a-go releases, including release notes and deprecation notices for the pinned v2 line.

Open a focused evaluation before changing a pin or conformance claim when any of these signals appears:

  1. A new stable A2A specification revision is published. Drafts and release candidates are observed but are not adoption targets.
  2. a2a-go publishes a new major version.
  3. Either upstream opens a deprecation window affecting Fgentic's version header, JSON-RPC binding, operation names, AgentCard shape or signing, task lifecycle, or extension negotiation.

An SDK minor or patch still receives its normal dependency review, but it does not by itself change the A2A specification claim. Conversely, a new specification revision is evaluated even when no SDK release accompanies it.

Adoption checklist

Before adopting a new specification revision or SDK major, record evidence for every item:

  1. Delegation lifecycle: non-streaming SendMessage still returns the supported Task | Message result, and acknowledged long-running tasks still resume only through GetTask polling. Confirm the bounded CancelTask paths and ensure no streaming or subscription behavior becomes implicit.
  2. Signed AgentCards: the pinned remote AgentCard remains verified as a currently valid JWS using the configured ES256 identity before it becomes routing input. Confirm that the signed payload, supportedInterfaces, version fields, key selection, and refresh behavior have not changed incompatibly.
  3. Extension negotiation: the A2A-Extensions negotiation used by #114 remains valid, including fail-closed handling for required extensions. Re-evaluate the Stable token-budget URI and the Experimental quote, signed-usage-receipt, and mandate-profile URIs registered in the Public Surface Stability Contract; the latter are owned by #142, #141, and #144 respectively.
  4. Remote authorization: ADR 0017's assumptions remain true: the configured route is authoritative, remote routes receive no local A2A_API_KEY, the selected JSON-RPC interface stays pinned to the verified card and configured target, and the applicable OIDC/mTLS plus per-partner authorization remains fail closed.
  5. Canonical operations and wire versions: compare the upstream operation set with SendMessage, GetTask, and CancelTask; then verify the explicit A2A-Version, protocolVersion, protocolBinding, and JSON-RPC values without deriving any of them from an SDK constant.
  6. Evidence and public claims: update the baseline in this note, the claim in Security Boundaries, the decision context in ADR 0017 through a superseding ADR when the settled decision changes, and the A2A entries in the Public Surface Stability Contract. Update the bridge go.mod pin only when the evaluated SDK is adopted. These surfaces move in one PR so none can silently drift.

Coupling boundary

The wire contract crosses the bridge, agentgateway, and the target A2A runtime, so adoption is not safe merely because the bridge compiles with a new SDK.

Coupled with agentgateway's pin set (#63): changes to the service-version header, AgentCard/interface rewriting, JSON-RPC transport or operation routing, extension-header forwarding, authentication/authorization behavior, and target-runtime compatibility require evaluation against the pinned agentgateway, kagent, Gateway API, and Traefik set. Move a coupled infrastructure pin only through that set's upgrade process and prove the same positive and fail-closed paths.

Bridge-local: the a2a-go module pin, client construction and result mapping, non-streaming send/poll/cancel control flow, Signed AgentCard verification/cache behavior, and bridge contract/unit tests are owned by the bridge. A bridge-local SDK update still runs the full checklist above; it must not imply that agentgateway or kagent supports a new wire revision.