@pi-in-go/pigpen-a2a 0.1.0

package/extensions/a2a/review_test.go

@@ -0,0 +1,293 @@
+package a2aext
+
+// Review findings (rev-pigpen-a2a). Each test names the finding it pins.
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/a2aproject/a2a-go/v2/a2a"
+)
+
+// H1: PiG's read, grep, find and ls tools accept absolute paths, so a "read-only" worker can read every file
+// the account can: PiG's credentials, SSH keys, other tenants' session files. The worker therefore gets no tools
+// unless the operator names them.
+func TestReview_WorkerHasNoToolsUnlessConfigured(t *testing.T) {
+	dir := t.TempDir()
+	writeConfig(t, dir, `{"listen":"127.0.0.1:5555","insecureNoAuth":true}`)
+	cfg, err := LoadConfig(LoadOptions{ConfigHome: dir, Getenv: envFrom(nil)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(cfg.Worker.Tools) != 0 {
+		t.Fatalf("default worker tools = %v; PiG's file tools are not confined to the workspace, so the default must be none", cfg.Worker.Tools)
+	}
+	w, err := NewProcessWorker(cfg.Worker, t.TempDir(), envFrom(nil))
+	if err != nil {
+		t.Fatal(err)
+	}
+	args := w.args(Turn{Principal: alice, ContextID: "c", Prompt: "p"})
+	if !contains(args, "--no-tools") || contains(args, "--tools") {
+		t.Fatalf("a worker without configured tools must run pig --no-tools: %v", args)
+	}
+	w, err = NewProcessWorker(WorkerConfig{Tools: []string{"read"}}, t.TempDir(), envFrom(nil))
+	if err != nil {
+		t.Fatal(err)
+	}
+	args = w.args(Turn{Principal: alice, ContextID: "c", Prompt: "p"})
+	if argValue(args, "--tools") != "read" || contains(args, "--no-tools") {
+		t.Fatalf("configured tools must be passed as the allowlist: %v", args)
+	}
+}
+
+// H1 end to end with a real pig: a worker configured only by a2a.json (no tools named) must not hand a peer the
+// contents of a file outside its workspace.
+func TestE2E_DefaultWorkerCannotReadFilesOutsideItsWorkspace(t *testing.T) {
+	bin := os.Getenv("PIG_A2A_E2E_BIN")
+	if bin == "" {
+		t.Skip("set PIG_A2A_E2E_BIN to a pig (or Piglet Binary) executable to run the real-PiG end-to-end tests")
+	}
+	home := t.TempDir()
+	agent := filepath.Join(home, "pig", "agent")
+	if err := os.MkdirAll(agent, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	llm := startE2ELLM(t)
+	models := map[string]any{"providers": map[string]any{"e2e": map[string]any{
+		"baseUrl": llm.baseURL(), "api": "openai-completions", "apiKey": "e2e-key",
+		"models": []any{map[string]any{"id": "e2e-1", "name": "e2e-1", "reasoning": false, "input": []string{"text"},
+			"contextWindow": 100000, "maxTokens": 4096, "cost": map[string]any{"input": 0, "output": 0, "cacheRead": 0, "cacheWrite": 0}}},
+	}}}
+	b, _ := json.Marshal(models)
+	if err := os.WriteFile(filepath.Join(agent, "models.json"), b, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	// A stand-in for the operator's credential store, in the temporary home (never the real one).
+	secret := filepath.Join(agent, "operator-secret.json")
+	const canary = "CANARY-7f3a-operator-credential"
+	if err := os.WriteFile(secret, []byte(canary), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	a2aJSON := fmt.Sprintf(`{"listen":"127.0.0.1:0","tokens":[{"name":"alice","tokenEnv":"TOKEN_A"}],
+	  "worker":{"command":%q,"provider":"e2e","model":"e2e-1","graceSeconds":5}}`, bin)
+	if err := os.WriteFile(filepath.Join(agent, "a2a.json"), []byte(a2aJSON), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	env := map[string]string{"PATH": os.Getenv("PATH"), "HOME": home, "PIG_HOME": filepath.Join(home, "pig"), "PIG_CODING_AGENT_DIR": agent, "TOKEN_A": tokenA}
+	getenv := func(k string) string { return env[k] }
+	cfg, err := LoadConfig(LoadOptions{ConfigHome: agent, Getenv: getenv})
+	if err != nil {
+		t.Fatal(err)
+	}
+	w, err := NewProcessWorker(cfg.Worker, cfg.StateDir, getenv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	s, err := NewServer(cfg, w, getenv)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := s.Start(); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
+		defer cancel()
+		_ = s.Shutdown(ctx)
+	})
+	c := a2aClient(t, "http://"+s.Addr(), tokenA)
+	task := sendTask(t, c, &a2a.SendMessageRequest{Message: textMessage("read the file " + secret)})
+	if got := taskText(task) + " " + fmt.Sprint(task.Status.Message); strings.Contains(got, canary) {
+		t.Fatalf("a peer read a file outside the worker's workspace: %q", got)
+	}
+	llm.mu.Lock()
+	defer llm.mu.Unlock()
+	if len(llm.tools) == 0 {
+		t.Fatal("the model was never called")
+	}
+	for _, tools := range llm.tools {
+		if len(tools) != 0 {
+			t.Fatalf("the model was offered %v without the operator naming any tool", tools)
+		}
+	}
+}
+
+// M1: with insecureNoAuth a loopback listener has no credential, so a web page that rebinds its own host name to
+// 127.0.0.1 would be same-origin with it and could drive it. Only loopback Host headers are served.
+func TestReview_InsecureLoopbackListenerRefusesAForeignHostHeader(t *testing.T) {
+	w := &scriptedWorker{}
+	s := startServer(t, Config{Listen: "127.0.0.1:0", InsecureNoAuth: true, MaxConcurrentTasks: 2, TaskTimeoutSeconds: 30}, w)
+	_, port, _ := net.SplitHostPort(s.Addr())
+	params := map[string]any{"message": map[string]any{"messageId": "m1", "role": "ROLE_USER", "parts": []any{map[string]any{"text": "hello there"}}}}
+	post := func(host string) int {
+		body, _ := json.Marshal(map[string]any{"jsonrpc": "2.0", "id": 1, "method": "SendMessage", "params": params})
+		req, _ := http.NewRequest(http.MethodPost, "http://"+s.Addr()+"/", bytes.NewReader(body))
+		req.Host = host
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("A2A-Version", "1.0")
+		resp, err := http.DefaultClient.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp.Body.Close()
+		return resp.StatusCode
+	}
+	if code := post("rebind.attacker.example:" + port); code != http.StatusForbidden {
+		t.Fatalf("a foreign Host on an unauthenticated listener got %d, want 403", code)
+	}
+	if n := len(w.Turns()); n != 0 {
+		t.Fatalf("the worker ran %d time(s) for a foreign Host", n)
+	}
+	for _, host := range []string{"127.0.0.1:" + port, "localhost:" + port, "[::1]:" + port} {
+		if code := post(host); code != http.StatusOK {
+			t.Fatalf("loopback Host %s got %d", host, code)
+		}
+	}
+}
+
+// M1: the Host check is only for the unauthenticated mode; a token already proves the caller.
+func TestReview_TokenListenerServesAnyHostHeader(t *testing.T) {
+	s := startServer(t, serverConfig(), &scriptedWorker{})
+	body, _ := json.Marshal(map[string]any{"jsonrpc": "2.0", "id": 1, "method": "ListTasks", "params": map[string]any{}})
+	req, _ := http.NewRequest(http.MethodPost, "http://"+s.Addr()+"/", bytes.NewReader(body))
+	req.Host = "pig.example.com"
+	req.Header.Set("Authorization", "Bearer "+tokenA)
+	req.Header.Set("A2A-Version", "1.0")
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("a token caller behind a proxy got %d", resp.StatusCode)
+	}
+}
+
+// M2: credentials are pinned to the configured origin, scheme included: an https remote's token must never go
+// over plain http to the same host (a card, or a redirect target, naming http://).
+func TestReview_CredentialsAreNotDowngradedToPlainHTTP(t *testing.T) {
+	var mu sync.Mutex
+	var got []string
+	plain := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		mu.Lock()
+		got = append(got, r.Header.Get("Authorization"))
+		mu.Unlock()
+	}))
+	defer plain.Close()
+	host := strings.TrimPrefix(plain.URL, "http://")
+	rs := NewRemotes(map[string]RemoteAgent{"peer": {URL: "https://" + host, BearerTokenEnv: "T", TimeoutSeconds: 5}}, envFrom(map[string]string{"T": "secret-value"}))
+	hc, err := rs.httpClient("peer", rs.cfg["peer"])
+	if err != nil {
+		t.Fatal(err)
+	}
+	req, _ := http.NewRequest(http.MethodGet, plain.URL+"/rpc", nil)
+	if resp, err := hc.Transport.RoundTrip(req); err == nil {
+		resp.Body.Close()
+		t.Fatal("the transport sent an https remote's credentials over http")
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if len(got) != 0 {
+		t.Fatalf("credentials reached the plain-http port: %q", got)
+	}
+
+	card := &a2a.AgentCard{SupportedInterfaces: []*a2a.AgentInterface{a2a.NewAgentInterface("http://"+host+"/rpc", a2a.TransportProtocolJSONRPC)}}
+	if _, err := pinnedInterface("peer", rs.cfg["peer"], card); err == nil {
+		t.Fatal("a card that downgrades an https remote to http must be refused while credentials are configured")
+	}
+	same := &a2a.AgentCard{SupportedInterfaces: []*a2a.AgentInterface{a2a.NewAgentInterface("https://"+host+"/rpc", a2a.TransportProtocolJSONRPC)}}
+	if _, err := pinnedInterface("peer", rs.cfg["peer"], same); err != nil {
+		t.Fatalf("the configured origin must be accepted: %v", err)
+	}
+}
+
+// L1 (mutation survivor): the per-context lock is per principal, so two tenants that pick the same contextId do
+// not queue behind each other.
+func TestReview_SameContextIDInTwoTenantsRunsConcurrently(t *testing.T) {
+	var w *scriptedWorker
+	w = &scriptedWorker{run: func(ctx context.Context, tn Turn, up func(Update)) (Result, error) {
+		// Wait (bounded) for the other tenant's turn to be running too; a shared lock would keep it queued.
+		deadline := time.Now().Add(3 * time.Second)
+		for w.running.Load() < 2 && time.Now().Before(deadline) {
+			time.Sleep(10 * time.Millisecond)
+		}
+		return Result{Text: "ok"}, nil
+	}}
+	s := startServer(t, serverConfig(), w)
+	var wg sync.WaitGroup
+	for _, token := range []string{tokenA, tokenB} {
+		c := a2aClient(t, "http://"+s.Addr(), token)
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			m := textMessage("same id")
+			m.ContextID = "shared-name"
+			_, _ = c.SendMessage(context.Background(), &a2a.SendMessageRequest{Message: m})
+		}()
+	}
+	wg.Wait()
+	if w.maxRun.Load() != 2 {
+		t.Fatalf("two tenants' contexts must not share a lock: max concurrent %d", w.maxRun.Load())
+	}
+}
+
+// L2 (mutation survivor): a process the worker started and left behind is killed after a normal turn.
+func TestReview_WorkerKillsWhatATurnLeftBehind(t *testing.T) {
+	w, logPath, _ := newTestWorker(t)
+	res, err := w.Run(context.Background(), Turn{Principal: alice, ContextID: "c", TaskID: "t", Prompt: "ORPHAN please"}, func(Update) {})
+	if err != nil || res.Failure != "" {
+		t.Fatalf("%+v %v", res, err)
+	}
+	l := readFakeLog(t, logPath)
+	if l.ChildPID == 0 {
+		t.Fatal("the fake pig did not start a child")
+	}
+	waitFor(t, func() bool { return !processAlive(l.ChildPID) }, "the left-behind child to be killed")
+}
+
+// H1 inside the Piglet Binary: the Binary hosts the listener from an a2a.json that names no tools; a peer asking its
+// worker (the same Binary) to read a file outside the workspace gets nothing from it.
+func TestBinary_DefaultWorkerCannotReadFilesOutsideItsWorkspace(t *testing.T) {
+	bin := os.Getenv("PIG_A2A_BINARY")
+	if bin == "" {
+		t.Skip("set PIG_A2A_BINARY to the Piglet Binary built from piglets/a2a to run the Binary proof")
+	}
+	const canary = "CANARY-51c2-operator-credential"
+	var secret string
+	env, work, port, llm := binaryHome(t, bin, func(port int, work string) string {
+		secret = filepath.Join(filepath.Dir(work), "pig", "agent", "operator-secret.json")
+		return fmt.Sprintf(`{"listen":"127.0.0.1:%d","tokens":[{"name":"alice","tokenEnv":"A2A_TOKEN_A"}],
+		  "worker":{"command":%q,"cwd":%q,"provider":"e2e","model":"e2e-1"}}`, port, bin, work)
+	})
+	if err := os.WriteFile(secret, []byte(canary), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	startBinaryHost(t, bin, env, work)
+	addr := fmt.Sprintf("127.0.0.1:%d", port)
+	if !waitDial(t, addr, true, 60*time.Second) {
+		t.Fatal("the Binary never opened the configured A2A listener")
+	}
+	c := a2aClient(t, "http://"+addr, tokenA)
+	task := sendTask(t, c, &a2a.SendMessageRequest{Message: textMessage("read the file " + secret)})
+	if got := taskText(task) + " " + fmt.Sprint(task.Status.Message); strings.Contains(got, canary) {
+		t.Fatalf("a peer read a file outside the worker's workspace through the Binary: %q", got)
+	}
+	llm.mu.Lock()
+	defer llm.mu.Unlock()
+	for _, tools := range llm.tools {
+		if len(tools) != 0 {
+			t.Fatalf("the Binary's worker offered %v without a2a.json naming any tool", tools)
+		}
+	}
+}

package/extensions/a2a/server.go

@@ -0,0 +1,267 @@
+package a2aext
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"log/slog"
+	"net"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/a2aproject/a2a-go/v2/a2a"
+	"github.com/a2aproject/a2a-go/v2/a2asrv"
+	"github.com/a2aproject/a2a-go/v2/a2asrv/taskstore"
+)
+
+// ProtocolVersion is the only A2A protocol version served and spoken.
+const ProtocolVersion = a2a.Version
+
+const (
+	maxBodyBytes    = 1 << 20
+	agentVersion    = "0.1.0"
+	shutdownTimeout = 20 * time.Second
+)
+
+// Server is the A2A listener.
+type Server struct {
+	cfg     Config
+	auth    *Authenticator
+	exec    *executor
+	handler http.Handler
+	cancel  context.CancelFunc
+
+	mu     sync.Mutex
+	srv    *http.Server
+	ln     net.Listener
+	served chan struct{} // closed when the Serve goroutine has returned
+	logs   []string
+
+	// The Agent Card is the same document for every request, so its handler (which holds the encoded card) is
+	// kept for as long as the advertised URL is the same.
+	cardMu      sync.Mutex
+	cardURL     string
+	cardHandler http.Handler
+}
+
+// NewServer builds the server. It does not listen until Start.
+func NewServer(cfg Config, worker Worker, getenv func(string) string) (*Server, error) {
+	if getenv == nil {
+		getenv = func(string) string { return "" }
+	}
+	cfg.applyDefaults()
+	if err := cfg.validate(getenv); err != nil {
+		return nil, err
+	}
+	if worker == nil {
+		return nil, errors.New("a2a: server needs a worker")
+	}
+	auth, err := NewAuthenticator(cfg.Tokens, getenv, cfg.InsecureNoAuth)
+	if err != nil {
+		return nil, err
+	}
+	base, cancel := context.WithCancel(context.Background())
+	s := &Server{cfg: cfg, auth: auth, cancel: cancel}
+	s.exec = newExecutor(base, worker, cfg.MaxConcurrentTasks, time.Duration(cfg.TaskTimeoutSeconds)*time.Second, s.logf)
+
+	// The store is ours so that guard can ask it who owns a task: a2a-go's SubscribeToTask attaches to a live
+	// task's event queue without consulting the store, so without this check any authenticated caller who
+	// knew a task id could read another tenant's live stream (found by TestSubscribeToALiveTaskDeliversTheRest).
+	store := taskstore.NewInMemory(&taskstore.InMemoryStoreConfig{Authenticator: a2asrv.NewTaskStoreAuthenticator()})
+	handler := a2asrv.NewHandler(s.exec,
+		a2asrv.WithTaskStore(store),
+		a2asrv.WithCallInterceptors(guard{store: store}),
+		// The a2a-go logger writes to stderr, which is PiG's terminal when the extension is fused.
+		a2asrv.WithLogger(slog.New(slog.NewTextHandler(io.Discard, nil))),
+	)
+	mux := http.NewServeMux()
+	mux.Handle("POST /{$}", http.MaxBytesHandler(a2asrv.NewJSONRPCHandler(handler), maxBodyBytes))
+	mux.HandleFunc(a2asrv.WellKnownAgentCardPath, s.serveCard)
+	s.handler = auth.Wrap(mux, func(r *http.Request) bool { return r.URL.Path == a2asrv.WellKnownAgentCardPath })
+	return s, nil
+}
+
+func (s *Server) logf(format string, args ...any) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.logs = append(s.logs, fmt.Sprintf(format, args...))
+	if len(s.logs) > 50 {
+		s.logs = s.logs[len(s.logs)-50:]
+	}
+}
+
+// RecentLogs returns the last server messages (task failures, listener errors).
+func (s *Server) RecentLogs() []string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return append([]string(nil), s.logs...)
+}
+
+// Handler returns the HTTP handler (authentication included).
+func (s *Server) Handler() http.Handler { return s.handler }
+
+func (s *Server) baseURL() string {
+	if s.cfg.ExternalURL != "" {
+		return strings.TrimRight(s.cfg.ExternalURL, "/")
+	}
+	scheme := "http"
+	if s.cfg.TLS != nil {
+		scheme = "https"
+	}
+	return scheme + "://" + s.Addr()
+}
+
+func (s *Server) card() *a2a.AgentCard {
+	return &a2a.AgentCard{
+		Name: s.cfg.Name, Description: s.cfg.Description, Version: agentVersion,
+		SupportedInterfaces: []*a2a.AgentInterface{a2a.NewAgentInterface(s.baseURL(), a2a.TransportProtocolJSONRPC)},
+		Capabilities:        a2a.AgentCapabilities{Streaming: true},
+		DefaultInputModes:   []string{"text/plain"}, DefaultOutputModes: []string{"text/plain"},
+		Skills: []a2a.AgentSkill{{
+			ID: "pig-task", Name: "PiG task",
+			Description: "Runs a task with a PiG coding agent. Each contextId is one PiG session; a later task in the same context continues it.",
+			Tags:        []string{"coding", "pig"}, Examples: []string{"Summarise the layout of the repository."},
+			InputModes: []string{"text/plain"}, OutputModes: []string{"text/plain"},
+		}},
+		SecuritySchemes: a2a.NamedSecuritySchemes{"bearer": a2a.HTTPAuthSecurityScheme{Scheme: "Bearer", Description: "Static bearer token issued by the operator."}},
+		SecurityRequirements: a2a.SecurityRequirementsOptions{
+			a2a.SecurityRequirements{"bearer": a2a.SecuritySchemeScopes{}},
+		},
+	}
+}
+
+func (s *Server) serveCard(w http.ResponseWriter, r *http.Request) {
+	url := s.baseURL()
+	s.cardMu.Lock()
+	if s.cardHandler == nil || s.cardURL != url {
+		s.cardHandler, s.cardURL = a2asrv.NewStaticAgentCardHandler(s.card()), url
+	}
+	h := s.cardHandler
+	s.cardMu.Unlock()
+	h.ServeHTTP(w, r)
+}
+
+// Start listens and serves in the background.
+func (s *Server) Start() error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.srv != nil {
+		return errors.New("a2a: server already started")
+	}
+	ln, err := net.Listen("tcp", s.cfg.Listen)
+	if err != nil {
+		return fmt.Errorf("a2a: listen %s: %w", s.cfg.Listen, err)
+	}
+	// The default error log writes to stderr, which is PiG's terminal when the extension is fused.
+	srv := &http.Server{Handler: s.handler, ReadHeaderTimeout: 10 * time.Second, IdleTimeout: 2 * time.Minute,
+		ErrorLog: log.New(io.Discard, "", 0)}
+	if s.cfg.TLS != nil {
+		cert, err := tls.LoadX509KeyPair(s.cfg.TLS.CertFile, s.cfg.TLS.KeyFile)
+		if err != nil {
+			_ = ln.Close()
+			return fmt.Errorf("a2a: load TLS key pair: %w", err)
+		}
+		srv.TLSConfig = &tls.Config{Certificates: []tls.Certificate{cert}, MinVersion: tls.VersionTLS12}
+		ln = tls.NewListener(ln, srv.TLSConfig)
+	}
+	s.srv, s.ln = srv, ln
+	s.served = make(chan struct{})
+	go func() {
+		defer close(s.served)
+		if err := srv.Serve(ln); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			s.logf("listener stopped: %v", err)
+		}
+	}()
+	return nil
+}
+
+// Addr is the bound address, or "" before Start.
+func (s *Server) Addr() string {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.ln == nil {
+		return ""
+	}
+	return s.ln.Addr().String()
+}
+
+// ActiveTasks counts tasks that are queued or running.
+func (s *Server) ActiveTasks() int { return int(s.exec.active.Load()) }
+
+// Shutdown stops accepting connections, cancels running turns and waits for their workers.
+func (s *Server) Shutdown(ctx context.Context) error {
+	s.mu.Lock()
+	srv, ln, served := s.srv, s.ln, s.served
+	s.mu.Unlock()
+	s.cancel()
+	var errs []error
+	if err := s.exec.shutdown(ctx); err != nil {
+		errs = append(errs, err)
+	}
+	if srv != nil {
+		// Streams end once their tasks stop; close whatever is left.
+		sctx, cancel := context.WithTimeout(ctx, shutdownTimeout)
+		defer cancel()
+		if err := srv.Shutdown(sctx); err != nil {
+			_ = srv.Close()
+		}
+		// http.Server closes only the listeners its Serve goroutine has already registered. If Shutdown wins the
+		// race with that goroutine's start, the port would stay open until it ran, so close it here as well
+		// (a second close is harmless) and wait for Serve to return.
+		_ = ln.Close()
+		<-served
+	}
+	return errors.Join(errs...)
+}
+
+// guard is the call interceptor that enforces the pinned protocol version, attaches the
+// authenticated principal and keeps callers inside their tenant.
+type guard struct {
+	store taskstore.Store
+	a2asrv.PassthroughCallInterceptor
+}
+
+func (g guard) Before(ctx context.Context, callCtx *a2asrv.CallContext, req *a2asrv.Request) (context.Context, any, error) {
+	if v, ok := callCtx.ServiceParams().Get(a2a.SvcParamVersion); !ok || !versionsOK(v) {
+		return ctx, nil, a2a.ErrVersionNotSupported
+	}
+	p, ok := PrincipalFrom(ctx)
+	if !ok {
+		return ctx, nil, a2a.ErrUnauthenticated
+	}
+	if t := callCtx.Tenant(); t != "" && t != p.Tenant {
+		return ctx, nil, a2a.ErrUnauthorized
+	}
+	callCtx.User = a2asrv.NewAuthenticatedUser(p.Key(), map[string]any{"name": p.Name, "tenant": p.Tenant})
+	if sub, ok := req.Payload.(*a2a.SubscribeToTaskRequest); ok && sub != nil && g.store != nil {
+		// Ownership is masked as "not found", as the spec's task lookups are (§3.3.2).
+		if _, err := g.store.Get(ctx, sub.ID); err != nil {
+			return ctx, nil, a2a.ErrTaskNotFound
+		}
+	}
+	return ctx, nil, nil
+}
+
+// versionsOK accepts the header when every value it carries is 1.0. kagent's client sends the
+// header twice (the SDK's own and its static-header interceptor's), which HTTP folds into "1.0, 1.0".
+func versionsOK(values []string) bool {
+	n := 0
+	for _, v := range values {
+		for _, one := range strings.Split(v, ",") {
+			if !versionOK(strings.TrimSpace(one)) {
+				return false
+			}
+			n++
+		}
+	}
+	return n > 0
+}
+
+func versionOK(v string) bool {
+	return v == string(ProtocolVersion) || strings.HasPrefix(v, string(ProtocolVersion)+".")
+}