codex-a2a 0.6.1__tar.gz → 0.7.0__tar.gz

codex_a2a-0.7.0/.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 1
+    commit-message:
+      prefix: "deps"
+    labels:
+      - "dependencies"
+    groups:
+      uv-all-updates:
+        patterns:
+          - "*"

{codex_a2a-0.6.1 → codex_a2a-0.7.0}/.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-name: CI
+name: Validation
 
 on:
   pull_request:
@@ -11,11 +11,12 @@ permissions:
 
 jobs:
   quality-gate:
+    name: Validation Baseline
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Setup Python
         uses: actions/setup-python@v6
@@ -34,6 +35,7 @@ jobs:
         run: bash ./scripts/validate_baseline.sh
 
   runtime-matrix:
+    name: Runtime Matrix (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -42,7 +44,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Setup Python
         uses: actions/setup-python@v6

codex_a2a-0.7.0/.github/workflows/dependency-health.yml

@@ -0,0 +1,32 @@
+name: Dependency Health
+
+on:
+  workflow_dispatch:
+  schedule:
+    # 03:00 UTC on day-of-month 1
+    - cron: "0 3 1 * *"
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-health:
+    name: Dependency Health Audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: false
+
+      - name: Run dependency health checks
+        run: bash ./scripts/dependency_health.sh

{codex_a2a-0.6.1 → codex_a2a-0.7.0}/.github/workflows/publish.yml

@@ -1,4 +1,4 @@
-name: Publish
+name: Release Publish
 
 on:
   push:
@@ -18,6 +18,7 @@ on:
 
 jobs:
   build_release_artifacts:
+    name: Build Release Artifacts
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -27,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag_name || github.ref_name }}
@@ -42,6 +43,17 @@ jobs:
         with:
           enable-cache: true
 
+      - name: Sync dependencies
+        run: uv sync --all-extras --frozen
+
+      - name: Export runtime requirements for vulnerability audit
+        run: >
+          uv export --format requirements.txt --no-dev --locked --no-emit-project
+          --output-file /tmp/runtime-requirements.txt >/dev/null
+
+      - name: Run runtime dependency vulnerability audit
+        run: uv run pip-audit --requirement /tmp/runtime-requirements.txt
+
       - name: Resolve release tag
         id: release_tag
         run: echo "tag=${RELEASE_TAG}" >> "$GITHUB_OUTPUT"
@@ -96,13 +108,14 @@ jobs:
           WHEEL_PATH: ${{ steps.wheel.outputs.wheel_path }}
 
       - name: Upload built artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: ${{ steps.artifact_name.outputs.name }}
           path: dist/
           if-no-files-found: error
 
   publish_pypi:
+    name: Publish to PyPI
     runs-on: ubuntu-latest
     needs: build_release_artifacts
     if: github.event_name == 'push' || inputs.publish_to_pypi
@@ -111,7 +124,7 @@ jobs:
 
     steps:
       - name: Download built artifacts
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           name: ${{ needs.build_release_artifacts.outputs.artifact_name }}
           path: dist
@@ -120,6 +133,7 @@ jobs:
         uses: pypa/gh-action-pypi-publish@release/v1
 
   publish_github_release:
+    name: Sync GitHub Release
     runs-on: ubuntu-latest
     needs:
       - build_release_artifacts
@@ -133,12 +147,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Download built artifacts
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           name: ${{ needs.build_release_artifacts.outputs.artifact_name }}
           path: dist

{codex_a2a-0.6.1 → codex_a2a-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-a2a
-Version: 0.6.1
+Version: 0.7.0
 Summary: Codex A2A runtime adapter
 Author: liujuanjuan1984@Intelligent-Internet
 License-Expression: Apache-2.0
@@ -22,22 +22,27 @@ Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: a2a-sdk==0.3.25
+Requires-Dist: a2a-sdk==0.3.26
 Requires-Dist: aiosqlite<1.0,>=0.20
-Requires-Dist: fastapi<0.111,>=0.110
+Requires-Dist: fastapi<0.136,>=0.121
 Requires-Dist: httpx<0.29,>=0.28.1
+Requires-Dist: protobuf<8.0,>=6.33.5
+Requires-Dist: pyasn1<1.0,>=0.6.3
 Requires-Dist: pydantic<3.0,>=2.6
 Requires-Dist: pydantic-settings<3.0,>=2.2
+Requires-Dist: requests<3.0,>=2.33.0
 Requires-Dist: sqlalchemy<3.0,>=2.0
-Requires-Dist: sse-starlette<3.0,>=2.1
-Requires-Dist: uvicorn<0.30,>=0.29
+Requires-Dist: sse-starlette<4.0,>=2.1
+Requires-Dist: uvicorn<0.45,>=0.29
 Provides-Extra: dev
+Requires-Dist: pip-audit<3.0,>=2.9; extra == "dev"
 Requires-Dist: pre-commit>=3.7; extra == "dev"
+Requires-Dist: pygments<3.0,>=2.20.0; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
 Requires-Dist: pytest-cov<8.0,>=5.0; extra == "dev"
 Requires-Dist: ruff>=0.5; extra == "dev"
-Requires-Dist: mypy<1.12,>=1.11; extra == "dev"
+Requires-Dist: mypy<1.21,>=1.11; extra == "dev"
 Dynamic: license-file
 
 # codex-a2a
@@ -193,6 +198,7 @@ The normative compatibility split and deployment model live in [Compatibility Gu
 - [Architecture Guide](docs/architecture.md) System structure, boundaries, and request flow.
 - [Maintainer Architecture Guide](docs/maintainer-architecture.md) Internal module structure, request call chains, and persistence touchpoints for contributors.
 - [Compatibility Guide](docs/compatibility.md) Supported Python/runtime surface, extension stability, and ecosystem-facing compatibility expectations.
+- [External Conformance Experiments](docs/conformance.md) Manual A2A TCK experiment entrypoint and triage workflow.
 - [Security Policy](SECURITY.md) Threat model, deployment caveats, and vulnerability disclosure guidance.
 
 ## Development

{codex_a2a-0.6.1 → codex_a2a-0.7.0}/README.md

@@ -151,6 +151,7 @@ The normative compatibility split and deployment model live in [Compatibility Gu
 - [Architecture Guide](docs/architecture.md) System structure, boundaries, and request flow.
 - [Maintainer Architecture Guide](docs/maintainer-architecture.md) Internal module structure, request call chains, and persistence touchpoints for contributors.
 - [Compatibility Guide](docs/compatibility.md) Supported Python/runtime surface, extension stability, and ecosystem-facing compatibility expectations.
+- [External Conformance Experiments](docs/conformance.md) Manual A2A TCK experiment entrypoint and triage workflow.
 - [Security Policy](SECURITY.md) Threat model, deployment caveats, and vulnerability disclosure guidance.
 
 ## Development

{codex_a2a-0.6.1 → codex_a2a-0.7.0}/docs/architecture.md

@@ -93,6 +93,7 @@ Use the docs by responsibility:
 - [Maintainer Architecture Guide](maintainer-architecture.md): internal module boundaries, request call chains, and persistence touchpoints
 - [Extension Specifications](extension-specifications.md): stable extension URI/spec index and public-vs-extended disclosure rules
 - [Compatibility Guide](compatibility.md): current compatibility promises and stability expectations
+- [External Conformance Experiments](conformance.md): manual A2A TCK experiment entrypoint and triage workflow
 - [Contributing Guide](../CONTRIBUTING.md): contributor workflow and validation
 - [Security Policy](../SECURITY.md): threat model and disclosure guidance
 

{codex_a2a-0.6.1 → codex_a2a-0.7.0}/docs/compatibility.md

@@ -7,9 +7,12 @@ This document explains the compatibility promises this repository currently trie
 - Python versions: 3.11, 3.12, 3.13
 - A2A SDK line: `0.3.x`
 - A2A protocol version advertised by default: `0.3.0`
+- Normalized protocol compatibility lines declared today: `0.3`, `1.0`
 
 The repository pins the SDK version in `pyproject.toml` and validates the published CLI build in CI. Upgrade the SDK deliberately rather than relying on floating dependency resolution.
 
+The authenticated compatibility profile and wire contract publish `default_protocol_version`, `supported_protocol_versions`, and `protocol_compatibility`. Request-time `A2A-Version` negotiation currently supports the default `0.3` line plus a partial `1.0` compatibility line for response header echo, PascalCase JSON-RPC method aliases, and protocol-aware error shaping. Transport payload schemas, enums, pagination, and push-notification behavior remain SDK-owned `0.3` behavior until separately implemented.
+
 ## Contract Honesty
 
 Machine-readable discovery surfaces must reflect actual runtime behavior:

codex_a2a-0.7.0/docs/conformance-triage.md

@@ -0,0 +1,49 @@
+# External Conformance Triage
+
+This document is the standing triage template for local `./scripts/conformance.sh` runs against the official `a2aproject/a2a-tck`.
+
+## Standards Used For Triage
+
+- `a2a-sdk==0.3.26` as installed in this repository.
+- The default A2A protocol version advertised by this repository: `0.3.0`.
+- Repository compatibility policy:
+  - machine-readable Agent Card and OpenAPI contracts must reflect implemented runtime behavior;
+  - external TCK results are investigation input rather than default merge gates;
+  - unsupported `1.0` behavior should be tracked as future compatibility work, not silently declared as supported.
+
+## Classification Labels
+
+- `Runtime issue`: the failure reproduces against the repository's declared runtime behavior and should be fixed here.
+- `TCK mismatch`: the failure appears to conflict with the installed SDK line or this repository's declared v0.3 baseline.
+- `Future protocol gap`: the failure is not a v0.3 regression, but it identifies work needed for stronger v1.0 compatibility.
+- `Local experiment artifact`: the failure comes from the dummy-backed SUT, local auth, local URLs, timing, or other experiment setup details.
+- `Needs repro`: the failure needs a focused local probe before assigning ownership.
+
+## Triage Workflow
+
+For each failed or errored node ID:
+
+1. Copy the node ID from `failed-tests.json`.
+2. Inspect the corresponding raw details in `pytest-report.json` and `tck.log`.
+3. Compare the expectation with `docs/compatibility.md`, authenticated Agent Card params, and OpenAPI `x-a2a-extension-contracts`.
+4. Assign one classification label.
+5. Record whether the next action belongs in this repository, the TCK, or a future protocol compatibility issue.
+
+## Per-Test Triage
+
+Add dated entries below after a real run:
+
+```text
+YYYY-MM-DD:
+- <nodeid>: <classification>. <short rationale>. Next action: <repo/TCK/future/none>.
+```
+
+## Summary
+
+Keep the summary short and separate:
+
+- Count clean runtime issues.
+- Count TCK mismatches.
+- Count future protocol gaps.
+- Count local experiment artifacts.
+- List follow-up issue numbers when created.

codex_a2a-0.7.0/docs/conformance.md

@@ -0,0 +1,78 @@
+# External Conformance Experiments
+
+This repository keeps internal regression and external interoperability experiments separate on purpose.
+
+## Scope
+
+- `./scripts/doctor.sh` and `./scripts/validate_baseline.sh` remain the default internal regression entrypoints.
+- `./scripts/conformance.sh` is a local/manual experiment entrypoint for official external tooling.
+- External conformance output is investigation input, not an automatic merge gate.
+
+## Current Experiment Shape
+
+The default `./scripts/conformance.sh` workflow does the following:
+
+1. Syncs the repository environment unless explicitly skipped.
+2. Caches or refreshes the official `a2aproject/a2a-tck` checkout.
+3. Starts a local dummy-backed `codex-a2a` runtime unless `CONFORMANCE_SUT_URL` points to an existing SUT.
+4. Runs the requested TCK category, defaulting to `mandatory`.
+5. Preserves raw logs and machine-readable reports under `run/conformance/<timestamp>/`.
+
+The default local SUT uses the repository test double `DummyChatCodexClient`. That keeps the experiment reproducible without requiring a live Codex upstream.
+
+## Usage
+
+Run the default mandatory experiment:
+
+```bash
+bash ./scripts/conformance.sh
+```
+
+Run a different TCK category:
+
+```bash
+bash ./scripts/conformance.sh capabilities
+```
+
+Target an already running runtime instead of the local dummy-backed SUT:
+
+```bash
+CONFORMANCE_SUT_URL=http://127.0.0.1:8000 \
+A2A_AUTH_TYPE=bearer \
+A2A_AUTH_TOKEN=dev-token \
+bash ./scripts/conformance.sh mandatory
+```
+
+Skip local environment sync when the repository and cached TCK environment are already current:
+
+```bash
+CONFORMANCE_SKIP_REPO_SYNC=1 \
+CONFORMANCE_SKIP_TCK_SYNC=1 \
+bash ./scripts/conformance.sh mandatory
+```
+
+## Artifacts
+
+Each run keeps the following artifacts in the selected output directory:
+
+- `agent-card.json`: fetched public Agent Card
+- `health.json`: fetched authenticated health payload when the local SUT is used
+- `repo-health.log`: repository environment sync and dependency compatibility output
+- `tck.log`: raw TCK console output
+- `pytest-report.json`: pytest-json-report output emitted by the TCK runner when available
+- `failed-tests.json`: compact list of failed/error node IDs for triage when a report is available
+- `metadata.json`: experiment metadata including local repo commit and cached TCK commit
+
+## Interpretation Guidance
+
+When a TCK run fails, inspect the raw report before changing the runtime:
+
+- Some failures may point to real runtime gaps.
+- Some failures may come from TCK assumptions that do not match `a2a-sdk==0.3.26`.
+- Some failures may come from A2A v0.3 versus v1.0 naming or schema drift.
+- Some failures may be local experiment artifacts from the dummy-backed runtime.
+
+The experiment is useful only if those categories stay separate during triage.
+Use the authenticated compatibility profile and wire contract `protocol_compatibility` fields as the repository-owned declaration of which protocol lines are supported today, partially supported for compatibility, or reserved for future work.
+
+Record first-pass classifications in [conformance-triage.md](./conformance-triage.md).

{codex_a2a-0.6.1 → codex_a2a-0.7.0}/docs/guide.md

@@ -163,7 +163,7 @@ Extension boundary principles:
 
 Current implementation note:
 
-- The compatibility profile is declarative. It does not introduce a global runtime `core-only` switch.
+- The compatibility profile is declarative. It does not introduce a global runtime `core-only` switch; request-time `A2A-Version` negotiation is limited to the protocol lines and gaps published in the profile.
 - This is intentional: current shared session/stream/interrupt behavior is part of the deployed interoperability contract, so a blanket runtime profile split would be misleading without broader wire-level changes.
 - For compatibility policy and stability expectations, use [compatibility.md](./compatibility.md) as the normative repo document rather than this usage guide.
 
@@ -199,6 +199,7 @@ Use the grouped sections below as the deployment-first reading order:
 - `A2A_VERSION`: agent version string
 - `A2A_PROJECT`: optional project label injected into examples and discovery metadata
 - `A2A_PROTOCOL_VERSION`: advertised A2A protocol version, default `0.3.0`
+- `A2A_SUPPORTED_PROTOCOL_VERSIONS`: comma-separated request negotiation lines, default `0.3,1.0`
 - `A2A_DOCUMENTATION_URL`: optional external documentation URL exposed on Agent Card
 - `A2A_STATIC_AUTH_CREDENTIALS`: JSON array of static inbound credentials. Supports multiple `bearer` and `basic` entries, each with a stable `principal`; `bearer` entries must declare `principal`, while `basic` entries derive `principal` from `username`.
 
@@ -278,6 +279,7 @@ These variables are forwarded to the local `codex app-server` subprocess.
 | `A2A_VERSION` | Agent version |
 | `A2A_PROJECT` | Project label |
 | `A2A_PROTOCOL_VERSION` | Protocol version |
+| `A2A_SUPPORTED_PROTOCOL_VERSIONS` | Supported protocol versions |
 | `A2A_DOCUMENTATION_URL` | Documentation URL |
 | `A2A_ENABLE_HEALTH_ENDPOINT` | Enable /health |
 | `A2A_ENABLE_SESSION_SHELL` | Enable session shell |

{codex_a2a-0.6.1 → codex_a2a-0.7.0}/pyproject.toml

@@ -24,25 +24,30 @@ classifiers = [
     "Topic :: Internet :: WWW/HTTP",
 ]
 dependencies = [
-    "a2a-sdk==0.3.25",
+    "a2a-sdk==0.3.26",
     "aiosqlite>=0.20,<1.0",
-    "fastapi>=0.110,<0.111",
+    "fastapi>=0.121,<0.136",
     "httpx>=0.28.1,<0.29",
+    "protobuf>=6.33.5,<8.0",
+    "pyasn1>=0.6.3,<1.0",
     "pydantic>=2.6,<3.0",
     "pydantic-settings>=2.2,<3.0",
+    "requests>=2.33.0,<3.0",
     "sqlalchemy>=2.0,<3.0",
-    "sse-starlette>=2.1,<3.0",
-    "uvicorn>=0.29,<0.30",
+    "sse-starlette>=2.1,<4.0",
+    "uvicorn>=0.29,<0.45",
 ]
 
 [project.optional-dependencies]
 dev = [
+    "pip-audit>=2.9,<3.0",
     "pre-commit>=3.7",
+    "pygments>=2.20.0,<3.0",
     "pytest>=8.0",
     "pytest-asyncio>=0.23",
     "pytest-cov>=5.0,<8.0",
     "ruff>=0.5",
-    "mypy>=1.11,<1.12",
+    "mypy>=1.11,<1.21",
 ]
 
 [project.scripts]

{codex_a2a-0.6.1 → codex_a2a-0.7.0}/scripts/README.md

@@ -12,8 +12,11 @@ This document only explains the remaining repository-local maintainer scripts. U
 
 ## Which Script to Use
 
+- [`scripts/doctor.sh`](./doctor.sh): run the default local validation baseline through the shortest maintainer entrypoint.
 - [`scripts/validate_baseline.sh`](./validate_baseline.sh): run the default local validation baseline used by contributors and CI.
 - [`scripts/validate_runtime_matrix.sh`](./validate_runtime_matrix.sh): run the reduced runtime-only validation used by the multi-version CI matrix.
+- [`scripts/conformance.sh`](./conformance.sh): run the official A2A TCK as a local/manual external compatibility experiment.
+- [`scripts/dependency_health.sh`](./dependency_health.sh): run the standalone dependency review flow (`sync`/`pip check`, outdated package listing, and dev vulnerability audit).
 - [`scripts/smoke_test_built_cli.sh`](./smoke_test_built_cli.sh): validate that a built wheel can be installed through `uv tool` and becomes healthy.
 - [`scripts/sync_codex_docs.sh`](./sync_codex_docs.sh): refresh local upstream Codex reference snapshots when maintainers need them.
 
@@ -27,5 +30,10 @@ The `Publish` workflow now separates build, PyPI publish, and GitHub Release syn
 
 ## Notes
 
+- `doctor.sh` is a thin alias for the default local regression baseline; `validate_baseline.sh` remains the CI-facing script name.
+- `conformance.sh` intentionally stays outside the default regression gate. Use it to gather external compatibility evidence, then triage results in [`docs/conformance-triage.md`](../docs/conformance-triage.md).
+- `validate_baseline.sh` and `dependency_health.sh` intentionally remain separate entrypoints and share common prerequisites through [`health_common.sh`](./health_common.sh).
+- `validate_baseline.sh` now blocks on runtime dependency vulnerability audit, while `dependency_health.sh` remains focused on broader dependency review (`outdated` + dev audit).
+- [`.github/dependabot.yml`](../.github/dependabot.yml) prefers a single weekly grouped Dependabot PR for `uv`, while the repository scripts remain the explicit audit and validation entrypoints.
 - End-user runtime startup does not use repository scripts. Prefer the published CLI command documented in [README.md](../README.md) and [docs/guide.md](../docs/guide.md).
 - Keep long-form documentation changes in `docs/` to avoid divergence.