codex-a2a 1.1.2__tar.gz → 1.2.0__tar.gz

{codex_a2a-1.1.2 → codex_a2a-1.2.0}/.github/workflows/ci.yml

@@ -42,7 +42,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12"]
+        python-version: ["3.11", "3.12", "3.14"]
 
     steps:
       - name: Checkout

codex_a2a-1.2.0/.github/workflows/compatibility.yml

@@ -0,0 +1,76 @@
+name: Scheduled Compatibility
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 4 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  a2a-tck:
+    name: A2A Mandatory TCK
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Run pinned mandatory TCK
+        env:
+          CONFORMANCE_TCK_REF: 5996b79f9cefa6fc390980e383e358a66fb9e49e # pragma: allowlist secret
+        run: bash ./scripts/conformance.sh mandatory
+
+      - name: Upload TCK evidence
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: a2a-tck-evidence
+          path: run/conformance/
+          if-no-files-found: error
+          retention-days: 14
+
+  live-codex:
+    name: Latest Codex App Server Smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.13"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24"
+
+      - name: Setup uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+
+      - name: Sync dependencies
+        run: uv sync --all-extras --frozen
+
+      - name: Install latest stable Codex CLI
+        run: npm install --global @openai/codex@latest
+
+      - name: Verify real Codex app-server initialization
+        run: bash ./scripts/smoke_test_live_codex.sh

{codex_a2a-1.1.2 → codex_a2a-1.2.0}/CONTRIBUTING.md

@@ -51,7 +51,7 @@ CODEX_WORKSPACE_ROOT=/abs/path/to/workspace uv run codex-a2a serve
 5. Inspect the discovery surfaces:
 
 - `http://127.0.0.1:8000/.well-known/agent-card.json`
-- `curl -H "Authorization: Bearer ${DEMO_BEARER_TOKEN}" http://127.0.0.1:8000/v1/card`
+- `curl -H "Authorization: Bearer ${DEMO_BEARER_TOKEN}" http://127.0.0.1:8000/extendedAgentCard`
 
 ## Validation Baseline
 
@@ -61,7 +61,7 @@ Run the default validation baseline before opening or updating a PR:
 bash ./scripts/validate_baseline.sh
 ```
 
-This script runs `pre-commit`, `mypy`, `pytest` with the repository coverage floor, then builds the package and smoke-tests the freshly built wheel.
+This script checks untracked files before the tracked repository, runs `mypy`, runs `pytest` with the repository coverage floor and a 90% changed-line coverage gate against `origin/main`, then builds the package and smoke-tests the freshly built wheel.
 
 For shell script changes, validate the touched scripts directly, for example:
 

{codex_a2a-1.1.2 → codex_a2a-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codex-a2a
-Version: 1.1.2
+Version: 1.2.0
 Summary: Codex A2A runtime adapter
 Author: liujuanjuan1984@Intelligent-Internet
 License-Expression: Apache-2.0
@@ -17,24 +17,22 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Framework :: FastAPI
 Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: a2a-sdk==1.1.0
+Requires-Dist: a2a-sdk==1.1.2
 Requires-Dist: aiosqlite<1.0,>=0.20
-Requires-Dist: fastapi<0.137,>=0.121
+Requires-Dist: fastapi<0.142,>=0.121
 Requires-Dist: httpx<0.29,>=0.28.1
 Requires-Dist: protobuf<7.0,>=6.33.5
-Requires-Dist: pyasn1<1.0,>=0.6.3
-Requires-Dist: python-dotenv<2.0,>=1.2.2
 Requires-Dist: pydantic<3.0,>=2.6
 Requires-Dist: pydantic-settings<3.0,>=2.2
-Requires-Dist: requests<3.0,>=2.33.0
 Requires-Dist: sqlalchemy<3.0,>=2.0
 Requires-Dist: sse-starlette<4.0,>=2.1
-Requires-Dist: uvicorn<0.46,>=0.29
+Requires-Dist: uvicorn<0.53,>=0.29
 Provides-Extra: dev
 Requires-Dist: pip-audit<3.0,>=2.9; extra == "dev"
 Requires-Dist: pre-commit>=3.7; extra == "dev"
@@ -42,8 +40,9 @@ Requires-Dist: pygments<3.0,>=2.20.0; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
 Requires-Dist: pytest-cov<8.0,>=5.0; extra == "dev"
+Requires-Dist: diff-cover<10,>=9; extra == "dev"
 Requires-Dist: ruff>=0.5; extra == "dev"
-Requires-Dist: mypy<2.2,>=1.11; extra == "dev"
+Requires-Dist: mypy<2.4,>=1.11; extra == "dev"
 Dynamic: license-file
 
 # codex-a2a
@@ -163,7 +162,7 @@ Agent Card: `http://127.0.0.1:8000/.well-known/agent-card.json`
 
 Authenticated extended card:
 - JSON-RPC: `agent/getAuthenticatedExtendedCard`
-- HTTP: `GET /v1/card`
+- HTTP: `GET /extendedAgentCard`
 
 Outbound peer auth is configured with `A2A_CLIENT_BEARER_TOKEN` or `A2A_CLIENT_BASIC_AUTH`; see the Usage Guide for the complete client-side matrix.
 
@@ -186,7 +185,7 @@ Look elsewhere if:
 
 ## Highlights
 
-- A2A HTTP+JSON endpoints such as `/v1/message:send` and `/v1/message:stream`
+- A2A HTTP+JSON endpoints such as `/message:send` and `/message:stream`
 - A2A JSON-RPC support on `POST /`
 - Embedded client access through `codex-a2a call`
 - Autonomous outbound peer calls through the `a2a_call` tool

{codex_a2a-1.1.2 → codex_a2a-1.2.0}/README.md

@@ -115,7 +115,7 @@ Agent Card: `http://127.0.0.1:8000/.well-known/agent-card.json`
 
 Authenticated extended card:
 - JSON-RPC: `agent/getAuthenticatedExtendedCard`
-- HTTP: `GET /v1/card`
+- HTTP: `GET /extendedAgentCard`
 
 Outbound peer auth is configured with `A2A_CLIENT_BEARER_TOKEN` or `A2A_CLIENT_BASIC_AUTH`; see the Usage Guide for the complete client-side matrix.
 
@@ -138,7 +138,7 @@ Look elsewhere if:
 
 ## Highlights
 
-- A2A HTTP+JSON endpoints such as `/v1/message:send` and `/v1/message:stream`
+- A2A HTTP+JSON endpoints such as `/message:send` and `/message:stream`
 - A2A JSON-RPC support on `POST /`
 - Embedded client access through `codex-a2a call`
 - Autonomous outbound peer calls through the `a2a_call` tool

{codex_a2a-1.1.2 → codex_a2a-1.2.0}/docs/compatibility.md

@@ -83,7 +83,7 @@ The current service profile is intentionally:
 
 One deployed instance should be treated as a single-tenant trust boundary, not as a secure multi-tenant runtime boundary.
 
-The supported HTTP+JSON contract is rooted at `/v1/...` only. Tenant-prefixed REST aliases such as `/{tenant}/v1/...` are intentionally not part of the supported surface for this single-tenant deployment profile.
+The supported HTTP+JSON contract is rooted at the service root (A2A 1.0 resolves REST paths from the advertised interface URL, and protocol version is negotiated via the `A2A-Version` header rather than a URL prefix). Tenant-prefixed REST aliases such as `/{tenant}/...` are intentionally not part of the supported surface for this single-tenant deployment profile.
 
 The compatibility surface distinguishes between:
 

codex_a2a-1.2.0/docs/conformance-triage.md

@@ -0,0 +1,66 @@
+# External Conformance Triage
+
+This document is the standing triage template for local `./scripts/conformance.sh` runs against the official `a2aproject/a2a-tck`.
+
+## Standards Used For Triage
+
+- `a2a-sdk==1.1.2` as installed in this repository.
+- The default A2A protocol version advertised by this repository: `1.0`.
+- Repository compatibility policy:
+  - machine-readable Agent Card and OpenAPI contracts must reflect implemented runtime behavior;
+  - external TCK results are investigation input rather than default merge gates;
+  - unsupported behavior should be tracked as implementation work, not silently declared as supported.
+
+## Classification Labels
+
+- `Runtime issue`: the failure reproduces against the repository's declared runtime behavior and should be fixed here.
+- `TCK mismatch`: the failure appears to conflict with the installed SDK line or this repository's declared `1.0` baseline.
+- `Protocol gap`: the failure identifies work needed to complete the repository's declared `1.0` surface.
+- `Local experiment artifact`: the failure comes from the dummy-backed SUT, local auth, local URLs, timing, or other experiment setup details.
+- `Needs repro`: the failure needs a focused local probe before assigning ownership.
+
+## Triage Workflow
+
+For each failed or errored node ID:
+
+1. Copy the node ID from `failed-tests.json`.
+2. Inspect the corresponding raw details in `pytest-report.json` and `tck.log`.
+3. Compare the expectation with `docs/compatibility.md`, authenticated extended card skills/examples, and OpenAPI `x-a2a-extension-contracts`.
+4. Assign one classification label.
+5. Record whether the next action belongs in this repository, the TCK, or a future protocol compatibility issue.
+
+## Per-Test Triage
+
+Add dated entries below after a real run:
+
+```text
+YYYY-MM-DD:
+- <nodeid>: <classification>. <short rationale>. Next action: <repo/TCK/future/none>.
+```
+
+2026-08-21 (pinned TCK `5996b79f9cefa6fc390980e383e358a66fb9e49e`, jsonrpc transport, `must` level; 8 failed / 61 passed / 166 skipped):
+
+- `test_artifacts.py::TestTextArtifact::test_task_has_text_artifact[jsonrpc]`: Local experiment artifact. The dummy-backed SUT echoes fixed text instead of the TCK-provided content. Next action: none (fixture limitation of the dummy SUT).
+- `test_artifacts.py::TestFileArtifact::test_task_has_file_artifact[jsonrpc]`: Local experiment artifact. Dummy SUT returns a text part where the TCK expects a file part. Next action: none.
+- `test_artifacts.py::TestFileUrlArtifact::test_task_has_file_url_artifact[jsonrpc]`: Local experiment artifact. Same dummy-SUT limitation. Next action: none.
+- `test_artifacts.py::TestDataArtifact::test_task_has_data_artifact[jsonrpc]`: Local experiment artifact. Same dummy-SUT limitation. Next action: none.
+- `test_artifacts.py::TestMessageResponse::test_returns_message_with_text_part[jsonrpc]`: Local experiment artifact. The adapter returns a Task for plain send (streaming-first contract); the TCK expects a Message for this case. Next action: none (documented deviation; see `docs/compatibility.md`).
+- `test_error_codes.py::TestJsonRpcErrorCodeMappings::test_content_type_not_supported_error[jsonrpc]`: Local experiment artifact. The TCK sends a raw unauthenticated request; the repository's auth wall (by design) returns 401 before the content-type check can produce `ContentTypeNotSupportedError` (-32005). The authenticated path returns -32005 (covered by repository regression tests). Next action: none.
+- `test_error_codes.py::TestJsonRpcErrorCodeMappings::test_version_not_supported_error[jsonrpc]`: Local experiment artifact. Same raw unauthenticated call; the authenticated path returns `VersionNotSupportedError` (-32009). Next action: none.
+- `test_error_codes.py::TestJsonRpcErrorCodeRange::test_error_code_in_valid_range[SendMessage-bad-version]`: Local experiment artifact. Same raw unauthenticated call; the authenticated path returns -32009, which is in the valid A2A range. Next action: none.
+
+Previously failing adapter defects fixed in this pass (verified by the same pinned TCK run and repository regression tests):
+
+- `test_error_handling.py::TestCoreErrorStructure::test_error_has_code_and_message_jsonrpc`: Fixed. The 401 unauthorized body now carries `code`/`message` (A2A error shape).
+- `test_requirements.py::test_must_requirement[STREAM-SUB-004-jsonrpc]` and `test_sse_streaming.py::TestSseSubscribeToTask::test_subscribe_nonexistent_task_returns_error`: Fixed. SubscribeToTask for a missing task now returns `TaskNotFoundError` (-32001) instead of -32603.
+- `test_task_lifecycle.py::TestMultiTurn::test_reject_mismatching_context[jsonrpc]` (CORE-MULTI-006): Fixed. SendMessage with a mismatching contextId is now rejected.
+
+## Summary
+
+Keep the summary short and separate:
+
+- Count clean runtime issues.
+- Count TCK mismatches.
+- Count protocol gaps.
+- Count local experiment artifacts.
+- List follow-up issue numbers when created.

{codex_a2a-1.1.2 → codex_a2a-1.2.0}/docs/conformance.md

@@ -7,6 +7,7 @@ This repository keeps internal regression and external interoperability experime
 - `./scripts/validate_baseline.sh` remains the default internal regression entrypoint.
 - `./scripts/conformance.sh` is a local/manual experiment entrypoint for official external tooling.
 - External conformance output is investigation input, not an automatic merge gate.
+- `.github/workflows/compatibility.yml` runs the mandatory TCK weekly against a pinned TCK commit and preserves its evidence as a workflow artifact.
 
 ## Current Experiment Shape
 
@@ -19,6 +20,7 @@ The default `./scripts/conformance.sh` workflow does the following:
 5. Preserves raw logs and machine-readable reports under `run/conformance/<timestamp>/`.
 
 The default local SUT uses the repository test double `DummyChatCodexClient`. That keeps the experiment reproducible without requiring a live Codex upstream.
+For current TCK releases that do not expose authentication options, the runner loads `scripts/tck_auth_plugin.py` to inject the configured test credential into HTTP transport clients. The SUT authentication middleware remains enabled.
 
 ## Usage
 
@@ -61,6 +63,8 @@ Each run keeps the following artifacts in the selected output directory:
 - `tck.log`: raw TCK console output
 - `pytest-report.json`: pytest-json-report output emitted by the TCK runner when available
 - `failed-tests.json`: compact list of failed/error node IDs for triage when a report is available
+- `compatibility.json` / `compatibility.html`: current TCK compatibility reports when emitted
+- `tck_report.html` / `junitreport.xml`: current TCK pytest reports when emitted
 - `metadata.json`: experiment metadata including local repo commit and cached TCK commit
 
 ## Interpretation Guidance
@@ -68,11 +72,13 @@ Each run keeps the following artifacts in the selected output directory:
 When a TCK run fails, inspect the raw report before changing the runtime:
 
 - Some failures may point to real runtime gaps.
-- Some failures may come from TCK assumptions that do not match `a2a-sdk==1.0.2`.
+- Some failures may come from TCK assumptions that do not match `a2a-sdk==1.1.2`.
 - Some failures may come from older A2A naming or schema expectations that no longer match the repository's `1.0` contract.
 - Some failures may be local experiment artifacts from the dummy-backed runtime.
 
 The experiment is useful only if those categories stay separate during triage.
 Use the authenticated compatibility profile and wire contract `protocol_compatibility` fields as the repository-owned declaration of which protocol lines are supported today.
 
+The same scheduled workflow installs the latest stable Codex CLI and runs `scripts/smoke_test_live_codex.sh`. The smoke check only verifies the real stdio app-server initialization and shutdown handshake; it does not send a model request or require provider credentials.
+
 Record first-pass classifications in [conformance-triage.md](./conformance-triage.md).

{codex_a2a-1.1.2 → codex_a2a-1.2.0}/docs/guide.md

@@ -5,14 +5,14 @@ This guide covers runtime configuration, transport contracts, streaming/session/
 ## Transport Contracts
 
 - The service supports both transports:
-  - HTTP+JSON (REST endpoints such as `/v1/message:send`)
+  - HTTP+JSON (REST endpoints such as `/message:send`)
   - Shared JSON-RPC (`POST /`) for both core A2A methods and provider-private extension methods
 - Agent Card publishes both HTTP+JSON and JSON-RPC endpoints through `supported_interfaces[]`.
-- Both supported interfaces now publish the same `public_url`. For HTTP+JSON, that URL is the REST service root; concrete REST methods remain under `/v1/...`.
+- Both supported interfaces publish the same `public_url`. For HTTP+JSON, that URL is the REST service root: per A2A 1.0 the concrete REST methods (`/message:send`, `/tasks/...`) live at that root, and the protocol version is negotiated via the `A2A-Version` header rather than a URL prefix.
 - The public Agent Card at `/.well-known/agent-card.json` is intentionally slimmed to the minimum discovery surface.
 - The authenticated extended card exposes the authenticated provider-private skill inventory and deployment-aware examples:
   - preferred: JSON-RPC `GetExtendedAgentCard`
-  - HTTP core route: `GET /v1/extendedAgentCard`
+  - HTTP core route: `GET /extendedAgentCard`
 - Anonymous shared-contract hints are available through OpenAPI metadata:
   - `GET /openapi.json`
   - `x-a2a-extension-contracts` for negotiated shared extensions and shared interrupt callback hints
@@ -20,7 +20,7 @@ This guide covers runtime configuration, transport contracts, streaming/session/
 - Agent Card responses publish `ETag` and `Cache-Control`; clients should revalidate instead of repeatedly fetching full payloads.
 - Larger discovery documents support gzip compression on these HTTP GET routes:
   - `/.well-known/agent-card.json`
-  - `GET /v1/extendedAgentCard`
+  - `GET /extendedAgentCard`
   - `GET /openapi.json`
 - Streaming and task routes do not rely on this gzip behavior.
 - Payload schema is transport-specific and should not be mixed:
@@ -48,9 +48,9 @@ Current behavior:
   - `CancelTask`
   - `SubscribeToTask`
 - core HTTP endpoints:
-  - `/v1/message:send`
-  - `/v1/message:stream`
-  - `/v1/tasks/{id}:subscribe`
+  - `/message:send`
+  - `/message:stream`
+  - `/tasks/{id}:subscribe`
 - extension JSON-RPC methods are declared separately from the core baseline even though they share the same `POST /` endpoint
 - `codex.interrupts.list` is an always-on adapter-local recovery surface for pending interrupt request IDs
 - `codex.turns.steer` becomes deployment-conditional when `A2A_ENABLE_TURN_CONTROL=false`
@@ -130,9 +130,9 @@ Current profile shape:
   - `CancelTask`
   - `SubscribeToTask`
 - core HTTP endpoints:
-  - `/v1/message:send`
-  - `/v1/message:stream`
-  - `/v1/tasks/{id}:subscribe`
+  - `/message:send`
+  - `/message:stream`
+  - `/tasks/{id}:subscribe`
 
 Retention guidance:
 
@@ -196,11 +196,14 @@ Use the grouped sections below as the deployment-first reading order:
 - `A2A_LOG_LEVEL`: `DEBUG/INFO/WARNING/ERROR`, default `WARNING`
 - `A2A_LOG_PAYLOADS`: log A2A/Codex payload bodies, default `false`
 - `A2A_LOG_BODY_LIMIT`: payload log body size limit, default `0` (no truncation)
+- `A2A_REQUEST_BODY_MAX_BYTES`: hard HTTP request body limit, default `4194304` (4 MiB); set `0` to disable
+- `A2A_MAX_CONCURRENT_OPERATIONS`: process-local active POST and task-subscription limit, default `32`; set `0` to disable
+- `A2A_ENABLE_METRICS_ENDPOINT`: enable the authenticated Prometheus `/metrics` endpoint, default `true`
 - `A2A_TITLE`: agent name, default `Codex A2A`
 - `A2A_DESCRIPTION`: agent description exposed on Agent Card and docs surfaces
 - `A2A_VERSION`: agent version string
 - `A2A_PROJECT`: optional project label injected into examples and discovery metadata
-- `A2A_PROTOCOL_VERSION`: advertised A2A protocol version, default `1.0.0`; values outside the `1.0` protocol line are rejected
+- `A2A_PROTOCOL_VERSION`: advertised A2A protocol version, default `1.0`; values outside the `1.0` protocol line are rejected
 - `A2A_DOCUMENTATION_URL`: optional external documentation URL exposed on Agent Card
 - `A2A_STATIC_AUTH_CREDENTIALS`: JSON array of static inbound credentials. Supports multiple `bearer` and `basic` entries, each with a stable `principal`; `bearer` entries must declare `principal`, while `basic` entries derive `principal` from `username`.
 
@@ -275,6 +278,8 @@ These variables are forwarded to the local `codex app-server` subprocess.
 | `A2A_LOG_LEVEL` | Log level |
 | `A2A_LOG_PAYLOADS` | Log bodies |
 | `A2A_LOG_BODY_LIMIT` | Body log limit |
+| `A2A_REQUEST_BODY_MAX_BYTES` | HTTP request body limit |
+| `A2A_MAX_CONCURRENT_OPERATIONS` | Active operation capacity |
 | `A2A_TITLE` | Agent title |
 | `A2A_DESCRIPTION` | Agent description |
 | `A2A_VERSION` | Agent version |
@@ -282,6 +287,7 @@ These variables are forwarded to the local `codex app-server` subprocess.
 | `A2A_PROTOCOL_VERSION` | Protocol version |
 | `A2A_DOCUMENTATION_URL` | Documentation URL |
 | `A2A_ENABLE_HEALTH_ENDPOINT` | Enable /health |
+| `A2A_ENABLE_METRICS_ENDPOINT` | Enable /metrics |
 | `A2A_ENABLE_TURN_CONTROL` | Enable turn control |
 | `A2A_ENABLE_REVIEW_CONTROL` | Enable review control |
 | `A2A_ENABLE_EXEC_CONTROL` | Enable interactive exec |
@@ -439,6 +445,8 @@ On the current npm global install layout for Linux x64, the command above resolv
 ### Health, Auth, and Deployment Boundary
 
 - `GET /health` is a lightweight authenticated status probe. It requires the same configured inbound auth as other protected endpoints and returns service status plus a structured `profile` summary; it does not call upstream Codex.
+- `GET /ready` is enabled with `/health` and reports whether the initialized Codex app-server subprocess is alive and its stdout reader is running. It does not make a model request.
+- `GET /metrics` exposes authenticated Prometheus text metrics, including active operations and resource-limit rejections. Disable it with `A2A_ENABLE_METRICS_ENDPOINT=false` when metrics are collected through another integration.
 - Protected routes accept configured inbound `Authorization: Bearer <token>` and/or `Authorization: Basic <base64(username:password)>` credentials. The public Agent Card endpoints are public; authenticated extended card routes still require inbound auth.
 - Static credential registry mode is the only supported inbound auth shape. It lets deployments define multiple bearer tokens and/or multiple Basic credentials with stable `principal` values.
 - Stable `principal` values back runtime ownership checks. This avoids tying session, watch, or exec ownership to a bearer token hash that changes during token rotation.
@@ -452,7 +460,7 @@ On the current npm global install layout for Linux x64, the command above resolv
 ### Session and Task Behavior
 
 - The service forwards A2A `message:send` requests and `SendMessage` JSON-RPC calls to Codex session/message flows.
-- Streaming is always enabled for this service surface. `/v1/message:stream` and JSON-RPC `SendStreamingMessage` are compatibility-sensitive core capabilities rather than deployment-time toggles.
+- Streaming is always enabled for this service surface. `/message:stream` and JSON-RPC `SendStreamingMessage` are compatibility-sensitive core capabilities rather than deployment-time toggles.
 - `codex.exec.start`, `codex.exec.write`, `codex.exec.resize`, and `codex.exec.terminate` expose a standalone interactive `command/exec` runtime when `A2A_ENABLE_EXEC_CONTROL=true`. This surface is intended for internal or tightly controlled deployments where interactive terminal control is an explicit part of the adapter contract. `codex.exec.start` returns process/task handles immediately, while stdout/stderr deltas and the final result flow through normal A2A task streaming and `SubscribeToTask`.
 - Rich input is supported on two surfaces:
   - core A2A `SendMessage` and `SendStreamingMessage` keep standard A2A parts and map `Part(text)`, image `Part(url|raw)`, and `Part(data={"type":"mention"|"skill", ...})` into Codex turn input
@@ -477,7 +485,7 @@ On the current npm global install layout for Linux x64, the command above resolv
 
 ### Streaming and Interrupt Contract
 
-- Streaming (`/v1/message:stream`) emits an initial working `Task`, then incremental `TaskArtifactUpdateEvent` / `TaskStatusUpdateEvent` updates, and finally a terminal `Task`.
+- Streaming (`/message:stream`) emits an initial working `Task`, then incremental `TaskArtifactUpdateEvent` / `TaskStatusUpdateEvent` updates, and finally a terminal `Task`.
 - If task persistence fails while processing a request, the service maps that failure to a stable failed task or failed final status instead of leaking raw task-store exceptions.
 - Those task-store failure surfaces use `metadata.codex.error` with `type=TASK_STORE_UNAVAILABLE` and an `operation` field such as `get` or `save`.
 - Stream artifacts carry `artifact.metadata.shared.stream.block_type` with values `text`, `reasoning`, and `tool_call`.
@@ -565,7 +573,7 @@ Server behavior:
 Minimal example:
 
 ```bash
-curl -sS http://127.0.0.1:8000/v1/message:send \
+curl -sS http://127.0.0.1:8000/message:send \
   -H 'content-type: application/json' \
   -H "Authorization: Bearer ${DEMO_BEARER_TOKEN}" \
   -d '{
@@ -755,7 +763,7 @@ curl -sS http://127.0.0.1:8000/ \
 The JSON-RPC result returns `task_id` and `context_id`. Then use the standard task stream:
 
 ```bash
-curl -sS http://127.0.0.1:8000/v1/tasks/<task_id>:subscribe \
+curl -sS http://127.0.0.1:8000/tasks/<task_id>:subscribe \
   -H "Authorization: Bearer ${DEMO_BEARER_TOKEN}"
 ```
 
@@ -886,7 +894,7 @@ curl -sS http://127.0.0.1:8000/ \
 The JSON-RPC result returns `task_id` and `context_id`. Then use the standard task stream:
 
 ```bash
-curl -sS http://127.0.0.1:8000/v1/tasks/<task_id>:subscribe \
+curl -sS http://127.0.0.1:8000/tasks/<task_id>:subscribe \
   -H "Authorization: Bearer ${DEMO_BEARER_TOKEN}"
 ```
 
@@ -1165,7 +1173,7 @@ curl -sS http://127.0.0.1:8000/ \
 ## Authentication Example (curl)
 
 ```bash
-curl -sS http://127.0.0.1:8000/v1/message:send \
+curl -sS http://127.0.0.1:8000/message:send \
   -H 'content-type: application/json' \
   -H "Authorization: Bearer ${DEMO_BEARER_TOKEN}" \
   -d '{
@@ -1199,7 +1207,7 @@ curl -sS http://127.0.0.1:8000/ \
 
 ## Streaming Re-Subscription (`subscribe`)
 
-If an SSE connection drops, use `GET /v1/tasks/{task_id}:subscribe` to re-subscribe while the task is still non-terminal.
+If an SSE connection drops, use `GET /tasks/{task_id}:subscribe` to re-subscribe while the task is still non-terminal.
 
 Terminal-task note:
 

{codex_a2a-1.1.2 → codex_a2a-1.2.0}/docs/maintainer-architecture.md

@@ -8,7 +8,7 @@ This document describes the internal structure, module boundaries, and request c
 flowchart TD
     subgraph Inbound["Server Layer (src/codex_a2a/server/)"]
         App["application.py (FastAPI)"]
-        Routes["Routes (message_routes.py, etc.)"]
+        Routes["SDK REST and Agent Card routes"]
     end
 
     subgraph Execution["Execution Layer (src/codex_a2a/execution/)"]
@@ -33,7 +33,7 @@ flowchart TD
 
 ### Inbound Message (Send/Stream)
 
-1.  **FastAPI Route**: `POST /v1/message:send` or `POST /v1/message:stream` (or JSON-RPC equivalent).
+1.  **FastAPI Route**: `POST /message:send` or `POST /message:stream` (or JSON-RPC equivalent).
 2.  **Handler**: Validates auth and maps transport-specific payloads into `RequestContext`.
 3.  **Executor (`CodexAgentExecutor.execute`)**:
     -   Maps A2A parts to Codex-compatible items.

codex_a2a-1.2.0/mypy.ini

@@ -0,0 +1,14 @@
+[mypy]
+python_version = 3.11
+files = src/codex_a2a, tests/client/test_agent_card.py, tests/client/test_errors.py, tests/client/test_lifecycle.py, tests/client/test_payload_text.py, tests/client/test_request_context.py, tests/config/test_settings.py, tests/contracts/test_extension_contract_consistency.py, tests/contracts/test_extension_registry.py, tests/execution/test_agent_errors.py, tests/execution/test_cancellation.py, tests/execution/test_directory_validation.py, tests/execution/test_metrics.py, tests/execution/test_request_metadata.py, tests/execution/test_session_persistence.py, tests/execution/test_session_runtime.py, tests/execution/test_stream_chunks.py, tests/execution/test_stream_interrupts.py, tests/execution/test_tool_call_payloads.py, tests/jsonrpc/test_codex_discovery_extension.py, tests/jsonrpc/test_codex_exec_extension.py, tests/jsonrpc/test_codex_session_extension.py, tests/jsonrpc/test_codex_thread_lifecycle_extension.py, tests/jsonrpc/test_codex_turn_review_extension.py, tests/jsonrpc/test_dispatch.py, tests/jsonrpc/test_guard_hooks.py, tests/jsonrpc/test_interrupt_params.py, tests/jsonrpc/test_jsonrpc_models.py, tests/jsonrpc/test_protocol_payload_mapping.py, tests/package/test_logging.py, tests/package/test_publish_github_release_script.py, tests/package/test_release_distribution_contract.py, tests/package/test_typing_contract.py, tests/package/test_version.py, tests/profile/test_profile.py, tests/scripts/test_audit_low_call_sites.py, tests/scripts/test_script_health_contract.py, tests/scripts/test_tck_auth_plugin.py, tests/server/test_agent_card.py, tests/server/test_auth.py, tests/server/test_call_context_builder.py, tests/server/test_cli.py, tests/server/test_database.py, tests/server/test_database_app_persistence.py, tests/server/test_migrations.py, tests/server/test_output_negotiation.py, tests/server/test_push_config_store.py, tests/server/test_request_handler.py, tests/server/test_runtime_limits.py, tests/server/test_runtime_state.py, tests/support/context.py, tests/support/dummy_clients.py, tests/support/fixtures.py, tests/support/http_auth.py, tests/support/jsonrpc_errors.py, tests/support/settings.py, tests/test_a2a_proto.py, tests/test_input_mapping.py, tests/test_protocol_versions.py, tests/upstream/test_interrupt_bridge.py, tests/upstream/test_interrupt_persistence.py, tests/upstream/test_request_mapping.py
+mypy_path = src
+follow_imports = silent
+warn_unused_ignores = True
+warn_redundant_casts = True
+show_error_codes = True
+
+[mypy-a2a.*]
+ignore_missing_imports = True
+
+[mypy-setuptools_scm]
+ignore_missing_imports = True

{codex_a2a-1.1.2 → codex_a2a-1.2.0}/pyproject.toml

@@ -20,23 +20,21 @@ classifiers = [
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Framework :: FastAPI",
     "Topic :: Internet :: WWW/HTTP",
 ]
 dependencies = [
-    "a2a-sdk==1.1.0",
+    "a2a-sdk==1.1.2",
     "aiosqlite>=0.20,<1.0",
-    "fastapi>=0.121,<0.137",
+    "fastapi>=0.121,<0.142",
     "httpx>=0.28.1,<0.29",
     "protobuf>=6.33.5,<7.0",
-    "pyasn1>=0.6.3,<1.0",
-    "python-dotenv>=1.2.2,<2.0",
     "pydantic>=2.6,<3.0",
     "pydantic-settings>=2.2,<3.0",
-    "requests>=2.33.0,<3.0",
     "sqlalchemy>=2.0,<3.0",
     "sse-starlette>=2.1,<4.0",
-    "uvicorn>=0.29,<0.46",
+    "uvicorn>=0.29,<0.53",
 ]
 
 [project.optional-dependencies]
@@ -47,8 +45,9 @@ dev = [
     "pytest>=8.0",
     "pytest-asyncio>=0.23",
     "pytest-cov>=5.0,<8.0",
+    "diff-cover>=9,<10",
     "ruff>=0.5",
-    "mypy>=1.11,<2.2",
+    "mypy>=1.11,<2.4",
 ]
 
 [project.scripts]
@@ -67,7 +66,13 @@ line-length = 100
 src = ["src"]
 
 [tool.ruff.lint]
-select = ["E", "F", "I", "B", "UP"]
+select = ["E", "F", "I", "B", "UP", "S", "C90"]
+
+[tool.ruff.lint.mccabe]
+max-complexity = 25
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = ["S"]
 
 [tool.ruff.format]
 quote-style = "double"
@@ -83,12 +88,12 @@ fallback_version = "0.0.0+unknown"
 tag_regex = "^v?(?P<version>.+)$"
 
 [tool.pytest.ini_options]
-addopts = "--cov=src/codex_a2a --cov-branch --cov-report=term-missing:skip-covered"
+addopts = "--cov=src/codex_a2a --cov-branch --cov-report=term-missing:skip-covered --cov-report=xml"
 filterwarnings = [
     "ignore:'HTTP_413_REQUEST_ENTITY_TOO_LARGE' is deprecated. Use 'HTTP_413_CONTENT_TOO_LARGE' instead.:DeprecationWarning:a2a\\.server\\.apps\\.jsonrpc\\.fastapi_app",
 ]
 
 [tool.coverage.report]
-fail_under = 78
+fail_under = 84
 show_missing = true
 skip_covered = true

{codex_a2a-1.1.2 → codex_a2a-1.2.0}/scripts/README.md

@@ -19,6 +19,7 @@ This document only explains the remaining repository-local maintainer scripts. U
 - [`scripts/conformance.sh`](./conformance.sh): run the official A2A TCK as a local/manual external compatibility experiment.
 - [`scripts/dependency_health.sh`](./dependency_health.sh): run the standalone dependency review flow (`sync`/`pip check`, outdated package listing, and dev vulnerability audit).
 - [`scripts/smoke_test_built_cli.sh`](./smoke_test_built_cli.sh): validate that a built wheel can be installed through `uv tool` and becomes healthy.
+- [`scripts/smoke_test_live_codex.sh`](./smoke_test_live_codex.sh): initialize and close a real locally installed Codex app-server without making a model request.
 - [`scripts/sync_codex_docs.sh`](./sync_codex_docs.sh): refresh local upstream Codex reference snapshots when maintainers need them.
 
 ## Release Recovery

{codex_a2a-1.1.2 → codex_a2a-1.2.0}/scripts/conformance.sh

@@ -15,7 +15,8 @@ Purpose:
   This script is intentionally separate from validate_baseline.sh and CI gates.
 
 Category:
-  Defaults to "mandatory". Any category supported by a2aproject/a2a-tck run_tck.py is accepted.
+  Defaults to "mandatory", which aliases the current TCK "must" level.
+  The current runner also accepts "must", "should", and "may".
 
 Selected environment variables:
   CONFORMANCE_OUTPUT_DIR              Override artifact directory (default: run/conformance/<timestamp>)
@@ -156,12 +157,18 @@ json_report_name="pytest-${category}.json"
 set +e
 (
   cd "${tck_dir}"
-  CONFORMANCE_CATEGORY="${category}" \
-  CONFORMANCE_SUT_URL="${sut_url}" \
-  CONFORMANCE_JSON_REPORT_NAME="${json_report_name}" \
-  CONFORMANCE_TRANSPORT_STRATEGY="${transport_strategy}" \
-  CONFORMANCE_TRANSPORTS="${transports}" \
-  uv run python - <<'PY'
+  if uv run python - <<'PY'
+import run_tck
+
+raise SystemExit(0 if hasattr(run_tck, "run_test_category") else 1)
+PY
+  then
+    CONFORMANCE_CATEGORY="${category}" \
+    CONFORMANCE_SUT_URL="${sut_url}" \
+    CONFORMANCE_JSON_REPORT_NAME="${json_report_name}" \
+    CONFORMANCE_TRANSPORT_STRATEGY="${transport_strategy}" \
+    CONFORMANCE_TRANSPORTS="${transports}" \
+    uv run python - <<'PY'
 from __future__ import annotations
 
 import os
@@ -181,6 +188,28 @@ raise SystemExit(
     )
 )
 PY
+  else
+    case "${category}" in
+      mandatory | must)
+        level="must"
+        ;;
+      should | may)
+        level="${category}"
+        ;;
+      *)
+        echo "Unsupported current TCK level: ${category}" >&2
+        exit 2
+        ;;
+    esac
+    normalized_transports="${transports//http-json/http_json}"
+    PYTHONPATH="${ROOT_DIR}${PYTHONPATH:+:${PYTHONPATH}}" \
+    uv run python run_tck.py \
+      --sut-host "${sut_url}" \
+      --level "${level}" \
+      --transport "${normalized_transports}" \
+      --verbose-log \
+      -- -p scripts.tck_auth_plugin
+  fi
 ) 2>&1 | tee "${tck_log}"
 tck_exit="${PIPESTATUS[0]}"
 set -e
@@ -189,6 +218,11 @@ report_path="${tck_dir}/reports/${json_report_name}"
 if [[ -f "${report_path}" ]]; then
   cp "${report_path}" "${output_dir}/pytest-report.json"
 fi
+for report_name in compatibility.json compatibility.html tck_report.html junitreport.xml; do
+  if [[ -f "${tck_dir}/reports/${report_name}" ]]; then
+    cp "${tck_dir}/reports/${report_name}" "${output_dir}/${report_name}"
+  fi
+done
 
 CONFORMANCE_CATEGORY="${category}" \
 CONFORMANCE_OUTPUT_DIR="${output_dir}" \