opencode-a2a 0.6.1__tar.gz → 0.7.1__tar.gz

opencode_a2a-0.6.1/.github/workflows/dependency-health.yml → opencode_a2a-0.7.1/.github/workflows/dependency-review.yml

@@ -1,4 +1,4 @@
-name: Dependency Health
+name: Review Development Dependencies
 
 on:
   workflow_dispatch:
@@ -11,18 +11,19 @@ permissions:
 
 jobs:
   dependency-health:
+    name: Audit Development Dependencies
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Setup Python
+      - name: Set up Python
         uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
-      - name: Setup uv
+      - name: Set up uv
         uses: astral-sh/setup-uv@v7
         with:
           enable-cache: false

{opencode_a2a-0.6.1 → opencode_a2a-0.7.1}/.github/workflows/publish.yml

@@ -1,4 +1,4 @@
-name: Publish
+name: Release Publish and Repair
 
 on:
   push:
@@ -31,6 +31,7 @@ permissions:
 
 jobs:
   publish:
+    name: Build and Publish Release Artifacts
     runs-on: ubuntu-latest
 
     steps:
@@ -40,17 +41,17 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event_name == 'workflow_dispatch' && inputs.release_tag || github.ref }}
 
-      - name: Setup Python
+      - name: Set up Python
         uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
-      - name: Setup uv
+      - name: Set up uv
         uses: astral-sh/setup-uv@v7
         with:
           enable-cache: false
 
-      - name: Run regression baseline
+      - name: Run default regression baseline
         run: bash ./scripts/doctor.sh
 
       - name: Export runtime requirements for vulnerability audit
@@ -94,10 +95,10 @@ jobs:
           print(f"Validated release version: {version}")
           PY
 
-      - name: Smoke test wheel install
+      - name: Smoke test wheel artifact
         run: bash ./scripts/smoke_test_built_cli.sh dist/opencode_a2a-*.whl
 
-      - name: Smoke test sdist install
+      - name: Smoke test sdist artifact
         run: bash ./scripts/smoke_test_built_cli.sh dist/opencode_a2a-*.tar.gz
 
       - name: Publish to PyPI

opencode_a2a-0.6.1/.github/workflows/ci.yml → opencode_a2a-0.7.1/.github/workflows/validate.yml

@@ -1,4 +1,4 @@
-name: CI
+name: Validate PRs and Main
 
 on:
   pull_request:
@@ -11,29 +11,30 @@ permissions:
 
 jobs:
   quality-gate:
+    name: Validate Default Toolchain
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Setup Python
+      - name: Set up Python
         uses: actions/setup-python@v6
         with:
           python-version: "3.13"
 
-      - name: Setup uv
+      - name: Set up uv
         uses: astral-sh/setup-uv@v7
         with:
           enable-cache: false
 
-      - name: Sync Dependencies
+      - name: Sync locked dependencies
         run: uv sync --all-extras --frozen
 
-      - name: Run pre-commit
+      - name: Run lint checks
         run: bash ./scripts/lint.sh
 
-      - name: Run pytest
+      - name: Run test suite
         run: uv run pytest
 
       - name: Enforce coverage policy
@@ -60,6 +61,7 @@ jobs:
         run: bash ./scripts/smoke_test_built_cli.sh dist/opencode_a2a-*.tar.gz
 
   runtime-matrix:
+    name: Validate Runtime Matrix (Python ${{ matrix.python-version }})
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -70,18 +72,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Setup Python
+      - name: Set up Python
         uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
-      - name: Setup uv
+      - name: Set up uv
         uses: astral-sh/setup-uv@v7
         with:
           enable-cache: false
 
-      - name: Sync Dependencies
+      - name: Sync locked dependencies
         run: uv sync --all-extras --frozen
 
-      - name: Run pytest runtime matrix
+      - name: Run runtime regression tests
         run: uv run pytest --no-cov

{opencode_a2a-0.6.1 → opencode_a2a-0.7.1}/.gitignore

@@ -225,3 +225,6 @@ temp_*.*
 docs/operations/opencode/
 .swival/
 *.db
+.codex-a2a/
+opencode-a2a.db
+opencode-a2a.db*

{opencode_a2a-0.6.1 → opencode_a2a-0.7.1}/CONTRIBUTING.md

@@ -33,7 +33,7 @@ opencode serve --hostname 127.0.0.1 --port 4096
 Then start the A2A runtime in another terminal:
 
 ```bash
-A2A_BEARER_TOKEN=dev-token \
+A2A_STATIC_AUTH_CREDENTIALS='[{"scheme":"bearer","token":"dev-token","principal":"automation"}]' \
 OPENCODE_BASE_URL=http://127.0.0.1:4096 \
 OPENCODE_WORKSPACE_ROOT=/abs/path/to/workspace \
 uv run opencode-a2a serve
@@ -55,6 +55,14 @@ bash -n scripts/doctor.sh
 bash -n scripts/lint.sh
 ```
 
+External interoperability experiments stay outside the default regression baseline. When you need to reproduce current official-tool behavior, run:
+
+```bash
+bash ./scripts/conformance.sh
+```
+
+Treat that output as investigation input. Do not fold it into `doctor.sh` or the default CI quality gate unless the repository explicitly decides to promote a specific experiment into a maintained policy.
+
 If you change extension methods, extension metadata, or Agent Card/OpenAPI contract surfaces, also run:
 
 ```bash

{opencode_a2a-0.6.1/src/opencode_a2a.egg-info → opencode_a2a-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: opencode-a2a
-Version: 0.6.1
+Version: 0.7.1
 Summary: OpenCode A2A runtime
 Author: liujuanjuan1984@Intelligent-Internet
 License-Expression: Apache-2.0
@@ -25,7 +25,6 @@ Requires-Dist: fastapi<1.0,>=0.110
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: pydantic<3.0,>=2.6
 Requires-Dist: pydantic-settings<3.0,>=2.2
-Requires-Dist: requests<3.0,>=2.33.0
 Requires-Dist: sqlalchemy<3.0,>=2.0
 Requires-Dist: sse-starlette<4.0,>=2.1
 Requires-Dist: uvicorn<1.0,>=0.29
@@ -33,6 +32,7 @@ Provides-Extra: dev
 Requires-Dist: mypy<2.0,>=1.19.1; extra == "dev"
 Requires-Dist: pip-audit<3.0,>=2.9; extra == "dev"
 Requires-Dist: pre-commit<5.0,>=4.5.1; extra == "dev"
+Requires-Dist: pygments<3.0,>=2.20.0; extra == "dev"
 Requires-Dist: pytest<10.0,>=8.0; extra == "dev"
 Requires-Dist: pytest-asyncio<2.0,>=0.23; extra == "dev"
 Requires-Dist: pytest-cov<8.0.0,>=7.0.0; extra == "dev"
@@ -104,7 +104,8 @@ Treat the deployed OpenCode user's HOME/XDG config directories as part of the ru
 Then start `opencode-a2a` against that upstream:
 
 ```bash
-A2A_BEARER_TOKEN=dev-token \
+DEMO_BEARER_TOKEN="$(python3 -c 'import secrets; print(secrets.token_hex(24))')"
+A2A_STATIC_AUTH_CREDENTIALS='[{"scheme":"bearer","token":"'"${DEMO_BEARER_TOKEN}"'","principal":"automation"}]' \
 OPENCODE_BASE_URL=http://127.0.0.1:4096 \
 A2A_TASK_STORE_DATABASE_URL=sqlite+aiosqlite:///./opencode-a2a.db \
 A2A_HOST=127.0.0.1 \
@@ -132,6 +133,14 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 - Request-scoped model selection through `metadata.shared.model`
 - OpenCode-oriented JSON-RPC extensions for session and model/provider queries
 
+## A2A Protocol Support
+
+- Default protocol line: `0.3`
+- Declared supported protocol lines: `0.3`, `1.0`
+- `0.3` is the stable interoperability baseline for the current runtime surface.
+- `1.0` currently covers version negotiation plus protocol-aware JSON-RPC and REST error shaping, while transport payloads, enums, pagination, signatures, and interface-level protocol declarations still follow the shipped SDK baseline.
+- The detailed compatibility matrix and machine-readable support boundary are documented in [`docs/guide.md`](docs/guide.md).
+
 ## Peering Node / Outbound Access
 
 `opencode-a2a` supports a "Peering Node" architecture where a single process handles both inbound (Server) and outbound (Client) A2A traffic.
@@ -153,7 +162,7 @@ opencode-a2a call http://other-agent:8000 "How are you?"
 ### Outbound Agent Calls (Tools)
 The server can autonomously execute `a2a_call(url, message)` tool calls emitted by the OpenCode runtime. Results are fetched via A2A and returned to the model as tool results, enabling multi-agent orchestration.
 
-When the target peer agent requires bearer auth, configure `A2A_CLIENT_BEARER_TOKEN` for server-side outbound calls. When the target peer agent requires Basic auth, use `A2A_CLIENT_BASIC_AUTH`. These outbound credentials apply to the peer specified by `opencode-a2a call` or `a2a_call(url, message)`, not to this service's inbound `A2A_BEARER_TOKEN`. The CLI intentionally reads outbound credentials from environment variables only, so secrets do not appear in shell history or process arguments.
+When the target peer agent requires bearer auth, configure `A2A_CLIENT_BEARER_TOKEN` for server-side outbound calls. When the target peer agent requires Basic auth, use `A2A_CLIENT_BASIC_AUTH`. These outbound credentials apply to the peer specified by `opencode-a2a call` or `a2a_call(url, message)`, not to this service's inbound `A2A_STATIC_AUTH_CREDENTIALS`. The CLI intentionally reads outbound credentials from environment variables only, so secrets do not appear in shell history or process arguments.
 
 Server-side outbound client settings are fully wired through runtime config: `A2A_CLIENT_TIMEOUT_SECONDS`, `A2A_CLIENT_CARD_FETCH_TIMEOUT_SECONDS`, `A2A_CLIENT_USE_CLIENT_PREFERENCE`, `A2A_CLIENT_BEARER_TOKEN`, `A2A_CLIENT_BASIC_AUTH`, and `A2A_CLIENT_SUPPORTED_TRANSPORTS`.
 
@@ -179,7 +188,7 @@ For client-side integration, prefer [a2a-client-hub](https://github.com/liujuanj
 
 This repository improves the service boundary around OpenCode, but it does not turn OpenCode into a hardened multi-tenant platform.
 
-- `A2A_BEARER_TOKEN` protects the A2A surface.
+- `A2A_STATIC_AUTH_CREDENTIALS` protects the A2A surface.
 - Provider auth and default model configuration remain on the OpenCode side; deployment-time precedence details and HOME/XDG state impact are documented in [docs/guide.md](docs/guide.md#troubleshooting-provider-auth-state).
 - Use `A2A_CLIENT_BEARER_TOKEN` for server-side outbound peer calls initiated by `a2a_call`.
 - Deployment supervision is intentionally BYO. Use `systemd`, Docker, Kubernetes, or another supervisor if you need long-running operation.

{opencode_a2a-0.6.1 → opencode_a2a-0.7.1}/README.md

@@ -63,7 +63,8 @@ Treat the deployed OpenCode user's HOME/XDG config directories as part of the ru
 Then start `opencode-a2a` against that upstream:
 
 ```bash
-A2A_BEARER_TOKEN=dev-token \
+DEMO_BEARER_TOKEN="$(python3 -c 'import secrets; print(secrets.token_hex(24))')"
+A2A_STATIC_AUTH_CREDENTIALS='[{"scheme":"bearer","token":"'"${DEMO_BEARER_TOKEN}"'","principal":"automation"}]' \
 OPENCODE_BASE_URL=http://127.0.0.1:4096 \
 A2A_TASK_STORE_DATABASE_URL=sqlite+aiosqlite:///./opencode-a2a.db \
 A2A_HOST=127.0.0.1 \
@@ -91,6 +92,14 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 - Request-scoped model selection through `metadata.shared.model`
 - OpenCode-oriented JSON-RPC extensions for session and model/provider queries
 
+## A2A Protocol Support
+
+- Default protocol line: `0.3`
+- Declared supported protocol lines: `0.3`, `1.0`
+- `0.3` is the stable interoperability baseline for the current runtime surface.
+- `1.0` currently covers version negotiation plus protocol-aware JSON-RPC and REST error shaping, while transport payloads, enums, pagination, signatures, and interface-level protocol declarations still follow the shipped SDK baseline.
+- The detailed compatibility matrix and machine-readable support boundary are documented in [`docs/guide.md`](docs/guide.md).
+
 ## Peering Node / Outbound Access
 
 `opencode-a2a` supports a "Peering Node" architecture where a single process handles both inbound (Server) and outbound (Client) A2A traffic.
@@ -112,7 +121,7 @@ opencode-a2a call http://other-agent:8000 "How are you?"
 ### Outbound Agent Calls (Tools)
 The server can autonomously execute `a2a_call(url, message)` tool calls emitted by the OpenCode runtime. Results are fetched via A2A and returned to the model as tool results, enabling multi-agent orchestration.
 
-When the target peer agent requires bearer auth, configure `A2A_CLIENT_BEARER_TOKEN` for server-side outbound calls. When the target peer agent requires Basic auth, use `A2A_CLIENT_BASIC_AUTH`. These outbound credentials apply to the peer specified by `opencode-a2a call` or `a2a_call(url, message)`, not to this service's inbound `A2A_BEARER_TOKEN`. The CLI intentionally reads outbound credentials from environment variables only, so secrets do not appear in shell history or process arguments.
+When the target peer agent requires bearer auth, configure `A2A_CLIENT_BEARER_TOKEN` for server-side outbound calls. When the target peer agent requires Basic auth, use `A2A_CLIENT_BASIC_AUTH`. These outbound credentials apply to the peer specified by `opencode-a2a call` or `a2a_call(url, message)`, not to this service's inbound `A2A_STATIC_AUTH_CREDENTIALS`. The CLI intentionally reads outbound credentials from environment variables only, so secrets do not appear in shell history or process arguments.
 
 Server-side outbound client settings are fully wired through runtime config: `A2A_CLIENT_TIMEOUT_SECONDS`, `A2A_CLIENT_CARD_FETCH_TIMEOUT_SECONDS`, `A2A_CLIENT_USE_CLIENT_PREFERENCE`, `A2A_CLIENT_BEARER_TOKEN`, `A2A_CLIENT_BASIC_AUTH`, and `A2A_CLIENT_SUPPORTED_TRANSPORTS`.
 
@@ -138,7 +147,7 @@ For client-side integration, prefer [a2a-client-hub](https://github.com/liujuanj
 
 This repository improves the service boundary around OpenCode, but it does not turn OpenCode into a hardened multi-tenant platform.
 
-- `A2A_BEARER_TOKEN` protects the A2A surface.
+- `A2A_STATIC_AUTH_CREDENTIALS` protects the A2A surface.
 - Provider auth and default model configuration remain on the OpenCode side; deployment-time precedence details and HOME/XDG state impact are documented in [docs/guide.md](docs/guide.md#troubleshooting-provider-auth-state).
 - Use `A2A_CLIENT_BEARER_TOKEN` for server-side outbound peer calls initiated by `a2a_call`.
 - Deployment supervision is intentionally BYO. Use `systemd`, Docker, Kubernetes, or another supervisor if you need long-running operation.

{opencode_a2a-0.6.1 → opencode_a2a-0.7.1}/SECURITY.md

@@ -6,7 +6,7 @@ This repository wraps OpenCode as an A2A runtime. It exposes A2A HTTP+JSON and J
 
 ## Security Boundary
 
-- `A2A_BEARER_TOKEN` protects access to the A2A surface, but it is not a tenant-isolation boundary inside one deployed instance.
+- `A2A_STATIC_AUTH_CREDENTIALS` protects access to the A2A surface, but it is not a tenant-isolation boundary inside one deployed instance.
 - One `OpenCode + opencode-a2a` instance pair is treated as a single-tenant trust boundary by design.
 - Tenant isolation across consumers is expected to come from parameterized self-deployment.
 - For mutually untrusted tenants, use separate instance pairs with distinct Linux users, workspace roots, credentials, and runtime ports.
@@ -21,7 +21,7 @@ This project is currently best suited for trusted or internal environments. Impo
 
 - no per-tenant workspace isolation inside one instance
 - no hard guarantee that upstream provider keys are inaccessible to agent logic
-- bearer-token auth only by default; stronger identity propagation is still a follow-up hardening area
+- static credential auth only by default; stronger identity propagation is still a follow-up hardening area
 - operators remain responsible for host hardening, secret rotation, process access controls, and reverse-proxy exposure strategy
 
 ## Reporting a Vulnerability

opencode_a2a-0.7.1/docs/conformance-triage.md

@@ -0,0 +1,89 @@
+# External Conformance Triage
+
+This document records the first local `./scripts/conformance.sh mandatory` run against the official `a2aproject/a2a-tck` using the repository's dummy-backed SUT.
+
+## Standards Used For Triage
+
+- `a2a-sdk==0.3.25` as installed in this repository:
+  - `AgentCard` uses `additionalInterfaces`, not `supportedInterfaces`.
+  - JSON-RPC request models use `message/send`, `tasks/get`, `tasks/cancel`, and `agent/getAuthenticatedExtendedCard`.
+  - The installed SDK does not expose a JSON-RPC `ListTasks` request model.
+- A2A v0.3.0 specification:
+  - JSON-RPC methods use the `{category}/{action}` pattern such as `message/send` and `tasks/get`.
+  - Transport declarations use `preferredTransport` plus `additionalInterfaces`.
+  - The method mapping table lists `tasks/list` as gRPC/REST only.
+- Repository compatibility policy:
+  - `A2A-Version` negotiation supports both `0.3` and `1.0`.
+  - Payloads still follow the shipped `0.3` SDK baseline.
+  - `1.0` compatibility is currently documented as partial rather than complete.
+
+## Classification Labels
+
+- `TCK issue`: the failing expectation conflicts with `a2a-sdk==0.3.25` and the v0.3.0 baseline used by this repository.
+- `TCK issue; also a repo v1.0 gap`: the exact failure is caused by a TCK mismatch, but the same area would still need extra work for stronger `1.0` compatibility.
+- `TCK issue / local experiment artifact`: the failure comes from an aggressive heuristic or from local dummy-run characteristics and should not be treated as a runtime protocol bug.
+
+## Per-Test Triage
+
+- `tests/mandatory/authentication/test_auth_compliance_v030.py::test_security_scheme_structure_compliance`: `TCK issue`. The TCK expects each `securitySchemes` entry to be wrapped as `{httpAuthSecurityScheme: {...}}`, but `a2a-sdk==0.3.25` exposes the flattened OpenAPI-shaped object with fields like `type`, `scheme`, `description`, and `bearerFormat`.
+- `tests/mandatory/authentication/test_auth_enforcement.py::test_authentication_scheme_consistency`: `TCK issue`. Same root cause as the previous test: the TCK validates a non-SDK wrapper shape instead of the installed SDK schema.
+- `tests/mandatory/jsonrpc/test_a2a_error_codes_enhanced.py::test_push_notification_not_supported_error_32003_enhanced`: `TCK issue`. The failure is a TCK helper bug: `transport_create_task_push_notification_config()` is called with the wrong positional signature before the runtime behavior is even exercised.
+- `tests/mandatory/jsonrpc/test_json_rpc_compliance.py::test_rejects_invalid_json_rpc_requests[invalid_request4--32602]`: `TCK issue`. The test sends JSON-RPC method `SendMessage`; under the v0.3.0 / SDK 0.3.25 baseline the correct method is `message/send`, so the runtime correctly returns `-32601` for an unknown method instead of `-32602`.
+- `tests/mandatory/jsonrpc/test_json_rpc_compliance.py::test_rejects_invalid_params`: `TCK issue`. Same method-name mismatch as above; with the correct `message/send` method the runtime returns `-32602` for invalid parameters.
+- `tests/mandatory/jsonrpc/test_protocol_violations.py::test_duplicate_request_ids`: `TCK issue`. The first request already fails because the TCK uses `SendMessage` instead of `message/send`, so the duplicate-ID assertion never reaches the actual duplicate-ID behavior.
+- `tests/mandatory/protocol/test_a2a_v030_new_methods.py::TestMethodMappingCompliance::test_core_method_mapping_compliance`: `TCK issue; also a repo v1.0 gap`. The JSON-RPC client uses PascalCase methods (`SendMessage`, `GetTask`, `CancelTask`) that do not match the v0.3.0 JSON-RPC mapping, but the repository also does not currently provide PascalCase aliases even when `A2A-Version: 1.0` is negotiated.
+- `tests/mandatory/protocol/test_message_send_method.py::test_message_send_valid_text`: `TCK issue; also a repo v1.0 gap`. The failing request uses `SendMessage` over JSON-RPC; the repository correctly supports `message/send` for the current SDK baseline, but not the PascalCase alias.
+- `tests/mandatory/protocol/test_message_send_method.py::test_message_send_invalid_params`: `TCK issue; also a repo v1.0 gap`. Direct cause is the same PascalCase JSON-RPC method mismatch.
+- `tests/mandatory/protocol/test_message_send_method.py::test_message_send_continue_task`: `TCK issue; also a repo v1.0 gap`. Direct cause is again `SendMessage` instead of `message/send`.
+- `tests/mandatory/protocol/test_state_transitions.py::test_task_history_length`: `TCK issue; also a repo v1.0 gap`. Task creation fails only because the TCK uses `SendMessage` on JSON-RPC.
+- `tests/mandatory/protocol/test_tasks_cancel_method.py::test_tasks_cancel_valid`: `TCK issue; also a repo v1.0 gap`. The fixture cannot create a task because the TCK uses `SendMessage`; the runtime's `tasks/cancel` behavior is not the direct failing cause in this run.
+- `tests/mandatory/protocol/test_tasks_cancel_method.py::test_tasks_cancel_nonexistent`: `TCK issue; also a repo v1.0 gap`. The TCK calls JSON-RPC `CancelTask`; under the v0.3.0 baseline the method is `tasks/cancel`. With the correct method, the runtime returns `Task not found` / `-32001`.
+- `tests/mandatory/protocol/test_tasks_get_method.py::test_tasks_get_valid`: `TCK issue; also a repo v1.0 gap`. The task-creation fixture fails first because the TCK uses `SendMessage`.
+- `tests/mandatory/protocol/test_tasks_get_method.py::test_tasks_get_with_history_length`: `TCK issue; also a repo v1.0 gap`. Same fixture failure via `SendMessage`.
+- `tests/mandatory/protocol/test_tasks_get_method.py::test_tasks_get_nonexistent`: `TCK issue; also a repo v1.0 gap`. The TCK calls JSON-RPC `GetTask`; under the v0.3.0 baseline the method is `tasks/get`. With the correct method, the runtime returns `Task not found` / `-32001`.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestBasicListing::test_list_all_tasks`: `TCK issue; also a repo v1.0 gap`. The test suite uses JSON-RPC `ListTasks`, which is outside the `a2a-sdk==0.3.25` JSON-RPC surface and outside the v0.3.0 JSON-RPC mapping.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestBasicListing::test_list_tasks_empty_when_none_exist`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestBasicListing::test_list_tasks_validates_required_fields`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestBasicListing::test_list_tasks_sorted_by_timestamp_descending`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestFiltering::test_filter_by_context_id`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestFiltering::test_filter_by_status`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestFiltering::test_filter_by_last_updated_after`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestFiltering::test_combined_filters`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestPagination::test_default_page_size`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestPagination::test_custom_page_size`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestPagination::test_page_token_navigation`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestPagination::test_last_page_detection`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestPagination::test_total_size_accuracy`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestHistoryLimiting::test_history_length_zero`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestHistoryLimiting::test_history_length_custom`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestHistoryLimiting::test_history_length_exceeds_actual`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestArtifactInclusion::test_artifacts_excluded_by_default`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestArtifactInclusion::test_artifacts_included_when_requested`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestEdgeCasesAndErrors::test_invalid_page_token_error`: `TCK issue; also a repo v1.0 gap`. The assertion expects JSON-RPC param validation on `ListTasks`, but the direct failure is still that `ListTasks` is not a supported JSON-RPC method in the current SDK baseline.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestEdgeCasesAndErrors::test_invalid_status_error`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestEdgeCasesAndErrors::test_negative_page_size_error`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestEdgeCasesAndErrors::test_zero_page_size_error`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestEdgeCasesAndErrors::test_out_of_range_page_size_error`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestEdgeCasesAndErrors::test_default_page_size_is_50`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestEdgeCasesAndErrors::test_negative_history_length_error`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/protocol/test_tasks_list_method.py::TestEdgeCasesAndErrors::test_invalid_timestamp_error`: `TCK issue; also a repo v1.0 gap`. Same JSON-RPC `ListTasks` mismatch.
+- `tests/mandatory/security/test_agent_card_security.py::test_public_agent_card_access_control`: `TCK issue`. The TCK requires `supportedInterfaces`, but `a2a-sdk==0.3.25` and the v0.3.0 specification use `additionalInterfaces`.
+- `tests/mandatory/security/test_agent_card_security.py::test_sensitive_information_protection`: `TCK issue / local experiment artifact`. The failure is driven by heuristic keyword scanning (`token`, `private`, `127.0.0.1`, non-standard port) against a local dummy-backed run. That is not a reliable indicator of protocol non-compliance.
+- `tests/mandatory/security/test_agent_card_security.py::test_security_scheme_consistency`: `TCK issue`. Same schema mismatch as the earlier authentication tests: the TCK expects wrapped security scheme objects instead of the installed SDK shape.
+- `tests/mandatory/transport/test_multi_transport_equivalence.py::test_message_sending_equivalence`: `TCK issue; also a repo v1.0 gap`. The transport client uses JSON-RPC `SendMessage`; under the v0.3.0 baseline the method is `message/send`, but stronger `1.0` compatibility would still require additional alias handling.
+- `tests/mandatory/transport/test_multi_transport_equivalence.py::test_concurrent_operation_equivalence`: `TCK issue; also a repo v1.0 gap`. Same direct cause as the previous test: the JSON-RPC client sends `SendMessage`.
+
+## Adjacent Repository Gaps Found During Triage
+
+These did not directly cause the exact failed node IDs above, but they are real repository-side gaps revealed during follow-up probes:
+
+- `A2A-Version: 1.0` still returns `-32601` for JSON-RPC `SendMessage` and `GetExtendedAgentCard`. That means current `1.0` support is still limited to negotiation and error-shaping rather than full method-surface compatibility.
+- `GET /v1/tasks` currently returns `500 NotImplementedError` in a local probe, even though the route exists and repository docs describe the SDK-owned REST surface as including task listing. That behavior should be treated as a repository issue independent from the TCK's incorrect JSON-RPC `ListTasks` expectation.
+
+## Summary
+
+For the exact 47 failed/error cases in the first mandatory run:
+
+- No failure is a clean `a2a-sdk==0.3.25` / v0.3.0 conformance bug in the current runtime.
+- Most failures come from TCK method/schema assumptions that do not match the shipped SDK baseline.
+- Several failures also highlight future repository work if stronger `1.0` compatibility becomes a goal.

opencode_a2a-0.7.1/docs/conformance.md

@@ -0,0 +1,67 @@
+# External Conformance Experiments
+
+This repository keeps internal regression and external interoperability experiments separate on purpose.
+
+## Scope
+
+- `./scripts/doctor.sh` remains the primary internal regression entrypoint.
+- `./scripts/conformance.sh` is a local/manual experiment entrypoint for official external tooling.
+- External conformance output should be treated as investigation input, not as an automatic merge gate.
+
+## Current Experiment Shape
+
+The default `./scripts/conformance.sh` workflow does the following:
+
+1. Sync the repository environment unless explicitly skipped.
+2. Cache or refresh the official `a2aproject/a2a-tck` checkout.
+3. Start a local dummy-backed `opencode-a2a` runtime unless `CONFORMANCE_SUT_URL` points to an existing SUT.
+4. Run the requested TCK category, defaulting to `mandatory`.
+5. Preserve raw logs and machine-readable reports under `run/conformance/<timestamp>/`.
+
+The default local SUT uses the repository test double `DummyChatOpencodeUpstreamClient`. That keeps the experiment reproducible without requiring a live OpenCode upstream.
+
+## Usage
+
+Run the default mandatory experiment:
+
+```bash
+bash ./scripts/conformance.sh
+```
+
+Run a different TCK category:
+
+```bash
+bash ./scripts/conformance.sh capabilities
+```
+
+Target an already running runtime instead of the local dummy-backed SUT:
+
+```bash
+CONFORMANCE_SUT_URL=http://127.0.0.1:8000 \
+A2A_AUTH_TYPE=bearer \
+A2A_AUTH_TOKEN=dev-token \
+bash ./scripts/conformance.sh mandatory
+```
+
+## Artifacts
+
+Each run keeps the following artifacts in the selected output directory:
+
+- `agent-card.json`: fetched public Agent Card
+- `health.json`: fetched authenticated health payload when the local SUT is used
+- `tck.log`: raw TCK console output
+- `pytest-report.json`: pytest-json-report output emitted by the TCK runner
+- `failed-tests.json`: compact list of failed/error node IDs for triage
+- `metadata.json`: experiment metadata including local repo commit and cached TCK commit
+
+## Interpretation Guidance
+
+When a TCK run fails, inspect the raw report before changing the runtime:
+
+- Some failures may point to real runtime gaps.
+- Some failures may come from TCK assumptions that do not match `a2a-sdk==0.3.25`.
+- Some failures may come from A2A v0.3 versus v1.0 naming or schema drift.
+
+The experiment is useful only if those categories stay separate during triage.
+
+The current first-pass triage is recorded in [`./conformance-triage.md`](./conformance-triage.md).

{opencode_a2a-0.6.1 → opencode_a2a-0.7.1}/docs/extension-specifications.md

@@ -37,14 +37,16 @@ URI: `https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extens
 - Authenticated extended card: full shared stream contract including detailed block payload mappings and extended usage metadata
 - Runtime fields: `metadata.shared.stream`, `metadata.shared.usage`, `metadata.shared.interrupt`, `metadata.shared.session`
 
-## OpenCode Session Query v1
+## OpenCode Session Management v1
 
-URI: `https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#opencode-session-query-v1`
+URI: `https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#opencode-session-management-v1`
 
-- Scope: provider-private OpenCode session lifecycle, history, and low-risk control methods
+- Scope: provider-private OpenCode session read, mutation, and control methods
 - Public Agent Card: capability declaration only
-- Authenticated extended card: full method matrix, pagination rules, errors, and context semantics
+- Authenticated extended card: full method matrix, read/mutation/control grouping, pagination rules, errors, context semantics, and existing `opencode.sessions.prompt_async` input-part contracts
 - Transport: A2A JSON-RPC extension methods
+- `opencode.sessions.prompt_async` includes a provider-private `request.parts[]` compatibility surface for upstream OpenCode part types `text`, `file`, `agent`, and `subtask`
+- `subtask` support is declared as passthrough-compatible only: subagent selection and task-tool execution remain upstream OpenCode runtime behavior, not a separate `opencode-a2a` orchestration API
 
 ## OpenCode Provider Discovery v1
 
@@ -70,16 +72,16 @@ URI: `https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extens
 
 - Scope: provider-private recovery methods for pending local interrupt bindings
 - Public Agent Card: capability declaration only
-- Authenticated extended card: full method contracts, error surface, and local-registry notes
+- Authenticated extended card: full method contracts, error surface, local-registry notes, and identity-scope semantics
 - Transport: A2A JSON-RPC extension methods
 
 ## OpenCode Workspace Control v1
 
 URI: `https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#opencode-workspace-control-v1`
 
-- Scope: provider-private project, workspace, and worktree control-plane methods
+- Scope: provider-private project discovery plus workspace/worktree surfaces over upstream experimental endpoints, with deployment-conditional operator mutation methods
 - Public Agent Card: capability declaration only
-- Authenticated extended card: full method contracts, error surface, and routing notes
+- Authenticated extended card: full method contracts, error surface, routing notes, and upstream-stability hints
 - Transport: A2A JSON-RPC extension methods
 
 ## A2A Compatibility Profile v1
@@ -87,6 +89,7 @@ URI: `https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extens
 URI: `https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#a2a-compatibility-profile-v1`
 
 - Scope: compatibility profile describing core baselines, extension retention, and service behaviors
+- Includes machine-readable protocol compatibility summary for the currently declared `0.3` / `1.0` support boundary
 - Public Agent Card: capability declaration only
 - Authenticated extended card: full compatibility profile payload
 - Transport: Agent Card extension params
@@ -96,6 +99,7 @@ URI: `https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extens
 URI: `https://github.com/Intelligent-Internet/opencode-a2a/blob/main/docs/extension-specifications.md#a2a-wire-contract-v1`
 
 - Scope: wire-level contract for supported methods, endpoints, and error semantics
+- Includes the same machine-readable protocol compatibility summary published by the compatibility profile
 - Public Agent Card: capability declaration only
 - Authenticated extended card: full wire contract payload
 - Transport: Agent Card extension params