opencode-a2a 1.3.0__tar.gz → 1.3.2__tar.gz

opencode_a2a-1.3.2/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,43 @@
+name: Bug report
+description: Report a reproducible runtime, protocol, or documentation issue
+title: "[Bug] "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: Remove secrets and sensitive data from logs and protocol payloads before submitting.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem description
+      description: What happened, and what behavior did you expect?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps
+      description: Provide minimal, repeatable steps and sanitized requests.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version and environment
+      description: Include the opencode-a2a, OpenCode, Python, and operating system versions.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Supporting evidence
+      description: Include sanitized logs, error responses, or relevant links.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-submission checklist
+      options:
+        - label: I searched the open issues and found no duplicate report.
+          required: true
+        - label: I confirm that this submission contains no tokens, passwords, or `.env` contents.
+          required: true

opencode_a2a-1.3.2/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability reporting
+    url: https://github.com/Intelligent-Internet/opencode-a2a/blob/main/SECURITY.md
+    about: Read the private disclosure guidance before reporting sensitive information. Do not disclose it in a public issue.
+  - name: Support scope
+    url: https://github.com/Intelligent-Internet/opencode-a2a/blob/main/SUPPORT.md
+    about: Review the supported scope before opening an issue.

opencode_a2a-1.3.2/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,39 @@
+name: Feature request
+description: Propose a new A2A, OpenCode, or engineering capability
+title: "[Feature] "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: User problem
+      description: What specific problem needs to be solved? Avoid describing only an implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the expected behavior, protocol or extension boundary, and alternatives.
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Affected surface
+      options:
+        - A2A core / transport
+        - OpenCode provider-private extension
+        - Operations / observability
+        - Documentation / open source engineering
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-submission checklist
+      options:
+        - label: I searched the open issues and found no duplicate request.
+          required: true
+        - label: I explained whether this capability belongs to A2A core, a shared extension, or a provider-private surface.
+          required: true

opencode_a2a-1.3.2/.github/pull_request_template.md

@@ -0,0 +1,18 @@
+## Summary
+
+Describe the problem, solution, and user-visible impact.
+
+## Related issue
+
+Closes #
+
+## Validation
+
+- [ ] Ran `./scripts/doctor.sh`
+- [ ] Ran `./scripts/conformance.sh` when changing an A2A transport or contract
+- [ ] Verified that the Agent Card, OpenAPI, machine-readable contracts, and documentation remain synchronized
+- [ ] Confirmed that logs, test data, and commits contain no secrets or `.env` contents
+
+## Compatibility and risk
+
+Describe protocol, SDK or Python support boundaries, deployment impact, and security considerations. Write "None" when not applicable.

{opencode_a2a-1.3.0 → opencode_a2a-1.3.2}/.github/workflows/validate.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
 
       - name: Set up uv
         uses: astral-sh/setup-uv@v7
@@ -66,7 +66,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12"]
+        python-version: ["3.11", "3.12", "3.13"]
 
     steps:
       - name: Checkout

{opencode_a2a-1.3.0 → opencode_a2a-1.3.2}/CONTRIBUTING.md

@@ -14,7 +14,7 @@ This repository maintains an OpenCode A2A runtime. Changes should keep runtime b
 
 Requirements:
 
-- Python 3.11, 3.12, or 3.13
+- Python 3.11, 3.12, 3.13, or 3.14
 - `uv`
 - A reachable OpenCode runtime if you need end-to-end manual checks
 
@@ -56,13 +56,13 @@ bash -n scripts/doctor.sh
 bash -n scripts/lint.sh
 ```
 
-External interoperability experiments stay outside the default regression baseline. When you need to reproduce current official-tool behavior, run:
+Repository-owned black-box compatibility probes stay outside the default regression baseline. Run them when transport or A2A protocol behavior changes:
 
 ```bash
 bash ./scripts/conformance.sh
 ```
 
-Treat that output as investigation input. Do not fold it into `doctor.sh` or the default CI quality gate unless the repository explicitly decides to promote a specific experiment into a maintained policy.
+The script does not download or bind to an external TCK. It checks the public Agent Card and both shipped transports against invariants maintained by this repository. A third-party TCK may be used independently as investigation input, but is not a repository dependency or certification claim.
 
 If you change extension methods, extension metadata, or Agent Card/OpenAPI contract surfaces, also make sure the targeted contract checks stay green:
 
@@ -71,6 +71,14 @@ uv run pytest tests/contracts/test_extension_contract_consistency.py
 uv run mypy src/opencode_a2a
 ```
 
+If you change outbound authentication, tracing, protocol-version, or extension headers, run the SDK transport regression directly:
+
+```bash
+uv run pytest --no-cov tests/client/test_client_http_headers.py
+```
+
+Assertions against a mocked SDK client or `ClientCallContext` alone do not prove that headers reached the HTTP request. Keep at least one regression test across Agent Card resolution, the real SDK transport, and the final `httpx.Request` boundary.
+
 ## Change Expectations
 
 - Keep code, comments, and docs in English.

{opencode_a2a-1.3.0 → opencode_a2a-1.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: opencode-a2a
-Version: 1.3.0
+Version: 1.3.2
 Summary: OpenCode A2A runtime
 Author: liujuanjuan1984@Intelligent-Internet
 License-Expression: Apache-2.0
@@ -14,6 +14,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Framework :: FastAPI
 Classifier: Topic :: Internet :: WWW/HTTP
 Requires-Python: >=3.11
@@ -142,6 +143,7 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 - Session continuity through `metadata.shared.session.id`
 - Request-scoped model selection through `metadata.shared.model`
 - OpenCode-oriented JSON-RPC extensions for session and model/provider queries
+- Authenticated Prometheus-compatible process metrics at `GET /metrics`
 
 ## A2A Protocol Support
 
@@ -219,7 +221,7 @@ Read before deployment:
 - [docs/compatibility.md](docs/compatibility.md) Compatibility-sensitive surface and contract-honesty guidance.
 - [docs/guide.md](docs/guide.md) Usage guide, transport details, streaming behavior, extensions, and examples.
 - [docs/security-architecture.md](docs/security-architecture.md) Security surface, boundaries, and residual-risk register.
-- [docs/conformance.md](docs/conformance.md) External TCK experiment workflow and artifact handling.
+- [docs/conformance.md](docs/conformance.md) Repository-owned black-box compatibility probes and artifact handling.
 - [SECURITY.md](SECURITY.md) Threat model, deployment caveats, and vulnerability disclosure guidance.
 
 ## Development

{opencode_a2a-1.3.0 → opencode_a2a-1.3.2}/README.md

@@ -100,6 +100,7 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 - Session continuity through `metadata.shared.session.id`
 - Request-scoped model selection through `metadata.shared.model`
 - OpenCode-oriented JSON-RPC extensions for session and model/provider queries
+- Authenticated Prometheus-compatible process metrics at `GET /metrics`
 
 ## A2A Protocol Support
 
@@ -177,7 +178,7 @@ Read before deployment:
 - [docs/compatibility.md](docs/compatibility.md) Compatibility-sensitive surface and contract-honesty guidance.
 - [docs/guide.md](docs/guide.md) Usage guide, transport details, streaming behavior, extensions, and examples.
 - [docs/security-architecture.md](docs/security-architecture.md) Security surface, boundaries, and residual-risk register.
-- [docs/conformance.md](docs/conformance.md) External TCK experiment workflow and artifact handling.
+- [docs/conformance.md](docs/conformance.md) Repository-owned black-box compatibility probes and artifact handling.
 - [SECURITY.md](SECURITY.md) Threat model, deployment caveats, and vulnerability disclosure guidance.
 
 ## Development

{opencode_a2a-1.3.0 → opencode_a2a-1.3.2}/docs/architecture.md

@@ -97,6 +97,6 @@ Use the docs by responsibility:
 - [Maintainer Architecture Guide](maintainer-architecture.md): internal module boundaries, request call chains, and persistence touchpoints
 - [Extension Specifications](extension-specifications.md): stable extension URI/spec index and disclosure policy
 - [Security Architecture](security-architecture.md): security surface mapping and residual-risk register
-- [Conformance Notes](conformance.md): external TCK experiment workflow
+- [Conformance Notes](conformance.md): repository-owned black-box compatibility probes
 - [Contributing Guide](../CONTRIBUTING.md): contributor workflow and validation
 - [Security Policy](../SECURITY.md): threat model and disclosure guidance

{opencode_a2a-1.3.0 → opencode_a2a-1.3.2}/docs/compatibility.md

@@ -4,7 +4,7 @@ This document defines the compatibility promises `opencode-a2a` currently uphold
 
 ## Runtime Support
 
-- Python versions: 3.11, 3.12, 3.13
+- Python versions: 3.11, 3.12, 3.13, 3.14
 - A2A SDK line: `1.x.y`
 - Supported A2A protocol line: `1.0`
 - OpenCode runtime line: `1.18.x` (verified with `1.18.19`)
@@ -27,7 +27,7 @@ If runtime support is not implemented, do not publish it as a supported machine-
 
 Consumer guidance:
 
-- Treat the v1 core A2A methods (`SendMessage`, `SendStreamingMessage`, `GetTask`, `CancelTask`, `SubscribeToTask`) as the portable baseline.
+- Discover the complete SDK-owned v1 core method set from `core.jsonrpc_methods`; do not infer it from a shortened documentation list.
 - Treat `urn:opencode-a2a:extension:...` entries in this repository as repository-governed extension identifiers, not as a claim that they are part of the A2A core baseline.
 - Treat `opencode.*` methods and `metadata.opencode.*` fields as provider-private OpenCode control and discovery surfaces layered on top of the portable A2A baseline.
 - Treat [extension-specifications.md](./extension-specifications.md) as the stable URI/spec index, not as the main usage guide.
@@ -40,7 +40,7 @@ When docs or reference material disagree, treat these as normative in this order
 - machine-readable discovery output such as Agent Card, authenticated extended card, and OpenAPI metadata
 - repository-owned docs in `README.md`, `docs/`, and `CONTRIBUTING.md`
 
-External TCK runs and local conformance experiments are investigation inputs. They do not override the repository's declared contract by themselves.
+The repository-owned black-box compatibility probes protect selected runtime invariants but are not a complete conformance suite. Third-party TCK output is investigation input only and does not override the repository's declared contract by itself.
 
 ## Compatibility-Sensitive Surface
 
@@ -60,7 +60,7 @@ Changes to those surfaces should be treated as compatibility-sensitive and shoul
 
 Service-level behavior layered on top of those core methods should also be declared explicitly when interoperability depends on it. Current examples:
 
-- `SubscribeToTask` replay-once behavior for terminal updates
+- `SubscribeToTask` rejection with `UnsupportedOperationError` for terminal tasks
 - first-terminal-state-wins task persistence policy
 - task-scoped `acceptedOutputModes` negotiation persistence across send / stream / get / subscribe
 - request-body rejection behavior for oversized transport payloads

opencode_a2a-1.3.2/docs/conformance.md

@@ -0,0 +1,50 @@
+# Repository-Owned Compatibility Probes
+
+`./scripts/conformance.sh` runs black-box checks maintained and reviewed with this repository. It deliberately does not clone, pin, or execute the official A2A TCK.
+
+## Scope
+
+The probe verifies a small set of high-value A2A 1.0 invariants through public HTTP boundaries:
+
+- Agent Card discovery advertises both HTTP+JSON and JSON-RPC interfaces
+- empty `SendMessage` input is rejected before execution
+- unsupported push notification configuration uses the protocol-specific error
+- subscribing to a terminal task returns `UnsupportedOperationError` on both transports
+- `ListTasks` is reachable through both shipped transports
+
+These checks protect this runtime's declared contract. They are not a complete A2A conformance suite and must not be presented as certification.
+
+## Usage
+
+Run against the local dummy-backed runtime:
+
+```bash
+bash ./scripts/conformance.sh
+```
+
+Run against an existing deployment:
+
+```bash
+CONFORMANCE_SUT_URL=http://127.0.0.1:8000 \
+CONFORMANCE_AUTH_TOKEN=dev-token \
+CONFORMANCE_ALLOW_EXTERNAL=1 \
+bash ./scripts/conformance.sh
+```
+
+The probe creates a real task and reads task state. Use a dedicated test deployment, never a production target. `CONFORMANCE_ALLOW_EXTERNAL=1` is a required explicit acknowledgement, and `CONFORMANCE_AUTH_TOKEN` is required for an existing deployment. The default `test-token` is used only for the locally launched test SUT.
+
+Use `CONFORMANCE_OUTPUT_DIR` to select the artifact directory and `CONFORMANCE_SKIP_REPO_SYNC=1` only when the locked environment has already been verified.
+
+## Artifacts
+
+Each run writes:
+
+- `agent-card.json`: the discovered public Agent Card
+- `report.json`: versioned check results and repository revision
+- `probe.log`: human-readable probe output
+- `sut.log`: local test-runtime output, when the script launches it
+- `repo-health.log`: repository environment checks, unless explicitly skipped
+
+## External Tools
+
+Maintainers may run third-party TCKs independently to investigate interoperability. Record exact tool revisions and wire payloads when reporting a finding. External output is evidence to triage, not an automatic merge gate, source of runtime truth, or reason to restore obsolete protocol behavior.

{opencode_a2a-1.3.0 → opencode_a2a-1.3.2}/docs/guide.md

@@ -43,6 +43,7 @@ Key variables to understand protocol behavior:
 - `A2A_ALLOWED_HOSTS`: comma-separated `Host` header allowlist (exact names or `*.example.com` wildcards). When configured, every inbound request must present a matching `Host` header. Binding to a non-loopback address without this allowlist logs a startup warning (DNS rebinding risk).
 - `A2A_LOG_LEVEL`: runtime log level. Default: `WARNING`.
 - `A2A_LOG_PAYLOADS` / `A2A_LOG_BODY_LIMIT`: payload logging behavior and truncation. When `A2A_LOG_LEVEL=DEBUG`, upstream OpenCode stream events are also logged with preview truncation controlled by `A2A_LOG_BODY_LIMIT`.
+- `A2A_METRICS_ENABLED`: expose process-local Prometheus text metrics at authenticated `GET /metrics`. Default: `true`.
 - The runtime accepts W3C `traceparent` / `tracestate` headers on inbound requests. When `traceparent` is missing or invalid, the runtime generates a fresh valid value and exposes it on the HTTP response header.
 - The active `traceparent` / `tracestate` pair is propagated across inbound A2A handling, OpenCode upstream requests, and outbound peer A2A calls triggered through the embedded client or `a2a_call` tool path.
 - Logs derive a stable `trace_id` from the active `traceparent` so request-scoped log lines can be correlated without introducing high-cardinality metric labels.
@@ -341,7 +342,7 @@ Current behavior:
 - The current SDK-owned core JSON-RPC surface includes `GetExtendedAgentCard` and `tasks/pushNotificationConfig/*`.
 - The current SDK-owned REST surface also includes `GET /tasks` and the task push notification config routes.
 - The SDK-owned core JSON-RPC method set follows the pinned `a2a-sdk` release and is locked by repository tests; review that surface deliberately when upgrading the SDK.
-- Push notification config routes/methods are currently exposed only because they are part of the SDK-owned core surface. This runtime does not configure a push config store or push sender, so push notification operations remain unsupported. REST routes currently return HTTP `501`, while JSON-RPC methods surface SDK-owned unsupported error envelopes.
+- Push notification config routes/methods are currently exposed only because they are part of the SDK-owned core surface. This runtime does not configure a push config store or push sender, so operations return the A2A 1.0 `PushNotificationNotSupportedError` contract: HTTP `400` for REST and JSON-RPC code `-32003`.
 
 When `A2A_ENABLE_SESSION_SHELL=false`, `opencode.sessions.shell` is omitted from `all_jsonrpc_methods` and exposed only through `extensions.conditionally_available_methods`.
 
@@ -384,7 +385,7 @@ Current compatibility matrix:
 | Transport payloads and enums | Supported | Request/response payloads, enums, and schema details follow the current SDK-owned v1 baseline. |
 | Error model | Supported | JSON-RPC and REST both use the v1 protocol-aware error shapes. |
 | Pagination and list semantics | Supported | Cursor/list behavior follows the current SDK baseline. |
-| Push notification surfaces | Unsupported | SDK-owned task push-notification routes are still exposed, but this runtime does not enable push sender/config-store support. REST routes return HTTP `501`, while JSON-RPC methods remain unsupported via SDK-owned error envelopes. |
+| Push notification surfaces | Unsupported | SDK-owned routes remain exposed, but the runtime has no push sender/config store. REST returns HTTP `400`; JSON-RPC returns `-32003` (`PUSH_NOTIFICATION_NOT_SUPPORTED`). |
 | Signatures and authenticated data | Supported | Security schemes and authenticated extended card discovery follow the shipped SDK schema. |
 
 ## Compatibility Profile
@@ -657,7 +658,7 @@ Detailed contract discovery for this provider-private surface is intentionally a
 - Privacy guard: when `A2A_LOG_PAYLOADS=true`, request/response bodies are still suppressed for `method=opencode.sessions.*`
 - Endpoint discovery: prefer `supportedInterfaces[]` with `protocolBinding=JSONRPC` from Agent Card
 - The runtime still delegates SDK-owned JSON-RPC methods such as `GetExtendedAgentCard` and `tasks/pushNotificationConfig/*` to the base A2A implementation; they are not OpenCode-specific extensions.
-- Push notification config methods remain effectively unsupported in the current runtime because no push config store or push sender is configured; REST routes return HTTP `501`, while JSON-RPC methods stay on SDK-owned unsupported error handling.
+- Push notification config methods remain unsupported because no push config store or sender is configured; REST returns HTTP `400` and JSON-RPC returns `-32003` with `PUSH_NOTIFICATION_NOT_SUPPORTED` details.
 - Notification behavior: for `opencode.sessions.*`, requests without `id` return HTTP `204 No Content`
 - Result format:
   - `opencode.sessions.status` => provider-private status summaries in `result.items`
@@ -1319,10 +1320,10 @@ If an SSE connection drops, use `GET /tasks/{task_id}:subscribe` to re-subscribe
 - For running tasks, the service attempts upstream OpenCode `POST /session/{sessionID}/abort` to stop generation.
 - Upstream interruption is best-effort: if upstream returns 404, network errors, or other HTTP errors, A2A cancellation still completes with `TaskState.TASK_STATE_CANCELED`.
 - Idempotency contract: repeated `CancelTask` on an already `canceled` task returns the current terminal task state without error.
-- Terminal subscribe contract: calling `SubscribeToTask` or `GET /tasks/{task_id}:subscribe` on a terminal task replays one terminal `Task` snapshot and then closes the stream.
+- Terminal subscribe contract: calling `SubscribeToTask` or `GET /tasks/{task_id}:subscribe` on a terminal task returns `UnsupportedOperationError`, as required by A2A 1.0.
 - Terminal persistence contract: once a terminal task snapshot is persisted, this service treats it as immutable. Producers must emit final text and artifact updates before the terminal event, and any final usage or stream metadata must be attached to that terminal event itself. Late terminal-state mutations are rejected by the task-store write policy.
-- These two semantics are also declared as machine-readable `service_behaviors` in the compatibility profile and wire contract extensions.
-- At `A2A_LOG_LEVEL=DEBUG`, the service emits lightweight metric log records (`logger=opencode_a2a.execution.executor`):
+- The cancellation idempotency enhancement is also declared under machine-readable `service_behaviors`. Terminal-task subscription rejection remains a core A2A 1.0 rule and is therefore not republished as a custom enhancement.
+- The service records process-local metrics for authenticated Prometheus scraping at `GET /metrics`; `A2A_METRICS_ENABLED=false` disables the endpoint. At `A2A_LOG_LEVEL=DEBUG`, the same updates are emitted as lightweight metric log records (`logger=opencode_a2a.execution.executor`):
   - `a2a_stream_requests_total`
   - `a2a_stream_active` (`value=1` when a stream starts, `value=-1` when it closes)
   - `opencode_stream_retries_total`

{opencode_a2a-1.3.0 → opencode_a2a-1.3.2}/docs/security-architecture.md

@@ -42,14 +42,17 @@ All REST routes are served at the root path (no `/v1` prefix).
 | GET | `/tasks` | List tasks | Credential |
 | GET/POST/DELETE | `/tasks/{id}/pushNotificationConfigs[/{push_id}]` | Push notification config (exposed-but-unsupported) | Credential |
 | POST | `/` | JSON-RPC endpoint (core + extensions) | Credential |
-| GET | `/health` | Health / runtime profile | Anonymous |
+| GET | `/health` | Health / runtime profile | Credential |
+| GET | `/metrics` | Process-local Prometheus metrics (when enabled) | Credential |
 | GET | `/openapi.json` | Sanitized OpenAPI contract | Anonymous |
 
 ### JSON-RPC Surface
 
-- Core A2A methods from the SDK dispatcher: `message/send`, `message/stream`,
-  `tasks/get`, `tasks/cancel`, `tasks/list`, `tasks/subscribe`,
-  `tasks/pushNotificationConfig/*`.
+- Core A2A methods from the SDK dispatcher: `SendMessage`,
+  `SendStreamingMessage`, `GetTask`, `ListTasks`, `CancelTask`,
+  `CreateTaskPushNotificationConfig`, `GetTaskPushNotificationConfig`,
+  `ListTaskPushNotificationConfigs`, `DeleteTaskPushNotificationConfig`,
+  `SubscribeToTask`, and `GetExtendedAgentCard`.
 - Provider-private `opencode.*` extensions (authenticated extended card only):
   - `opencode.sessions.*`: `status`, `list`, `messages.list`, `get`, `children`,
     `todo`, `diff`, `message.get`, `prompt_async`, `command`, `fork`, `share`,
@@ -87,6 +90,7 @@ All REST routes are served at the root path (no `/v1` prefix).
 | Rate limit | `A2A_RATE_LIMIT_ENABLED` / `_WINDOW_SECONDS` / `_MAX_REQUESTS` | On by default; 60 s window, 120 requests; 429 + `Retry-After` |
 | Stream budgets | `A2A_STREAM_MAX_BYTES` / `_MAX_DURATION_SECONDS` / `_IDLE_TIMEOUT_SECONDS` | 64 MiB / 3600 s / 120 s; `0` disables |
 | Payload logging | `A2A_LOG_PAYLOADS` / `A2A_LOG_BODY_LIMIT` | Opt-in; logs treated as sensitive |
+| Metrics | `A2A_METRICS_ENABLED` | On by default; authenticated `/metrics`; process-local values |
 
 ### Outbound Side Effects
 
@@ -160,7 +164,7 @@ are skipped idempotently.
 | R-3 | Non-loopback bind without `A2A_ALLOWED_HOSTS` only warns at startup | Accepted | Operator contract: trusted network or reverse proxy validates Host. [guide.md](./guide.md) "Inbound Origin and Host Boundary" |
 | R-4 | Single-tenant shared-workspace boundary; static credentials only by default | Accepted by design | Threat model and tenant guidance in [SECURITY.md](../SECURITY.md) |
 | R-5 | Payload logging can capture sensitive data when enabled | Accepted | Opt-in with `A2A_LOG_BODY_LIMIT` cap; treat logs as sensitive. [SECURITY.md](../SECURITY.md) |
-| R-6 | Push notification config surface exposed-but-unsupported (HTTP 501 / JSON-RPC unsupported) | Accepted | Contract kept explicitly unsupported; capability recovery is intentionally deferred |
+| R-6 | Push notification config surface exposed-but-unsupported | Accepted | A2A 1.0-specific errors are stable (REST 400 / JSON-RPC -32003); capability recovery is intentionally deferred |
 | R-7 | SQLite hardening exempts `:memory:` / `file:` URIs and non-POSIX platforms | Accepted | Plain absolute file path recommended for deployments. [guide.md](./guide.md) "SQLite Persistence Hardening" |
 
 ## Maintenance Rules

{opencode_a2a-1.3.0 → opencode_a2a-1.3.2}/pyproject.toml

@@ -20,6 +20,7 @@ classifiers = [
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Framework :: FastAPI",
     "Topic :: Internet :: WWW/HTTP",
 ]
@@ -102,3 +103,8 @@ ignore_missing_imports = true
 
 [tool.pytest.ini_options]
 addopts = "--cov=src/opencode_a2a --cov-report=term-missing --cov-report=json:.coverage.json --cov-fail-under=90"
+filterwarnings = [
+    "error::pytest.PytestUnhandledThreadExceptionWarning",
+    "error::pytest.PytestUnraisableExceptionWarning",
+    "always:.*was deleted before being closed.*:ResourceWarning:aiosqlite.core",
+]

{opencode_a2a-1.3.0 → opencode_a2a-1.3.2}/scripts/README.md

@@ -12,7 +12,7 @@ Executable scripts live in this directory. This file is the entry index for the
 ## Other Scripts
 
 - [`doctor.sh`](./doctor.sh): primary local development regression entrypoint with explicit fix/verify/package phases (uv sync + dependency compatibility + lint + mypy + tests + coverage + built-wheel smoke test)
-- [`conformance.sh`](./conformance.sh): local/manual external A2A conformance experiment entrypoint; caches the official TCK, can launch a dummy-backed local SUT, and preserves raw artifacts under `run/conformance/`
+- [`conformance.sh`](./conformance.sh): repository-owned A2A 1.0 black-box compatibility probes; can launch a dummy-backed local SUT and preserves machine-readable artifacts under `run/conformance/`
 - [`live_opencode_smoke.sh`](./live_opencode_smoke.sh): local/manual live integration smoke against a real OpenCode runtime; boots an isolated password-hardened `opencode serve` plus the opencode-a2a runtime in throwaway directories and verifies upstream auth, JSON-RPC extension reads, and a streaming prompt round-trip
 - [`dependency_health.sh`](./dependency_health.sh): development dependency review entrypoint (`sync`/`pip check` + outdated + dev audit), while blocking CI/publish audits focus on runtime dependencies
 - [`check_coverage.py`](./check_coverage.py): enforces the overall coverage floor and per-file minimums for critical modules
@@ -26,4 +26,4 @@ Executable scripts live in this directory. This file is the entry index for the
 - `doctor.sh` covers the default local validation baseline, while `dependency_health.sh` remains focused on standalone dependency review and audit flow.
 - `doctor.sh` stops early when `pre-commit` rewrites files so you can review the changes and rerun `doctor.sh` from the updated worktree.
 - [`.github/dependabot.yml`](../.github/dependabot.yml) prefers a single weekly grouped Dependabot PR for `uv`, while `dependency_health.sh` remains the explicit review/audit entrypoint.
-- External conformance experiments remain intentionally separate from the default regression path. See [`../docs/conformance.md`](../docs/conformance.md).
+- Repository-owned compatibility probes remain separate from the default regression path. See [`../docs/conformance.md`](../docs/conformance.md).

opencode_a2a-1.3.2/scripts/conformance.sh

@@ -0,0 +1,114 @@
+#!/usr/bin/env bash
+# Run repository-owned black-box A2A compatibility probes.
+set -euo pipefail
+
+# shellcheck source=./health_common.sh
+source "$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/health_common.sh"
+
+usage() {
+  cat <<'EOF'
+Usage:
+  bash ./scripts/conformance.sh
+
+Purpose:
+  Run repository-owned A2A 1.0 black-box compatibility probes.
+  This script does not download or depend on an external TCK.
+
+Selected environment variables:
+  CONFORMANCE_OUTPUT_DIR       Artifact directory (default: run/conformance/<timestamp>)
+  CONFORMANCE_SUT_URL          Probe an already running runtime instead of a local test SUT
+  CONFORMANCE_SUT_PORT         Local test SUT port (default: 8011)
+  CONFORMANCE_AUTH_TOKEN       Bearer token (default: test-token for the local test SUT)
+  CONFORMANCE_ALLOW_EXTERNAL=1 Required acknowledgement when CONFORMANCE_SUT_URL is set
+  CONFORMANCE_SKIP_REPO_SYNC=1 Skip uv sync/uv pip check
+EOF
+}
+
+if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
+  usage
+  exit 0
+fi
+if [[ "$#" -ne 0 ]]; then
+  echo "This entrypoint accepts no positional arguments." >&2
+  exit 2
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT_DIR="$(cd "${SCRIPT_DIR}/.." && pwd)"
+timestamp="$(date -u +%Y%m%dT%H%M%SZ)"
+output_dir="${CONFORMANCE_OUTPUT_DIR:-${ROOT_DIR}/run/conformance/${timestamp}}"
+sut_port="${CONFORMANCE_SUT_PORT:-8011}"
+sut_log="${output_dir}/sut.log"
+probe_log="${output_dir}/probe.log"
+
+mkdir -p "${output_dir}"
+
+cleanup() {
+  local exit_code="$1"
+  if [[ -n "${sut_pid:-}" ]] && kill -0 "${sut_pid}" >/dev/null 2>&1; then
+    kill "${sut_pid}" >/dev/null 2>&1 || true
+    wait "${sut_pid}" >/dev/null 2>&1 || true
+  fi
+  exit "${exit_code}"
+}
+trap 'cleanup $?' EXIT
+
+cd "${ROOT_DIR}"
+if [[ "${CONFORMANCE_SKIP_REPO_SYNC:-0}" != "1" ]]; then
+  run_shared_repo_health_prerequisites "conformance" >"${output_dir}/repo-health.log" 2>&1
+fi
+
+sut_url="${CONFORMANCE_SUT_URL:-}"
+auth_token="${CONFORMANCE_AUTH_TOKEN:-}"
+if [[ -z "${sut_url}" ]]; then
+  sut_url="http://127.0.0.1:${sut_port}"
+  auth_token="${auth_token:-test-token}"
+  if ! uv run python -c \
+    'import socket, sys; server = socket.create_server(("127.0.0.1", int(sys.argv[1]))); server.close()' \
+    "${sut_port}"; then
+    echo "Local conformance port ${sut_port} is unavailable; choose CONFORMANCE_SUT_PORT." >&2
+    exit 1
+  fi
+  CONFORMANCE_SUT_PORT="${sut_port}" \
+  CONFORMANCE_SUT_URL="${sut_url}" \
+  CONFORMANCE_AUTH_TOKEN="${auth_token}" \
+    uv run python -m scripts.conformance_sut >"${sut_log}" 2>&1 &
+  sut_pid="$!"
+
+  sut_ready=0
+  for _ in $(seq 1 50); do
+    if curl --silent --fail --output /dev/null \
+      "${sut_url}/.well-known/agent-card.json" 2>/dev/null; then
+      sut_ready=1
+      break
+    fi
+    if ! kill -0 "${sut_pid}" >/dev/null 2>&1; then
+      echo "Local conformance SUT exited before becoming ready." >&2
+      cat "${sut_log}" >&2 || true
+      exit 1
+    fi
+    sleep 0.2
+  done
+  if [[ "${sut_ready}" != "1" ]]; then
+    echo "Local conformance SUT did not become ready at ${sut_url}." >&2
+    cat "${sut_log}" >&2 || true
+    exit 1
+  fi
+elif [[ "${CONFORMANCE_ALLOW_EXTERNAL:-0}" != "1" ]]; then
+  echo "Set CONFORMANCE_ALLOW_EXTERNAL=1 to acknowledge external SUT side effects." >&2
+  exit 2
+elif [[ -z "${auth_token}" ]]; then
+  echo "CONFORMANCE_AUTH_TOKEN is required with CONFORMANCE_SUT_URL." >&2
+  exit 2
+fi
+
+set +e
+CONFORMANCE_AUTH_TOKEN="${auth_token}" \
+  uv run python -m scripts.conformance_probe \
+    --base-url "${sut_url}" \
+    --output-dir "${output_dir}" 2>&1 | tee "${probe_log}"
+probe_exit="${PIPESTATUS[0]}"
+set -e
+
+echo "Conformance artifacts: ${output_dir}"
+exit "${probe_exit}"