feat(a2a): add 1.0 agent gateway - #196
Conversation
There was a problem hiding this comment.
Reviewed the complete current diff at d96c682. This head is not mergeable yet:
- Required Backend/CI fails because parseSSEDataForTest is unused in backend/internal/server/agent_e2e_test.go:819.
- The runtime A2A dial guard in agent_gateway.go only rejects private/loopback/unspecified/link-local addresses. It still permits CGNAT and other special-use destinations (for example 100.100.100.200), after which agentCredentialTransport attaches static instance credentials. Reuse a complete special-use classifier at validation and dial time, and add credential-bearing dial regressions.
- Issue #160 requires fixed A2A 0.3/1.0 compatibility, but this head only advertises/accepts 1.0 and explicitly rejects 0.3. Either implement the acceptance criterion with compatibility tests or update the issue/scope before closing it.
- Direct JSON-RPC calls distinguish a missing Agent (TASK_NOT_FOUND) from an existing but unauthorized Agent (UNAUTHORIZED), creating the existence oracle that #160 prohibits. Return the same non-disclosing response as Card discovery.
- Only input text is evaluated by guardrails. Non-streaming output, streaming status messages, and artifact parts are persisted/returned without the output/artifact content-policy hook required by #160.
- This adds tracked data/agent-catalog.yaml, while AGENTS.md still says only data/model-catalog.yaml is tracked and other runtime data is ignored. Synchronize the repository guide.
No approval while these blockers and the failing required check remain.
|
Addressed the review findings in
A2A 0.3 is intentionally not implemented, per the confirmed product scope that this gateway uses A2A 1.0 exclusively. I changed the PR relationship from Validation rerun: focused A2A E2E, Please re-review the updated head when convenient. |
…ateway # Conflicts: # backend/go.mod # backend/internal/server/gateway_http.go # backend/internal/server/http.go # backend/internal/server/multi_instance_e2e_test.go
|
Follow-up: merged the latest Post-merge validation passed: focused A2A E2E, |
…ixes # Conflicts: # backend/go.sum # backend/internal/server/http.go # docs/deployment.md # docs/ja/deployment.md # docs/zh-CN/deployment.md # frontend/features/admin/i18n/translations.tsx
astaxie
left a comment
astaxie
left a comment
There was a problem hiding this comment.
Re-reviewed the complete current diff at 51b24f5. The three author replies are verified: streamed task state and artifacts are folded into the persisted snapshot, delegated background Responses are rejected before budget admission and job creation, and direct delegation now rejects expired backing API keys. The full backend suite, go vet, frontend tests/typecheck/build, all 122 repository tests and gates, three Compose renders, native installer tests, git diff check, and all required GitHub checks pass. I found no remaining code blocker. Approval still requires the PR body to preserve the current template: add the required English title/body checklist item and record explicit pass results for the first four Verification commands. The Linux-only container entrypoint test and SDK process smoke were not rerun locally; the corresponding GitHub Deployment and backend checks are green.
Summary
Adds a disabled-by-default A2A 1.0 Agent Gateway to TokenHub. The gateway lets authenticated callers discover and invoke reviewed upstream Agents through TokenHub while preserving centralized access control, task isolation, routing, budgets, auditability, and deployment controls. This implements the agreed scope of #160 using A2A 1.0 exclusively; A2A 0.3 is intentionally unsupported.
Related Issue
Relates to #160.
Changes
SendMessage,SendStreamingMessage,GetTask,ListTasks,CancelTask, andSubscribeToTask, plus authenticated Agent Card discovery.agent/<slug>OpenAI Responses bridge for non-streaming and streaming calls.Type of Change
Verification
cd backend && go test ./...cd backend && go vet ./...cd frontend && npm run typecheckcd frontend && npm run buildnode --test tools/*.test.mjs— 116 tests passednode tools/check-doc-translations.mjs --base origin/main --head HEADnode tools/check-ui-translations.mjsnode tools/check-env-contract.mjsnode tools/check-source-lines.mjsgit diff --checkmax_concurrency=1admission passed.Compatibility, Security, and Operations
/a2a/<slug>and theagent/<slug>Responses model namespace.A2A-Version: 1.0; missing versions and A2A 0.3 are rejected intentionally.TOKENHUB_A2A_ENABLED=false. Rollback is to disable the flag; registry, task, and execution data remain stored.TOKENHUB_A2A_ALLOW_PRIVATE_UPSTREAMS=trueis restricted to controlled development environments.data/agent-catalog.yamlis added to source, container, and native release artifacts.Checklist
.envfiles, databases, backups, or runtime logs are included.start.sh, and deployment documentation where applicable.data/model-catalog.yamlremains tracked and catalog changes were reviewed where applicable.git diff --checkpasses.