[dinakarjs]

Ready for independent review — 31 October 2026

Readiness assessed at 877ade76e03878ccf83bb16ef059948a9cb1d40a: current metadata is mergeable; all returned PR-triggered technical workflows succeeded, and the public discussion contains no explicit unresolved draft hold or code-change request. Changed-file scope and current CONTRIBUTING requirements were checked. This is a readiness assessment, not a new full source audit, fresh suite run, independent approval or complete branch-protection inventory.

Ordinary-path advertisement characterization only; no full A2A certification, protected-path TCK coverage or hardware acceptance.

The earlier draft-for-review wording below is historical. Independent maintainer review and normal merge gates remain required; no merge or release is authorized by this transition. Earlier test counts apply to their stated revisions; obsolete baseline CI failures below are superseded by the successful current-head runs. Prepared with OpenAI Codex.

---

Current closure refresh - 30 October 2026

Published head: 877ade7. Tested tree: 1dda1c7d13dd103fb31fa4d1f48f1b86579edb3e. Current-main history is merged without rewriting earlier contributors' commits; DCO trailers are present on this refresh commit.

Unit/conformance suites: 849 passed / 2 skipped; six TCK-comparison helper tests pass; Ruff, mypy (47 files) and configured Bandit pass. The earlier pinned official-TCK runs were not repeated here. Characterization does not become general A2A interoperability acceptance.

The published tree equals the locally tested tree. Whitespace checks on the contribution delta against current main pass (existing CRLF documentation is preserved). Hosted current-head checks and independent maintainer acceptance remain separate; no merge, production deployment or hardware result is claimed. Earlier measurements below describe their original revisions. Prepared with OpenAI Codex.

---

Adds a reproducible official A2A TCK advertisement comparison for the existing SDK loopback: pinned upstream scenario executor for ordinary messages, per-test comparator, six negative controls and a CI evidence job.

Historical initial-implementation validation: both JSON-RPC MUST runs: 79 passed, 156 skipped, 30 deselected, with identical test identities/outcomes. Protected handler count is zero in TCK runs. Separate bridge/signed-loopback suite: 55 passed. Comparator controls: 6 passed. Full unit suite: 790 passed, 2 skipped. Ruff passed.

Ubuntu TCK job, 61 companion tests, and artifact upload passed: https://github.com/agentrust-io/ca2a/actions/runs/39665468125 . The upload-path issue found in the first run is fixed. Workflow lint and CodeQL passed. The historical general-CI certifi blocker is superseded by successful current-head CI, Pinned A2A ordinary-path TCK, Workflow lint and CodeQL. The pinned TCK runs were not rerun locally in the 30 October refresh; hosted confirmation is separate from those original measurements. The maintainer gate still awaits review.

Both modes remain cA2A-aware; baseline removes only the advertisement. This is ordinary-path differential evidence, not full A2A certification, cross-language SDK coverage, hardware attestation or protected-path TCK coverage. Runtime code is unchanged. Reproduction and fixture limitations are documented in experiments/a2a-tck/README.md. Complements owner-led implementation work; closes no owner-gated issue.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dinakarjs]

@carloshvp Please review the pinned official A2A TCK advertisement comparison and its comparator controls at current head 877ade76e03878ccf83bb16ef059948a9cb1d40a. This PR is now ready for independent review, and the existing reviewer requests are populated. All returned current-head technical workflows succeed (validation evidence); the PR description records the prior local tests and their revisions.

Ordinary-path characterization only; no protected-handler TCK coverage, full A2A certification or hardware acceptance.

Please identify any remaining change required or disposition this bounded contribution. This request does not claim independent approval, a new full-suite rerun, or merge readiness. Prepared with OpenAI Codex.

[rajnisht7]

the overall changes looks good, but the evidence gate has a gap that matters for what this PR claims

• compare.py never asserts that protected_handler_invocations is 0 on either side. It only reports the numbers. I reproduced both [0, 7] and [7, 7] still returning identical_test_outcomes: true when the rest of the provenance and JUnit outcomes match. The README claims 0/0 and the runner records the count specifically for this isolation property, so the comparator should enforce it.

Please add the zero-check in compare() and a negative-control test (or three) covering non-zero / unequal counts. The existing negative controls cover everything else except this.

A couple of related notes while we’re here:

• The counter only increments inside _lookup() after successful auth + payload checks, so early rejects on the protected path stay at 0. The field name is a bit stronger than the actual metric.
• Streaming is forced True on both sides (original card is False). The differential is still controlled, but the “only removes the advertisement” wording is slightly imprecise.
• The new workflow only triggers on the experiment/demo paths; changes under src/ won’t re-run it.
• TCK cleanliness check uses --untracked-files=no.
• Child process inherits PYTEST_ADDOPTS etc.
• Small pin differences (cedarpy 4.12.1 vs current 4.12.2, setup-python still on v7.0.0).
• ca2a_tracked_changes is recorded but never compared.
  even though none of these break runtime. The missing zero assertion is the one that needs fixing before this can land, since the whole point of the PR is ordinary-path characterization evidence.