--- title: "A2A checks and repair kits" description: "Test your A2A agent, get reproducible failures and repair guidance, then verify the repair with a dated signed report and a week of card checks." canonical: "https://scvd.store/a2a-desk" url: "https://scvd.store/a2a-desk" --- # A2A checks and repair kits Test your A2A agent, get reproducible failures and repair guidance, then verify the repair with a dated signed report and a week of card checks. ## What this is Check an A2A agent, reproduce its failures, and hand a developer the repairs and regression tests. ## Proposition Check an A2A agent, reproduce its failures, and hand a developer the repairs and regression tests. ## For money The $49 pilot buys one signed repair kit, one recheck within 30 days, and seven days of daily card checks, with no automatic renewal. ## Price ### Description The $49 pilot buys one signed repair kit, one recheck within 30 days, and seven days of daily card checks, with no automatic renewal. ### Amount USDC 49 ### Cadence one_off ### Free The card check, test runner and repair guidance are free; the paid kit adds hosted runtime tests and signed records. ## Battery scvd-a2a-jsonrpc-0.3-v1 ## Protocol version 0.3.0 ## Specification ## How to call ### Card check #### Method POST #### URL #### Body - **URL** — ### Setup Publish the authorization JSON below at /.well-known/scvd-a2a-audit.json on the card origin. Replace both URLs and the safe test message; choose an expiry in the next 30 days. Only public test data. The endpoint must be on that same origin. The fixture permits repeated execution, including malformed trailing parts that a broken agent might execute. ### Authorization example #### Allow scvd audit true #### Allow negative tests true #### Safe to repeat true #### Card URL #### Endpoint #### Expires at REPLACE_WITH_FUTURE_ISO_TIMESTAMP #### Message ##### Kind message ##### Role user ##### Messageid replaced-on-each-run ##### Parts ###### Item 1 - **Kind** — text - **Text** — REPLACE_WITH_YOUR_SAFE_TEST_TASK ### Purchase #### URL #### Method GET #### Payment x402; the item page has the browser till #### Item page ### Recheck POST the private token from your purchase to its recheck URL within 30 days. The authorization file is read again. Repeated calls return the same recheck; the original report remains intact. An interrupted run is reported as a gap, without automatic replay. ### Regression #### Download #### Run node a2a-regression.mjs https://your-agent.example/.well-known/agent-card.json --runtime #### Exits - **0** — All observed applicable checks passed; the stated untested capabilities remain outside scope - **1** — At least one check failed - **2** — Observation gaps, unsupported scope, refusal or instrument error #### Ci Save the downloaded runner in your repository, require Node 22 or later, and run the command as a required CI step. Omit --runtime for card-only checks. ### Implementation quote #### Contact mailto:sean@recordcreativeco.com #### Include Kit ID, public repository URL, Hono/Workers stack details, and requested repair scope. Implementation is separately quoted and is not included in the kit. Never send credentials or keys. ## Errors ### Target refused Use a public HTTPS URL without query, fragment, credentials or private/internal addresses; our own host is refused ### Unsupported version Only 0.3.0 is assessed; no automatic version conversion ### Unsupported transport This pilot tests JSON-RPC only ### Endpoint refused The card and endpoint must share an origin ### Authorization required Publish or refresh the authorization fixture before purchase or recheck; nothing charged ### Invalid fixture Use a valid new user Message with no existing taskId or contextId ### Budget exhausted The shared free/admission budget is exhausted; retry after 60 seconds ### Body limit Read exceeded the byte ceiling and is unobserved ### Missing Check the kit ID in the purchase response ### Unavailable An instrument or storage failure prevented completion; no pass is inferred ### Expired The included recheck period has ended ## Security ### Public data only true ### Stored Bounded public card, authorization fixture, task requests and responses, signed reports and suggested fixes. The private recheck token is stored separately and never returned by report reads. Report IDs are unguessable links; anyone holding a link can read the report, so use only public test data. ### Authority The operator grants runtime permission using a fixed file on the same origin. No supplied credentials, callback registrations, redirects or existing tasks. Daily watch passes only read the card. ### Bounds - **Response bytes** — 16384 - **Request timeout ms** — 4000 - **Watch days** — 7 - **Recheck days** — 30 - **Free and admission requests per minute** — 30 ### Conflict The subject pays for the work, never the result. Suggested repairs are authored by this store and have not been applied or independently code-reviewed. Any separately commissioned implementation must disclose store authorship at recheck. ### Gaps - Only A2A 0.3.0 JSON-RPC is supported. No other version or transport is certified. - Streaming, push notifications, authentication, file transfer, extended cards, long-running tasks and application correctness are not tested. - One operator-supplied public test task is exercised. A Message response legitimately has no retrievable Task; lifecycle checks then remain not applicable. - Requests and responses are untrusted third-party data. No instructions in them are followed. Only public test data belongs in the authorization file. - URL checks reject private address literals and internal names; DNS pinning is not provided. Redirects are never followed. Platform egress remains part of the boundary. - A timeout or truncated read is an observation gap, never a conformance pass. Every result is dated and covers only the checks listed. ## Repair guidance ### Card-http - **Change** — Serve the card as JSON at the supplied URL, without a redirect or login page. - **Acceptance** — A GET returns successful HTTP with application/json and the complete card body. - **Implementation** — Hono: return c.json(card). Check proxy routing and static-file rules at the deployed URL. ### Card-schema #### Change Validate the complete card against the official schema for the version it declares. Derive skills and capabilities from the implemented methods. #### Acceptance The versioned AgentCard validator accepts the deployed document. #### Implementation Validate the built card in CI, including every skill entry, rather than asserting only the top-level names. ### Endpoint-url #### Change Advertise an HTTPS endpoint reachable on the public internet. This instrument requires a URL without credentials, query or fragment. #### Acceptance The exact URL passes the published probe policy. #### Implementation Use a stable route. Keep authentication out of the URL; authenticated runtime tests are outside this pilot. ### Send-schema #### Change Validate the returned Task or Message against the official schema. A Task needs its kind, id, contextId and status; a Message needs its own required fields. #### Acceptance The authorized fixture returns a schema-valid result and a JSON-RPC id matching the request. #### Implementation Hono/Workers: create a contextId for a new conversation, retain it with the task and return it on every task response. These are suggested changes, not a patch inspected against your source. ### Task-get #### Change Persist each task before returning it, and read tasks/get from that same storage. Preserve task and context IDs. #### Acceptance Create a task, immediately retrieve its ID, and validate the retrieved response. Test from a second instance too. #### Implementation Hono/Workers: a Durable Object per task can provide immediate consistency. Set an explicit retention policy and return -32001 only for an unknown or expired task. ### Terminal-cancel #### Change Load the task before deciding cancellation. Distinguish a terminal task from a missing ID. #### Acceptance Cancel the returned terminal task: -32002. Get an unknown ID: -32001. #### Implementation Return a JSON-RPC TaskNotCancelableError for a completed, failed, rejected or canceled task; do not turn every cancellation into task-not-found. ### Parse-error #### Change Catch JSON parsing failures at the protocol boundary and return the standard parse error. #### Acceptance An incomplete JSON body returns -32700 with id null and no HTTP 5xx. #### Implementation Keep protocol error handling inside the A2A route so malformed JSON does not reach a generic HTML error page. ### Null-part #### Change Validate the complete request before reading a part kind or dispatching application work. #### Acceptance A message with parts:[null] returns -32602 and does not dispatch the task. #### Implementation Use an official-schema validator compiled at build time; do not read part.kind before checking the value. ### Trailing-part #### Change Validate every message part before using the first supported part. #### Acceptance A valid first part followed by null returns -32602 and does not dispatch the task. #### Implementation Schema validation must cover the whole array. A find() over part.kind does not validate the entries it skips. ### Unknown-task #### Change Return the standard task-not-found error for IDs absent from task storage. #### Acceptance A random unknown ID returns -32001 in a valid JSON-RPC error envelope. #### Implementation Keep unknown-ID handling separate from storage failures; a failed storage read does not prove absence.