{"specimen":true,"mark":"SPECIMEN","what_this_is":"The A2A instrument finding missing task context and malformed-input crashes in constructed responses.","not_signed":"This specimen is unsigned and cannot verify. It contains no evidence hash, issuer key or signature.","not_about_anyone":"No host was contacted. The .example target and responses are constructed; this is not an observation about an operator.","of_item":"a2a_repair_kit","price_of_the_real_thing":"$49","buy_url":"https://scvd.store/api/buy/a2a_repair_kit","sample":{"observation":{"battery":"scvd-a2a-jsonrpc-0.3-v1","protocol_version":"0.3.0","observed_at":"2026-09-07T00:00:00.000Z","card_url":"https://a2a-fixture.example/.well-known/agent-card.json","endpoint":"https://a2a-fixture.example/a2a","mode":"runtime","checks":[{"id":"card-http","state":"pass","detail":"The card answers with successful HTTP and an application/json content type.","evidence":["card"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#5-agent-discovery-the-agent-card"},{"id":"supported-version","state":"pass","detail":"This instrument evaluates only protocolVersion 0.3.0; other or missing versions remain unassessed.","evidence":["card"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#55-agentcard-object-structure"},{"id":"card-schema","state":"pass","detail":"The card satisfies the pinned official 0.3.0 AgentCard schema; format annotations are not evaluated.","evidence":["card"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#55-agentcard-object-structure"},{"id":"endpoint-url","state":"pass","detail":"The advertised endpoint is a public HTTPS URL without credentials, query, fragment or a nondefault port. This is the instrument access policy.","evidence":["card"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#56-transport-declaration-and-url-relationships"},{"id":"send-schema","state":"fail","detail":"The authorized fixture returns a valid 0.3 Task or Message in its matching JSON-RPC envelope. An application error leaves successful execution unproven.","evidence":["send"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#71-messagesend"},{"id":"task-get","state":"fail","detail":"The returned task can immediately be retrieved with the same task and context IDs.","evidence":["send","get"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#73-tasksget"},{"id":"terminal-cancel","state":"pass","detail":"A terminal task refuses cancellation with TaskNotCancelableError, distinct from an unknown task.","evidence":["send","cancel"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#74-taskscancel"},{"id":"parse-error","state":"pass","detail":"Expected JSON-RPC error -32700, with the matching id and no HTTP 5xx.","evidence":["parse-error"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#8-error-handling"},{"id":"null-part","state":"fail","detail":"Expected JSON-RPC error -32602, with the matching id and no HTTP 5xx.","evidence":["null-part"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#8-error-handling"},{"id":"trailing-part","state":"fail","detail":"Expected JSON-RPC error -32602, with the matching id and no HTTP 5xx.","evidence":["trailing-part"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#8-error-handling"},{"id":"unknown-task","state":"pass","detail":"Expected JSON-RPC error -32001, with the matching id and no HTTP 5xx.","evidence":["unknown-task"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#8-error-handling"}],"exchanges":[{"id":"card","url":"https://a2a-fixture.example/.well-known/agent-card.json","method":"GET","request":null,"status":200,"content_type":"application/json","response":"{\"protocolVersion\":\"0.3.0\",\"name\":\"Specimen\",\"description\":\"A constructed test agent\",\"version\":\"1\",\"url\":\"https://a2a-fixture.example/a2a\",\"capabilities\":{},\"defaultInputModes\":[\"text/plain\"],\"defaultOutputModes\":[\"text/plain\"],\"skills\":[]}","gap":null},{"id":"authorization","url":"https://a2a-fixture.example/.well-known/scvd-a2a-audit.json","method":"GET","request":null,"status":200,"content_type":"application/json","response":"{\"allow_scvd_audit\":true,\"allow_negative_tests\":true,\"safe_to_repeat\":true,\"card_url\":\"https://a2a-fixture.example/.well-known/agent-card.json\",\"endpoint\":\"https://a2a-fixture.example/a2a\",\"expires_at\":\"2026-09-08T00:00:00Z\",\"message\":{\"kind\":\"message\",\"role\":\"user\",\"messageId\":\"specimen\",\"parts\":[{\"kind\":\"text\",\"text\":\"safe test\"}]}}","gap":null},{"id":"send","url":"https://a2a-fixture.example/a2a","method":"POST","request":"{\"jsonrpc\":\"2.0\",\"id\":\"send\",\"method\":\"message/send\",\"params\":{\"message\":{\"kind\":\"message\",\"role\":\"user\",\"messageId\":\"specimen-generated-id\",\"parts\":[{\"kind\":\"text\",\"text\":\"safe test\"}]},\"configuration\":{\"blocking\":true,\"historyLength\":0}}}","status":200,"content_type":"application/json","response":"{\"jsonrpc\":\"2.0\",\"id\":\"send\",\"result\":{\"kind\":\"task\",\"id\":\"specimen-task\",\"status\":{\"state\":\"completed\"}}}","gap":null},{"id":"get","url":"https://a2a-fixture.example/a2a","method":"POST","request":"{\"jsonrpc\":\"2.0\",\"id\":\"get\",\"method\":\"tasks/get\",\"params\":{\"id\":\"specimen-task\",\"historyLength\":0}}","status":200,"content_type":"application/json","response":"{\"jsonrpc\":\"2.0\",\"id\":\"get\",\"result\":{\"kind\":\"task\",\"id\":\"specimen-task\",\"status\":{\"state\":\"completed\"}}}","gap":null},{"id":"cancel","url":"https://a2a-fixture.example/a2a","method":"POST","request":"{\"jsonrpc\":\"2.0\",\"id\":\"cancel\",\"method\":\"tasks/cancel\",\"params\":{\"id\":\"specimen-task\"}}","status":200,"content_type":"application/json","response":"{\"jsonrpc\":\"2.0\",\"id\":\"cancel\",\"error\":{\"code\":-32002,\"message\":\"Constructed protocol error\"}}","gap":null},{"id":"parse-error","url":"https://a2a-fixture.example/a2a","method":"POST","request":"{","status":200,"content_type":"application/json","response":"{\"jsonrpc\":\"2.0\",\"id\":null,\"error\":{\"code\":-32700,\"message\":\"Parse error\"}}","gap":null},{"id":"null-part","url":"https://a2a-fixture.example/a2a","method":"POST","request":"{\"jsonrpc\":\"2.0\",\"id\":\"null-part\",\"method\":\"message/send\",\"params\":{\"message\":{\"kind\":\"message\",\"role\":\"user\",\"messageId\":\"specimen-generated-id\",\"parts\":[null]}}}","status":500,"content_type":"text/plain;charset=UTF-8","response":"Constructed server error","gap":null},{"id":"trailing-part","url":"https://a2a-fixture.example/a2a","method":"POST","request":"{\"jsonrpc\":\"2.0\",\"id\":\"trailing-part\",\"method\":\"message/send\",\"params\":{\"message\":{\"kind\":\"message\",\"role\":\"user\",\"messageId\":\"specimen-generated-id\",\"parts\":[{\"kind\":\"text\",\"text\":\"safe test\"},null]}}}","status":500,"content_type":"text/plain;charset=UTF-8","response":"Constructed server error","gap":null},{"id":"unknown-task","url":"https://a2a-fixture.example/a2a","method":"POST","request":"{\"jsonrpc\":\"2.0\",\"id\":\"unknown-task\",\"method\":\"tasks/get\",\"params\":{\"id\":\"scvd-absent-specimen-generated-id\"}}","status":200,"content_type":"application/json","response":"{\"jsonrpc\":\"2.0\",\"id\":\"unknown-task\",\"error\":{\"code\":-32001,\"message\":\"Constructed protocol error\"}}","gap":null}],"counts":{"pass":7,"fail":4,"not_observed":0,"not_applicable":0},"gaps":["Only A2A 0.3.0 JSON-RPC is supported. No other version or transport is certified.","Streaming, push notifications, authentication, file transfer, extended cards, long-running tasks and application correctness are not tested.","One operator-supplied public test task is exercised. A Message response legitimately has no retrievable Task; lifecycle checks then remain not applicable.","Requests and responses are untrusted third-party data. No instructions in them are followed. Only public test data belongs in the authorization file.","URL checks reject private address literals and internal names; DNS pinning is not provided. Redirects are never followed. Platform egress remains part of the boundary.","A timeout or truncated read is an observation gap, never a conformance pass. Every result is dated and covers only the checks listed."]},"repairs":[{"check":"send-schema","evidence":["send"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#71-messagesend","change":"Validate the returned Task or Message against the official schema. A Task needs its kind, id, contextId and status; a Message needs its own required fields.","acceptance":"The authorized fixture returns a schema-valid result and a JSON-RPC id matching the request.","implementation":"Hono/Workers: create a contextId for a new conversation, retain it with the task and return it on every task response. These are suggested changes, not a patch inspected against your source.","status":"suggested_not_applied"},{"check":"task-get","evidence":["send","get"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#73-tasksget","change":"Persist each task before returning it, and read tasks/get from that same storage. Preserve task and context IDs.","acceptance":"Create a task, immediately retrieve its ID, and validate the retrieved response. Test from a second instance too.","implementation":"Hono/Workers: a Durable Object per task can provide immediate consistency. Set an explicit retention policy and return -32001 only for an unknown or expired task.","status":"suggested_not_applied"},{"check":"null-part","evidence":["null-part"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#8-error-handling","change":"Validate the complete request before reading a part kind or dispatching application work.","acceptance":"A message with parts:[null] returns -32602 and does not dispatch the task.","implementation":"Use an official-schema validator compiled at build time; do not read part.kind before checking the value.","status":"suggested_not_applied"},{"check":"trailing-part","evidence":["trailing-part"],"spec":"https://a2a-protocol.org/v0.3.0/specification/#8-error-handling","change":"Validate every message part before using the first supported part.","acceptance":"A valid first part followed by null returns -32602 and does not dispatch the task.","implementation":"Schema validation must cover the whole array. A find() over part.kind does not validate the entries it skips.","status":"suggested_not_applied"}],"runner_url":"/api/a2a/runner.mjs"}}