[GH-ISSUE #3721] [Feature] A2A protocol reverse engineering: Agent Cards, task lifecycles, artifacts, streaming sessions and multi-agent workflow reconstruction #1432

New issue

Open

opened 2026-10-16 21:05:23 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:05:23 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3721

Problem Statement & Context

The Agent-to-Agent (A2A) protocol (standardized at v1.0 by the Linux Foundation / A2A Protocol Working Group) establishes a vendor-neutral, interoperable communication standard for autonomous AI agents collaborating across enterprise boundaries.

While REA's issue #3672 covers general tool calling and Model Context Protocol (MCP) clients, A2A defines a distinct, multi-turn distributed protocol with unique entities:

Agent Cards (agent-card.json): Cryptographically verifiable agent discovery manifests declaring capabilities, authentication requirements, supported skills, provider identity, and privacy policies.
Task Lifecycle Management: Asynchronous state machines tracking tasks (submitted, working, completed, failed, cancelled), context parameters, and task handoff delegations.
Artifact Generation & Handoff: Immutable data objects (files, diffs, code, structured JSON) produced by worker agents and passed downstream to supervisor or peer agents.
Bi-Directional Streaming & SSE: Server-Sent Events (SSE) and WebSocket channels streaming incremental thoughts, progress tokens, tool invocation checkpoints, and intermediate status messages.
Multi-Agent Orchestration Graphs: Complex topologies (hub-and-spoke, hierarchical delegation, peer-to-peer voting consensus) coordinating multiple specialized agents.

REA needs an A2A semantic analyzer capable of ingesting recorded network traffic (HTTP/SSE/WebSocket) or local agent configuration bundles to model agent capabilities and reconstruct multi-agent task workflows.

Proposed Architecture

flowchart TD
    A["A2A Captures / Endpoints (HTTP / SSE / WebSocket)"] --> B["A2A Protocol Semantic Engine"]
    B --> C["Agent Card & Capability Parser"]
    B --> D["Task Lifecycle & State Machine Tracker"]
    B --> E["Artifact & Handoff Reconstructor"]
    
    C --> C1["agent-card.json Metadata & Signatures"]
    C --> C2["Declared Skills, Tools & Authorization Scopes"]
    
    D --> D1["Task Submission & Handoff Delegation (Parent -> Subtask)"]
    D --> D2["SSE Streaming Events (Thought, Chunk, Progress)"]
    D --> D3["Execution States (Working -> Completed / Failed)"]
    
    E --> E1["Emitted Artifacts (Code, Reports, Data Tables)"]
    E --> E2["Cross-Agent Dependency Links"]
    
    C & D & E --> F["Synthesized Multi-Agent Workflow Diagram & Interaction Graph"]

Technical Capabilities & Modules

Agent Card Discovery & Verification:
- Parse and validate agent-card.json specifications: schema versions, endpoint URLs, provider identity, and cryptographic signatures.
- Index declared skills, supported message modalities, and authentication schemes (OAuth2, DPoP, mTLS).
Task Lifecycle & Session State Reconstruction:
- Dissect A2A JSON-RPC / REST message envelopes.
- Trace task progression across standardized states: submitted -> working -> completed / failed.
- Track task context variables, history turns, and intermediate cancellation requests.
Streaming Trace Slicing:
- Parse Server-Sent Events (text/event-stream) and WebSocket frames.
- Decode A2A event types: token generation, reasoning/thought traces, tool invocation proposals, and status updates.
Multi-Agent Delegation & Handoff Graph:
- Reconstruct parent-child task relationships (parent_task_id).
- Detect routing patterns: Router Agent -> Specialist Agent, Critic Agent -> Generator Agent loops.
- Generate Mermaid sequence and flowchart diagrams visualizing agent collaboration.
Artifact Provenance & Audit:
- Extract and verify artifacts produced during task execution.
- Trace artifact data flow across agents to detect data leakage or prompt injection vectors.

Acceptance Criteria

Automated validation of A2A v1.0 Agent Cards and capability declarations.
Parsing of recorded A2A sessions over REST, SSE, and WebSocket.
Complete reconstruction of task lifecycle state transitions and subtask handoffs.
Extraction of shared artifacts with cryptographic provenance tracking.
Generation of an end-to-end interactive multi-agent workflow graph.

Complements #3672 (AI agent protocol reverse engineering: MCP and tool calling)
Complements #3651 (LLM application reverse engineering)

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3721 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Game & Engine RE](https://img.shields.io/badge/domain-game_&_engine_RE-green.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ### Problem Statement & Context The Agent-to-Agent (A2A) protocol (standardized at v1.0 by the Linux Foundation / A2A Protocol Working Group) establishes a vendor-neutral, interoperable communication standard for autonomous AI agents collaborating across enterprise boundaries. While REA's issue #3672 covers general tool calling and Model Context Protocol (MCP) clients, A2A defines a distinct, multi-turn distributed protocol with unique entities: 1. **Agent Cards (`agent-card.json`)**: Cryptographically verifiable agent discovery manifests declaring capabilities, authentication requirements, supported skills, provider identity, and privacy policies. 2. **Task Lifecycle Management**: Asynchronous state machines tracking tasks (`submitted`, `working`, `completed`, `failed`, `cancelled`), context parameters, and task handoff delegations. 3. **Artifact Generation & Handoff**: Immutable data objects (files, diffs, code, structured JSON) produced by worker agents and passed downstream to supervisor or peer agents. 4. **Bi-Directional Streaming & SSE**: Server-Sent Events (SSE) and WebSocket channels streaming incremental thoughts, progress tokens, tool invocation checkpoints, and intermediate status messages. 5. **Multi-Agent Orchestration Graphs**: Complex topologies (hub-and-spoke, hierarchical delegation, peer-to-peer voting consensus) coordinating multiple specialized agents. REA needs an A2A semantic analyzer capable of ingesting recorded network traffic (HTTP/SSE/WebSocket) or local agent configuration bundles to model agent capabilities and reconstruct multi-agent task workflows. ### Proposed Architecture ```mermaid flowchart TD A["A2A Captures / Endpoints (HTTP / SSE / WebSocket)"] --> B["A2A Protocol Semantic Engine"] B --> C["Agent Card & Capability Parser"] B --> D["Task Lifecycle & State Machine Tracker"] B --> E["Artifact & Handoff Reconstructor"] C --> C1["agent-card.json Metadata & Signatures"] C --> C2["Declared Skills, Tools & Authorization Scopes"] D --> D1["Task Submission & Handoff Delegation (Parent -> Subtask)"] D --> D2["SSE Streaming Events (Thought, Chunk, Progress)"] D --> D3["Execution States (Working -> Completed / Failed)"] E --> E1["Emitted Artifacts (Code, Reports, Data Tables)"] E --> E2["Cross-Agent Dependency Links"] C & D & E --> F["Synthesized Multi-Agent Workflow Diagram & Interaction Graph"] ``` ### Technical Capabilities & Modules 1. **Agent Card Discovery & Verification:** - Parse and validate `agent-card.json` specifications: schema versions, endpoint URLs, provider identity, and cryptographic signatures. - Index declared skills, supported message modalities, and authentication schemes (OAuth2, DPoP, mTLS). 2. **Task Lifecycle & Session State Reconstruction:** - Dissect A2A JSON-RPC / REST message envelopes. - Trace task progression across standardized states: `submitted` -> `working` -> `completed` / `failed`. - Track task context variables, history turns, and intermediate cancellation requests. 3. **Streaming Trace Slicing:** - Parse Server-Sent Events (`text/event-stream`) and WebSocket frames. - Decode A2A event types: token generation, reasoning/thought traces, tool invocation proposals, and status updates. 4. **Multi-Agent Delegation & Handoff Graph:** - Reconstruct parent-child task relationships (`parent_task_id`). - Detect routing patterns: Router Agent -> Specialist Agent, Critic Agent -> Generator Agent loops. - Generate Mermaid sequence and flowchart diagrams visualizing agent collaboration. 5. **Artifact Provenance & Audit:** - Extract and verify artifacts produced during task execution. - Trace artifact data flow across agents to detect data leakage or prompt injection vectors. ### Acceptance Criteria - [ ] Automated validation of A2A v1.0 Agent Cards and capability declarations. - [ ] Parsing of recorded A2A sessions over REST, SSE, and WebSocket. - [ ] Complete reconstruction of task lifecycle state transitions and subtask handoffs. - [ ] Extraction of shared artifacts with cryptographic provenance tracking. - [ ] Generation of an end-to-end interactive multi-agent workflow graph. ### Related Issues & Dependencies - Complements #3672 (AI agent protocol reverse engineering: MCP and tool calling) - Complements #3651 (LLM application reverse engineering)

bsakaguchi referenced this issue

2026-10-17 21:11:22 +00:00

[PR #1432] [CLOSED] fix(browser): launch verification Chrome without the desktop keyring #2881

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#1432

No description provided.

Rows
Columns