`memos/a2a-protocol-build-TK-10132.md`

58 lines
# GATED GO-BUILD — real A2A (Agent2Agent) client for AbramsEgo (TK-10132)

**From:** abramsego-agent (build-loop task 53, 2026-08-02) · **Ticket:** TK-10132
**Full scope memo:** `~/Projects/AbramsEgo/memos/a2a-protocol-scope.md`
**Research cost:** $0 (curl of public spec pages; sources: a2a-protocol.org/latest/specification/ [v1.0], /topics/agent-discovery/, /topics/enterprise-ready/)

## Recommended approach

Build AbramsEgo as an A2A **CLIENT only** (no server, no published Agent Card, no inbound
port, no directory registration). Thin zero-dependency client over the JSON-RPC 2.0
binding; direct-configuration discovery via a hand-curated allowlist that starts EMPTY.
`/api/chat` stays local-Ollama-only; external consults get their own Basic-Auth-gated
`POST /api/a2a/consult` route. Every response is treated as hostile input: rendered
escaped + tagged UNTRUSTED, never executed, never fed to an agent as instructions; any
recommended action drafts back to pending-approval. Outbound egress = allowlisted HTTPS
hosts on 443 only (the exact shape egress-sentinel treats as benign — rail written
against the 2026-07-29 stealer lesson, C2 144.172.92.199:8080). Payload linter blocks
secrets/fleet-snapshot fields from ever leaving.

**Activation condition:** even after build, do not enable until at least one trustworthy
peer A2A agent is named and approved into `data/a2a-agents.json`. Public A2A advisory
agents are scarce today; the internal cabinet panel (task 51) stays the working consult
surface until then.

## Effort estimate (future build tasks — none started)

- **Phase A (~0.5 day):** `lib/a2a-client.js` — Agent Card fetch
  (`/.well-known/agent-card.json`), JSON-RPC SendMessage/GetTask, timeouts, payload
  linter; tests against a local mock card.
- **Phase B (~0.5–1 day):** `POST /api/a2a/consult` + allowlist registry
  `data/a2a-agents.json` + append-only `data/a2a-consults.jsonl` + dashboard UNTRUSTED
  rendering.
- **Phase C (~0.5 day):** rails — officer-gated action drafts, egress-allowlist doc +
  egress-sentinel cross-reference, pm2-restart + curl :9773 smoke tests.
- **Phase D (NOT scoped, default-BLOCK):** A2A SERVER mode (publishing our own card /
  opening inbound). Separate Steve decision.

Total A–C: ~2–2.5 agent-days.

## Explicit dependency list (NOTHING installed yet)

- Required: **none** — Node ≥18 built-in `fetch` + hand-rolled JSON-RPC (~150 lines).
- Optional/deferred: `@a2a-js/sdk` (only if the thin client outgrows itself); SSE
  streaming via native fetch streams (still no dep).
- Credentials (if a peer requires auth): stored via secrets-manager `auth_ref`, never in
  repo.

## vp-abramsego decision block

```
[ ] APPROVE — build Phases A–C as queued build-loop tasks; activation still
              gated on Steve approving the first allowlist entry.
[ ] REVISE  — notes: ____________________________________________
[ ] BLOCK   — reason: ____________________________________________
```

Steve: final go/no-go is yours; nothing runs, installs, or opens until approved.