docs(spec): make the A2A profile binding normative (RFC 2119) - #64
Merged
Conversation
The profile page described the binding; it did not state requirements. An implementer could not tell what conformance meant, and A2A's extension governance requires official extensions to use the same RFC 2119 language as the core specification. Adds BCP 14 requirements language and nine numbered requirements (P-1 overlay, P-2 extension declaration, P-3 ignore-versus-enforce, P-4 attenuated delegation, P-5 effective scope, P-6 peer attestation, P-7 sealed payload, P-8 provenance, P-9 honest assurance), plus scope and conformance sections. P-6 is marked inline as not yet met: the appraisal runs in software mode at assurance="none". Stating the requirement and admitting the gap is the point; the alternative is a spec that quietly describes the implementation rather than the profile. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The profile page described the binding without stating requirements. An implementer could not tell what conformance meant, and A2A's own extension governance requires official extensions to use the same RFC 2119 language as the core spec, so this is also a prerequisite for proposing cA2A as an A2A extension.
What
BCP 14 requirements language plus nine numbered requirements:
A2A-Extensionsopt-inThe one deliberately awkward part
P-6 is marked inline as not yet met. The handshake gates the seal on an appraised channel key, but the appraisal runs in software mode at
assurance="none". The spec states the requirement and admits the gap in the same place, rather than weakening the requirement to match what ships. The alternative is a specification that quietly describes this implementation instead of the profile.P-8's denial-record requirement depends on #63.
Not in scope here
The other
docs/spec/pages are still descriptive. The requirements-language section covers them, so they can be tightened incrementally.Test plan
pytest tests/conformance— unchanged, passing. No code touched.🤖 Generated with Claude Code