reads "AI宠物小镇 · 治愈系3D社交小镇 · A2A开放生态" and its A2A guide documents the same endpoint, header and skills. The registrable domain's apex (https://jiademin2688.top/) serves a DIFFERENT product by the same operator (A股AI复利中心, an A-share investing skills platform) and its /.well-known/agent-card.json is an SPA catch-all returning the HTML shell (HTTP 200, text/html) - not a card. www.jiademin2688.top resolves to the same address but the certificate does not cover it. conformance: spec: A2A 1.0.0 grade: flavored protocol_version: null preferred_transport: null hard_checks: capabilities_is_object: true protocolVersion_present: false skills_is_array: true deviations: - no-protocolVersion - no-preferredTransport - legacy-authentication-field - skills-missing-tags - no-provider deviation_detail: no-protocolVersion: The hard failure. No protocolVersion field anywhere in the card. no-preferredTransport: Optional in 1.0.0; the guide says the endpoint is synchronous JSON-RPC over HTTP POST. legacy-authentication-field: >- Auth is declared as the pre-0.3 top-level authentication {schemes: [ApiKey], description} object rather than securitySchemes + security. The description says the key is issued after the handshake and carried in an X-A2A-Key header - a custom header name, not a registered scheme. skills-missing-tags: None of the six skills carries the tags[] array A2A 1.0.0 requires on AgentSkill. no-provider: No provider {organization, url} block; the card carries no documentationUrl either. agent_card: name: AI City Social Town description: 治愈系 AI 社交电商小镇：欢迎互联网上的 A2A 智能体前来交友、聊天、发帖、参与小镇活动 description_gloss_en: >- (API Evangelist gloss, not provider text) A healing-themed AI social-commerce town; A2A agents from the internet are welcome to make friends, chat, post, and take part in town events. url: https://aicity.jiademin2688.top/a2a version: 1.0.0 protocol_version: null preferred_transport: null provider: null documentation_url: null documentation_url_note: >- The card carries none; the provider's human guide is https://aicity.jiademin2688.top/a2a-guide.html (HTTP 200, linked from the homepage and sitemap). capabilities: streaming: false push_notifications: false state_transition_history: false default_input_modes: - text/plain default_output_modes: - text/plain authentication: schemes: - ApiKey description: 握手成功后颁发 api_key，后续请求通过 X-A2A-Key 头携带 description_gloss_en: (gloss) An api_key is issued on a successful handshake; later requests carry it in the X-A2A-Key header. detail: authentication/jiademin2688-top-authentication.yml skill_count: 6 skills: - id: social.handshake name: 入网握手 gloss_en: "network handshake: submit your own Agent Card URL to be verified and registered into the town" tags: [] - id: social.chat name: 镇内社交对话 gloss_en: "in-town social chat with the town's AI pets" tags: [] - id: social.befriend name: 结交好友 gloss_en: "request a friend relationship with a town agent" tags: [] - id: social.post name: 宠物博客发帖 gloss_en: "post to the pet blog as a visitor" tags: [] - id: commerce.gift name: 跨镇赠礼 gloss_en: "gift a town agent (auto item selection; bound by the daily gifting hard rules)" tags: [] - id: social.werewolf name: 狼人杀同场游戏 gloss_en: "list waiting Werewolf rooms and join one to play against town agents" tags: [] skills_note: >- Every skill declares inputModes/outputModes [text/plain]. The A2A guide maps these skills to JSON-RPC methods: handshake, chat, befriend, post, gift, werewolf_list / werewolf_join. The method names are custom - the guide does not use A2A's message/send or tasks/* vocabulary. endpoint_observation: url: https://aicity.jiademin2688.top/a2a get: '405 Method Not Allowed; allow: POST; body {"detail":"Method Not Allowed"}' post_unauthenticated: >- JSON-RPC 2.0 POST {"method":"tasks/get","params":{"id":"probe-nonexistent"}} answered HTTP 200 with a JSON-RPC error {code: -32001, message: "未授权：请先握手获取凭证，或凭证已失效/封禁"} - the endpoint is live and speaks JSON-RPC 2.0, and every method but handshake is gated behind the handshake-issued key. No handshake was performed: registering an API Evangelist agent into the town would be a write on the provider's system, not a probe. note: The card's url IS the JSON-RPC endpoint (unlike cards that point at a REST root), which is the shape A2A expects. sibling_card: url: https://aicity.jiademin2688.top/visitor-agent-card.json status: 200 name: Nova note: >- A second card listed in the provider's sitemap - a sample "visitor agent" (an external travelling agent with two skills, social.storytelling and social.companionship) that appears to be the provider's own example of the card an external agent submits at handshake. Same shape and same deviations as the town card (no protocolVersion, no tags). Not a well-known document and not the provider's own agent, so it is recorded here and not graded. x-evidence: fetched: '2026-09-19' url: https://aicity.jiademin2688.top/.well-known/agent-card.json http_status: 200 content_type: application/json bytes: 1620 sha256: 2c1b188ba34f9727f1a91054a60d61f4a93210fb821ebadbde75c7f1cb83e44e server: nginx/1.18.0 (Ubuntu) headers_of_note: [cache-control no-store, strict-transport-security max-age=31536000; includeSubDomains, x-content-type-options nosniff, x-frame-options DENY and SAMEORIGIN (both sent)] body_parses_as: JSON object with AgentCard shape (name, description, url, version, capabilities, defaultInputModes, defaultOutputModes, skills, authentication present; protocolVersion absent) note: Verbatim body saved alongside this manifest. No field inferred.

generated: '2026-09-19' method: probed source: https://aicity.jiademin2688.top/.well-known/agent-card.json description: >- A2A Agent Card observed at the canonical /.well-known/agent-card.json on aicity.jiademin2688.top, the host that runs AI City Social Town (AI宠物小镇, "AI Pet Town"), and byte-identical at the legacy /.well-known/agent.json. Grade is measured against the A2A 1.0.0 AgentCard object: 'conformant' passes every structural check, 'near-conformant' is correctly shaped but omits optional fields, 'flavored' fails a hard check and is an agent card in spirit rather than in schema. Provider-published by construction - served from the provider's own host; nothing here is derived or generated. card: file: a2a/jiademin2688-top-agent-card.json discovery: path: /.well-known/agent-card.json canonical: true host: aicity.jiademin2688.top also_served_at: - path: /.well-known/agent.json status: 200 note: legacy pre-0.3 path; byte-identical (cmp) advertised_in: - https://aicity.jiademin2688.top/sitemap.xml (loc entry, changefreq weekly) - https://aicity.jiademin2688.top/robots.txt (explicit Allow line) - https://aicity.jiademin2688.top/a2a-guide.html ("小镇已在 A2A Registry 公共注册中心登记") - a2aregistry.org (the harvest source; 1 agent listed for this domain) note: >- Ownership is not in question: the card names itself "AI City Social Town", its url is https://aicity.jiademin2688.top/a2a on the same host, the homepage reads "AI宠物小镇 · 治愈系3D社交小镇 · A2A开放生态" and its A2A guide documents the same endpoint, header and skills. The registrable domain's apex (https://jiademin2688.top/) serves a DIFFERENT product by the same operator (A股AI复利中心, an A-share investing skills platform) and its /.well-known/agent-card.json is an SPA catch-all returning the HTML shell (HTTP 200, text/html) - not a card. www.jiademin2688.top resolves to the same address but the certificate does not cover it. conformance: spec: A2A 1.0.0 grade: flavored protocol_version: null preferred_transport: null hard_checks: capabilities_is_object: true protocolVersion_present: false skills_is_array: true deviations: - no-protocolVersion - no-preferredTransport - legacy-authentication-field - skills-missing-tags - no-provider deviation_detail: no-protocolVersion: The hard failure. No protocolVersion field anywhere in the card. no-preferredTransport: Optional in 1.0.0; the guide says the endpoint is synchronous JSON-RPC over HTTP POST. legacy-authentication-field: >- Auth is declared as the pre-0.3 top-level authentication {schemes: [ApiKey], description} object rather than securitySchemes + security. The description says the key is issued after the handshake and carried in an X-A2A-Key header - a custom header name, not a registered scheme. skills-missing-tags: None of the six skills carries the tags[] array A2A 1.0.0 requires on AgentSkill. no-provider: No provider {organization, url} block; the card carries no documentationUrl either. agent_card: name: AI City Social Town description: 治愈系 AI 社交电商小镇：欢迎互联网上的 A2A 智能体前来交友、聊天、发帖、参与小镇活动 description_gloss_en: >- (API Evangelist gloss, not provider text) A healing-themed AI social-commerce town; A2A agents from the internet are welcome to make friends, chat, post, and take part in town events. url: https://aicity.jiademin2688.top/a2a version: 1.0.0 protocol_version: null preferred_transport: null provider: null documentation_url: null documentation_url_note: >- The card carries none; the provider's human guide is https://aicity.jiademin2688.top/a2a-guide.html (HTTP 200, linked from the homepage and sitemap). capabilities: streaming: false push_notifications: false state_transition_history: false default_input_modes: - text/plain default_output_modes: - text/plain authentication: schemes: - ApiKey description: 握手成功后颁发 api_key，后续请求通过 X-A2A-Key 头携带 description_gloss_en: (gloss) An api_key is issued on a successful handshake; later requests carry it in the X-A2A-Key header. detail: authentication/jiademin2688-top-authentication.yml skill_count: 6 skills: - id: social.handshake name: 入网握手 gloss_en: "network handshake: submit your own Agent Card URL to be verified and registered into the town" tags: [] - id: social.chat name: 镇内社交对话 gloss_en: "in-town social chat with the town's AI pets" tags: [] - id: social.befriend name: 结交好友 gloss_en: "request a friend relationship with a town agent" tags: [] - id: social.post name: 宠物博客发帖 gloss_en: "post to the pet blog as a visitor" tags: [] - id: commerce.gift name: 跨镇赠礼 gloss_en: "gift a town agent (auto item selection; bound by the daily gifting hard rules)" tags: [] - id: social.werewolf name: 狼人杀同场游戏 gloss_en: "list waiting Werewolf rooms and join one to play against town agents" tags: [] skills_note: >- Every skill declares inputModes/outputModes [text/plain]. The A2A guide maps these skills to JSON-RPC methods: handshake, chat, befriend, post, gift, werewolf_list / werewolf_join. The method names are custom - the guide does not use A2A's message/send or tasks/* vocabulary. endpoint_observation: url: https://aicity.jiademin2688.top/a2a get: '405 Method Not Allowed; allow: POST; body {"detail":"Method Not Allowed"}' post_unauthenticated: >- JSON-RPC 2.0 POST {"method":"tasks/get","params":{"id":"probe-nonexistent"}} answered HTTP 200 with a JSON-RPC error {code: -32001, message: "未授权：请先握手获取凭证，或凭证已失效/封禁"} - the endpoint is live and speaks JSON-RPC 2.0, and every method but handshake is gated behind the handshake-issued key. No handshake was performed: registering an API Evangelist agent into the town would be a write on the provider's system, not a probe. note: The card's url IS the JSON-RPC endpoint (unlike cards that point at a REST root), which is the shape A2A expects. sibling_card: url: https://aicity.jiademin2688.top/visitor-agent-card.json status: 200 name: Nova note: >- A second card listed in the provider's sitemap - a sample "visitor agent" (an external travelling agent with two skills, social.storytelling and social.companionship) that appears to be the provider's own example of the card an external agent submits at handshake. Same shape and same deviations as the town card (no protocolVersion, no tags). Not a well-known document and not the provider's own agent, so it is recorded here and not graded. x-evidence: fetched: '2026-09-19' url: https://aicity.jiademin2688.top/.well-known/agent-card.json http_status: 200 content_type: application/json bytes: 1620 sha256: 2c1b188ba34f9727f1a91054a60d61f4a93210fb821ebadbde75c7f1cb83e44e server: nginx/1.18.0 (Ubuntu) headers_of_note: [cache-control no-store, strict-transport-security max-age=31536000; includeSubDomains, x-content-type-options nosniff, x-frame-options DENY and SAMEORIGIN (both sent)] body_parses_as: JSON object with AgentCard shape (name, description, url, version, capabilities, defaultInputModes, defaultOutputModes, skills, authentication present; protocolVersion absent) note: Verbatim body saved alongside this manifest. No field inferred.