---
name: a2a-conformance
description: Evaluate an existing Agent-to-Agent (A2A) protocol service or agent for specification compliance, security best practices, and quality design. Uses static inspection, a2acli probes, and official TCK orchestration to produce a structured conformance report with stable check IDs. Use when asked to audit an A2A agent, run conformance checks, evaluate a service against the A2A spec, or check compatibility.
license: Apache-2.0
compatibility: Requires a2acli binary for live probes. Optional python3/uv/git for Tier 2 TCK.
metadata:
  category: protocol-engineering
---

# A2A Conformance & Audit Skill

Evaluate any A2A Protocol v1.0 remote agent (server) implementation for normative spec compliance, multi-transport behavioral equivalence, security, and quality design.

## Core Evaluation Principles

1. **RFC 2119 Normative Strictness:** Every MUST failure is blocking and results in a `NOT CONFORMANT` verdict. No exceptions.
2. **Multi-Tier Assessment:** Escalate from static metadata review (Tier 0) to active `a2acli` black-box probes (Tier 1) to official `a2a-tck` execution (Tier 2).
3. **Stable Check IDs:** Map all findings to stable `A2A-<AREA>-<NNN>` IDs defined in the conformance checklist.
4. **Actionable Remediation:** Always provide specific, copy-pasteable SDK code/configuration fixes for every identified warning or failure.

## Reference Manifest (Progressive Disclosure)

Load additional reference documents as needed for each phase of review:

- [references/checklist.md](references/checklist.md) — Master normative checklist (~110 rules across 9 areas with stable `A2A-*` IDs and spec citations).
- [references/static-review.md](references/static-review.md) — Tier 0 instructions for Agent Card JSON inspection and Go/Python SDK code audits.
- [references/probes.md](references/probes.md) — Tier 1 `a2acli` probe battery commands and expected JSON assertions.
- [references/tck.md](references/tck.md) — Tier 2 instructions for orchestrating `a2aproject/a2a-tck` via Python/uv.
- [references/scoring.md](references/scoring.md) — Verdict rules (`CONFORMANT`, `CONFORMANT WITH WARNINGS`, `NOT CONFORMANT`), area summary tables, and worked example report.

## Step-by-Step Execution Workflow

### Step 1: Identify Evaluation Target & Scope
Determine the target A2A service URL (e.g. `http://localhost:9001`) and available access level:
- **Card-only / Static source:** Perform Tier 0 static review.
- **Live HTTP/gRPC endpoint:** Perform Tier 0 + Tier 1 probes.
- **Full compliance validation requested:** Perform Tier 0 + Tier 1 + Tier 2 TCK.

### Step 2: Execute Tier 0 Static Review
1. Fetch or inspect `/.well-known/agent-card.json`.
2. Validate required fields (`name`, `version`, `supportedInterfaces`, `skills`, `capabilities`).
3. Follow guidelines in [references/static-review.md](references/static-review.md) and check against `A2A-CARD-*` rules in [references/checklist.md](references/checklist.md).

### Step 3: Execute Tier 1 Live Server Probes
Run the automated probe script or execute `a2acli` commands manually:

```bash
# Automated probe battery
./skills/a2a-conformance/scripts/probe.sh http://127.0.0.1:9001

# Manual key probes
a2acli discover --service-url http://127.0.0.1:9001 --output json
a2acli conformance --service-url http://127.0.0.1:9001 --output json
a2acli send "conformance probe" --service-url http://127.0.0.1:9001 --wait --output json
a2acli list tasks --service-url http://127.0.0.1:9001 --limit 5 --output json
```

Evaluate outputs against [references/probes.md](references/probes.md) and record `PASS`, `WARN`, or `FAIL` for each `A2A-*` ID.

### Step 4: Execute Tier 2 Official TCK (Optional / Full Conformance)
If the user requests full TCK verification or a formal compatibility certificate:

```bash
./skills/a2a-conformance/scripts/run-tck.sh http://127.0.0.1:9001
```

Review `reports/compatibility.json` generated by the TCK per [references/tck.md](references/tck.md).

### Step 5: Generate Conformance Report
1. Use the report template at `assets/report.template.md`.
2. Calculate MUST pass/fail counts and SHOULD pass/fail counts.
3. Apply verdict logic from [references/scoring.md](references/scoring.md):
   - **`CONFORMANT`**: 100% MUST checks pass, 0 MUST failures.
   - **`CONFORMANT WITH WARNINGS`**: 100% MUST checks pass, but SHOULD warnings or quality recommendations exist.
   - **`NOT CONFORMANT`**: 1 or more MUST checks fail.
4. Output the filled markdown report to the user.

## Mandatory Verification Checklist

When generating a conformance report, ensure:
- [ ] Every finding cites a stable `A2A-<AREA>-<NNN>` ID and specification section.
- [ ] No MUST failure is marked as optional or ignored.
- [ ] Multi-transport equivalence (`A2A-BIND-001`) was verified across all declared interfaces.
- [ ] The report includes top 3 actionable remediation steps with code snippets.