Implemented and verified.
33 implemented capabilitiesResponsive A2A coordination studio · Official A2A v1 SDK client · JSONRPC and HTTP+JSON negotiation · OAuth-protected A2A client · Transport token non-persistence · Agent Card OAuth contract validation · Offline and live-read profile discovery · All ten live-read command contracts · Exact live-read OAuth scope · Purpose and data-class evidence · One-read authority validation · Provider payload excluded from audit · Credential-free zero-network fixture · Agent Card SHA-256 fingerprint · Advertised-skill and protocol validation · Client-owned message and context identity · Server-assigned task identity · Unknown-outcome context reconciliation · Structured-only command allowlist · Canonical command and artifact digests · Offline authority non-escalation · Live authority non-escalation · Human accept and reject review · Explicit no provider writes · Explicit no production approval · Idempotent commands · Changed-intent replay rejection · Optimistic concurrency · Append-only audit events · Transactional outbox · Atomic restart recovery · Bounded input and Agent Card · HTTPS outside loopback
Browser application
A responsive operations console backed by the included JSON API.
Durable domain
Aggregate snapshots, audit events, idempotency records, evidence, and outbox entries are committed together.
Fixture adapter
A credential-safe provider boundary aligned to named Mappls endpoint contracts.
Executable tests
21 tests covering lifecycle, HTTP, replay, conflicts, domain recovery, and restart behavior.
Architecture notes
Trust boundaries, aggregate invariants, adapter ownership, evidence lineage, and recovery design.
Deployment guide
Database, identity, secrets, outbox, privacy, observability, migration, and rollback work.