Migrate A2A protocol from 0.3 to 1.0-preview

[rockfordlhotka]

Summary

• Swaps the agent's A2A hosting from Microsoft.Agents.Hosting.AspNetCore.A2A.Preview (M365 Agents SDK lineage, A2A 0.3) to the Microsoft Agent Framework (Microsoft.Agents.AI.Hosting.A2A.AspNetCore) plus the upstream A2A .NET SDK (A2A, A2A.AspNetCore), which speak A2A 1.0.
• Live agent on the cluster was previously advertising \"protocolVersion\": \"0.3.0\" in its agent card; after this PR it will advertise \"1.0\".
• Skill behavior, public endpoint paths under /a2a, ApiKey auth, the seven skill IDs, and skill JSON output are all preserved.

Why this isn't a simple version bump

A2A 1.0 lives in a different package family, with a different agent abstraction and a different DI/registration shape. The old SDK's AgentApplication-derived handler doesn't exist in the new framework — the new world models agents as AIAgent + tools, with optional custom IAgentHandler for full control of request processing.

Approach

SocialAgent's seven skills are deterministic JSON returners, not LLM tool calls — forcing them through an AIAgent would have made the LLM mandatory in the request path (currently optional via SkillRouter).

So this PR uses the framework's custom-handler escape hatch:

• SocialAgentA2AHandler implements A2A.IAgentHandler and is registered as a keyed singleton under the agent name \"social-agent\". The framework's default A2AAgentHandler (which calls into an AIAgent) is bypassed entirely.
• SocialAgentStubAgent is a minimal AIAgent subclass registered alongside it. Required by AddA2AServer's wiring (it pulls AIAgent keyed by name to read .Name), but all of its abstract members throw NotSupportedException — they are never invoked because our keyed IAgentHandler short-circuits the path.
• SkillCatalog holds skill metadata (AgentSkill list for the card; keyword + LLM router definitions). SkillDispatcher runs the existing skill logic.
• The agent card is now built explicitly and served via MapWellKnownAgentCard(agentCard) at /.well-known/agent-card.json with ProtocolVersion = \"1.0\" on each AgentInterface.

Endpoint surface

Path	What it serves	Auth
GET /.well-known/agent-card.json	A2A 1.0 agent card	Anonymous (consumers discover capabilities first)
POST /a2a	JSON-RPC binding (SendMessage, GetTask, etc. — see A2A.A2AMethods)	ApiKey in non-Development
POST /a2a/message:send, GET /a2a/tasks/{id}, …	HTTP+JSON binding	ApiKey in non-Development
GET /health/ready, /health/live	Health probes	Anonymous

The old /.well-known/agent.json (no hyphen) is gone — that was an artifact of the M365-lineage SDK's auto-emitted card. RockBot is reportedly 1.0-capable, so this should be the right path for it; if RockBot still hits the old URL it'll need a one-line update.

ApiKey auth is reapplied with AuthorizationPolicyBuilder against the mapped endpoint groups instead of the old requireAuth: bool parameter (the new SDKs don't expose that knob).

Tradeoff considered

The other path was to wrap each skill as an AIFunction tool on a real LLM-backed AIAgent. Cleaner with the new framework's grain, but it would have:

1. Made an LLM mandatory in the request path (regression — SkillRouter is currently optional with keyword fallback).
2. Risked the LLM re-formatting tool output JSON the way it sees fit.

Sticking with the custom-handler path keeps observable behavior identical to today's 0.3 deployment.

Smoke test (in Development, no auth)

$ curl http://localhost:18181/.well-known/agent-card.json | jq '.supportedInterfaces[0].protocolVersion'
\"1.0\"

$ curl -sX POST http://localhost:18181/a2a -H 'Content-Type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":\"1\",\"method\":\"SendMessage\",\"params\":{\"message\":{\"messageId\":\"m1\",\"role\":\"ROLE_USER\",\"parts\":[{\"text\":\"provider-status\"}]}}}'
{\"jsonrpc\":\"2.0\",\"id\":\"1\",\"result\":{\"message\":{\"role\":\"ROLE_AGENT\",\"parts\":[{\"text\":\"[]\"}],\"messageId\":\"…\",\"contextId\":\"…\"}}}

$ curl -sX POST http://localhost:18181/a2a/message:send -H 'Content-Type: application/json' -d '{\"message\":{\"messageId\":\"m2\",\"role\":\"ROLE_USER\",\"parts\":[{\"text\":\"provider-status\"}]}}'
{\"message\":{\"role\":\"ROLE_AGENT\",\"parts\":[{\"text\":\"[]\"}],\"messageId\":\"…\",\"contextId\":\"…\"}}

Both transports route correctly. [] is the expected provider-status output when neither Mastodon nor Bluesky is configured in the smoke environment.

Side cleanup

OpenTelemetry packages were bumped from 1.15.0/1.15.1 to 1.15.3/1.15.2/1.15.1 (latest available on each) to clear pre-existing NU1902 vulnerability advisories that had been silently breaking dotnet restore on a fresh machine. Unrelated to A2A but unavoidable to validate the build.

Test plan

• dotnet build SocialAgent.slnx — clean (0 warnings, 0 errors)
• dotnet test SocialAgent.slnx --filter \"FullyQualifiedName!~Integration\" — all unit tests pass
• Manual smoke: agent card, JSON-RPC SendMessage, HTTP+JSON /message:send all round-trip correctly
• Verify in cluster after merge: new image deployed; agent card reports protocolVersion: \"1.0\"; RockBot can still call skills end-to-end
• Confirm RockBot still works: RockBot needs to discover via /.well-known/agent-card.json (the hyphenated path) and use either the JSON-RPC SendMessage method name or the HTTP+JSON /message:send route
• Pre-existing integration tests (*Integration*) still need live MASTODON_ACCESS_TOKEN / BLUESKY_* env vars to pass — not changed by this PR

Caveats for reviewers

• All packages added are *-preview* — Microsoft.Agents.AI.Hosting.A2A.AspNetCore 1.3.0-preview.260423.1, A2A/A2A.AspNetCore 1.0.0-preview2. The Agent Framework itself shipped 1.0 GA but the A2A hosting subpackage is still in preview.
• Default InMemoryAgentSessionStore / InMemoryTaskStore are unchanged — fine for our use because our custom handler doesn't use sessions or task continuations. If we ever switch to background/long-running task semantics, we'll need durable stores.
• The framework's experimental [Experimental(...)] attributes flow through to consumers; we may need to suppress diagnostics if any leak in future.

🤖 Generated with Claude Code