feat(a2a): add A2A (Agent2Agent) protocol server

[yugui923]

Summary

Adds an A2A (Agent2Agent) protocol server as a bundled Hermes platform plugin. Other agents can discover Hermes through an Agent Card and delegate tasks over JSON-RPC and SSE.

Run the standalone server with:

hermes-a2a
# or
python -m plugins.platforms.a2a

The same adapter is available to the gateway through the generic plugin loader and ctx.register_platform().

Configuration

All non-secret A2A behavior is configured through the top-level a2a: section in config.yaml, including:

• host, port, and advertised public URL
• maximum concurrent turns
• session and retained-task bounds
• per-task history bounds
• peer-visible tool metadata mode

Tool availability uses the generic platform_toolsets.a2a surface and honors globally disabled toolsets. The adapter does not use A2A-specific behavioral environment variables.

Reliability and security

• Bounded worker admission and dedicated turn pool
• Persistent per-context sessions with lease-safe LRU eviction
• Bounded task retention and status history
• Task-scoped cancellation with terminal-state persistence
• Graceful shutdown that prevents post-close session or pool recreation
• Bootstrap import-path hardening before gateway imports
• Remote dangerous-command approval requests are automatically denied
• Peer-safe error messages and bounded tool metadata
• Loopback binding by default; non-loopback exposure warns that the endpoint is unauthenticated

Packaging and documentation

• [a2a] optional dependency and hermes-a2a console script
• Included in all-dependencies, lockfile, Nix, Homebrew, setup, and release metadata
• English and zh-Hans user/developer documentation
• Agent Card, plugin lifecycle, configuration, cancellation, JSON-RPC, and SSE test coverage

Reviewer feedback addressed

• Moved tool_io and max_concurrency from environment variables into config.yaml
• Migrated the adapter from direct core CLI/toolset integration to the bundled platform-plugin path
• Reconciled the implementation with current main
• Added lifecycle, bounds, shutdown-race, cancellation-persistence, and real SSE regressions

Validation

• 51/51 A2A tests
• 173/173 shared plugin, configuration, bootstrap, and packaging tests
• Ruff
• ty
• hermes-a2a --check equivalent module self-check
• Two independent blocker reviews, both clean

The PR is intentionally presented as one commit for straightforward review and cherry-picking.

[teknium1]

Thank you for the thorough A2A adapter, lifecycle work, and focused tests. The feature is still needed: tracked searches of current main/origin/main found no A2A adapter, Agent Card, or hermes-a2a surface.

Problems

• a2a_adapter/events.py:44 and a2a_adapter/executor.py:42 add HERMES_A2A_TOOL_IO and HERMES_A2A_MAX_CONCURRENCY for behavioral configuration. AGENTS.md:102-107 requires non-secret thresholds and feature settings to use config.yaml.
• The PR adds direct CLI/toolset integration (hermes_cli/main.py:11335, toolsets.py:396) around a root-level adapter. Current platform guidance instead documents a plugin directory registered through ctx.register_platform() with zero core edits (gateway/platforms/ADDING_A_PLATFORM.md:5-15; hermes_cli/plugins.py:931-975).

Suggested changes

• Move the two A2A settings into a documented config.yaml section.
• Re-scope the platform integration to the existing plugin registration path where possible, then reconcile it carefully with current main rather than mechanically applying the stale core changes.

This is an automated hermes-sweeper review.

[yugui923]

Reviewer feedback is addressed in the final commit 5b32760c1.

Summary:

• Moved A2A behavioral configuration into config.yaml; removed the A2A behavioral environment-variable reads.
• Migrated A2A to the bundled platform-plugin path using ctx.register_platform().
• Hardened bootstrap, server lifecycle, cancellation persistence, bounded task/session storage, concurrency admission, shutdown cleanup, and remote dangerous-command approval handling.
• Added configuration, plugin, lifecycle, cancellation, eviction, real JSON-RPC cancel/get, and SSE regression coverage.

For review clarity, the branch was rebuilt directly atop current main as one commit: 41 changed files, 3,903 additions, and 8 deletions. It can be reviewed or cherry-picked as 5b32760c1.

Two independent blocker reviews returned clean. Validation: 51/51 A2A tests, 173/173 shared plugin/config/bootstrap/packaging tests, Ruff, ty, adapter self-check, and git diff --check.

[teknium1]

Thanks for building this, @yugui923 — a full standalone A2A server with card discovery, JSON-RPC and SSE was exactly the right shape. A2A support has now landed on main via #77109 (the consolidated plugin from #41711 plus the community v1.0 follow-up stack, verified against the official a2a-sdk), so this parallel implementation is superseded. Closing with credit; if you spot gaps in the landed plugin relative to yours, focused follow-up PRs against plugins/platforms/a2a/ are very welcome.