fix(a2a): remove non-existent InvalidSignatureError catch

[POWERFULMOVES]

Problem

python-jose does not define InvalidSignatureError on the jwt module. When an invalid JWT signature was encountered, the except clause itself raised AttributeError, causing a 500 instead of the intended 403.

Fix

Remove the broken handler. The existing jose_jwt.JWTError catch-all already returns 403 for all signature failures.

Verification

• A2A runtime verified working on SPARK node (ARM64 + GB10)
• Auth chain works via JWT signed with SUPABASE_JWT_SECRET
• This fix prevents 500 -> ensures 403 on bad signatures

Closes AGNOTE4482 Lane A finding.

Risk

Low — 5-line deletion, no behavior change (JWTError already returned 403).

Summary by CodeRabbit

• Documentation

  • Updated documentation with information on multi-lane claim processing and parallel execution capabilities.
  • Added details about secondary authentication migration updates.

• Refactor

  • Streamlined JWT authentication error handling for consistency.

[coderabbitai]

Warning

Review limit reached

@POWERFULMOVES, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 33 minutes and 25 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4ed8887f-e8ca-41b7-a257-f348ad9d5044

📥 Commits

Reviewing files that changed from the base of the PR and between bfb54e3 and dac8d12.

📒 Files selected for processing (2)

• pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md
• pmoves/services/agent-zero/python/features/a2a/server.py

📝 Walkthrough

Walkthrough

This PR contains two independent updates: a coordination document entry recording planned execution lanes for the SPARK-KIMI node, and a code simplification that consolidates JWT authentication error handling into a single exception path, broadening the returned error detail message.

Changes

Coordination and authentication updates

Layer / File(s)	Summary
SPARK-KIMI multi-lane coordination note pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md	New dated claim section (2026-05-27T21:40:00Z) declares four parallel execution lanes: A2A runtime verification, NATS auth secondary migration via NATS_URL, pmoves-yt summarize/chapters endpoint additions, and SPARK model orchestration with Ollama/TensorZero routing updates, with agent signature and Graphiti mark boundaries.
JWT error handling consolidation pmoves/services/agent-zero/python/features/a2a/server.py	_require_a2a_auth removes the dedicated InvalidSignatureError exception handler; JWT validation failures are now routed through a single except jose_jwt.JWTError path, changing the HTTP 403 error detail from "Invalid token signature" to "JWT validation failed".

Possibly related PRs

• POWERFULMOVES/PMOVES.AI#1125: Previous update to the same pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md coordination document for lane schedule changes.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 A multi-lane dream takes flight today,
Four lanes of work in grand display,
While errors speak in simpler tongue,
The JWT songs are sweetly sung!
🌟

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The description provides problem statement, fix explanation, and verification steps, but lacks the required template sections including Testing commands, Required Checks checklist, and Review Coordination items.	Fill out the required template sections: add Testing commands/output section with specific test execution details and check the Required Checks and Review Coordination checkboxes.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title precisely describes the main change: removing a broken InvalidSignatureError catch block from JWT authentication error handling in the a2a module.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/a2a-jwt-error-handling

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md`:
- Around line 975-976: The Lane D entry "Lane D — SPARK Model Orchestration"
lacks a branch/PR scope; update that line to include an explicit CLAIM scope
(e.g., add "CLAIM=branch-name/PR-<id>" or "CLAIM=docs-only/no-branch") so
ownership is unambiguous; ensure the agent_signature remains
`ACK::SPARK-KIMI::MULTI-LANE-CLAIM-2026-05-27` and, if relevant, note the
branch/PR in the delivery metadata (delivery=SPARK-KIMI) and any model routing
changes referenced (tensorzero.toml) for traceability.
- Around line 971-976: The claim header says "Three parallel lanes" but the list
defines four lanes (Lane A — A2A Runtime Verification, Lane B — NATS Auth
Secondary Batch, Lane C — PMOVES.YT Summarize + Chapters, Lane D — SPARK Model
Orchestration); update the header in the timestamped claim line (the line
starting with `2026-05-27T21:40:00Z` CLAIM `SPARK-KIMI` scope:) to reflect the
correct count by changing "Three parallel lanes" to "Four parallel lanes" (or
else remove/merge a lane so the count matches), leaving the rest of the lanes
and agent_signature intact.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d0c78721-69ac-4320-99da-89c94123efdd

📥 Commits

Reviewing files that changed from the base of the PR and between dbf2f14 and bfb54e3.

📒 Files selected for processing (2)

• pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md
• pmoves/services/agent-zero/python/features/a2a/server.py

💤 Files with no reviewable changes (1)

• pmoves/services/agent-zero/python/features/a2a/server.py

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix lane count mismatch in the claim summary.

Line 971 says “Three parallel lanes,” but Lines 972-975 define four lanes (A-D). Please align the summary text with the actual list to avoid coordination ambiguity.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md` around lines 971 - 976, The claim
header says "Three parallel lanes" but the list defines four lanes (Lane A — A2A
Runtime Verification, Lane B — NATS Auth Secondary Batch, Lane C — PMOVES.YT
Summarize + Chapters, Lane D — SPARK Model Orchestration); update the header in
the timestamped claim line (the line starting with `2026-05-27T21:40:00Z` CLAIM
`SPARK-KIMI` scope:) to reflect the correct count by changing "Three parallel
lanes" to "Four parallel lanes" (or else remove/merge a lane so the count
matches), leaving the rest of the lanes and agent_signature intact.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Add explicit branch/PR scope for Lane D to keep claim traceable.

Lane D currently has no branch/PR scope while the other lanes do. Please add it (or explicitly mark as docs-only/no-branch) so claim ownership is unambiguous.
As per coding guidelines, “claim the relevant lane with branch/PR scope (CLAIM)”.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pmoves/docs/AGENTS/AGNOTE4482PHI.t1.md` around lines 975 - 976, The Lane D
entry "Lane D — SPARK Model Orchestration" lacks a branch/PR scope; update that
line to include an explicit CLAIM scope (e.g., add "CLAIM=branch-name/PR-<id>"
or "CLAIM=docs-only/no-branch") so ownership is unambiguous; ensure the
agent_signature remains `ACK::SPARK-KIMI::MULTI-LANE-CLAIM-2026-05-27` and, if
relevant, note the branch/PR in the delivery metadata (delivery=SPARK-KIMI) and
any model routing changes referenced (tensorzero.toml) for traceability.