fix(a2a): wait for final replies before resolving RPCs

.github/workflows/build-windows-installer.yml

@@ -12,7 +12,7 @@ jobs:
   # permission via the API and fail fast for anyone below admin.
   authorize:
     name: Authorize (admins only)
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 5
     steps:
       - name: Check actor is a repo admin
@@ -34,7 +34,7 @@ jobs:
   build:
     name: Hermes-Setup.exe
     needs: authorize
-    runs-on: windows-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 30
     permissions:
       contents: read

.github/workflows/contributor-check.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   check-attribution:
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:

.github/workflows/deploy-site.yml

@@ -28,14 +28,14 @@ jobs:
     # a skills-index PR that doesn't touch website/** paths and so
     # doesn't auto-deploy via the deploy-docs path.
     if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - name: Trigger Vercel Deploy
         run: curl -X POST "${{ secrets.VERCEL_DEPLOY_HOOK }}"
 
   deploy-docs:
     if: github.repository == 'NousResearch/hermes-agent'
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     environment:
       name: github-pages
       url: ${{ steps.deploy.outputs.page_url }}

.github/workflows/docker-lint.yml

@@ -36,7 +36,7 @@ concurrency:
 jobs:
   hadolint:
     name: Lint Dockerfile (hadolint)
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 5
     steps:
       - name: Checkout code
@@ -51,7 +51,7 @@ jobs:
 
   shellcheck:
     name: Lint docker/ shell scripts (shellcheck)
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 5
     steps:
       - name: Checkout code

.github/workflows/docker-publish.yml

@@ -51,7 +51,7 @@ jobs:
   build-amd64:
     # Only run on the upstream repository, not on forks
     if: github.repository == 'NousResearch/hermes-agent'
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 45
     outputs:
       digest: ${{ steps.push.outputs.digest }}
@@ -185,7 +185,7 @@ jobs:
   # ---------------------------------------------------------------------------
   build-arm64:
     if: github.repository == 'NousResearch/hermes-agent'
-    runs-on: ubuntu-24.04-arm
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 45
     outputs:
       digest: ${{ steps.push.outputs.digest }}
@@ -307,7 +307,7 @@ jobs:
   # ---------------------------------------------------------------------------
   merge:
     if: github.repository == 'NousResearch/hermes-agent' && (github.event_name == 'push' && github.ref == 'refs/heads/main' || github.event_name == 'release')
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     needs: [build-amd64, build-arm64]
     timeout-minutes: 10
     steps:

.github/workflows/docs-site-checks.yml

@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   docs-site-checks:
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 

.github/workflows/history-check.yml

@@ -22,7 +22,7 @@ permissions:
 
 jobs:
   check-common-ancestor:
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:

.github/workflows/lint.yml

@@ -33,7 +33,7 @@ concurrency:
 jobs:
   lint-diff:
     name: ruff + ty diff
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 10
     steps:
       - name: Checkout code
@@ -163,7 +163,7 @@ jobs:
     # ``lint-diff`` job above runs independently so reviewers still get
     # the diff comment even when enforcement fails.
     name: ruff enforcement (blocking)
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 5
     steps:
       - name: Checkout code
@@ -187,7 +187,7 @@ jobs:
     # shebang scripts via subprocess, bare open() without encoding=, etc.
     # See scripts/check-windows-footguns.py for the full rule list.
     name: Windows footguns (blocking)
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 5
     steps:
       - name: Checkout code

.github/workflows/nix-lockfile-fix.yml

@@ -43,7 +43,7 @@ jobs:
   #      triggers downstream nix.yml verification.
   auto-fix-main:
     if: github.event_name == 'push'
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 25
     concurrency:
       group: auto-fix-main
@@ -131,7 +131,7 @@ jobs:
        && github.event.issue.pull_request != null
        && contains(github.event.comment.body, '[x] **Apply lockfile fix**')
        && !contains(github.event.changes.body.from, '[x] **Apply lockfile fix**'))
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 25
     steps:
       - name: Authorize & resolve PR

.github/workflows/skills-index-freshness.yml

@@ -19,7 +19,7 @@ permissions:
 jobs:
   check-freshness:
     if: github.repository == 'NousResearch/hermes-agent'
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - name: Probe live index
         id: probe

.github/workflows/skills-index.yml

@@ -19,7 +19,7 @@ jobs:
   build-index:
     # Only run on the upstream repository, not on forks
     if: github.repository == 'NousResearch/hermes-agent'
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
 
@@ -48,7 +48,7 @@ jobs:
   trigger-deploy:
     needs: build-index
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - name: Trigger Deploy Site workflow
         env:

.github/workflows/supply-chain-audit.yml

@@ -23,7 +23,7 @@ permissions:
 jobs:
   # ── Path filter (shared by both scan and dep-bounds) ───────────────
   changes:
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     outputs:
       # True when any file the scanner cares about changed in this PR
       scan: ${{ steps.filter.outputs.scan }}
@@ -59,7 +59,7 @@ jobs:
     name: Scan PR for critical supply chain risks
     needs: changes
     if: needs.changes.outputs.scan == 'true'
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
@@ -186,15 +186,15 @@ jobs:
     # skipped — without it, a failed dependency would leave the required
     # check unreported (i.e. "pending"), the exact failure mode this fixes.
     if: always() && needs.changes.outputs.scan != 'true'
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - run: echo "No supply-chain-relevant files changed, skipping scan."
 
   dep-bounds:
     name: Check PyPI dependency upper bounds
     needs: changes
     if: needs.changes.outputs.deps == 'true'
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
@@ -265,6 +265,6 @@ jobs:
     # skipped — without it, a failed dependency would leave the required
     # check unreported (i.e. "pending"), the exact failure mode this fixes.
     if: always() && needs.changes.outputs.deps != 'true'
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - run: echo "No pyproject.toml changes, skipping dependency bounds check."

.github/workflows/tests.yml

@@ -22,7 +22,7 @@ concurrency:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -110,7 +110,7 @@ jobs:
   save-durations:
     needs: test
     if: always() && github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - name: Download all slice durations
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
@@ -139,7 +139,7 @@ jobs:
           key: test-durations
 
   e2e:
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 15
     steps:
       - name: Checkout code

.github/workflows/upload_to_pypi.yml

@@ -25,7 +25,7 @@ concurrency:
 jobs:
   build:
     name: Build distribution 📦
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
@@ -89,7 +89,7 @@ jobs:
   publish:
     name: Publish to PyPI
     needs: build
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     environment:
       name: pypi
       url: https://pypi.org/p/hermes-agent
@@ -114,7 +114,7 @@ jobs:
     # and workflow_dispatch won't have a matching release to attach to.
     if: startsWith(github.ref, 'refs/tags/')
     needs: publish
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     permissions:
       contents: write   # attach assets to the existing release
       id-token: write   # sigstore signing

.github/workflows/uv-lockfile-check.yml

@@ -67,7 +67,7 @@ concurrency:
 jobs:
   check:
     name: uv lock --check
-    runs-on: ubuntu-latest
+    runs-on: tenki-standard-medium-4c-8g
     timeout-minutes: 5
     steps:
       - name: Checkout code

plugins/platforms/a2a/adapter.py

@@ -85,7 +85,10 @@ def name(self) -> str:
 
     # ── Lifecycle ─────────────────────────────────────────────────────────
 
-    async def connect(self) -> bool:
+    async def connect(self, **_kwargs) -> bool:
+        # Gateway reconnection plumbing passes adapter-agnostic kwargs such as
+        # ``is_reconnect``. A2A does not need them, but accepting them keeps the
+        # plugin compatible with the BasePlatformAdapter lifecycle contract.
         # Capture the running gateway loop so the HTTP thread can marshal
         # events onto it via run_coroutine_threadsafe.
         try:
@@ -280,12 +283,21 @@ async def send(
 
         ``chat_id`` is the A2A context id we set as the source chat_id, so it
         keys straight back to the blocked HTTP request.
+
+        The gateway marks final user-visible replies with ``metadata['notify']``.
+        Progress, status, and editable preview sends intentionally lack that
+        marker; those must not satisfy the JSON-RPC caller, or the caller sees
+        a banner/status update instead of the agent's actual answer.
         """
+        is_final_reply = bool((metadata or {}).get("notify"))
         with self._pending_lock:
             fut = self._pending_replies.get(chat_id)
-        if fut is not None and not fut.done():
-            fut.set_result(content or "")
-            return SendResult(success=True, message_id=str(int(time.time() * 1000)))
+            if fut is not None and not fut.done():
+                if not is_final_reply:
+                    logger.debug("A2A: ignoring non-final send for context %s", chat_id)
+                    return SendResult(success=True, message_id=str(int(time.time() * 1000)))
+                fut.set_result(content or "")
+                return SendResult(success=True, message_id=str(int(time.time() * 1000)))
         # No waiter (e.g. a late streamed chunk or out-of-band send) — drop it.
         logger.debug("A2A: send() for context %s had no pending waiter", chat_id)
         return SendResult(success=True, message_id=str(int(time.time() * 1000)))