# Conflict register D1 to D40: what upstream did since v1.0.1

Pinned: A2A `v1.0.1`, commit [`3303592`](https://github.com/a2aproject/A2A/commit/3303592588e388e62e0f69f701af531d2f4e3991) (2026-05-28). Checked on 2026-10-06 against:

- `origin/main` at [`679ab3a`](https://github.com/a2aproject/A2A/commit/679ab3afc6f95ef47bb969d511053d0f63bca2a2) (2026-10-05), 73 commits after the tag. Of those, 9 touch `docs/specification.md` and 1 touches `specification/a2a.proto`.
- `origin/dev-1.1` at [`db39eb5`](https://github.com/a2aproject/A2A/commit/db39eb52363a007868a755703f7044841c729acb) (2026-09-22), 3 commits ahead of its merge base with main (`5d2676e`, 2026-06-30).
- `origin/dev` is identical to main as of 2026-06-23 (0 ahead, 60 behind). `origin/next` is a 2025 branch (14 commits from May 2025, 535 behind). `origin/rp` is the release-please branch holding the unmerged 1.0.2 release commit.
- a2a-python `origin/main` at `a016002` (2026-10-06), 4 commits after `v1.2.2`; none touch the conflicts below (they change `card_resolver.py`, `active_task.py`, `_jcs.py`, `signing.py`, `telemetry.py`; the `_jcs.py`/`signing.py` change only moves the nesting-depth counter from 0 to 1).
- Issue and PR dumps in `research/v2/data/` (`spec-issues-raw.json`: 1779 items up to #2308, latest `updated_at` 2026-10-06T08:16Z; `spec-comments-raw.json`: 3460 comments), swept with `sweep.py` (output in `research/v2/sweep-all.txt`) and `threads.py`; `gh` used with the sandbox off for PR base branches, review state and releases.

Permalink shorthand: `main:` = `https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/`, `tag:` = `https://github.com/a2aproject/A2A/blob/3303592588e388e62e0f69f701af531d2f4e3991/`, `dev11:` = `https://github.com/a2aproject/A2A/blob/db39eb52363a007868a755703f7044841c729acb/`.

Status counts: fixed on main 5 (D8, D9, D12, D32, D34), partly fixed on main 5 (D4, D5, D6, D10, D23), open PR 6 (D1, D3, D13, D16, D24, D37), open issue 7 (D2, D17, D19, D21, D28, D31, D38), closed without fix 0, no upstream activity 17 (D7, D11, D14, D15, D18, D20, D22, D25, D26, D27, D29, D30, D33, D35, D36, D39, D40).

## 1. The table

| id | topic | status | evidence (dates) | what changed |
|---|---|---|---|---|
| D1 | Subscribe verb: proto `GET`, §5.3 and §11.3.2 `POST` | open PR | [#2068](https://github.com/a2aproject/A2A/pull/2068) OPEN, created 2026-07-18, base retargeted to `dev-1.1` 2026-09-29, review APPROVED; TSC comment by darrelmiller 2026-09-29: consensus that GET "is the right method because it signals a safe and idempotent request". Opposite-direction [#1891](https://github.com/a2aproject/A2A/pull/1891) (proto to POST) OPEN on main since 2026-05-28, review required, last comment 2026-09-18 (SDK survey: Go, JS, .NET send POST; Python and Go servers accept both). Issues [#1574](https://github.com/a2aproject/A2A/issues/1574) OPEN (TSC Review), [#2063](https://github.com/a2aproject/A2A/issues/2063) OPEN; [#2172](https://github.com/a2aproject/A2A/pull/2172) closed 2026-08-23 as duplicate; [#1819](https://github.com/a2aproject/A2A/issues/1819) closed 2026-06-23 as duplicate. | Nothing on main: [main:docs/specification.md#L1169](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L1169) still reads `POST /tasks/{id}:subscribe` and [#L2803](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2803) the same; proto [main:specification/a2a.proto#L78](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/specification/a2a.proto#L78) still `get: "/tasks/{id=*}:subscribe"`. The approved fix (#2068) changes the two spec lines to `GET /tasks/{id}:subscribe` on `dev-1.1`, so the manual's choice (the proto, GET) matches the TSC direction. |
| D2 | Blocking: §3.1.1 "returns immediately", §3.2.2 and proto wait | open issue | [#2135](https://github.com/a2aproject/A2A/issues/2135) OPEN, created 2026-08-13, one comment 2026-08-14 (a-yeyang offers to make §3.1.1 defer to §3.2.2); no PR references #2135 in the dump. | Nothing on main: [main:docs/specification.md#L180](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L180) still says "The operation MUST return immediately" and [#L446](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L446) still says blocking "MUST wait until the task reaches a terminal state". |
| D3 | Streams at interrupted states: §3.1.2/§3.1.6 close at terminal, §11.7 and streaming guide also at interrupted, §7.6.1 keeps auth streams open | open PR | [#2270](https://github.com/a2aproject/A2A/pull/2270) OPEN, created 2026-09-29, base `dev-1.1`, review APPROVED; prose-only, makes interrupted states explicitly non-terminal and says entering one "does not necessitate closing a streaming response". Earlier [#1403](https://github.com/a2aproject/A2A/pull/1403) merged 2026-01-29 (pre-tag). Related open issue [#2130](https://github.com/a2aproject/A2A/issues/2130) (2026-08-12, undefined stream completion signal). | Nothing on main: [main:docs/specification.md#L2981](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2981) still says events continue "until the task reaches a terminal or interrupted state"; [main:docs/topics/streaming-and-async.md#L23](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/topics/streaming-and-async.md#L23) still says "When a task reaches a terminal or interrupted state ... the server closes the stream". #2270 would change §11.7 so the stream closes only at a terminal state; it is queued for 1.1, not 1.0.x. |
| D4 | Push configuration name: prose `PushNotificationConfig`, proto `TaskPushNotificationConfig` | partly fixed on main | [#1981](https://github.com/a2aproject/A2A/pull/1981) merged 2026-08-28, commit [`f63dbb4`](https://github.com/a2aproject/A2A/commit/f63dbb48271940ca5bd421f87e27e4d6ec002795). | §3.1.7, §3.1.8, §4.3.1, §4.3.3, §10.4.7 to §10.4.9, §13.4 and `streaming-and-async.md` now say `TaskPushNotificationConfig`; heading [main:docs/specification.md#L832](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L832) reads `#### 4.3.1. TaskPushNotificationConfig` (tag: `#### 4.3.1. PushNotificationConfig`). Residuals: [main:#L3117](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3117) still links `PushNotificationConfig.authentication`, and [main:docs/whats-new-v1.md#L426](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/whats-new-v1.md#L426) still has the heading `### PushNotificationConfig Object`. |
| D5 | Create request: prose and Appendix A `CreateTaskPushNotificationConfigRequest`, proto takes `TaskPushNotificationConfig` | partly fixed on main | Same PR [#1981](https://github.com/a2aproject/A2A/pull/1981), merged 2026-08-28, [`f63dbb4`](https://github.com/a2aproject/A2A/commit/f63dbb48271940ca5bd421f87e27e4d6ec002795). | §10.4.7 on main: [main:docs/specification.md#L2631](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2631) "**Request:** See [`TaskPushNotificationConfig`](#431-taskpushnotificationconfig) object definition." (tag: `{{ proto_to_table("CreateTaskPushNotificationConfigRequest") }}`, a macro that could not resolve). The Appendix A naming-history table still lists `CreateTaskPushNotificationConfigRequest` as the 0.5.0 name at [main:#L3372](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3372). Related: [#2151](https://github.com/a2aproject/A2A/issues/2151) OPEN and [#2188](https://github.com/a2aproject/A2A/pull/2188) OPEN (2026-08-28) would fail the docs build when a proto macro cannot resolve. |
| D6 | Card security field: §3.1.11, §13.3 and the §8.5 sample say `security`, proto `securityRequirements` | partly fixed on main | Issue [#2044](https://github.com/a2aproject/A2A/issues/2044) closed completed 2026-07-21; PR [#2046](https://github.com/a2aproject/A2A/pull/2046) merged 2026-07-21, commit [`dfe216a`](https://github.com/a2aproject/A2A/commit/dfe216ab59bdba3f26df43899f84ade7c989b59b) (dated 2026-07-22). | §8.5 sample now [main:docs/specification.md#L2176](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2176): `"securityRequirements": [{ "schemes": { "google": { "list": ["openid", "profile", "email"] } } }],` (tag: `"security": [{ "google": ["openid", "profile", "email"] }],`). Prose at [#L423](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L423) (§3.1.11) and [#L3151](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3151) (§13.3) still say "`AgentCard.securitySchemes` and `AgentCard.security` fields". |
| D7 | Extended card flag number: Appendix A.2.2 field 5, proto field 4 | no upstream activity | Searched dump for `extended_agent_card` with `field 4/5` and `AgentCapabilities.*field`; hits are pre-1.0 (#1307, merged 2025) and #1549 (bidi streaming proposal). | Nothing on main: Appendix A.2.2 still says "Added: `AgentCapabilities.extended_agent_card` (field 5)" ([main:docs/specification.md#L3566](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3566)); proto still `optional bool extended_agent_card = 4;` ([main:specification/a2a.proto#L420](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/specification/a2a.proto#L420)). |
| D8 | Protocol version: Appendix A.2.1 `protocolVersions` on the card, proto `protocolVersion` per interface | fixed on main | [#2165](https://github.com/a2aproject/A2A/pull/2165) merged 2026-08-28, commit [`aa042ec`](https://github.com/a2aproject/A2A/commit/aa042ec2653ab98c7ec5c3dc8e2feb7c3078aee1); closes [#2162](https://github.com/a2aproject/A2A/issues/2162) (closed 2026-08-28). Duplicates [#2174](https://github.com/a2aproject/A2A/pull/2174) and [#2179](https://github.com/a2aproject/A2A/pull/2179) closed unmerged 2026-09-25 as redundant. | `protocolVersions` no longer appears in `docs/specification.md` on main. [main:docs/specification.md#L3517](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3517): "Implement version detection based on `protocolVersion` in the agent's `supportedInterfaces` entries" (tag: "based on the agent's `protocolVersions` in the `AgentCard`"); [#L3525](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3525): "Ensure each `AgentInterface` in the `AgentCard` declares the correct `protocolVersion` (e.g., "1.0" or later)". |
| D9 | Stream event names: migration guide `taskStatusUpdate`/`taskArtifactUpdate`, proto `statusUpdate`/`artifactUpdate` | fixed on main | Issue [#2045](https://github.com/a2aproject/A2A/issues/2045) closed completed 2026-08-06; PR [#2056](https://github.com/a2aproject/A2A/pull/2056) merged 2026-08-06, commit [`08b42eb`](https://github.com/a2aproject/A2A/commit/08b42ebda1490900d1eb560cd67eb77d497d01b3). | `taskStatusUpdate`/`taskArtifactUpdate` have 0 hits in `whats-new-v1.md` on main (12 at the tag). [main:docs/whats-new-v1.md#L464](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/whats-new-v1.md#L464): "Event type determined by JSON member name (`statusUpdate` or `artifactUpdate`)"; code at [#L661-L664](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/whats-new-v1.md#L661-L664) now `if ("statusUpdate" in event)`. The guide also corrected the 0.3 `kind` values to `status-update`/`artifact-update`. |
| D10 | Fields the proto lacks: `Task.createdAt`, `Task.lastModified`, `configId`, `TaskArtifactUpdateEvent.index` | partly fixed on main | Same [#2056](https://github.com/a2aproject/A2A/pull/2056), merged 2026-08-06, [`08b42eb`](https://github.com/a2aproject/A2A/commit/08b42ebda1490900d1eb560cd67eb77d497d01b3). | Removed from the guide: "`createdAt` and `lastModified` timestamp fields added to Task object", "`createdAt` timestamp field added to PushNotificationConfig", the `configId`/`createdAt` "Added Fields" block, the "Enhanced Timestamp Tracking" sample, and the "Add createdAt/lastModified timestamp tracking" checklist line; `config_id` became `id` at [main:docs/whats-new-v1.md#L187](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/whats-new-v1.md#L187). Residual: [#L497](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/whats-new-v1.md#L497) still says "**NEW:** `index` field indicates artifact position"; the proto on main has no `index` field (grep `\bindex\b` in `a2a.proto`: 0 hits). |
| D11 | Deprecated OAuth flows: guide says implicit and password removed, proto keeps them deprecated | no upstream activity | Searched dump for `ImplicitOAuthFlow`, `PasswordOAuthFlow`, `implicit.{0,30}password`; all hits predate the tag (#1234, #1303 merged for 1.0.0, #830). | Nothing on main: proto [main:specification/a2a.proto#L575-L577](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/specification/a2a.proto#L575-L577) still `ImplicitOAuthFlow implicit = 3 [deprecated = true];` and `PasswordOAuthFlow password = 4 [deprecated = true];`; guide [main:docs/whats-new-v1.md#L40](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/whats-new-v1.md#L40) still "removed deprecated implicit/password flows". |
| D12 | Pagination names: guide `cursor`/`limit`/`nextCursor`, proto `pageToken`/`pageSize`/`nextPageToken` | fixed on main | [#2165](https://github.com/a2aproject/A2A/pull/2165) merged 2026-08-28, [`aa042ec`](https://github.com/a2aproject/A2A/commit/aa042ec2653ab98c7ec5c3dc8e2feb7c3078aee1); issue [#2162](https://github.com/a2aproject/A2A/issues/2162) closed 2026-08-28. | [main:docs/whats-new-v1.md#L702-L707](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/whats-new-v1.md#L702-L707): `let pageToken = undefined; ... listTasks({ pageToken, pageSize: 50 }); ... pageToken = response.nextPageToken;` (tag: `cursor`, `limit: 50`, `nextCursor`). The prose still calls it "cursor-based pagination" (L691, L884), which is a description, not a field name. |
| D13 | Error body: §6.4/§6.5 samples `application/problem+json`, guide `application/json`, §11.6 `google.rpc.Status` | open PR | [#1641](https://github.com/a2aproject/A2A/pull/1641) OPEN since 2026-03-16 (rebased 2026-05-26, review required, no activity since 2026-05-28); [#1689](https://github.com/a2aproject/A2A/pull/1689) OPEN since 2026-03-26 (rebased 2026-08-03, review required; note on 2026-08-03 that §11.1 now reads `application/a2a+json`, so its content-type bullet was reworked); issue [#1685](https://github.com/a2aproject/A2A/issues/1685) OPEN (triaged), comment 2026-09-23 says the content-type half is covered by the two PRs; [#1643](https://github.com/a2aproject/A2A/issues/1643) closed 2026-06-26 as duplicate. | Nothing on main: [main:docs/specification.md#L1468](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L1468) and [#L1598](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L1598) still `Content-Type: application/problem+json`; §11.6 at [#L2906](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2906) still `google.rpc.Status`. |
| D14 | JSON-RPC method template: §9.3 `category/action`, §9.1/§9.4 PascalCase | no upstream activity | Searched dump for `category/action`: 0 hits in bodies and comments. | Nothing on main: [main:docs/specification.md#L2286](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2286) still `"method": "category/action",`. The block is also one of the four still-invalid JSON samples (see D24). |
| D15 | Proto path: §1.4 `spec/a2a.proto`, repository `specification/a2a.proto` | no upstream activity | Searched dump for `spec/a2a.(proto|json)`: [#2057](https://github.com/a2aproject/A2A/issues/2057) OPEN (2026-07-14, `definitions.md` links a missing `spec/a2a.json`), [#2058](https://github.com/a2aproject/A2A/pull/2058) closed unmerged 2026-09-25 ("reopen if still required"), [#1789](https://github.com/a2aproject/A2A/pull/1789) OPEN (per-type JSON Schema files). None touch §1.4. | Nothing on main: [main:docs/specification.md#L107](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L107) still "the file `spec/a2a.proto` is the single authoritative normative definition". Context from [main:specification/json/README.md](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/specification/json/README.md): the build copies `a2a.json` "to `docs/spec/a2a.json` for site publishing", so `spec/` is a site-build path, not a repository path. |
| D16 | Release and date: banner says 1.0.0 is latest; changelog 2026-05-26; tag message 2026-04-23; tag commit 2026-05-28 | open PR | Release-please PR [#2072](https://github.com/a2aproject/A2A/pull/2072) "chore(main): release 1.0.2" OPEN, created 2026-07-21, updated 2026-10-05, label `autorelease: pending`, base main; branch `rp` commit [`6f5911f`](https://github.com/a2aproject/A2A/commit/6f5911f1eee3a69ed9b9c32d2ec90409fa82c203) (2026-10-05) adds one CHANGELOG entry (1.0.2, 2026-10-05, only #1997). `gh release list`: v1.0.1 is still "Latest" (published 2026-05-28T11:34:36Z); no 1.0.2 tag, no RC. Related new issue [#2200](https://github.com/a2aproject/A2A/issues/2200) OPEN (2026-09-01): §3.6 says patch versions do not affect compatibility, but 1.0.1 changed six §5.4 error mappings. | Banner unchanged: [main:docs/specification.md#L3](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3) still `**Latest Released Version** [`1.0.0`]`. CHANGELOG on main still tops at 1.0.1 (2026-05-26). |
| D17 | Header registrations cite Section 3.2.5; service parameters are §3.2.6 | open issue | [#2305](https://github.com/a2aproject/A2A/issues/2305) OPEN, created 2026-10-05, no comments, no PR references it. | Nothing on main: [main:docs/specification.md#L3302](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3302) and [#L3323](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3323) still "Section 3.2.5 of the A2A Protocol Specification". §3.2.5 is still Metadata ([#L473](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L473)); its sentence was reworded by #1953 (2026-08-14) without renumbering. |
| D18 | TLS: spec 1.3+, enterprise guide 1.2+ | no upstream activity | Searched dump for `TLS 1\.[23]`: [#785](https://github.com/a2aproject/A2A/pull/785) merged 2025-06-24 (pre-tag, changed the spec to 1.3) and one unrelated comment on #1575. `docs/topics/enterprise-ready.md` has no commits since the tag. | Nothing on main: [main:docs/topics/enterprise-ready.md#L23](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/topics/enterprise-ready.md#L23) still "TLS 1.2 or higher is recommended"; spec [#L3182](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3182) still "TLS 1.3+ recommended". |
| D19 | Empty required arrays: §5.7 wants one element; §8.4.1 example has empty `skills` | open issue | [#2122](https://github.com/a2aproject/A2A/issues/2122) OPEN (2026-08-10, 30+ comments to 2026-10-02) and [#2249](https://github.com/a2aproject/A2A/issues/2249) OPEN (2026-09-20); comment on #2249 2026-09-24 reports a2a-go #441: a card signed with `skills: []` "fails verification in Python: Go canonicalizes the received JSON as is and keeps those REQUIRED fields, while Python rebuilds the card and drops them". A proposed rule on #2122 (2026-10-01, `rule-1-served-scope`): "The rules apply to the fields present in the JSON being signed or verified. A field absent from that JSON MUST NOT be added." No PR yet. | Nothing on main: [main:docs/specification.md#L2048](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2048) still `"skills": []`; §5.7 at [#L1263](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L1263) unchanged. |
| D20 | The `typ` header: listed among MUST fields, worded SHOULD | no upstream activity | Searched dump for `typ` near `JOSE|SHOULD|MUST`: only #2122 and #2249, neither raises the MUST/SHOULD wording. The 2026-10-05 draft on #2249 proposes a published test key and covered payload for §8.4.2; it does not change the header rules. | Nothing on main: [main:docs/specification.md#L2081](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2081) still "`typ`: **SHOULD** be set to "JOSE" for JWS" under the required-parameters list. |
| D21 | Signing steps: §8.4.2/§8.4.3 remove default values, §8.4.1 keeps REQUIRED and set optional fields | open issue | [#2249](https://github.com/a2aproject/A2A/issues/2249) OPEN; comment 2026-09-22 (aeoess): "`AgentCapabilities.streaming` is `optional bool` ... 8.4.1 keeps an explicit `false` ... while 8.4.2 step 1 and 8.4.3 step 3 say to remove properties with default values"; confirmed same day by eriknewton. [#2122](https://github.com/a2aproject/A2A/issues/2122) OPEN: three SDKs produce different bytes; test vectors landed in a2a-tck #228, #245, #246 (2026-09-18 to 2026-10-02); no spec PR yet. | Nothing on main: [main:docs/specification.md#L2091](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2091) and [#L2133](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2133) still "Remove properties with default values"; [#L2026](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2026) still the §8.4.1 rule. |
| D22 | JSON naming example: §5.5 `push_notification_config`, proto `task_push_notification_config` | no upstream activity | Searched dump for `push_notification_config`: [#1657](https://github.com/a2aproject/A2A/pull/1657) OPEN touches §4.6.1, §6.6, §6.7 only; others pre-tag or unrelated (#1092, #1339, #1812, #2227). | Nothing on main: [main:docs/specification.md#L1211](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L1211) still "Protocol Buffer field: `push_notification_config` → JSON field: `pushNotificationConfig`". |
| D23 | Samples that break REQUIRED: missing `messageId`, `artifactId`, event `contextId` | partly fixed on main | [#2083](https://github.com/a2aproject/A2A/pull/2083) merged 2026-08-11, commit [`84ba07f`](https://github.com/a2aproject/A2A/commit/84ba07fa44b214f74853f4099775fed7abda0e1d). Open [#1689](https://github.com/a2aproject/A2A/pull/1689) would also add `artifactId` to the §6.2 artifact event (comment 2026-03-26). | §6.2 SSE example now carries `contextId` on all three events: [main:docs/specification.md#L1376-L1380](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L1376-L1380) `data: {"task": {"id": "task-uuid", "contextId": "context-uuid", ...` (tag: no `contextId`). `blocks.py` on main still flags: §4.3.3 push payload with 2 events and 0 `contextId` (L849); `messageId` missing in §4.6.1, §4.6.2, §6.3, §11.2 samples; `artifactId` missing in the §6.2 artifact event (L1373) and mismatched in §4.6.2. |
| D24 | Invalid JSON in §4.6.1, §6.7, §9.4.1 | open PR | [#1657](https://github.com/a2aproject/A2A/pull/1657) OPEN since 2026-03-18 (review required, last updated 2026-05-28), fixes "trailing/missing commas and field name/type mismatches ... (§4.6.1, §6.6, §6.7)"; issue [#1656](https://github.com/a2aproject/A2A/issues/1656) OPEN. Nothing addresses §9.3/§9.4.1. | Nothing on main: `blocks.py validjson` reports the same four invalid `json` blocks at the tag and on main (§4.6.1 L1009 trailing comma; §9.3 L2283; §9.4.1 L2300 and L2313). |
| D25 | Layer 2 diagram shows Get Agent Card; §3.1 defines only Get Extended Agent Card | no upstream activity | Searched dump for `Get Agent Card|GetAgentCard`: only pre-1.0 items (#253, #285, #1148, #1275 closed, #1333). | Nothing on main: [main:docs/specification.md#L56](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L56) still `L[Get Agent Card]` in the mermaid diagram. |
| D26 | Mandatory operations: §3.1 requires all, §3.3.4 lets flags decline streaming, push, extended card | no upstream activity | Searched dump for `MUST support.*all.*operations`, `mandatory operations`, `optional operations`: one unrelated comment on #1717. | Nothing on main: [main:docs/specification.md#L2991](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2991) still "Implement All Core Operations"; §3.3.4 capability rules at [#L574-L575](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L574-L575) unchanged. |
| D27 | Core Concepts guide: JSON-RPC 2.0 for everything; spec: three bindings | no upstream activity | Searched dump for `JSON-RPC 2.0 is used as the payload`, `payload format for all requests`: 0 hits. The page was rewritten for readability by [#2225](https://github.com/a2aproject/A2A/pull/2225) (merged 2026-09-10, [`1e8a97a`](https://github.com/a2aproject/A2A/commit/1e8a97a6406e5d57da5b8a84da3e2151cb28926b)) and the sentence was kept. | Nothing on main: [main:docs/topics/key-concepts.md#L100](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/topics/key-concepts.md#L100) still "JSON-RPC 2.0 is used as the payload format for all requests and responses." |
| D28 | Who creates the context id: guide says server; spec lets a client propose one | open issue | [#1317](https://github.com/a2aproject/A2A/issues/1317) OPEN since 2025-12-16 (asks to "Remove wording around context id being server generated"); [#1319](https://github.com/a2aproject/A2A/pull/1319) closed unmerged 2026-02-03; [#1588](https://github.com/a2aproject/A2A/pull/1588) merged 2026-03-05 (pre-tag, spec wording); epic [#1987](https://github.com/a2aproject/A2A/issues/1987) OPEN (idempotency, v1.1-candidate). [#2225](https://github.com/a2aproject/A2A/pull/2225) (2026-09-10) rewrote the guide sentence and kept "server-generated". | Nothing on main: [main:docs/topics/key-concepts.md#L99](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/topics/key-concepts.md#L99) now reads "**Context (`contextId`):** A server-generated identifier. Use it to group related `Task` objects" (tag: "A server-generated identifier that can be used to logically group multiple related `Task` objects"). |
| D29 | Extensions guide lists state-machine extensions and forbids new enum values | no upstream activity | Searched dump for `State Machine Extensions`, `adding new (states|enum values)`, `new TaskState`: #1216 closed (pre-tag), #2198 (settlement extension proposal, not a fix). | Nothing on main: [main:docs/topics/extensions.md#L42](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/topics/extensions.md#L42) still "**State Machine Extensions**: Adding new states or transitions to the task". The page gained a URI-namespace note and a `supportedInterfaces` sample via [#2015](https://github.com/a2aproject/A2A/pull/2015) (2026-07-09) and [#2261](https://github.com/a2aproject/A2A/pull/2261) (2026-10-01). |
| D30 | Extension activation: §4.6.1 JSON-RPC parameters, §9.2 HTTP headers | no upstream activity | Searched dump for `JSON-RPC request parameters.{0,60}extension` and `A2A-Extensions`: only extension proposals and #1248 (merged 2025). | Nothing on main: [main:docs/specification.md#L1051](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L1051) still "binding-specific mechanisms such as HTTP headers, gRPC metadata, or JSON-RPC request parameters". |
| D31 | Version as a parameter: §3.6.1 allows it, §9.2/§11.2 require headers | open issue | [#2184](https://github.com/a2aproject/A2A/issues/2184) OPEN, created 2026-08-27, one comment 2026-08-28 enumerating the three contradicting places; no PR references it. | Nothing on main: [main:docs/specification.md#L724](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L724) still "Clients MAY provide the `A2A-Version` as a request parameter instead of a header." |
| D32 | Old endpoint names in the what-is-a2a diagram | fixed on main | [#2261](https://github.com/a2aproject/A2A/pull/2261) merged 2026-10-01, commit [`8d5f578`](https://github.com/a2aproject/A2A/commit/8d5f578fff525fbb57c50a1b53d7642a2c3b0c30). | [main:docs/topics/what-is-a2a.md#L186](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/topics/what-is-a2a.md#L186) `GET agent card eg: (/.well-known/agent-card.json)` (tag: `/.well-known/agent-card`); [#L222](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/topics/what-is-a2a.md#L222) `POST /message:send (with JWT)` (tag: `POST /sendMessage`); [#L229](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/topics/what-is-a2a.md#L229) `POST /message:stream` (tag: `/sendMessageStream`); the step text now says "Select an interface from supportedInterfaces." |
| D33 | Streaming guide names `SendStreamingMessageResponse`; spec `StreamResponse` | no upstream activity | Searched dump for `SendStreamingMessageResponse`: 0 hits. The bullet was edited by [#1965](https://github.com/a2aproject/A2A/pull/1965) (2026-08-12, anchor fixes) and the name was kept. | Nothing on main: [main:docs/topics/streaming-and-async.md#L17](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/topics/streaming-and-async.md#L17) still "typically a `SendStreamingMessageResponse`". |
| D34 | gRPC interface URL: proto demands an absolute HTTPS URL; gRPC dials host:port | fixed on main | [#1997](https://github.com/a2aproject/A2A/pull/1997) merged 2026-07-21, commit [`cfc9d34`](https://github.com/a2aproject/A2A/commit/cfc9d34bc41e368827eb6446d31f912e44f795c5); closes [#1388](https://github.com/a2aproject/A2A/issues/1388). The only proto change since the tag; it is the sole entry in the pending 1.0.2 release ([#2072](https://github.com/a2aproject/A2A/pull/2072) OPEN). | [main:specification/a2a.proto#L337-L339](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/specification/a2a.proto#L337-L339): "The URL or address where this interface is available. For HTTP-based transports, must be a valid absolute HTTPS URL in production. For gRPC, the address should be in the format "hostname:port". Example: "https://api.example.com/a2a/v1", "grpc.example.com:443"" (tag: "Must be a valid absolute HTTPS URL in production. Example: ..., "https://grpc.example.com/a2a""). Unreleased: not in any tag. |
| D35 | Role spelling: §2.2 user/agent, proto `ROLE_USER`/`ROLE_AGENT` | no upstream activity | Searched dump for `"user" or "agent"` and `ROLE_USER.*user`: only #1318 (about `ROLE_UNSPECIFIED`). | Nothing on main: [main:docs/specification.md#L138](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L138) still "a `role` ("user" or "agent")". |
| D36 | Another client's task: §3.3.2 calls it an authorization error and forbids revealing existence | no upstream activity | Searched dump for `another user`, `not (authorized|accessible).*(404|403)`, `(403|PERMISSION_DENIED).*(404|NOT_FOUND)`: one comment on [#1882](https://github.com/a2aproject/A2A/pull/1882) (conformance test spec, OPEN), no spec change proposed. | Nothing on main: [main:docs/specification.md#L514-L516](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L514-L516) still "Servers **MUST NOT** reveal the existence of resources the client is not authorized to access" and "Attempting to access a task created by another user". |
| D37 | A 0.3 state name in §3.4.3: `input-required` | open PR | [#2155](https://github.com/a2aproject/A2A/pull/2155) OPEN, created 2026-08-19, base main, review required, last updated 2026-09-22; one-line change to `TASK_STATE_INPUT_REQUIRED`. [#2270](https://github.com/a2aproject/A2A/pull/2270) (dev-1.1, approved) rewrites the surrounding interrupted-state prose. | Nothing on main: [main:docs/specification.md#L632](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L632) still "transitioning a task to the `input-required` state". |
| D38 | Cancel transitions: guide says clarified in 1.0; spec has no transition table | open issue | Epic [#1992](https://github.com/a2aproject/A2A/issues/1992) OPEN (2026-06-25, `v1.1-candidate`, "state acceptance rules, interruptibility, and task lifecycle"); [#1715](https://github.com/a2aproject/A2A/pull/1715) closed unmerged 2026-04-04 (pre-tag); [#1226](https://github.com/a2aproject/A2A/issues/1226) OPEN (error details for failed tasks). No PR adds a transition table. | Nothing on main: [main:docs/whats-new-v1.md#L112](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/whats-new-v1.md#L112) still "**CLARIFIED:** Task state transitions for cancellation scenarios"; the spec still has no transition table. |
| D39 | `A2A-Version: 0.3` in the §9.2, §11.2, §14.2.1 samples | no upstream activity | Searched dump for `A2A-Version: ?"?0\.3` and `0\.3.{0,40}A2A-Version`: 0 hits. [#2184](https://github.com/a2aproject/A2A/issues/2184) and [#2305](https://github.com/a2aproject/A2A/issues/2305) discuss the header but not the sample value. | Nothing on main: [main:docs/specification.md#L2267](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2267), [#L2780](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2780) and [#L3310](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3310) still `A2A-Version: 0.3`; §3.6.1 at [#L719](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L719) is the one `A2A-Version: 1.0`. |
| D40 | Old extended card flag: Appendix A.2.2 `supportsExtendedAgentCard`; guide and SDK `supportsAuthenticatedExtendedCard` | no upstream activity | Searched dump for `supportsExtendedAgentCard|supportsAuthenticatedExtendedCard`: all hits are pre-1.0 (#456, #618, #929, #1215, #1222, #1307). | Nothing on main: [main:docs/specification.md#L3545](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3545) still `"supportsExtendedAgentCard": true,`; [main:docs/whats-new-v1.md#L120](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/whats-new-v1.md#L120) still `supportsAuthenticatedExtendedCard`; a2a-python main `src/a2a/client/card_resolver.py#L38-L39` still maps `supportsAuthenticatedExtendedCard`. |

## 2. New on main since v1.0.1

Everything below is on `main` but in no tag. Only the first item is in the pending 1.0.2 release PR; the rest are "docs" commits that release-please does not list.

### 2.1 `AgentInterface.url` for gRPC is now `hostname:port`

Commit [`cfc9d34`](https://github.com/a2aproject/A2A/commit/cfc9d34bc41e368827eb6446d31f912e44f795c5), PR [#1997](https://github.com/a2aproject/A2A/pull/1997), merged 2026-07-21. File `specification/a2a.proto`, [main L337-L339](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/specification/a2a.proto#L337-L339).

Before (tag L337-L338):

> // The URL where this interface is available. Must be a valid absolute HTTPS URL in production.
> // Example: "https://api.example.com/a2a/v1", "https://grpc.example.com/a2a"

After:

> // The URL or address where this interface is available. For HTTP-based transports, must be a valid absolute
> // HTTPS URL in production. For gRPC, the address should be in the format "hostname:port".
> // Example: "https://api.example.com/a2a/v1", "grpc.example.com:443"

What an implementer does differently: a card that advertises a `GRPC` interface may now put a bare `host:port` in `url`; a client must not reject a gRPC interface whose `url` has no scheme. This resolves D34 and is the only change queued for 1.0.2.

### 2.2 New §7.6.4 In-Task Authorization Scope

Commit [`6550d34`](https://github.com/a2aproject/A2A/commit/6550d344b39c11f3ba64131f4841c8f6fd8e2754), PR [#2081](https://github.com/a2aproject/A2A/pull/2081), merged 2026-07-30 (gitvote). File `docs/specification.md`, [main L1964-L1972](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L1964-L1972). No such section at the tag.

New text:

> The `TASK_STATE_AUTH_REQUIRED` state signals that additional authorization is required to continue processing a Task. The A2A protocol does not define the scope, representation, validity, or revocation semantics of the authorization decision or credential obtained in response to this state.
>
> Agents MUST NOT treat the `TASK_STATE_AUTH_REQUIRED` state transition, by itself, as authorization for any particular operation. ...
>
> A credential or authorization decision obtained while a Task is in `TASK_STATE_AUTH_REQUIRED` MUST NOT be assumed to authorize subsequent messages on the Task unless that behavior is explicitly defined by the implementation, credential issuer, or extension.

What an implementer does differently: a server that leaves `AUTH_REQUIRED` must re-check authorization on every later message rather than treating the state exit as a grant. The manual's §4.3 and §6.1 describe `AUTH_REQUIRED` without these two MUST NOTs.

### 2.3 §8.5 sample card uses `securityRequirements` with the `schemes` wrapper

Commit [`dfe216a`](https://github.com/a2aproject/A2A/commit/dfe216ab59bdba3f26df43899f84ade7c989b59b), PR [#2046](https://github.com/a2aproject/A2A/pull/2046), merged 2026-07-21. [main L2176](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2176).

Before (tag L2166): `"security": [{ "google": ["openid", "profile", "email"] }],`
After: `"securityRequirements": [{ "schemes": { "google": { "list": ["openid", "profile", "email"] } } }],`

What changes: anyone who copied the tag's sample card sent a field no 1.0 parser reads. The manual already follows the proto (D6). §3.1.11 and §13.3 prose still say `AgentCard.security`.

### 2.4 Push configuration object renamed to `TaskPushNotificationConfig` throughout the prose

Commit [`f63dbb4`](https://github.com/a2aproject/A2A/commit/f63dbb48271940ca5bd421f87e27e4d6ec002795), PR [#1981](https://github.com/a2aproject/A2A/pull/1981), merged 2026-08-28. Touches §3.1.7, §3.1.8, §4.3.1, §4.3.3, §10.4.7 to §10.4.9, §13.4, and `docs/topics/streaming-and-async.md`.

Before (tag L832-L834): `#### 4.3.1. PushNotificationConfig` / `{{ proto_to_table("PushNotificationConfig") }}` (a macro naming a message that does not exist in the proto).
After ([main L832-L834](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L832-L834)): `#### 4.3.1. TaskPushNotificationConfig` / `{{ proto_to_table("TaskPushNotificationConfig") }}`.

Before (tag §10.4.7): `**Request:** {{ proto_to_table("CreateTaskPushNotificationConfigRequest") }}`
After ([main L2631](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L2631)): `**Request:** See [`TaskPushNotificationConfig`](#431-taskpushnotificationconfig) object definition.`

What changes: the gRPC create request is now documented as the config object itself, as the proto has always said (D4, D5).

### 2.5 §6.2 streaming example gains `contextId`

Commit [`84ba07f`](https://github.com/a2aproject/A2A/commit/84ba07fa44b214f74853f4099775fed7abda0e1d), PR [#2083](https://github.com/a2aproject/A2A/pull/2083), merged 2026-08-11. [main L1376-L1380](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L1376-L1380).

Before: `data: {"statusUpdate": {"taskId": "task-uuid", "status": {"state": "TASK_STATE_COMPLETED"}}}`
After: `data: {"statusUpdate": {"taskId": "task-uuid", "contextId": "context-uuid", "status": {"state": "TASK_STATE_COMPLETED"}}}`

What changes: the sample no longer violates the REQUIRED `context_id` on events (D23, partly). The §4.3.3 push payload sample still omits it.

### 2.6 Appendix migration text: version per interface

Commit [`aa042ec`](https://github.com/a2aproject/A2A/commit/aa042ec2653ab98c7ec5c3dc8e2feb7c3078aee1), PR [#2165](https://github.com/a2aproject/A2A/pull/2165), merged 2026-08-28. [main L3517](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3517) and [L3525](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L3525).

Before: "Implement version detection based on the agent's `protocolVersions` in the `AgentCard`" and "Ensure the `AgentCard` declares the correct `protocolVersions` (e.g., ["1.0"] or later)".
After: "Implement version detection based on `protocolVersion` in the agent's `supportedInterfaces` entries" and "Ensure each `AgentInterface` in the `AgentCard` declares the correct `protocolVersion` (e.g., "1.0" or later)".

The same commit fixed the migration guide's pagination sample (D8, D12).

### 2.7 Migration guide aligned with the proto

Commit [`08b42eb`](https://github.com/a2aproject/A2A/commit/08b42ebda1490900d1eb560cd67eb77d497d01b3), PR [#2056](https://github.com/a2aproject/A2A/pull/2056), merged 2026-08-06. File `docs/whats-new-v1.md`.

Before: `if ("taskStatusUpdate" in event) { handleStatusUpdate(event.taskStatusUpdate); }`
After ([main L661-L662](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/whats-new-v1.md#L661-L662)): `if ("statusUpdate" in event) { handleStatusUpdate(event.statusUpdate); }`

Also removed: `createdAt`, `lastModified`, `configId` claims; `config_id` became `id`; the 0.3 `kind` values became `status-update`/`artifact-update`. Still wrong: the `index` line at L497 (D9, D10).

### 2.8 §3.2.5 Metadata wording

Commit [`1eb4aa0`](https://github.com/a2aproject/A2A/commit/1eb4aa03b07589d3a00ce7deab0dde679120ed30), PR [#1953](https://github.com/a2aproject/A2A/pull/1953), merged 2026-08-13, after [`7608bd0`](https://github.com/a2aproject/A2A/commit/7608bd0f676417179b874e95d4b3388a04f1a103) (#2092, 2026-08-11). [main L475](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/docs/specification.md#L475).

Before: "Metadata keys and are strings and values can be any valid value that can be represented in JSON."
After: "Metadata keys must be strings, and values can be any valid JSON value."

Editorial; the constraint was already implied by `google.protobuf.Struct`.

### 2.9 Non-normative changes worth knowing

- What-is-A2A diagram now uses 1.0 endpoint names ([`8d5f578`](https://github.com/a2aproject/A2A/commit/8d5f578fff525fbb57c50a1b53d7642a2c3b0c30), #2261, 2026-10-01) (D32).
- Extensions guide: URI namespace note and a card sample with `supportedInterfaces` ([`fdcf8cc`](https://github.com/a2aproject/A2A/commit/fdcf8cc8354830a1a5a24ab1659d9bb8a869a55a), #2015, 2026-07-09; and #2261).
- Anchor and RFC-link fixes in the spec ([`0a43195`](https://github.com/a2aproject/A2A/commit/0a431950ddd2c698394219eefc2ba32977fe0716) #1965, 2026-08-12; [`1ae57a6`](https://github.com/a2aproject/A2A/commit/1ae57a673f729f743b35f2677f3adc302438695a) #2114, 2026-09-29).
- JSON Schema build pipeline fixed ([`2c3affc`](https://github.com/a2aproject/A2A/commit/2c3affc92e8a77b47695d0478e5a15e87e4a8a25), #2074, 2026-08-17): `scripts/proto_to_json_schema.sh` and a new `scripts/clean_schema_names.py`; `a2a.json` remains a build artifact, not committed ([specification/json/README.md](https://github.com/a2aproject/A2A/blob/679ab3afc6f95ef47bb969d511053d0f63bca2a2/specification/json/README.md)).
- New `docs/llms.txt` and `docs/llms-reference.txt` summaries ([`dc8cc23`](https://github.com/a2aproject/A2A/commit/dc8cc23e17c8caeeea713e4b11993e7af186554a) #1943, 2026-06-22; [`65dadbd`](https://github.com/a2aproject/A2A/commit/65dadbd9b900fe2d970e05416eb432a91347cd2a) #2278, 2026-10-02). `llms-reference.txt` lists the operations and names `security_requirements`; it does not state the subscribe verb.
- Readability rewrites of `what-is-a2a.md`, `key-concepts.md`, `a2a-and-mcp.md`, `life-of-a-task.md` (#2223 to #2226, 2026-09-10). They kept the D27 and D28 sentences.
- Governance: vulnerability intake moved to GitHub Security Advisories (#2086, 2026-07-31); partners, blog, CLI announcement, roadmap (#2237, 2026-09-16).

## 3. Release status

### Tags and releases

| Tag | Commit | Date | Note |
|---|---|---|---|
| `v1.0.1` | [`3303592`](https://github.com/a2aproject/A2A/commit/3303592588e388e62e0f69f701af531d2f4e3991) | 2026-05-28 | [Latest release](https://github.com/a2aproject/A2A/releases/tag/v1.0.1), published 2026-05-28T11:34:36Z; CHANGELOG entry dated 2026-05-26 |
| `v1.0.0` | [`1736957`](https://github.com/a2aproject/A2A/commit/173695755607e884aa9acf8ce4feed90e32727a1) | 2026-03-12 | |
| `v1.0.0-rc` | [`6292104`](https://github.com/a2aproject/A2A/commit/6292104e359efca05bd8703174517b6f961ae4e1) | 2026-01-29 | |
| `v0.3.0` | [`8d57eba`](https://github.com/a2aproject/A2A/commit/8d57eba286de756176892518a8fc39b0ac2ccefb) | 2025-07-31 | |

No tag newer than `v1.0.1` exists (checked with `git fetch --tags`, `gh release list`, `gh api repos/a2aproject/A2A/tags`). No release candidate for 1.0.2 or 1.1.

### Pending 1.0.2

[#2072](https://github.com/a2aproject/A2A/pull/2072) "chore(main): release 1.0.2", release-please, OPEN since 2026-07-21, last regenerated 2026-10-05, label `autorelease: pending`, review required. Its CHANGELOG entry lists one fix: "**proto:** correct gRPC URL example in AgentInterface (#1997)". Branch `rp` = commit [`6f5911f`](https://github.com/a2aproject/A2A/commit/6f5911f1eee3a69ed9b9c32d2ec90409fa82c203). When it merges, 1.0.2 will contain every docs commit above plus the proto comment change; nothing else is wire-affecting. The spec banner will still say 1.0.0 unless someone edits it separately.

### v1.1 plan

- Scope process: [#1942](https://github.com/a2aproject/A2A/issues/1942) "[TSC] Proposal: backlog consolidation & v1.1 scope alignment", OPEN, gitvote passed 2026-06-25 (62.5% in favor). Executed 2026-06-25: 8 umbrella epics labeled `v1.1-candidate`: [#1986](https://github.com/a2aproject/A2A/issues/1986) stream resumption and event ordering, [#1987](https://github.com/a2aproject/A2A/issues/1987) idempotency and safe retries, [#1988](https://github.com/a2aproject/A2A/issues/1988) push-notification config security and semantics, [#1991](https://github.com/a2aproject/A2A/issues/1991) coherent task history, [#1992](https://github.com/a2aproject/A2A/issues/1992) multi-turn interaction gaps, [#1995](https://github.com/a2aproject/A2A/issues/1995) bidirectional streaming, plus skill selection and auth discovery umbrellas. All OPEN on 2026-10-06. No GitHub milestone exists (`gh api .../milestones` returned nothing).
- Push epic [#1988](https://github.com/a2aproject/A2A/issues/1988): acceptance criteria "Read operations (`Get`/`List`) MUST redact or omit secret material", "`token` field type/format is specified", "Snapshot-on-registration behavior is defined for parity with subscribe". Related open PR [#1750](https://github.com/a2aproject/A2A/pull/1750) "redact push notification credentials in read APIs" (2026-04-15, review required, updated 2026-09-22). Comment 2026-09-24 proposes adding webhook body integrity and replay protection to the epic.
- Branch `dev-1.1` (head [`db39eb5`](https://github.com/a2aproject/A2A/commit/db39eb52363a007868a755703f7044841c729acb), 2026-09-22). Merged into it:
  - [#2084](https://github.com/a2aproject/A2A/pull/2084) ADR-002 coherent task history, merged 2026-08-11 ([`809fdd4`](https://github.com/a2aproject/A2A/commit/809fdd44455dc06e486ac34a248dca2deededc32)), adds `adrs/adr-002-coherent-task-history.md`.
  - [#1810](https://github.com/a2aproject/A2A/pull/1810) `generation` field, merged 2026-08-12 ([`2849187`](https://github.com/a2aproject/A2A/commit/28491879ff41a9c230fb51f3f7bd6096b80cc341), gitvote passed). Proto: `Task.generation` ([dev11 L211](https://github.com/a2aproject/A2A/blob/db39eb52363a007868a755703f7044841c729acb/specification/a2a.proto#L211)) "incremented by exactly 1 by the server on every state-changing mutation"; `TaskStatusUpdateEvent.generation`, `TaskArtifactUpdateEvent.generation` ([L390](https://github.com/a2aproject/A2A/blob/db39eb52363a007868a755703f7044841c729acb/specification/a2a.proto#L390)); `GetTaskRequest.current_generation` for long-polling ([L752](https://github.com/a2aproject/A2A/blob/db39eb52363a007868a755703f7044841c729acb/specification/a2a.proto#L752)); `SendMessageConfiguration.if_generation_match` ([L172](https://github.com/a2aproject/A2A/blob/db39eb52363a007868a755703f7044841c729acb/specification/a2a.proto#L172)); new error `TaskGenerationMismatchError` = JSON-RPC `-32010`, gRPC `ABORTED`, HTTP `409 Conflict` ([dev11 spec L1286](https://github.com/a2aproject/A2A/blob/db39eb52363a007868a755703f7044841c729acb/docs/specification.md#L1286)); new §3.2.7 ([L500](https://github.com/a2aproject/A2A/blob/db39eb52363a007868a755703f7044841c729acb/docs/specification.md#L500)).
  - [#2129](https://github.com/a2aproject/A2A/pull/2129) timeline, merged 2026-09-22 ([`db39eb5`](https://github.com/a2aproject/A2A/commit/db39eb52363a007868a755703f7044841c729acb), gitvote passed). Proto: `Task.history` deprecated ([L195](https://github.com/a2aproject/A2A/blob/db39eb52363a007868a755703f7044841c729acb/specification/a2a.proto#L195), "removed in 2.0"), new `repeated TimelineEntry timeline = 8` ([L200](https://github.com/a2aproject/A2A/blob/db39eb52363a007868a755703f7044841c729acb/specification/a2a.proto#L200)), `message TimelineEntry` with `oneof entry { Message message; TaskStatus status; }` ([L337](https://github.com/a2aproject/A2A/blob/db39eb52363a007868a755703f7044841c729acb/specification/a2a.proto#L337)), `timeline_length` replacing `history_length` in `SendMessageConfiguration`, `GetTaskRequest`, `ListTasksRequest`, `Artifact.start_generation`/`end_generation`; new §3.2.8 and §4.1.8.
- Open PRs targeting `dev-1.1` (from `gh pr list --base dev-1.1`): [#2068](https://github.com/a2aproject/A2A/pull/2068) subscribe verb GET (approved), [#2270](https://github.com/a2aproject/A2A/pull/2270) interrupted states non-terminal (approved), [#2153](https://github.com/a2aproject/A2A/pull/2153) bidi streaming foundations `SendLiveMessage` (2026-08-19, no review decision), [#2240](https://github.com/a2aproject/A2A/pull/2240) "update agent discovery to prefer AI Catalog over well-known URI" (2026-09-16; keeps `/.well-known/agent-card.json` "as a valid option with clearly documented limitations"). Closed unmerged on `dev-1.1`: [#2149](https://github.com/a2aproject/A2A/pull/2149) elicitations (closed 2026-09-22), [#2230](https://github.com/a2aproject/A2A/pull/2230) replace well-known discovery with AI Catalog.
- No 1.1 tag, RC, or release date is published anywhere found: not in `CHANGELOG.md`, `docs/roadmap.md` on main (updated 2026-09-16 by #2237), the release list, or the epics.

### a2a-python

`v1.2.2` ([`2f9e44a`](https://github.com/a2aproject/a2a-python/commit/2f9e44af243df5c7c7a3da361c8d095324bcd5e3)) is the latest release, published 2026-10-05T09:50:04Z; earlier 1.2.1 (2026-09-30), 1.2.0 (2026-09-29), 1.1.5 (2026-09-21). Main is 4 commits ahead (a2a-python #1294, #1307, #1309, #1317, all 2026-10-05/06), none touching the register topics.

## Searches run

- `git fetch --tags origin` in both clones; `git log v1.0.1..origin/main`; `git diff v1.0.1 origin/main -- docs/ specification/`; per-file `git log` for the 17 docs and spec files; `git log -S'<phrase>'` for `protocolVersions`, `Metadata keys must be strings`, `In-Task Authorization Scope`, the `securityRequirements` sample line, the `contextId` sample line, the datatracker RFC link, and two anchor strings; branch inspection of `dev`, `dev-1.1`, `next`, `conformance-spec`, `rp`.
- `research/v2/grep-main.py`: the 44 regex checks listed in that file, each run against `origin/main` and `v1.0.1` (output in this session; the script is reusable).
- `research/v2/data/sweep.py` over all 40 patterns against issue bodies and all comments; output saved to `research/v2/sweep-all.txt`.
- `research/v2/threads.py` (new helper, reads the dumps) for #785, #1317, #1574, #1641, #1657, #1685, #1689, #1819, #1891, #1942, #1988, #2044, #2045, #2057, #2058, #2063, #2068, #2087, #2122, #2135, #2155, #2162, #2172, #2174, #2179, #2184, #2200, #2240, #2249, #2270, #2305.
- `q.py spec "#2135\b"`, `"#2184\b"`, `"#2305\b"`, `"#1317\b"` to find PRs referencing the open issues (none for the first three).
- `research/v2/data/blocks.py` in all four modes against `docs/specification.md` at the tag and at main.
- `gh` (sandbox off, read-only): `release list`/`release view` for both repos, `api repos/a2aproject/A2A/tags`, `api .../branches/dev-1.1`, `pr view` for #2072 and the eleven PRs above (state, base, review decision), `pr list --base dev-1.1 --state all`, `pr list --search "chore(main): release"`.