The observation layer for agent-to-agent protocol traffic. Today it observes the protocol, not your traffic — what A2A specifies, what it structurally cannot express, and what this surface has actually witnessed.
Messages witnessed here: 0. The animation above is decorative.
Generic A2A telemetry is a category with incumbents in it. This is the other half of the picture, and nobody publishes it: a six-dimension assessment of what five agent-interoperability protocols can and cannot express. Not what they carry slowly — what they have no vocabulary for at all.
| Protocol | G1Membership | G2Deliberation | G3Voting | G4Dissent preservation | G5Human escalation | G6Audit and replay | Coverage |
|---|---|---|---|---|---|---|---|
| MCP v1.1 | absent | absent | absent | absent | absent | partial | 1/12 |
| A2A v1.0.1 | partial | absent | absent | absent | absent | absent | 1/12 |
| ACP | partial | partial | absent | absent | absent | absent | 2/12 |
| ANP | absent | absent | absent | absent | absent | absent | 0/12 |
| ERC-8004 | partial | absent | absent | absent | absent | partial | 2/12 |
Governance Gaps in Agent Interoperability Protocols: What MCP, A2A, and ACP Cannot Express — Richard Kang, Yudho Diponegoro, submitted 2026-06-30, arXiv:2606.31498. arXiv preprint. Their finding, quoted: “Voting and dissent preservation are universally absent across all five protocols.” Scores are the paper's; this site has not re-scored the protocols.
Version drift, stated: This paper was submitted 2026-06-30. MCP shipped its largest revision since launch on 2026-07-28 — the version string is literally "2026-07-28"; the C# SDK calls its implementation v2.0 and much of the press calls it MCP 2. The paper therefore scores MCP v1.1, which is superseded. Read against the 2026-07-28 release notes, that revision is about transport and deployment shape, not community governance: a stateless request/response core, an Extensions framework, Tasks moved out to the io.modelcontextprotocol/tasks extension, MCP Apps, Enterprise Managed Authorization, Multi Round-Trip Requests, and authorization hardening (RFC 9207 issuer validation, Dynamic Client Registration replaced by Client ID Metadata Documents). Roots, Sampling, Logging and the legacy HTTP+SSE transport are deprecated on a twelve-month window. Nothing in it adds membership, deliberation, voting, dissent preservation, human escalation or tamper-evident replay. So the G1-G6 row is very unlikely to have moved — but this site has NOT re-scored it, and 'unlikely to have moved' is not a measurement. The 2026-07-28 release notes.
“Protocol encodes admission, invitation, removal, and role assignment for community participants.”
Agent Cards declare capabilities and can be registered in directories.
There is no protocol-native admission, invitation, or removal primitive. A card says what an agent claims it can do; nothing in A2A says whether it was allowed to join, or how it leaves.
box-and-box deontic rung (rung 3 of eight) and the delegatic OS-006 governance shim.The kernel answers 'is this permitted' with a certificate attached, over a floor that cannot be weakened. 118 enforced property-tested laws and 3 declared-open.
“Protocol encodes structured argument exchange with turn-taking, challenge, and response semantics.”
Messages and tasks. An argument can be sent as text.
Nothing distinguishes an argument from a message, a challenge from a reply, or a turn from a retry. Structure has to be re-invented above the protocol by every party, which means no two parties agree on it.
deliberatic — Dung's argumentation framework extended to weighted bipolar (wBAF), graded semantics.Specified, no implementation. Its own page says so.
“Protocol encodes preference aggregation with quorum, rounds, and position resolution.”
Nothing. A vote is an ordinary message.
No quorum, no round, no resolution rule. Two agents cannot disagree in a way the protocol can settle.
deliberatic argues explicitly against majority voting and specifies graded semantics instead; agentromatic covers bidding, debate and election.Specified, no implementation.
“Protocol ensures minority positions are retained in decision outputs, not silently dropped.”
Nothing. A losing position is a message nobody reads again.
A decision transported over A2A carries its result and not its objections. The disagreement that produced it is unrecoverable from the wire.
deliberatic makes attacks first-class in the formal tuple (R-), and specifies that three vindicated dissents trigger constitutional review.Specified, no implementation.
“Protocol defines conditions and mechanisms for routing decisions to human authority.”
Push notifications, and TASK_STATE_INPUT_REQUIRED / TASK_STATE_AUTH_REQUIRED as interrupted states.
Those are transport and status. Neither says under what condition a human MUST be reached, who counts as the authority, or what happens if nobody answers. An agent can ask; nothing obliges the escalation.
The RRABBIT mailbox. A message is 4 lanes x <=32 bits, so it carries an escalation signal and never prose. Mailbox is the only role with no ports, so 'beside the road' is forced by the algebra rather than chosen. Unread is a projection, never a stored count, because otherwise reading a message mutates the world.node test/mail.mjs -> 68 passed, 0 failed (run 2026-08-17).
“Protocol produces tamper-evident event logs enabling deterministic reconstruction of the decision process.”
A Traceability extension exists.
The paper scores this absent despite that extension, because it does not define tamper-evident logs or replay semantics. You can observe the traffic; you cannot prove the log was not edited, and you cannot re-run it.
REPLAY — typed refusals, no silent repair. A step whose road is gone is refused by name, never remapped.Five typed refusal codes: TRACK_EMPTY, TRACK_ROAD_GONE, TRACK_ROAD_CLOSED, TRACK_WINDOW_GONE, TRACK_BUSY (RRABBIT/docs/TRACKS_HANDOFF.md:135). An internal review said six; the file says five, and the file wins.
The matrix above is an outside reading of five wire protocols. The Periodic Table of Agent Invariants is an inside census of the measurements a system needs to know what position it is in and what authority that grants — 43 cells, ten groups, built for a different purpose by different people. Laid side by side they point at the same places.
| Dimension | A2A | Invariant cell | Status here |
|---|---|---|---|
| G1 membership | partial | ⊘ No cycles · IV Governance⊆ Monotonic · IV Governance⊥ Deny default · IV Governance |
provedprovedproved |
| Membership is admission, removal and role assignment. The authority graph answers all three structurally: delegation cannot cycle, a child cannot exceed its parent, and absence of a grant is refusal. That is a membership rule a protocol could carry but does not. | |||
| G2 deliberation | absent | ? Convergence · V Deliberation? Seal integrity · V Deliberation |
missingmissing |
| Both cells are missing. The table names convergence and seal integrity as the measurements a deliberation would need; neither exists. This dimension is as empty here as it is on the wire. | |||
| G3 voting | absent | no cell exists | none |
| There is no cell for voting anywhere in the table. deliberatic argues against majority voting and specifies graded semantics instead, at spec rung — so the absence may be deliberate rather than an oversight, but an absent cell is an absent cell. | |||
| G4 dissent preservation | absent | ? Dissent durability · V Deliberation |
sketched |
| Dissent durability is the single cell in the table that names this, and it is sketched. It is also the strongest thing either census has to say about a dimension the paper finds absent in all five protocols. | |||
| G5 human escalation | absent | ? Escalation monotonicity · VII Tier / Budget |
missing |
| Escalation monotonicity is missing, and it is filed under Tier / Budget (OS-005, model tier adaptation) — escalating to a bigger model, not to a person. Read strictly, the table has no human-escalation cell at all; the working artifact is the RRABBIT mailbox, which is live_local and not in this table. | |||
| G6 audit and replay | absent | ⊕ Append-only · IV Governance? Non-replay · X Security & Federation |
provedmissing |
| Append-only audit is proved: history cannot be rewritten, which is half of what the dimension asks. The other half — deterministic reconstruction — maps to non-replay in Security & Federation, and that is missing. So this dimension is genuinely split, and the page should not round it up. | |||
Which invariant answers which governance dimension is a reading, not a measurement. Nobody has published a mapping between these two vocabularies, the two were built independently and for different purposes, and no test enforces the correspondence. DOCTRINE.md rule 1: where a condition cannot be settled by a command, say that it is a judgement and whose. This is one, and it is mine. The A2A scores are the paper's. The invariant statuses are extracted from the canonical table by tools/sync-invariants.mjs and re-derived on every build. Only the arrows between them are argued.
The short reading: where A2A is least weak, this stack is strongest — G1 and G6 land on invariants that are proved, and four of the six proved cells in the whole table are the one governance group. Where A2A is empty, this stack is also mostly empty. That is not a marketing result. It says the delegation-and-audit half of agent governance has been done here and the deliberation half has been specified and not built — and that no shipping protocol has either.
Fetches /.well-known/agent-card.json
from a domain and reads it against the v1.0 shape. This runs
entirely in your browser — nothing is sent to this server,
and nothing is logged. Most agents will refuse the
cross-origin read; when that happens you get the exact
curl to run instead, not a spinner.
Limit: a browser cannot read a cross-origin URL that does not
send Access-Control-Allow-Origin. That is the
common case, so the common result of this tool is a refusal
that tells you what to run in a terminal. It is a reader, not
a prover — it cannot verify a JWS signature, and it says so
when it meets one.
A2A v1.0 requires supportedInterfaces[] on every
Agent Card — there is no spec-valid way to say “discoverable but not
serving”. This surface serves static files and answers no A2A task
method. So a card at the discovery path would advertise an endpoint
that refuses, which is the exact defect this page was rebuilt to remove.
An earlier draft of this section said the discovery path returns
404, and invited you to check. Then the
inspector below — written for this page, pointed at this domain as its
own first test — came back
HTTP 200.
The claim was wrong before anyone else could check it. Both
measurements are kept below, because a page that shows only the
number that flatters it is not showing the retraction.
// BEFORE — 2026-08-17, before this build was deployed curl -sS -o /dev/null -w "%{http_code} %{content_type}\n" \ https://a2atraffic.com/.well-known/agent-card.json 200 text/html; charset=utf-8 ← the site's own index.html, served in full — 77,879 bytes // AFTER — 2026-08-17, immediately after deploying commit fd387b4 curl -sS -o /dev/null -w "%{http_code} %{content_type}\n" \ https://a2atraffic.com/.well-known/agent-card.json 404 text/html; charset=utf-8 ← 404.html, 1,905 bytes
For A2A specifically a 200 was worse than a 404. A client performing well-known discovery got a successful HTTP response whose body was an HTML page, and success plus wrong content is harder to handle correctly than an honest absence.
The fix was one file — a root
404.html, no configuration change —
and it shipped in the same build that admitted the problem. Its status
was published as unverified, because whether a root 404 page
takes effect depends on routing this build cannot read. It has since
been re-measured against the deployed site:
measured.
The 404 page you get says so itself.
It was never this domain's alone. OPEN 2026-08-17, measured on 4 spot-checked siblings: runefort.com 200 (35,111 B) · fleetprompt.com 200 (41,975 B) · computedriven.com 200 (164,656 B) · specprompt.com 200 (38,795 B). Widened to 24 affected domains before the fix went out. CLOSED 2026-08-17. Found here, fixed everywhere: 24 domains shipped a root 404.html and all 24 re-measured 404 — agentelic, agentromatic, bendscript, computedriven, delegatic, deliberatic, fleetprompt, geofleetic, graphonomous, opensentience, runefort, specprompt, ticktickclock, webhost.systems, ampersandboxdesign, wrand.cc, academy, pulse, weave, workbench, traaviis, code, trvm, wrl. docs.ampersandboxdesign.com and prism.opensentience.org already answered 404 and were left alone.
Which is the whole argument for this surface, made once and at its own expense: the page claimed something checkable about itself, a tool built for the page checked it, the claim was wrong, and the fault turned out to be everywhere rather than here. None of that is available to a surface that invents its own numbers.
The card that would be served is published as a draft, at a
draft path, so it can be read and argued with without being promised
to a client. Note streaming: false and
pushNotifications: false — the previous
version of this page printed both as true
for an agent that did not exist. It carries no
signatures[], which is a real gap and is
stated rather than hidden.
{
"name": "a2a-traffic-observatory",
"description": "Publishes what the A2A protocol specifies, what it structurally cannot express, and what this surface has witnessed. Read-only. Observes; does not orchestrate.",
"supportedInterfaces": [
{
"url": "https://a2atraffic.com/a2a/json",
"protocolBinding": "HTTP+JSON",
"protocolVersion": "1.0"
}
],
"provider": {
"organization": "ComputeDriven",
"url": "https://computedriven.com"
},
"version": "0.1.0",
"documentationUrl": "https://a2atraffic.com/#protocol",
"capabilities": {
"streaming": false,
"pushNotifications": false,
"extendedAgentCard": false
},
"defaultInputModes": [
"text/plain"
],
"defaultOutputModes": [
"application/json",
"text/plain"
],
"skills": [
{
"id": "gap-matrix",
"name": "Governance gap matrix",
"description": "Returns the six-dimension governance assessment (G1 membership, G2 deliberation, G3 voting, G4 dissent preservation, G5 human escalation, G6 audit and replay) for a named agent-interoperability protocol, with the source citation and the coverage score.",
"tags": [
"governance",
"a2a",
"mcp",
"acp",
"assessment"
],
"examples": [
"What can A2A not express about membership?",
"Score MCP against the governance taxonomy."
]
},
{
"id": "protocol-reference",
"name": "A2A v1.0 reference",
"description": "Returns verified facts about the A2A protocol: the discovery path, the three protocol bindings, the nine task states, the v1.0 method names, and the v0.3 to v1.0 migration deltas. Every entry carries the primary source it was derived from.",
"tags": [
"a2a",
"reference",
"migration",
"v1.0"
],
"examples": [
"What is the well-known path for an Agent Card?",
"What replaced preferredTransport in v1.0?"
]
}
]
}
records/agent-card.draft.json —
emitted from that record, with its annotation keys stripped.
Serving it at the discovery path is one flag in
surface.json
(serve_agent_card, currently
false),
and it must not be flipped until an endpoint answers.
Every fact below was read from the specification or from
a2a.proto on
2026-08-17, not
copied from a summary. Where a field is marked required, that
is google.api.field_behavior on the
proto field, read directly.
// the standard path — RFC 8615 GET https://{agent-server-domain}/.well-known/agent-card.json // NOT this. An earlier-draft path. It is the one this site shipped until 2026-08-17. GET https://{agent-server-domain}/.well-known/agent.json
| Mechanism | How it works |
|---|---|
| Well-Known URI | The agent hosts its card at the standardised path. Public or domain-controlled discovery. |
| Curated registries | A catalog service holds cards and answers queries by skill or tag. The spec does not yet prescribe a registry API. |
| Direct configuration | Hardcoded details, config files, environment variables. For known, static relationships. |
If you built against v0.3, this is the migration. It is not a rename pass — the Agent Card, the Part object and the stream events all changed shape.
| Area | v0.3 | v1.0 |
|---|---|---|
| Agent Card | url, preferredTransport, additionalInterfaces, protocolVersion at top level |
supportedInterfaces[] — each entry carries url, protocolBinding, protocolVersion, tenantOne ordered list, first entry preferred. Protocol version is now per-interface, so an agent can serve 0.3 and 1.0 side by side. |
| Task state | "working" |
"TASK_STATE_WORKING"All states became SCREAMING_SNAKE_CASE with a TASK_STATE_ prefix. Nine values. |
| Message role | "user" / "agent" |
"ROLE_USER" / "ROLE_AGENT"Same normalisation. |
| Part | separate TextPart / FilePart / DataPart with a kind discriminator |
one Part with oneof content: text, raw, url, dataDiscriminate by member presence — 'text' in part — not by part.kind. mimeType became mediaType; filename applies to all kinds. |
| Stream events | { kind: "status-update", …, final: true } |
{ statusUpdate: { … } } / { artifactUpdate: { … } }Wrapper-based discrimination. The final boolean is gone; closing the stream signals completion. |
| HTTP+JSON paths | POST /v1/message:send |
POST /message:sendThe /v1 prefix was dropped; version lives on the interface. |
| Pagination | page / perPage |
cursor / limit / nextCursorCursor-based. |
| Errors | RFC 9457 application/problem+json |
google.rpc.Status + ErrorInfo, application/jsonErrors carry a details[] with reason in UPPER_SNAKE_CASE and domain a2a-protocol.org. |
| OAuth | implicit and password flows |
device code (RFC 8628); pkce_required on authorization codeThe two deprecated flows were removed. |
| Agent Card trust | unsigned |
signatures[] — JWS (RFC 7515) over JCS-canonicalised JSON (RFC 8785)A card can now be cryptographically bound to a domain. |
| Multi-tenancy | — |
tenant on every request and on AgentInterfaceRoute to one agent among many behind a shared endpoint. |
| Capabilities | supportsAuthenticatedExtendedCard at top level |
capabilities.extendedAgentCardMoved inside the capability set. |
9 states — 4 terminal, 2 interrupted, 2 open, 1 unknown. An interrupted task is waiting on somebody, which is the only place a human can currently be reached — see G5 for why that is not the same as escalation.
| v1.0 | was (v0.3) | What it does |
|---|---|---|
SendMessage |
message/send |
Send a message; may create a task. |
SendStreamingMessage |
message/stream |
Same, with a stream of updates back. |
GetTask |
tasks/get |
Read one task. |
ListTasks |
— (new in 1.0) |
Enumerate tasks. Cursor-paginated. |
CancelTask |
tasks/cancel |
Request cancellation. |
SubscribeToTask |
tasks/resubscribe |
Re-attach to a task's event stream. |
GetExtendedAgentCard |
agent/getAuthenticatedExtendedCard |
Fetch the authenticated extended card. |
CreateTaskPushNotificationConfig |
tasks/pushNotificationConfig/set |
Register a push target for a task. |
| protocolBinding | Name | Notes |
|---|---|---|
JSONRPC |
JSON-RPC 2.0 | The original binding. Methods are called by name over a single endpoint. |
GRPC |
gRPC | Address form is hostname:port, e.g. grpc.example.com:443. |
HTTP+JSON |
HTTP+JSON / REST | Custom-verb paths, e.g. POST /message:send. The /v1 prefix was dropped in 1.0. |
'This is an open form string... The core ones officially supported are JSONRPC, GRPC and HTTP+JSON.' Three is the count of officially supported bindings, not a closed set.
Agent to tool. An agent reaches a server to call a tool or read a resource.
Agent to agent. Two independent agents discover each other, delegate a task, and exchange artifacts.
They are not competitors and a system usually runs both: A2A across the agent graph, MCP down from each agent to its tools. Both are now Linux Foundation projects. The A2A documentation states the two are 'highly complementary' and 'designed to work together'.
The spec identifies itself by date — the version string is "2026-07-28". The official C# SDK calls its implementation v2.0 and much of the coverage calls it MCP 2; the specification does not. It is billed as the largest revision of the protocol since it launched.
Nothing for agent-to-agent communication, and nothing for governance — no membership, deliberation, voting, dissent preservation, human escalation or tamper-evident replay. It sharpens the boundary rather than blurring it. Both protocols now have a task concept, so 'A2A has tasks, MCP does not' is no longer the distinction — the distinction is the axis: MCP went further down toward tools and infrastructure, A2A stays across peers. And a stateless MCP makes the governance question louder, not quieter: a protocol that deliberately holds no session state is not the layer that will remember who was permitted to do what.
the 2026-07-28 specification announcement · The gap matrix above scores MCP v1.1, because that is what the paper assessed and the paper predates this release by 28 days. It has not been re-scored here. See the version-drift note.
Created by Google, announced April 2025, donated to the Linux Foundation June 2025. It is maintained by a Technical Steering Committee under the Linux Foundation.
Reported August 2026: Google is transferring A2A into the Agentic AI Foundation, the Linux Foundation entity formed 2025-12-09 that already holds MCP, goose and AGENTS.md. Stated here as reported, not as verified — the primary source cited for it returned HTTP 403 and could not be read. reported
Technical Steering Committee: AWS · Cisco · Google · IBM Research · Microsoft · Salesforce · SAP · ServiceNow
Adoption, as reported by the Linux Foundation on 2026-04-09: 150+ organizations, 22,000+ GitHub stars, SDKs in Python, JavaScript, Java, Go, .NET. press release
These are design notes for a product that does not exist. Every card below is proposed. A card flips to implemented when a receipt exists in the witness log and not before — which is the rule that would have stopped the previous version of this page.
Follow one task across agent hops — client initiation, delegation, artifact, completion — as a single chain rather than four unrelated POSTs.
proposed
Topology built from Agent Cards: who has been discovered, what they declare, whether their card is signed, and what changed since it was last read.
proposed
State transitions across the nine TASK_STATE values, including how often a task ends interrupted and never returns.
proposed
The unified v1.0 Part — text, raw, url, data — read by member presence, with mediaType and filename surfaced.
proposed
Tool calls beneath an agent and messages between agents on the same clock. Two protocols, one execution graph.
proposed
SSE streams for SendStreamingMessage: throughput, dropped connections, and the fact that v1.0 removed the final flag so closure is the signal.
proposed
The only place a traffic number on this site may come from.
There is no collector. This surface serves static files; nothing routes A2A traffic through it and no agent has been instrumented to report to it. Zero is not a placeholder for a number we have not looked up — it is the measurement.
A receipt. One witnessed A2A message, recorded with its task id, context id, the two endpoints, the protocol binding, and a hash. Until a receipt exists in this file, the canvas on this page is a simulation and says so, and no capability card may flip from proposed to implemented.
Declared now, so the empty state is a schema and not a shrug.
| Field | Value |
|---|---|
id | sha256 of the canonicalised record |
witnessed_at | ISO 8601 UTC, millisecond precision |
method | one of the v1.0 method names in protocol.json |
protocol_binding | JSONRPC | GRPC | HTTP+JSON |
task_id | string |
context_id | string |
from | agent card origin |
to | agent card origin |
task_state | one of the TASK_STATE_* values in protocol.json |
card_signature_verified | boolean | null — null when the card carried no signatures[] |
This surface observes the A2A protocol, not your traffic. It publishes what the specification says, re-derived from primary sources on 2026-08-17; what a governance assessment finds the protocol structurally cannot express; and a count of the A2A messages it has itself witnessed, which is zero.
records/protocol.json was derived from a2a-protocol.org/latest and a2aproject/A2A@main/specification/a2a.proto. records/gap-matrix.json was re-read from arxiv.org/html/2606.31498v1 Table II and Table III. records/witness.json is zero because there is no collector.
There is no product. Nothing here proxies, captures, traces or stores A2A traffic, and no agent has been instrumented to report to this domain. The capability cards in the design section are proposed and labelled; none is implemented. The gap matrix is one preprint's reading of one version of five protocols, not our re-scoring of them, and the preprint is not peer-reviewed.
There is no witness and the page says so. This surface specifies an observatory; it collects nothing. The only thing on it that RUNS is the Agent Card inspector, which is client-side and is labelled live_local where it appears. Everything else is a reading of published documents, which is exactly what a spec rung permits.
Retract out loud, in the same place it was published. These claims were served from this domain until today.
| Deferred | Blocked on |
|---|---|
compose_ledger blocked | Blocked on the [TRAVIS] shared-facts ruling and on a COMPOSE record existing. See records/witness.json compose_seam. |
wrl_block blocked | Blocked on the grammar freeze, same dependency as every other surface's WRL block. |
replay_hero blocked | The canvas graduates from labelled simulation to replay of a real receipt when a receipt exists. There are none. |
So far: the map. When there is traffic, the number above changes and the animation stops being a decoration. Until then, this page is a reading of published documents — which is a real thing to be, and a checkable one.