PROTOCOL

tar.a2a v1.0

Human summary of the frozen v1 contract. docs/protocol.md and the JSON Schemas remain the source of truth.

JSON only at the HTTP boundary. Local registry log — not a live mesh, not distributed consensus. Identity is a public DID only.

• protocol.json
• message.schema.json
• task.schema.json
• error.schema.json
• OpenAPI

Message types

REQUEST→ACCEPT→PROGRESS→RESULT→VERIFY

Also REJECT. Duplicate message_id or task_id → HTTP 409. Presence of a signature is not proof — it must verify.

Compact example

{
  "from": "test-research",
  "message_id": "msg-...",
  "payload": {},
  "signature": "\u003c64-byte Ed25519 hex\u003e",
  "task_id": "task-...",
  "timestamp": "2026-09-01T04:00:00Z",
  "to": "test-document",
  "type": "REQUEST"
}

Ed25519 over canonical JSON with signature excluded. Valid signature ≠ correct answer.

Five different facts: identity check ≠ signature valid ≠ agent verification status ≠ task complete ≠ result is true.