fix: align A2A v1 semantics and repository tooling

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,43 @@
+name: Bug report
+description: Report a reproducible runtime, protocol, or documentation issue
+title: "[Bug] "
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: Remove secrets and sensitive data from logs and protocol payloads before submitting.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem description
+      description: What happened, and what behavior did you expect?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction steps
+      description: Provide minimal, repeatable steps and sanitized requests.
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version and environment
+      description: Include the opencode-a2a, OpenCode, Python, and operating system versions.
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Supporting evidence
+      description: Include sanitized logs, error responses, or relevant links.
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-submission checklist
+      options:
+        - label: I searched the open issues and found no duplicate report.
+          required: true
+        - label: I confirm that this submission contains no tokens, passwords, or `.env` contents.
+          required: true

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability reporting
+    url: https://github.com/Intelligent-Internet/opencode-a2a/blob/main/SECURITY.md
+    about: Read the private disclosure guidance before reporting sensitive information. Do not disclose it in a public issue.
+  - name: Support scope
+    url: https://github.com/Intelligent-Internet/opencode-a2a/blob/main/SUPPORT.md
+    about: Review the supported scope before opening an issue.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,39 @@
+name: Feature request
+description: Propose a new A2A, OpenCode, or engineering capability
+title: "[Feature] "
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: User problem
+      description: What specific problem needs to be solved? Avoid describing only an implementation.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: Describe the expected behavior, protocol or extension boundary, and alternatives.
+    validations:
+      required: true
+  - type: dropdown
+    id: surface
+    attributes:
+      label: Affected surface
+      options:
+        - A2A core / transport
+        - OpenCode provider-private extension
+        - Operations / observability
+        - Documentation / open source engineering
+    validations:
+      required: true
+  - type: checkboxes
+    id: checks
+    attributes:
+      label: Pre-submission checklist
+      options:
+        - label: I searched the open issues and found no duplicate request.
+          required: true
+        - label: I explained whether this capability belongs to A2A core, a shared extension, or a provider-private surface.
+          required: true

.github/pull_request_template.md

@@ -0,0 +1,18 @@
+## Summary
+
+Describe the problem, solution, and user-visible impact.
+
+## Related issue
+
+Closes #
+
+## Validation
+
+- [ ] Ran `./scripts/doctor.sh`
+- [ ] Ran `./scripts/conformance.sh` when changing an A2A transport or contract
+- [ ] Verified that the Agent Card, OpenAPI, machine-readable contracts, and documentation remain synchronized
+- [ ] Confirmed that logs, test data, and commits contain no secrets or `.env` contents
+
+## Compatibility and risk
+
+Describe protocol, SDK or Python support boundaries, deployment impact, and security considerations. Write "None" when not applicable.

.github/workflows/validate.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
-          python-version: "3.13"
+          python-version: "3.14"
 
       - name: Set up uv
         uses: astral-sh/setup-uv@v7
@@ -66,7 +66,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12"]
+        python-version: ["3.11", "3.12", "3.13"]
 
     steps:
       - name: Checkout

CONTRIBUTING.md

@@ -14,7 +14,7 @@ This repository maintains an OpenCode A2A runtime. Changes should keep runtime b
 
 Requirements:
 
-- Python 3.11, 3.12, or 3.13
+- Python 3.11, 3.12, 3.13, or 3.14
 - `uv`
 - A reachable OpenCode runtime if you need end-to-end manual checks
 
@@ -56,13 +56,13 @@ bash -n scripts/doctor.sh
 bash -n scripts/lint.sh
 ```
 
-External interoperability experiments stay outside the default regression baseline. When you need to reproduce current official-tool behavior, run:
+Repository-owned black-box compatibility probes stay outside the default regression baseline. Run them when transport or A2A protocol behavior changes:
 
 ```bash
 bash ./scripts/conformance.sh
 ```
 
-Treat that output as investigation input. Do not fold it into `doctor.sh` or the default CI quality gate unless the repository explicitly decides to promote a specific experiment into a maintained policy.
+The script does not download or bind to an external TCK. It checks the public Agent Card and both shipped transports against invariants maintained by this repository. A third-party TCK may be used independently as investigation input, but is not a repository dependency or certification claim.
 
 If you change extension methods, extension metadata, or Agent Card/OpenAPI contract surfaces, also make sure the targeted contract checks stay green:
 

README.md

@@ -100,6 +100,7 @@ curl http://127.0.0.1:8000/.well-known/agent-card.json
 - Session continuity through `metadata.shared.session.id`
 - Request-scoped model selection through `metadata.shared.model`
 - OpenCode-oriented JSON-RPC extensions for session and model/provider queries
+- Authenticated Prometheus-compatible process metrics at `GET /metrics`
 
 ## A2A Protocol Support
 
@@ -177,7 +178,7 @@ Read before deployment:
 - [docs/compatibility.md](docs/compatibility.md) Compatibility-sensitive surface and contract-honesty guidance.
 - [docs/guide.md](docs/guide.md) Usage guide, transport details, streaming behavior, extensions, and examples.
 - [docs/security-architecture.md](docs/security-architecture.md) Security surface, boundaries, and residual-risk register.
-- [docs/conformance.md](docs/conformance.md) External TCK experiment workflow and artifact handling.
+- [docs/conformance.md](docs/conformance.md) Repository-owned black-box compatibility probes and artifact handling.
 - [SECURITY.md](SECURITY.md) Threat model, deployment caveats, and vulnerability disclosure guidance.
 
 ## Development

docs/architecture.md

@@ -97,6 +97,6 @@ Use the docs by responsibility:
 - [Maintainer Architecture Guide](maintainer-architecture.md): internal module boundaries, request call chains, and persistence touchpoints
 - [Extension Specifications](extension-specifications.md): stable extension URI/spec index and disclosure policy
 - [Security Architecture](security-architecture.md): security surface mapping and residual-risk register
-- [Conformance Notes](conformance.md): external TCK experiment workflow
+- [Conformance Notes](conformance.md): repository-owned black-box compatibility probes
 - [Contributing Guide](../CONTRIBUTING.md): contributor workflow and validation
 - [Security Policy](../SECURITY.md): threat model and disclosure guidance

docs/compatibility.md

@@ -4,7 +4,7 @@ This document defines the compatibility promises `opencode-a2a` currently uphold
 
 ## Runtime Support
 
-- Python versions: 3.11, 3.12, 3.13
+- Python versions: 3.11, 3.12, 3.13, 3.14
 - A2A SDK line: `1.x.y`
 - Supported A2A protocol line: `1.0`
 - OpenCode runtime line: `1.18.x` (verified with `1.18.19`)
@@ -27,7 +27,7 @@ If runtime support is not implemented, do not publish it as a supported machine-
 
 Consumer guidance:
 
-- Treat the v1 core A2A methods (`SendMessage`, `SendStreamingMessage`, `GetTask`, `CancelTask`, `SubscribeToTask`) as the portable baseline.
+- Discover the complete SDK-owned v1 core method set from `core.jsonrpc_methods`; do not infer it from a shortened documentation list.
 - Treat `urn:opencode-a2a:extension:...` entries in this repository as repository-governed extension identifiers, not as a claim that they are part of the A2A core baseline.
 - Treat `opencode.*` methods and `metadata.opencode.*` fields as provider-private OpenCode control and discovery surfaces layered on top of the portable A2A baseline.
 - Treat [extension-specifications.md](./extension-specifications.md) as the stable URI/spec index, not as the main usage guide.
@@ -40,7 +40,7 @@ When docs or reference material disagree, treat these as normative in this order
 - machine-readable discovery output such as Agent Card, authenticated extended card, and OpenAPI metadata
 - repository-owned docs in `README.md`, `docs/`, and `CONTRIBUTING.md`
 
-External TCK runs and local conformance experiments are investigation inputs. They do not override the repository's declared contract by themselves.
+The repository-owned black-box compatibility probes protect selected runtime invariants but are not a complete conformance suite. Third-party TCK output is investigation input only and does not override the repository's declared contract by itself.
 
 ## Compatibility-Sensitive Surface
 
@@ -60,7 +60,7 @@ Changes to those surfaces should be treated as compatibility-sensitive and shoul
 
 Service-level behavior layered on top of those core methods should also be declared explicitly when interoperability depends on it. Current examples:
 
-- `SubscribeToTask` replay-once behavior for terminal updates
+- `SubscribeToTask` rejection with `UnsupportedOperationError` for terminal tasks
 - first-terminal-state-wins task persistence policy
 - task-scoped `acceptedOutputModes` negotiation persistence across send / stream / get / subscribe
 - request-body rejection behavior for oversized transport payloads

docs/conformance.md

@@ -1,67 +1,50 @@
-# External Conformance Experiments
+# Repository-Owned Compatibility Probes
 
-This repository keeps internal regression and external interoperability experiments separate on purpose.
+`./scripts/conformance.sh` runs black-box checks maintained and reviewed with this repository. It deliberately does not clone, pin, or execute the official A2A TCK.
 
 ## Scope
 
-- `./scripts/doctor.sh` remains the primary internal regression entrypoint.
-- `./scripts/conformance.sh` is a local/manual experiment entrypoint for official external tooling.
-- External conformance output should be treated as investigation input, not as an automatic merge gate.
+The probe verifies a small set of high-value A2A 1.0 invariants through public HTTP boundaries:
 
-## Current Experiment Shape
+- Agent Card discovery advertises both HTTP+JSON and JSON-RPC interfaces
+- empty `SendMessage` input is rejected before execution
+- unsupported push notification configuration uses the protocol-specific error
+- subscribing to a terminal task returns `UnsupportedOperationError` on both transports
+- `ListTasks` is reachable through both shipped transports
 
-The default `./scripts/conformance.sh` workflow does the following:
-
-1. Sync the repository environment unless explicitly skipped.
-2. Cache or refresh the official `a2aproject/a2a-tck` checkout.
-3. Start a local dummy-backed `opencode-a2a` runtime unless `CONFORMANCE_SUT_URL` points to an existing SUT.
-4. Run the requested TCK category, defaulting to `mandatory`.
-5. Preserve raw logs and machine-readable reports under `run/conformance/<timestamp>/`.
-
-The default local SUT uses the repository test double `DummyChatOpencodeUpstreamClient`. That keeps the experiment reproducible without requiring a live OpenCode upstream.
+These checks protect this runtime's declared contract. They are not a complete A2A conformance suite and must not be presented as certification.
 
 ## Usage
 
-Run the default mandatory experiment:
+Run against the local dummy-backed runtime:
 
 ```bash
 bash ./scripts/conformance.sh
 ```
 
-Run a different TCK category:
-
-```bash
-bash ./scripts/conformance.sh capabilities
-```
-
-Target an already running runtime instead of the local dummy-backed SUT:
+Run against an existing deployment:
 
 ```bash
 CONFORMANCE_SUT_URL=http://127.0.0.1:8000 \
-A2A_AUTH_TYPE=bearer \
-A2A_AUTH_TOKEN=dev-token \
-bash ./scripts/conformance.sh mandatory
+CONFORMANCE_AUTH_TOKEN=dev-token \
+CONFORMANCE_ALLOW_EXTERNAL=1 \
+bash ./scripts/conformance.sh
 ```
 
-## Artifacts
+The probe creates a real task and reads task state. Use a dedicated test deployment, never a production target. `CONFORMANCE_ALLOW_EXTERNAL=1` is a required explicit acknowledgement, and `CONFORMANCE_AUTH_TOKEN` is required for an existing deployment. The default `test-token` is used only for the locally launched test SUT.
 
-Each run keeps the following artifacts in the selected output directory:
+Use `CONFORMANCE_OUTPUT_DIR` to select the artifact directory and `CONFORMANCE_SKIP_REPO_SYNC=1` only when the locked environment has already been verified.
 
-- `agent-card.json`: fetched public Agent Card
-- `health.json`: fetched authenticated health payload when the local SUT is used
-- `tck.log`: raw TCK console output
-- `pytest-report.json`: pytest-json-report output emitted by the TCK runner
-- `failed-tests.json`: compact list of failed/error node IDs for triage
-- `metadata.json`: experiment metadata including local repo commit and cached TCK commit
-
-## Interpretation Guidance
+## Artifacts
 
-When a TCK run fails, inspect the raw report before changing the runtime:
+Each run writes:
 
-- Some failures may point to real runtime gaps.
-- Some failures may come from TCK assumptions that do not match the current `a2a-sdk 1.x.y` contract.
-- Some failures may come from local dummy-backed experiment behavior rather than a wire-level runtime defect.
+- `agent-card.json`: the discovered public Agent Card
+- `report.json`: versioned check results and repository revision
+- `probe.log`: human-readable probe output
+- `sut.log`: local test-runtime output, when the script launches it
+- `repo-health.log`: repository environment checks, unless explicitly skipped
 
-The experiment is useful only if those categories stay separate during triage.
+## External Tools
 
-The current first-pass triage is recorded in [`./conformance-triage.md`](./conformance-triage.md).
+Maintainers may run third-party TCKs independently to investigate interoperability. Record exact tool revisions and wire payloads when reporting a finding. External output is evidence to triage, not an automatic merge gate, source of runtime truth, or reason to restore obsolete protocol behavior.