Discover, trust, delegate: an A2A walkthrough across a boundary
Part 14's handoff transfers control to a specialist that lives in YOUR process. A billing agent owned by another team on another host cannot be imported. A2A lets your support agent DISCOVER a peer via its Agent Card, decide whether to TRUST it against an allowlist, and DELEGATE a task over JSON-RPC. Step the three stages, then flip to a rogue peer that gets refused.
The world: a support agent needs a refund issued, but the refund skill is owned by a peer, the billing-agent, served at https://billing.acme.example/a2a. Discovery fetches the peer's agent-card.json; an allowlist gate decides trust; delegation is a tasks/send task with a submitted -> working -> completed lifecycle, returning an artifact.
verified The transport is the in-process JSON-RPC shim from Part 12, reused. MCP is vertical (agent reaching down to tools); A2A is horizontal (agent reaching across to a peer). Same plumbing, opposite direction. Every frame below is a real JSON-RPC message printed verbatim; the real network transport is one flag away.
Discovery is not trust. Both peers serve a perfectly valid Agent Card, and both claim the process_refund skill. The card tells you what a peer SAYS it can do and how to reach it. Whether you act on it is a separate decision: the allowlist gate. The allowlisted billing-agent is delegated to; the unvetted refund-bot-9000 is refused, and any output from outside the allowlist is tagged UNTRUSTED. The deep treatment, injection via a delegated result and the lethal trifecta, is Part 16.
Two protocols, one transport: MCP vs A2A
Same JSON-RPC plumbing, opposite direction. MCP reaches down to tools; A2A reaches across to a peer agent.
MCP (Part 12)vertical
agent → TOOLS. A host reaches DOWN to its own tools inside one trust domain.
initialize / tools-list / tools-call
A2A (this part)horizontal
agent → AGENT. An agent reaches ACROSS an org boundary to a peer agent.
agent-card / tasks-send + a task lifecycle
Both ride JSON-RPC. A2A adds discovery via Agent Cards and a trust boundary between peers. Handoffs (Part 14) stop at the process boundary; A2A crosses it: an Agent Card at a well-known URL advertises a peer's skills and auth, delegation is a task with a submitted -> working -> completed lifecycle, a registry locates peers, and an allowlist decides which to trust.
How we keep it honest: the in-process shim is fully reproducible and every frame is a verbatim JSON-RPC message. The A2A field names and protocol strings move fast; only the transport and those strings would need edits for a live run. The real network transport, like the LLM swap in earlier parts, is one flag away. The trust touchpoint here stays deliberately thin; the deep agentic-security treatment is Part 16.