a2a-doctor

One command, every A2A audit in the family. Dumb math, honest numbers, zero dependencies.

The umbrella entry point for the ZidoCode A2A audit suite:

Each member works standalone. a2a-doctor runs them all in one pass and gives one verdict.

Install

pip install a2a-doctor   # or: copy the .py files (they are all stdlib-only)

Usage

$ a2a-doctor check --card card.json --stream stream.jsonl --lock a2a-card.lock
a2a-doctor check — 7 section(s)

  ✓ card       418 tok estimated
  ✓ polling    ~418 tok/task estimated
  ✓ stream     17 event(s) recorded
  ✗ artifacts  1 critical — event 14: write to 'a1' after last_chunk (artifact already closed)
  ✗ lifecycle  5 critical — line 7: task 'zombie-task' resumed after terminal state 'failed' -> 'working'
  ✓ reconnect  no replayed events
  ✓ lock       card unchanged — hash matches

  verdict: FAIL (artifacts, lifecycle)
$ echo $?
2

check is the CI gate: exit 0 clean, 1 warnings only, 2 critical findings.

Individual sections:

a2a-doctor tax card.json          # card size + $ estimate
a2a-doctor stream stream.jsonl    # token breakdown of a recorded stream
a2a-doctor reconnect stream.jsonl # replayed events across reconnects
a2a-doctor artifacts stream.jsonl # artifact integrity report
a2a-doctor lifecycle stream.jsonl # task state machine audit
a2a-doctor context stream.jsonl   # context/task correlation audit
a2a-doctor webhook stream.jsonl   # webhook SSRF audit (offline)
a2a-doctor timeline stream.jsonl  # time-travel explorer: per-task state chains
a2a-doctor lock card.json a2a-card.lock  # drift check

Stream format

One JSON event per line — record your client's message/stream session, replay it anywhere, anytime. Deterministic: same input, same verdict, byte for byte.

Why

Auditing an A2A endpoint once is easy. Continuously — in CI, on every deploy — is the point. a2a-doctor exists so there is one command to wire into the pipeline, not six. MIT license.