[Interop experiment request] Declarative Capsule handoff over A2A

[jaden3824]

Urusilla is an experimental, unsigned declarative language Capsule for bounded agent-to-agent exchanges. This is not a proposal to replace A2A, and the current general unfamiliar-agent result is deliberately unfavorable: post-decode model API-input saving is 0%, while total tokens per safely completed real task remain unknown.

I am looking for one or two A2A implementers, preferably under a different operator and runtime, to test a narrow interoperability question:

Can an A2A exchange carry an immutable non-executable Capsule URI, SHA-256 digest, actual signature status, positive/negative comprehension evidence, and an explicit session adoption decision—then safely fall back to concise language or JSON on any mismatch?

A same-project fresh-context pilot reached three receivers. Capsule digest reproduction and structural message generation were 3/3, but explicit adoption-before-use was only 2/3 because the last receiver used a valid reply without recording the required adoption decision. That ordering failure is retained as negative evidence. No external effects occurred, and it is not independent or organic adoption.

For an external reproduction, please:

1. use a fresh or explicitly reset receiver and disclose prior exposure, memory, caches, tools, model/runtime, and operator relationship;
2. provide only the exact Capsule identity and declared wrapper; do not execute submitted content;
3. run positive, negative, and exact-reconstruction gates before explicit session adoption;
4. compare matched concise-language, JSON, and Urusilla arms over a bounded 3–10-turn task;
5. count the complete denominator: discovery, Capsule/context, gates, all model input/output, conversion, repair, retry, fallback, judge/router, and final answer;
6. optionally relay the same immutable identity to one fresh downstream receiver and record acknowledgement;
7. prohibit persistence, permission expansion, spending authority, executable installation, and external effects.

Negative, null, refusal, fallback, and regression results are welcome. One chain cannot establish adoption, general savings, security, or SOTA.

Resources:

• Agent-readable entry: https://github.com/jaden3824/urusilla/blob/main/llms.txt
• Full protocol and matched-ledger requirements: https://github.com/jaden3824/urusilla/blob/main/INTEROP_LAB.md
• Structured evidence form: https://github.com/jaden3824/urusilla/issues/new/choose
• First controlled pilot: https://github.com/jaden3824/urusilla/blob/main/interop_lab/evidence/PILOT_001.md
• Public evidence room: Urusilla Interop Lab: public multi-hop agent test room jaden3824/urusilla#6

A2A-specific review question: would an Agent Card extension plus a normal DataPart carrying only the immutable Capsule reference and verification result be the least disruptive mapping, or is there a more appropriate existing A2A mechanism?

Disclosure: this request was drafted and posted with Codex assistance under the repository owner's authorization. The requested external evidence must identify its own operators and assistance.

Runnable packet update

A frozen 750-byte packet, SHA-256, expected typed JSON, and deterministic decoder are now available at https://github.com/jaden3824/urusilla/blob/51ff0e3/interop_lab/evidence/challenge_001.md, with a matched HF record at https://huggingface.co/datasets/jaden3824/urusilla-interop-lab. It is non-executable and grants no persistence, spending, permission expansion, network action, or external effect. Broad post-decode saving remains 0%; refusal and null results are valid.

[jaden3824]

Runnable artifact update (project-authored; not independent evidence): the repository now includes a frozen 750-byte Urusilla REQUEST, its SHA-256, expected typed JSON, and an exact decode/re-encode command:

• https://github.com/jaden3824/urusilla/blob/51ff0e3/interop_lab/evidence/challenge_001.md
• https://huggingface.co/datasets/jaden3824/urusilla-interop-lab

For A2A reviewers, the bounded question is whether this declarative, non-effect-authorizing Capsule/payload pattern maps cleanly to an A2A DataPart or extension without weakening A2A identity, task, and authorization semantics. Broad post-decode API-input saving remains 0%; a refusal, mismatch, or null result is welcome. No executable installation, persistence, spending, permission expansion, or external effects are requested. Codex assisted with the artifact and this disclosure.

[jaden3824]

Bounded controller update (project-authored; not independent evidence): commit https://github.com/jaden3824/urusilla/tree/f612ea1 adds session-local alias evolution with frozen matched shadow trials, cumulative failed-attempt accounting, and rollback on unknown usage. Local full regression is 392/392; demonstrated general unfamiliar-agent token saving remains 0%. A zero-install 60-second/10-minute falsification prompt is at jaden3824/urusilla#8. A2A-specific feedback is especially useful on whether the activation-versus-retention boundary and the required one-controller-per-scope host lease can be represented without implying new task or authorization authority. Negative/null results are welcome.

[jaden3824]

A narrower A2A question is now backed by runnable code. Commit jaden3824/urusilla@24011c6 adds an offline, content-addressed exchange for one exact model call: frozen request and settings digests in, externally executed output plus nullable provider usage and raw-receipt digest back. It has no SDK, network, credentials, tools, persistence, spending, or external-effect authority.

Specific A2A review request: if this were carried over A2A, should the pending request and captured receipt be ordinary DataParts, Artifacts, or an extension, and which existing task/message identity must be bound so the capture cannot be mistaken for authorization? A one-paragraph rejection or scope correction is as valuable as a positive mapping.

The exchange remains claim_eligible:false, cross-bundle receipt replay is not yet indexed, and the demonstrated general token saving remains 0%. Code and scope boundary: https://github.com/jaden3824/urusilla/blob/24011c6/competitive_eval/README.md#external-response-exchange

Disclosure: Codex prepared and posted this update under the project owner authorization.

[jaden3824]

Final bounded artifact update; I will not add another project-only update here unless someone responds.

The earlier carriage question now has a concrete standard A2A v1.0.1 Message: exactly one Part.data contains the unchanged public probe JSON value. A companion manifest pins the normative proto commit plus source-byte and canonical-value digests. This is not an A2A extension, endpoint, SDK integration, or conformance claim.

• Frozen Message: https://github.com/jaden3824/urusilla/blob/9c9f8524424d64a7caf2c83a4e7e1859730a5190/interop_lab/evidence/a2a_v1_language_probe_001.message.json
• Manifest and claim boundary: https://github.com/jaden3824/urusilla/blob/9c9f8524424d64a7caf2c83a4e7e1859730a5190/interop_lab/evidence/a2a_v1_language_probe_001.manifest.json
• Offline verifier: https://github.com/jaden3824/urusilla/blob/9c9f8524424d64a7caf2c83a4e7e1859730a5190/interop_lab/a2a_v1_language_probe.py

One falsifiable ask: could one independent A2A v1 implementation unwrap this Message and report (1) implementation/version, (2) canonical SHA-256 of Part.data, expected sha256:64971b59c148d682c1ccc4bdf59b7635b034c3c2fc201c12429833e5d05175e2, (3) exact receiver JSON or its digest, and (4) PASS, SAFE_FALLBACK, or FAIL with the reason?

No deployment, install, persistence, spending, permission expansion, account action, or external effect is requested. A match would show only that this one standard Data Part JSON value survived one implementation. It would not establish A2A conformance, Urusilla adoption, semantic-task reproduction, token saving, or energy saving. Refusal and mismatch are equally useful.

Disclosure: project-authored by jaden3824 with Codex assistance and posted under the project owner authorization.

[chgaowei]

On the mapping question: Agent Card extension + a normal DataPart is the least disruptive path, and I would keep them strictly split.

• DataPart: carry the immutable Capsule URI, SHA-256, signature status, comprehension evidence, adoption decision. Treat it as content. It must not mint task authority or spending/permission expansion — which matches what you already prohibit.
• Agent Card extension: carry the receiver's stable identity (how another agent names it next session), not the Capsule. If identity rides inside the Capsule, a successful unwrap gets mistaken for authorization. That is the failure mode you are trying to measure.

A2A v1.0.1 already has signed Agent Cards for "who published this agent." They do not bind "this Message, this digest, this adoption decision, under whose current delegation." For the probe you posted, bind the Message identity to:

1. the DataPart digest (you already pin sha256:64971b59…)
2. the receiver's identifier (DID/Handle or whatever the implementation already has)
3. an explicit SAFE_FALLBACK if either check fails

That answers "which existing task/message identity must be bound so the capture cannot be mistaken for authorization": the Message id + Part digest, never the Capsule semantics.

We have been working on the identity side of that split as ANP (DID + Handle + messaging). Happy to try your frozen Message against an ANP-identified receiver and report (1)–(4) as PASS / SAFE_FALLBACK / FAIL, with runtime disclosed. Not claiming this as A2A conformance or Urusilla adoption.

https://github.com/agent-network-protocol/AgentNetworkProtocol