[I] [Feature] A2A gateway production wiring: main-process boot, RocksDB task store, auth, metrics, contextId (eventmesh)

["qqeasonchen (via GitHub)" <gi...@apache.org>]

qqeasonchen opened a new issue, #5405:
URL: https://github.com/apache/eventmesh/issues/5405

   ### Motivation
   
   The A2A / Agent Gateway is feature-complete in components but not in wiring. A source audit of `runtime/a2a` + `protocol-a2a` (develop @ 66727b61b) shows:
   
   1. **Production wiring is missing.** `EventMeshA2ATransport` (bridging onto `UniIngressService` / the real CloudEvents-over-MQ core) exists but nothing uses it: `A2AGatewayServer` is only started from standalone demos with an in-memory transport, and `EventMeshApplication` never boots the gateway. `docker run apache/eventmesh` gives no A2A endpoints at all.
   2. **TaskStore has one backend.** Only `MetaBackedTaskStore` (requires Nacos). Single-instance / docker deployments have no durable task store at all.
   3. **#5225 class confusion.** Users post A2A JSON-RPC to the runtime traffic port (`/eventmesh/publish`) and get an opaque error. The traffic port should answer with actionable guidance pointing at the A2A gateway endpoints.
   4. **Gateway has no auth.** The `Authorization` header is passed to the security gate as an opaque principal (#5304) but never actually verified — the gateway is open when started.
   5. **Zero A2A metrics.** No counters for submitted/completed/failed/expired tasks or gateway latency; `/admin/metrics` and `/metrics` know nothing about the A2A plane.
   6. **Task payloads are opaque strings.** `TaskRecord.input/output` are raw strings; `contextId` (A2A conversation linkage) is not persisted, so related tasks cannot be correlated after the fact.
   
   ### Proposal
   
   Single PR, production wiring + hardening (Testcontainers E2E stays in #5347):
   
   1. **Gateway in the main process (opt-in).** `EventMeshApplication.withA2aGateway(...)` + `-Deventmesh.a2a.enabled=true` (port `-Deventmesh.a2a.port=10108`). Wired with `EventMeshA2ATransport(ingress)` — the real transport — plus `InMemoryAgentCardRegistry` (or Meta-backed when clustered). Graceful shutdown included.
   2. **`RocksDBTaskStore`.** Local durable `TaskStore` under the same data dir layout as offsets/delivery-state (`<data>/a2a-tasks`). Default when A2A is enabled and no Meta is configured; wire format reuses the MetaBacked v1 envelope so stores are format-compatible.
   3. **Traffic-port guidance (#5225).** POST to `/eventmesh/*` with an A2A-shaped body (jsonrpc field or protocoltype=a2a header) returns a 400 with a pointer to the A2A gateway endpoints instead of an opaque transform error.
   4. **Token auth on the gateway.** When `-Deventmesh.a2a.token` is set, `Authorization: Bearer <token>` is verified (constant-time, same pattern as the admin token #5364); without it the gateway logs a warning and stays open (dev mode), same opt-in semantics as the traffic plane.
   5. **A2A metrics.** Static counters/gauges (submitted / completed / failed / canceled / expired tasks, active task gauge) surfaced through `/admin/metrics` JSON and the `/metrics` Prometheus scrape.
   6. **`contextId` passthrough.** Optional `contextId` on task submit (request body + CloudEvent extension `a2acontextid`), persisted in `TaskRecord`, returned in task snapshots — enables conversation correlation without changing the existing callers.
   
   ### Non-Goals
   
   * Testcontainers E2E (tracked in #5347)
   * Full A2A spec `Message`/`Part` typed model, artifacts, push-notification config (follow-up once interop with the official A2A SDKs is validated)
   * Multi-language SDKs, WebSocket bidirectional streaming (a2a.md roadmap)
   
   ### Testing
   
   * Unit tests: RocksDBTaskStore round-trip + epoch CAS semantics; auth guard; contextId passthrough; guidance response on the traffic port.
   * Integration: gateway-on-main-process smoke (enabled via system property, health + submit round-trip over the real transport with the memory storage backend).
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@eventmesh.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@eventmesh.apache.org
For additional commands, e-mail: issues-help@eventmesh.apache.org

Re: [I] [Feature] A2A gateway production wiring: main-process boot, RocksDB task store, auth, metrics, contextId (eventmesh)

["qqeasonchen (via GitHub)" <gi...@apache.org>]

qqeasonchen closed issue #5405: [Feature] A2A gateway production wiring: main-process boot, RocksDB task store, auth, metrics, contextId
URL: https://github.com/apache/eventmesh/issues/5405


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@eventmesh.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@eventmesh.apache.org
For additional commands, e-mail: issues-help@eventmesh.apache.org