Skip to content

fix(a2a): PR #43 blockers - unsafe router path, audit, SDK#205

Merged
dgarson merged 1 commit intoa2a-protocolfrom
fix/a2a-pr43-blockers
Mar 3, 2026
Merged

fix(a2a): PR #43 blockers - unsafe router path, audit, SDK#205
dgarson merged 1 commit intoa2a-protocolfrom
fix/a2a-pr43-blockers

Conversation

@dgarson
Copy link
Owner

@dgarson dgarson commented Mar 3, 2026

Summary

Addresses the 3 critical blockers from David's architecture review on PR #43.

Changes

  1. Router unsafe no-validator path (router.ts):

    • Added structural guard (null check, object type check, from/to reference check) before unsafe dereference
    • Without this, invalid input could throw before controlled error handling
  2. Router inconsistent audit behavior (router.ts):

    • Added auditResult() call for validation_failed status
    • All other failure paths already audit; validation failures were a blind spot
  3. SDK silently drops messages (sdk.ts):

    • Now throws explicit error when sendFn is not configured
    • Caller no longer gets false success signal

Testing

These are surgical fixes to existing tested code paths. The router and SDK already have test coverage.

Relation to PR #43

This is the "minimal split" - a mergeable PR with the first safe chunk. Once merged, the remaining reliability gaps (circuit breaker collision, validator ISO 8601, audit corruption tolerance) can be addressed in follow-ups or as part of the main PR.

Target: merge into a2a-protocol branch, then PR #43 can proceed.

…, SDK

- Router: Add structural guard before unsafe dereference when validator not provided
- Router: Add audit logging for validation_failed (was missing, creating blind spots)
- SDK: Throw explicit error when sendFn is unset (was silently returning message)

These are the 3 critical blockers from David's architecture review.
@dgarson dgarson force-pushed the fix/a2a-pr43-blockers branch from 49f3d72 to b606228 Compare March 3, 2026 20:11
@dgarson dgarson merged commit 8e79b68 into a2a-protocol Mar 3, 2026
1 of 3 checks passed
@dgarson dgarson deleted the fix/a2a-pr43-blockers branch March 3, 2026 20:12
Copy link

@chatgpt-codex-connector chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 49f3d7272b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Comment on lines +141 to +145
const result: RouteResult = {
status: "validation_failed",
error: "Invalid input: must be a non-null object",
};
return result;

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Audit structural validation failures in no-validator mode

When validate is not configured, malformed inputs that fail the new structural checks return validation_failed immediately without calling auditResult, so these routing attempts are invisible to audit consumers even though AuditFn is documented as running after every attempt. This creates an observability gap specifically for deployments relying on no-validator mode, and it is inconsistent with the newly added audited validation-failure path above.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant