A2A SDK for Go 2.7

Apply these rules to applications using github.com/a2aproject/a2a-go/v2 on the 2.7 line, whether they expose an A2A server, consume another agent, or both. The A2A protocol version advertised in an Agent Card is separate from the SDK version.

Discover and connect to agents

• Resolve Agent Cards only from approved HTTPS origins. agentcard.Resolver accepts a complete URL and file:// URLs, follows its configured http.Client, and reads the entire response; reject untrusted local-file URLs, bound response size and redirects, and apply destination checks to every connection and redirect before parsing a card.
• When signatures are required, configure agentcard.Resolver.Verifier with keys anchored to the expected provider, then explicitly reject a resolved card with no signatures. The resolver invokes its verifier only when card.Signatures is nonempty. Never treat a jku, kid, or endpoint inside an untrusted card as its own trust anchor.
• Pass only verified or otherwise trusted cards to a2aclient.NewFromCard or Factory.CreateFromCard; these constructors assume the card is trusted. Check each SupportedInterfaces URL against the intended agent and egress policy before the factory can try it. PreferredTransports changes order rather than excluding other compatible transports; use WithDefaultsDisabled and explicit transport factories when only particular bindings are allowed.
• Scope AuthInterceptor credentials by the current SessionID, agent, and security scheme. Attach a session ID for each call, fail closed if the card requires credentials but