A2A SDK for Python 1.1

Apply the Python 3 prompt first. These rules cover the a2a-sdk 1.1 line, checked against 1.1.3, on maintained Python 3.10–3.14 releases, its A2A 1.0 protobuf APIs, and explicitly enabled v0.3 compatibility bindings.

Agent discovery and transports

• Apply the Python outbound-network controls to A2ACardResolver and ClientFactory.create_from_url: allowlist HTTPS destinations and constrain card paths, redirects, DNS results, deadlines, and response bytes before parsing. Keep resolver_http_kwargs under application control; the resolver reads the response body before constructing the card.
• Validate each AgentCard.supported_interfaces entry's url, protocol_binding, protocol_version, and tenant before ClientFactory.create. Set ClientConfig.supported_protocol_bindings explicitly and register only reviewed transport producers; a supported binding or signed card does not authorize its destination or a protocol downgrade.
• Pass an explicit signature_verifier wherever signed-card trust is required; verification is optional in the SDK. With create_signature_verifier, bind trusted keys to the expected agent and fix the allowed algorithms. Treat the supplied kid and jku as untrusted selectors; never let them choose an arbitrary key or key-fetch destination.
• Verify cards supplied directly to ClientFactory.create or create_client(AgentCard) before use. Pass a verifier separately to get_extended_agent_card; initial discovery verification is not a persistent policy for subsequent card retrievals.
• Supply a reviewed