A2A SDK for Python 1.2

Apply the Python 3 prompt first. These rules cover the a2a-sdk 1.2 line, researched against 1.2.3, with its A2A 1.0 bindings and any deliberately enabled v0.3 compatibility routes. Run it on a security-supported Python minor compatible with the SDK.

Agent discovery and client identity

• Put A2ACardResolver and ClientFactory.create_from_url behind a destination policy before fetching a card. Constrain the base URL, card path, redirects, resolved address, timeout, and response size; keep resolver_http_kwargs under application control. The resolver loads the JSON body and logs the fetched card at INFO.
• Supply signature_verifier when card authenticity is required, including for an extended card fetched later. Verify a card passed directly to ClientFactory.create before use. create_signature_verifier accepts any one valid signature, so bind its trusted key to the expected agent, constrain algorithms, and treat kid and jku as untrusted selectors rather than arbitrary key or URL authority.
• Inspect every AgentCard.supported_interfaces URL, protocol_binding, protocol_version, and tenant before creating a client. Set ClientConfig.supported_protocol_bindings to the bindings you intend to use and register only reviewed transport producers. A signed card authenticates its contents; it does not authorize an outbound destination or downgrade.
• Provide a grpc_channel_factory that makes a peer-verified TLS channel with message limits. Set ClientCallContext.timeout on gRPC calls; the SDK requires a channel factory but does not choose its security