A2A SDK for Rust 0.3

Apply the Rust 1.98 baseline first. These rules cover a2a-lf 0.3, which implements A2A protocol 1.0, and its companion crates. They were checked against 0.3.0 with a2a-client-lf 0.2.3, a2a-server-lf 0.4.3, a2a-pb 0.2.0, a2a-grpc 0.3.5, and a2a-slimrpc 0.2.7. The workspace declares Rust 1.85 and edition 2024; verify the resolved dependency graph against the supported toolchain required by the baseline.

Discovery and client credentials

• Allowlist discovery origins before AgentCardResolver::resolve and pass AgentCardResolver::new(Some(client)) an HTTP client with explicit redirect, proxy, and timeout policy. Use a capped HTTPS fetch-and-decode path when accepting untrusted cards: resolve deserializes the response without a card-size limit.
• Validate every supported_interfaces endpoint, binding, and protocol version before A2AClientFactory::create_from_card. Use no_defaults() and register only approved factories; preferred_bindings ranks candidates without excluding other bindings or fallback. Reject malformed versions before negotiation.
• Supply policy-configured clients to JsonRpcTransportFactory::new and RestTransportFactory::new as well as discovery. A custom discovery client does not configure the factory's default HTTP transports. For untrusted peers, add bounded response decoding through a custom Transport, including JSON-RPC version, request-ID, and result/error validation.
• Verify AgentCard.signatures with provider-trusted keys, allowed JWS algorithms, and the protocol's JCS canonicalization before relying on signed identity.