A2A 生产就绪检查：测试、观测与回滚

#!/usr/bin/env bash
set -euo pipefail

: "${A2A_CARD_URL:?Set A2A_CARD_URL to the public Agent Card URL}"

case "$A2A_CARD_URL" in
  https://*) ;;
  *) printf 'ERROR: production Agent Card URL must use HTTPS\n' >&2; exit 1 ;;
esac

work_dir="$(mktemp -d)"
cleanup() { rm -rf "$work_dir"; }
trap cleanup EXIT HUP INT TERM

status="$({ curl --silent --show-error --location \
  --proto '=https' --tlsv1.2 \
  --connect-timeout 5 --max-time 15 \
  --dump-header "$work_dir/headers" \
  --output "$work_dir/card.json" \
  --write-out '%{http_code}' \
  "$A2A_CARD_URL"; } 2>"$work_dir/curl.error")" || {
    cat "$work_dir/curl.error" >&2
    exit 1
  }

if [[ "$status" != "200" ]]; then
  printf 'ERROR: Agent Card returned HTTP %s\n' "$status" >&2
  exit 1
fi

content_type="$(tr -d '\r' < "$work_dir/headers" \
  | awk -F ': *' 'tolower($1) == "content-type" {print tolower($2)}' \
  | tail -n 1)"
case "$content_type" in
  application/json*) ;;
  *) printf 'ERROR: expected application/json, got %s\n' "${content_type:-missing}" >&2; exit 1 ;;
esac

jq -e '
  type == "object"
  and ([.name, .description, .version] | all(type == "string" and length > 0))
  and (.supportedInterfaces | type == "array" and length > 0)
  and (.skills | type == "array" and length > 0)
  and all(.supportedInterfaces[];
    (.protocolBinding == "GRPC" and (.url | test("^([^/:]+|\\[[0-9A-Fa-f:]+\\]):[0-9]+$")))
    or (.protocolBinding != "GRPC" and (.url | startswith("https://"))))
  and ((.securitySchemes // {}) as $schemes
    | [(.securityRequirements // [])[]?.schemes? | keys[]] as $refs
    | ($refs | all(. as $name | $schemes | has($name))))
' "$work_dir/card.json" >/dev/null

digest="$(shasum -a 256 "$work_dir/card.json" | awk '{print $1}')"
printf 'OK: HTTP 200, JSON contract and production interfaces passed\n'
printf 'card_sha256=%s\n' "$digest"
jq -r '.supportedInterfaces[] | "interface=\(.protocolBinding) \(.protocolVersion) \(.url)"' \
  "$work_dir/card.json"

A2A_CARD_URL='https://agent.example/.well-known/agent-card.json' \
  bash production-preflight.sh

timestamp, release_id, protocol_version, binding, operation,
request_id, trace_id, task_id, context_id, tenant_id,
caller_subject_hash, outcome, protocol_error, duration_ms

release_id: "git-sha-or-artifact-digest"
protocol_version: "1.0"
tested_at: "2026-10-25T12:00:00Z"
agent_card_url: "https://agent.example/.well-known/agent-card.json"
agent_card_sha256: "..."
bindings: ["HTTP+JSON"]
capabilities: ["streaming"]
checks:
  discovery: pass
  authentication: pass
  authorization_isolation: pass
  task_lifecycle: pass
  streaming_recovery: pass
  push_security: not_applicable
  overload_restart: pass
rollback_artifact: "previous-release-id"
owner: "team-or-role"