Finding — the A2A dependency gap

Found while acting on Young's "only report if error" request: I read the cron list to make the backup quiet, and the restore-proof job had been failing for a day. Chasing that failure surfaced a second, more important one.

What was wrong

a2a-sdk==1.2.2 is installed, but its declared runtime dependencies were not:

Consequence: any module that touches the real A2A wire types failed to import — from a2a.types.a2a_pb2 import CancelTaskRequest → ModuleNotFoundError: No module named 'google'. That took out 7 tests: 1 in test_observability.py, 6 in test_stage3_4_corrections.py — i.e. exactly the tests that prove the A2A cancel and streaming paths. The SDK was importable at the top level, so nothing noticed.

The tell: the failures were IDENTICAL on the live tree and the restored clone. That is what separated "the backup is broken" from "the code env is broken" — the restore rehearsal earned its keep by surfacing a live defect it did not cause.

Why it went unseen

• a2a.types was never imported on the happy path, so the missing deps were invisible.
• Tests that DID import it were skipped or passed on a different interpreter.
• The restore-proof's own python probe (fixed the same day) was masking it further by reporting its environment as a backup failure.

The fix, applied

Installed the declared set into the Hermes toolchain interpreter (~/.hermes/tools/python-*/bin/python3) via uv pip install --python: a2a-sdk==1.2.2 + pydantic httpx json-rpc packaging protobuf google-api-core googleapis-common-protos + starlette uvicorn sse-starlette.

Verified: from a2a.types.a2a_pb2 import CancelTaskRequest, SendMessageRequest and from operation.runtime.a2a_server import V3RequestHandler both import; the full suite is 457 passed, 2 skipped, 2 xfailed; the two affected test files go from 7 failed → 45 passed.

What this implies (for the register, not for me to fix)

1. The env has no lockfile. There is no requirements.txt / pyproject.toml in the code tree, so "457 passed" was true only on a machine where deps happened to be present. A clean env cannot reproduce it — which is precisely what a restore proof is supposed to catch, and did.
2. a2a-sdk should be installed with its extra, not bare: a2a-sdk[http-server]==1.2.2. Bare install leaves the HTTP surface (starlette) out.
3. Suggested owner: Sol (code env / architecture). This is his lane; I applied the minimal fix to unblock the proof and am reporting it, not claiming it.

Honest limits

• I fixed the environment, not the root cause (no lockfile). The gap will recur on any fresh machine until the deps are pinned in the repo.
• I did not add the lockfile — that is a code-tree change in Sol's lane.