UAT: CLI bypasses A2A protocol in local mode #6274

New issue

Open

opened 2026-04-09 19:45:55 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-09 19:45:55 +00:00

Owner

Summary

CLI commands call application services directly instead of sending JSON-RPC requests through the A2A facade, so local mode bypasses the protocol boundary.
_notify_facade is explicitly best-effort; even if the facade is absent or fails, operations continue via direct service calls, contradicting the spec requirement that every client operation flows through A2A.

Spec references

docs/specification.md §§23536-23595: "CleverAgents adopts the Agent-to-Agent Protocol ... No client ever bypasses A2A ... Every CLI command listed ... sends a _cleveragents/... JSON-RPC request through the active transport."
docs/specification.md §§23600-23605: "In local mode ... Client spawns agent as subprocess; JSON-RPC messages flow over stdin/stdout. Platform extension methods are resolved via A2aLocalFacade."

Evidence

# src/cleveragents/cli/commands/plan.py
service = _get_lifecycle_service()
plan = service.use_action(...)
_notify_facade("plan.create", {...})  # best-effort; failures are ignored

def _notify_facade(...):
    """Best-effort A2A facade notification... If the facade is not available or fails, the operation continues via direct service calls."""

# src/cleveragents/cli/commands/session.py
service = _get_session_service()
session = service.create(...)
_facade_dispatch(...)  # only for telemetry after the direct service call

These code paths create plans and sessions entirely through container-resolved services, with the A2A facade only invoked after the fact and allowed to fail silently. No agent subprocess or stdio transport is involved.

Impact

The CLI bypasses the A2A boundary, so behavior diverges from the documented architecture. Tests of the A2A protocol in local mode cannot rely on CLI usage, and future transports (TUI/IDE) cannot reuse the CLI flow.

Suggested Fix

Route CLI commands through an actual stdio A2A client/agent subprocess so that JSON-RPC requests go through A2aLocalFacade, and remove direct container service access paths that bypass the protocol.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Summary - CLI commands call application services directly instead of sending JSON-RPC requests through the A2A facade, so local mode bypasses the protocol boundary. - `_notify_facade` is explicitly best-effort; even if the facade is absent or fails, operations continue via direct service calls, contradicting the spec requirement that *every client operation flows through A2A*. ## Spec references - docs/specification.md §§23536-23595: "CleverAgents adopts the Agent-to-Agent Protocol ... No client ever bypasses A2A ... Every CLI command listed ... sends a `_cleveragents/...` JSON-RPC request through the active transport." - docs/specification.md §§23600-23605: "In local mode ... Client spawns agent as subprocess; JSON-RPC messages flow over stdin/stdout. Platform extension methods are resolved via `A2aLocalFacade`." ## Evidence ```python # src/cleveragents/cli/commands/plan.py service = _get_lifecycle_service() plan = service.use_action(...) _notify_facade("plan.create", {...}) # best-effort; failures are ignored ``` ```python def _notify_facade(...): """Best-effort A2A facade notification... If the facade is not available or fails, the operation continues via direct service calls.""" ``` ```python # src/cleveragents/cli/commands/session.py service = _get_session_service() session = service.create(...) _facade_dispatch(...) # only for telemetry after the direct service call ``` These code paths create plans and sessions entirely through container-resolved services, with the A2A facade only invoked after the fact and allowed to fail silently. No agent subprocess or stdio transport is involved. ## Impact - The CLI bypasses the A2A boundary, so behavior diverges from the documented architecture. Tests of the A2A protocol in local mode cannot rely on CLI usage, and future transports (TUI/IDE) cannot reuse the CLI flow. ## Suggested Fix - Route CLI commands through an actual stdio A2A client/agent subprocess so that JSON-RPC requests go through `A2aLocalFacade`, and remove direct container service access paths that bypass the protocol. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

Rows
Columns