{ "schema": "computedriven-surface-v1", "_comment": "The frozen record this landing page is GENERATED from. Nothing on the emitted page may state a rung, a status, a count or a protocol fact that is not derived here or in a sibling record. launch-gate.mjs reads the emitted index.html and refuses to publish when the two disagree.", "version": "0.2.0", "origin": "https://a2atraffic.com", "repo": "https://github.com/c-u-l8er/a2atraffic.com", "surface": "A2A Traffic", "parent": "ComputeDriven", "tier": 3, "_tier_comment": "READ THE NAV, NOT THE TEMPLATE. ampersand-nav records a2atraffic as { name: 'A2A Traffic', place: 3, rung: null } and renderPlacement() emits the layer sentence only for place 2 — place 3 gets 'a specification in the ComputeDriven world'. Checked 2026-08-17 by reading ampersand-nav/src/amp-nav.js:761.", "_nav_rung_disagreement": "The nav entry carries rung: null, which renders as ?. Its inline comment explains why: 'a2atraffic is listed at Tier 3 in the plan but has no directory in this repository at all, so there is nothing to link and no rung to state.' That is still true of ProjectAmp2 — this repository lives in ~/Projects/, outside it. The surface measures spec (below), so ? is under-stated rather than over-stated, which is the safe direction. Only the nav lane may change that entry; it must not be hand-edited in the vendored copy.", "question": "What can the agent internet not say about itself?", "surface_rung": "spec", "rung_witness": "none", "_rung_witness_comment": "There is no witness and the page says so. This surface specifies an observatory; it collects nothing. The only thing on it that RUNS is the Agent Card inspector, which is client-side and is labelled live_local where it appears. Everything else is a reading of published documents, which is exactly what a spec rung permits.", "verified_at": "2026-08-17", "nav_property": "a2atraffic", "_nav_property_comment": "RULED BY TRAVIS 2026-08-17: 'the ampersand-nav needs to be on each website!'. This surface had zero before today (grep -c amp-nav index.html -> 0) and was one of the two surfaces the nav fan-out script cannot reach, because it is not in ProjectAmp2. The vendored amp-nav.js is the DEPLOYED revision: 52,272 bytes, md5 da32283e1004f540e6d01b59dd0aeeee, byte-identical to what runefort.com/amp-nav.js served on 2026-08-17. A vendored copy must not be hand-edited.", "_nav_unknown_key_acknowledged": "MEASURED 2026-08-17, do not clear without re-measuring. The vendored (= deployed) amp-nav.js does NOT contain the key a2atraffic — that entry was added later, in ampersand-nav commit 35667df, and has not been deployed. grep -c a2atraffic on the 52,272-byte vendored copy returns 0; on ampersand-nav/src/amp-nav.js it returns 3. Read at amp-nav.js:1524, the property attribute is passed to TEMPLATE(property) and is used only to mark the current item, so an unknown key does not empty the bar — it renders the full portfolio nav with nothing highlighted and no placement band. That is the honest degradation and it is what ships. It resolves itself when lane N deploys the newer nav; nothing in this repository should be changed for it, and the vendored copy must NOT be hand-edited to add the key.", "hosting": { "_comment": "Two measurements, both kept. The BEFORE state is why this section exists and must not be dropped now that it is fixed — a page that only shows the current number is not showing the retraction. Found because the inspector built for this page, pointed at this domain, returned 200 where the page had promised 404.", "unmatched_path_status": 404, "unmatched_path_content_type": "text/html; charset=utf-8", "unmatched_path_body": "the 404 page", "not_found_bytes": 1970, "not_found_bytes_measured_at": "2026-09-05", "_not_found_bytes_comment": "THE ONLY CURRENT-STATE BYTE COUNT FOR THE 404 IN THIS RECORD, and it is checked rather than trusted: launch-gate.mjs asserts it equals the actual byte size of the 404.html this build emits, so editing the 404 page and not re-measuring refuses the build. It exists because the number that used to live in unmatched_path_body — hand-typed, undated, present tense — went stale twice without anything noticing. It was 1,905 and CORRECT when written at commit fd387b4; commit 7acb1c9 changed the page to 1,956 bytes the same day and did not touch the record; serving the Agent Card changed it again to 1,970. The defect was never a wrong number, it was a number nothing re-derived. Measured against the deployed site with six consecutive calls, all 1970 B, byte-identical to the emitted file.", "before": { "when": "2026-08-17, before this build was deployed", "status": 200, "content_type": "text/html; charset=utf-8", "body": "the site's own index.html, served in full — 77,879 bytes", "measured": [ "curl https://a2atraffic.com/.well-known/agent-card.json -> 200, text/html, 77,879 bytes", "curl https://a2atraffic.com/nonexistent-xyz -> 200, text/html, 77,879 bytes" ] }, "after": { "when": "2026-08-17, immediately after deploying commit fd387b4", "status": 404, "content_type": "text/html; charset=utf-8", "body": "404.html, 1,905 bytes", "_body_comment": "1,905 is DATED and correct for `when` above — that is genuinely what commit fd387b4 served. Do NOT 'correct' it to the current size: it is the measurement that closed the finding, and the current size lives in not_found_bytes. The gate checks that this number and the three measured lines below agree with each other, so a half-correction is refused.", "measured": [ "curl https://a2atraffic.com/.well-known/agent-card.json -> 404, 1,905 bytes", "curl https://a2atraffic.com/nonexistent-xyz -> 404, 1,905 bytes", "curl https://a2atraffic.com/definitely-not-here-42 -> 404, 1,905 bytes" ] }, "fix": "404.html", "fix_status": "measured", "_fix_status_comment": "Was recorded 'unverified' when this page first shipped, because whether a root 404.html takes effect depends on Pages routing configuration the build cannot read. It was re-measured against the deployed site and it worked. Do NOT change this back to a prediction.", "portfolio_wide": false, "portfolio_wide_measured": "CLOSED 2026-08-17. Found here, fixed everywhere: 24 domains shipped a root 404.html and all 24 re-measured 404 — agentelic, agentromatic, bendscript, computedriven, delegatic, deliberatic, fleetprompt, geofleetic, graphonomous, opensentience, runefort, specprompt, ticktickclock, webhost.systems, ampersandboxdesign, wrand.cc, academy, pulse, weave, workbench, traaviis, code, trvm, wrl. docs.ampersandboxdesign.com and prism.opensentience.org already answered 404 and were left alone.", "_portfolio_wide_comment": "The finding stays recorded after being closed, because the fix is only checkable against the fault it repaired. Every apex and subdomain the shared nav knows answered HTTP 200 with its own homepage for any invented path; one file per site closed it, with no dashboard change anywhere. Deploy directories were verified by byte-size match against the live homepage rather than assumed — four sites deploy from site/, not the repo root, and workbench needed static/404.html because adapter-static would erase anything written into build/.", "why_it_matters_here": "For A2A specifically a 200 was worse than a 404. A client performing well-known discovery got a successful HTTP response whose body was an HTML page, and success plus wrong content is harder to handle correctly than an honest absence.", "portfolio_wide_history": "OPEN 2026-08-17, measured on 4 spot-checked siblings: runefort.com 200 (35,111 B) · fleetprompt.com 200 (41,975 B) · computedriven.com 200 (164,656 B) · specprompt.com 200 (38,795 B). Widened to 24 affected domains before the fix went out." }, "inspector_examples": { "_comment": "The Try: buttons under the inspector, generated from here and never hand-written into the template. Each carries what it DEMONSTRATES, because a button labelled only with a domain makes a correct 404 read as a broken tool — which is exactly what happened on 2026-09-05, when a2a-protocol.org's honest 404 was reported as something to fix. Two of these three demonstrate the same outcome and the page now says so.", "_staleness_comment": "These are measurements of THIRD-PARTY domains and can go stale without anything here noticing. launch-gate.mjs can check that the page matches this record; it cannot check that this record still matches someone else's server. That is why measured_at is printed on the page rather than kept in the file, and why the labels say what each domain IS rather than only what it returned.", "measured_at": "2026-09-05", "items": [ { "url": "https://a2atraffic.com", "label": "a2atraffic.com", "shows": "this site \u2014 a signed card", "measured": "200, card verified" }, { "url": "https://a2a-protocol.org", "label": "a2a-protocol.org", "shows": "the spec's own docs site, not an agent \u2014 no card", "measured": "404 at the discovery path and at the superseded one" }, { "url": "https://example.com", "label": "example.com", "shows": "no agent at all", "measured": "404" } ] }, "a2a_endpoint": { "_comment": "The interface supportedInterfaces[0] declares. This record is what makes serve_agent_card legitimate: a card at the discovery path is a promise that the URL it names will answer, and these measurements are that the promise is good. Every line below was taken against https://a2atraffic.com after the deploy, never against a local run — an earlier reading of these same paths caught a mixed rollout serving the previous error shape, so they were re-taken until six consecutive calls agreed.", "url": "https://a2atraffic.com/a2a/json", "protocol_binding": "HTTP+JSON", "protocol_version": "1.0", "implementation": "Cloudflare Pages Functions, functions/a2a/. No storage is bound to it, by choice.", "declared_unanswered_for": "19 days", "_declared_unanswered_for_comment": "The card declared this URL from 2026-08-17, when the draft was written, to 2026-09-05, when it began to answer. Through that window the card was NOT at the discovery path, which is the only reason declaring it was not a false promise.", "measured_at": "2026-09-05", "derived_from": "Paths are the google.api.http annotations on a2a.proto's A2AService (a2a.proto:23-135), taken relative to the interface URL. Media types and the error shape are §11.6 and the worked examples in §6 of a2a-protocol.org/latest/specification/, re-read 2026-09-05. See protocol.json:drift_2026_09_05 for what that re-reading corrected, and for one correction it nearly made in the wrong direction.", "methods_note": "The agent holds no state, so it creates no Tasks: SendMessage answers with a Message, the arm of SendMessageResponse's oneof that promises nothing retrievable. ListTasks returns an empty page because the list IS empty, and GetTask returns TaskNotFoundError because no id has ever been issued. Those are true answers, not stubs.", "implemented": [ { "method": "SendMessage", "http": "POST /message:send" }, { "method": "ListTasks", "http": "GET /tasks" }, { "method": "GetTask", "http": "GET /tasks/{id}" }, { "method": "CancelTask", "http": "POST /tasks/{id}:cancel" } ], "refused": [ { "method": "SendStreamingMessage", "error": "UnsupportedOperationError", "because": "capabilities.streaming is false" }, { "method": "SubscribeToTask", "error": "UnsupportedOperationError", "because": "capabilities.streaming is false" }, { "method": "CreateTaskPushNotificationConfig", "error": "PushNotificationNotSupportedError", "because": "capabilities.pushNotifications is false" }, { "method": "GetExtendedAgentCard", "error": "ExtendedAgentCardNotConfiguredError", "because": "capabilities.extendedAgentCard is false" } ], "limits": [ "It holds no state, so nothing it says can depend on anything you said before.", "It has no model. Requests reach a skill by keyword match, not by understanding, and an unmatched request says so and lists what it can answer rather than guessing.", "It answers only out of /records/*.json — the same published records this page is generated from, read at request time over this origin's own asset store, so the agent and the page cannot disagree.", "The card IS signed (ES256, A2A \u00a78.4, key at /.well-known/jwks.json) — but the verifying key is published on the same domain as the card, so the signature proves the card has not changed since signing, not who signed it. Anyone able to serve you a forged card could serve a forged key beside it. TLS carries the domain binding; the signature is not a second opinion about the same channel." ], "measured": [ { "what": "the interface base URL — not an A2A method, a human-readable descriptor", "curl": "-sS -o /dev/null -w '%{http_code} %{content_type}' https://a2atraffic.com/a2a/json", "got": "200 application/json" }, { "what": "ListTasks — an empty page, because the list is empty", "curl": "-sS https://a2atraffic.com/a2a/json/tasks", "got": "200 application/a2a+json {\"tasks\": [], \"nextPageToken\": \"\", \"pageSize\": 50, \"totalSize\": 0}" }, { "what": "GetTask — no id has ever been issued, in the google.rpc.Status shape §11.6 requires", "curl": "-sS https://a2atraffic.com/a2a/json/tasks/task-123", "got": "404 application/a2a+json error.status NOT_FOUND, details[0].reason TASK_NOT_FOUND, domain a2a-protocol.org" }, { "what": "SendStreamingMessage — refused by the capability the card declares false", "curl": "-sS -X POST https://a2atraffic.com/a2a/json/message:stream", "got": "400 application/a2a+json UNSUPPORTED_OPERATION" }, { "what": "SendMessage — an example the card advertises, answered out of records/gap-matrix.json", "curl": "-sS -X POST https://a2atraffic.com/a2a/json/message:send -H 'content-type: application/a2a+json' -d '{\"message\":{\"messageId\":\"1\",\"role\":\"ROLE_USER\",\"parts\":[{\"text\":\"Score MCP against the governance taxonomy.\"}]}}'", "got": "200 application/a2a+json role ROLE_AGENT, skill gap-matrix, and the answer carries the preprint caveat with it" } ] }, "serve_agent_card": true, "_serve_agent_card_comment": "[TRAVIS] FLIPPED 2026-09-05, after a2a_endpoint above was measured against the deployed site and not before. When false, records/agent-card.draft.json stays a draft and the page states the measured hosting behaviour above rather than promising an absence it cannot deliver. When true, build-site.mjs emits the card at the discovery path with its _-prefixed keys stripped and the 'our own card' section switches to its served branch. The rule that governed this for 19 days still governs it: do not flip until an endpoint answers an A2A task method. It answers. See PLAN.md 3.2.", "status": { "statement": "This surface observes the A2A protocol, not your traffic. It publishes what the specification says, re-derived from primary sources on 2026-08-17; what a governance assessment finds the protocol structurally cannot express; and a count of the A2A messages it has itself witnessed, which is zero.", "source": "records/protocol.json was derived from a2a-protocol.org/latest and a2aproject/A2A@main/specification/a2a.proto. records/gap-matrix.json was re-read from arxiv.org/html/2606.31498v1 Table II and Table III. records/witness.json is zero because there is no collector.", "limit": "There is no product. Nothing here proxies, captures, traces or stores A2A traffic, and no agent has been instrumented to report to this domain. The capability cards in the design section are proposed and labelled; none is implemented. The gap matrix is one preprint's reading of one version of five protocols, not our re-scoring of them, and the preprint is not peer-reviewed." }, "removed_2026_08_17": [ "99.97% Uptime — fabricated; no runtime existed to have uptime", "Messages/sec, Active Agents, Avg Latency — animated from seeds 12,400 / 847 / 23ms in animateStats(); rendered 0 0 0 with JS off", "GET /.well-known/agent.json with streaming: true — wrong path for v1.0 AND a falsifiable endpoint claim", "Every agent in the [&] portfolio speaks A2A — an unwitnessed universal", "Transparent proxy layer captures all JSON-RPC messages / No code changes required / From Deploy to Insight in Minutes — present tense about a product that does not exist", "MONITORING LIVE A2A TRAFFIC badge over a decorative canvas", "100+ Partners in a strip that read as ours — recaptioned as the A2A ecosystem and corrected to the sourced 150+", "Documentation and Changelog footer links pointing at #" ], "deferred": { "compose_ledger": "Blocked on the [TRAVIS] shared-facts ruling and on a COMPOSE record existing. See records/witness.json compose_seam.", "wrl_block": "Blocked on the grammar freeze, same dependency as every other surface's WRL block.", "replay_hero": "The canvas graduates from labelled simulation to replay of a real receipt when a receipt exists. There are none." } }