[josemontespg]

Summary

Adds the JSON Schema for the iframe catalog, so agents, renderers and validators share one canonical definition of the sandboxed web frame components instead of the copy that lives in the ADK MCP app proxy sample. The catalog targets A2UI v1.0: protocolVersion is 1.0 and the shared shapes come from specification/v1_0. The MCP catalog's McpApp schema is a separate PR on top of this stack.

Changes

• catalogs/iframe/catalog.json ($id https://a2ui.org/specification/v1_0/catalogs/iframe/catalog.json) declares WebAppFrameUrl and WebAppFrameSrcdoc. The shared properties (allowedEvents, allowedFunctions, mutableData, data.paths, config, height, disableSchemaValidation) are inlined into both components, as the v1.0 Catalog Schema Rules require: no ComponentCommon allOf or unevaluatedProperties, relative common_types.json#/$defs/... refs, and $defs with only anyComponent (with discriminator) and anyFunction. The catalog has no functions.
• specification/v1_0/test/run_tests.py: registers catalogs/iframe/catalog.json in the structural, identifier and $ref target checks.
• The component specification moves from the Angular MCP calculator sample to catalogs/iframe/web_app_frame_specification.md.
• Three v1.0 examples: a WebAppFrameSrcdoc app with two-way data binding and an action next to basic components, a WebAppFrameUrl frame, and a WebAppFrameSrcdoc app that calls formatCurrency through allowedFunctions. The inline HTML speaks the documented a2ui_* protocol.
• specification/scripts/validate.py validates the examples against agent_to_renderer.json with the v1 basic catalog. Since a surface combines this catalog with the basic catalog, a config can now list several catalogs, which are merged into the single catalog.json alias the message schema expects, and a protocol_version key decouples the config name from the protocol version.
• .github/workflows/docs.yml publishes the catalog and its examples at specification/v1_0/catalogs/iframe/, so the $id URL resolves.
• catalogs/iframe/README.md documents the components and links the specification and examples; catalogs/README.md lists the new directory.

Verification

• python3 specification/scripts/validate.py: all configs pass, including the new iframe one (3 examples). Switching an example's version back to v0.9 makes it fail.
• python3 specification/v1_0/test/run_tests.py passes.
• ./scripts/fix_format.sh --check passes; every relative link in the added or moved markdown files resolves.

Pre-launch Checklist

• I read the Contributors Guide.
• My code changes have tests (schema and examples are covered by validate.py).

Related to #3157

[gemini-code-assist]

Code Review

This pull request introduces the iframe catalog (featuring WebAppFrameUrl and WebAppFrameSrcdoc components) and updates the MCP catalog to include the McpApp component, along with corresponding specifications, examples, and validation script updates. The review feedback suggests two key improvements: first, updating WebAppFrameSrcdoc's htmlContent to use DynamicString for consistency and dynamic data binding support; second, adding a mutableData property to McpApp to validate incoming state mutations against a JSON Schema, thereby enhancing security and aligning it with WebAppFrame's validation model.