Add native A2A Echo and Copilot web-search travel samples by Hameedkunkanoor · Pull Request #1144 · microsoft-foundry/foundry-samples

Hameed Kunkanoor (Hameedkunkanoor) · 2026-11-06T07:43:41Z

Purpose

Add two native A2A Python hosted-agent samples for inclusion in the public sample
repository. This branch starts from upstream main, not from the larger sharing PR.

Sample	Purpose
`bring-your-own/a2a/echo`	Deterministic Echo in an actual completed A2A Task; native GetTask examples; no model or Toolbox.
`bring-your-own/a2a/travel-planner-web-search`	Copilot SDK Planner discovers Flight/Hotel Cards and delegates directly over A2A. Specialists consume bounded Toolbox web search; cited trip research is saved in versioned user-isolated storage.

Includes these two samples, their shared behavior fixtures, sample-index links,
and shared CI support needed to validate and run native A2A.
No Support Case sample, synthetic non-web-search travel sample, standalone
bug-bash guide, deployment-specific environment, logs or saved plans.

Architecture

Native A2A 1.0 hosts and clients; validate advertised interfaces and trusted
endpoints before attaching credentials.
Travel specialists use Copilot SDK native MCP for Foundry Toolbox web search.
No Toolbox A2A delegation or direct model HTTP implementation.
At most two search attempts per specialist invocation; at least one successful
cited search is required. Failed/source-less attempts remain in receipts.
Request-scoped caller context and W3C trace propagation, including restoration
across the planner's custom-tool callback boundary.
Versioned FoundryStateStore trip requirements, metadata and recommendation
history; user isolation, 30-day default TTL, ETag/version conflict protection.
Specialist evidence is bound to the plan ID/version captured before delegation,
so late results cannot clear a newer revision's pending refresh.
Saved research is unverified: no claim of exact-date fares, availability,
cancellation eligibility, booking or payment.
Actual Planner/specialist Task IDs appear in readable output; structured
operation receipts remain compact.
All four runtimes use public PyPI AgentServer A2A 1.0.0b1 and Core 2.3.1b1,
with genuine per-runtime locks.

Web Search is billed and uses Bing grounding services; the README includes the
data-handling and geographic/compliance-boundary disclosures.

Native A2A CI support

Contract validation and planning accept native A2A 1.0 without a skiplist or
fake Responses declaration.
Discovery emits both container and code matrix cells for Echo and Travel.
A transport-specific helper sends blocking SendMessage requests through azd,
using the cell's explicit session and A2A 1.0 wire version. It validates
JSON-RPC IDs/errors, completed Task state and artifact text, including
HTTP-200/CLI-exit-zero failures; request, headers and raw evidence are retained.
Travel's fixture selects the planner. CI preserves and uniquely names all
three service/source projects, wires the specialists' own endpoints, and
uses the existing temporary-toolbox isolation/verification/cleanup lifecycle.
Existing Responses approval/continuation and Invocations behavior is preserved.

Validation

111 shared CI/contract/fixture Python regressions passed: 92 hosted-agent
harness tests, 17 contract-policy tests and 2 published-fixture tests.
Both existing session/quota and toolbox-lifecycle shell suites passed.
Actual discovery emitted all four expected native-A2A cells: Echo and Travel,
each with container and code deploy modes.
The previously failing contract-policy command validates both new samples.
Both native-A2A fixture plans build successfully. Ruff, new-file Black
formatting, Bash syntax and whitespace checks passed.
Earlier sample review fixes passed 25 offline regressions with the locked
public beta SDK runtime, including in-flight stale research rejection.
Echo executor was checked for exact Echo: hello, completed Task and explicit
unsupported cancellation in the public-beta runtime. Runtime dependency policy
previously passed with --resolve for both samples; no dependency changes
are introduced by this CI fix.
The travel implementation before the review fixes was deployed with public
betas to the existing test project (Flight/Hotel v2, Planner v3). Six
execution/storage checks completed while reusing one CLI session. This is
historical evidence, not a cloud deployment of the new review or CI changes.
Offline native runner tests mock azd responses; they do not establish live
project enablement, model availability, runtime permissions or a fresh cloud
end-to-end pass. Live cloud execution remains subject to the normal trusted
pipeline and configured project prerequisites.

Known limitations

Research-quality findings remain: some model prose reduced arrival deadlines to
clock-only comparisons, and clarification offered options unsupported by the
current trip schema. Repeating an unchanged update can also leave a tool failure
recorded even if later research saves succeed. Exact-price booking behavior,
forced restarts and cross-user cloud isolation are not claimed as verified.

Sharing PR is preserved

PR #1126 and feature/a2a-llm-release-planner remain unchanged by these fixes for
users to share and run the bug-bash guide. This PR remains the separate merge proposal.

Hosted Echo public-beta verification

Echo now uses AgentServer A2A 1.0.0b1 and Core 2.3.1b1 from public PyPI in both PRs. A fresh direct-code hosted deployment passed native SendMessage with exactly Echo: hello in a completed Task. GetTask with the same caller/session returned the identical stored Task, including artifacts, history and status; X-Platform-Server confirmed both beta SDK versions. The runtime and lock were verified identical across both branches and the deployment before pushing. Only Echo was redeployed for this check, not Travel. Dependency-policy validation with --resolve passed; 94 shared runner regressions passed. This does not establish the cause of the separately reported deployment's downstream 400 without its session logs, nor claim cross-user isolation or restart recovery.

Include only deterministic Echo and direct A2A travel research with bounded Toolbox web search and versioned user-isolated saved plans. Use public beta SDKs, sample documentation and shared behavior fixtures; exclude the standalone bug-bash guide and Support Case sample. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

azure-pipelines · 2026-11-06T07:43:51Z

Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run.

Copilot

🟡 Changes recommended

Stale specialist completions can clear needs_replan after requirements change, allowing outdated research to be accepted for a newer plan revision.

3 open issues

What changed in this PR

Adds two native A2A Python examples to the hosted-agent samples: a deterministic Echo agent and a Copilot SDK travel planner that delegates web research to Flight and Hotel specialists.

Changes:

Adds native A2A hosts, deployment manifests, pinned dependencies, and request examples.
Implements bounded web search, authenticated specialist delegation, and versioned, user-isolated trip storage.
Documents deployment and research limitations, adds sample-index links, and supplies behavior fixtures. The shared cloud runner does not yet support native A2A.

File	Description
`samples/python/hosted-agents/README.md`	Links both native A2A samples.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/trip-request.json`	Provides a public-criteria travel request.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/toolbox.json`	Defines the web-search-only toolbox.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/travel-agent/tools.py`	Exposes specialist delegation tools with trace propagation.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/travel-agent/pyproject.toml`	Pins planner runtime dependencies.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/travel-agent/plan_store.py`	Implements versioned trip storage and research validation.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/travel-agent/main.py`	Hosts the planner and emits Task and storage receipts.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/travel-agent/client.py`	Coordinates Copilot, specialists, and isolated storage.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/travel-agent/agents.py`	Validates endpoints and discovers authenticated specialist Cards.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/travel-agent/.azdignore`	Excludes local planner artifacts from deployment.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/travel-agent/.agentignore`	Excludes local planner artifacts from agent packaging.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/hotel-agent/pyproject.toml`	Pins hotel runtime dependencies.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/hotel-agent/main.py`	Hosts the hotel research specialist.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/hotel-agent/client.py`	Runs bounded hotel searches and records source evidence.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/hotel-agent/.azdignore`	Excludes local hotel artifacts from deployment.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/hotel-agent/.agentignore`	Excludes local hotel artifacts from agent packaging.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/flight-agent/pyproject.toml`	Pins flight runtime dependencies.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/flight-agent/main.py`	Hosts the flight research specialist.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/flight-agent/client.py`	Runs bounded flight searches and records source evidence.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/flight-agent/.azdignore`	Excludes local flight artifacts from deployment.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/src/flight-agent/.agentignore`	Excludes local flight artifacts from agent packaging.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/README.md`	Documents architecture, deployment, storage, and search limitations.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/azure.yaml`	Configures three hosted agents and their model deployment.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/AGENTS.md`	Documents travel sample development and safety constraints.
`samples/python/hosted-agents/bring-your-own/a2a/travel-planner-web-search/.gitignore`	Excludes generated workspace files and environment settings.
`samples/python/hosted-agents/bring-your-own/a2a/echo/src/echo-a2a/pyproject.toml`	Pins Echo runtime dependencies.
`samples/python/hosted-agents/bring-your-own/a2a/echo/src/echo-a2a/main.py`	Returns deterministic Echo artifacts in completed Tasks.
`samples/python/hosted-agents/bring-your-own/a2a/echo/src/echo-a2a/.azdignore`	Excludes local Echo artifacts from deployment.
`samples/python/hosted-agents/bring-your-own/a2a/echo/src/echo-a2a/.agentignore`	Excludes local Echo artifacts from agent packaging.
`samples/python/hosted-agents/bring-your-own/a2a/echo/README.md`	Documents deployment, local execution, and Task retrieval.
`samples/python/hosted-agents/bring-your-own/a2a/echo/get-task.json`	Provides a native GetTask request.
`samples/python/hosted-agents/bring-your-own/a2a/echo/echo-request.json`	Provides a native SendMessage request.
`samples/python/hosted-agents/bring-your-own/a2a/echo/azure.yaml`	Configures direct hosted Echo deployment.
`samples/python/hosted-agents/bring-your-own/a2a/echo/AGENTS.md`	Documents Echo development constraints.
`samples/python/hosted-agents/bring-your-own/a2a/echo/.gitignore`	Excludes generated files and local state.
`.azure-pipelines/hosted-agent-tests/python/bring-your-own/a2a/travel-planner-web-search/test-spec.yml`	Defines intended cited-research behavior.
`.azure-pipelines/hosted-agent-tests/python/bring-your-own/a2a/echo/test-spec.yml`	Defines deterministic Echo behavior.

_{Review effort: Balanced}

Bind specialist evidence to the plan ID and version captured before delegation. Accept partial cited-search success while preserving bounded attempts and all receipts, and allow additional successful delegations in the cloud fixture. Add offline regressions and document the research binding. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

🟡 Changes recommended

The toolbox URL validation permits path traversal outside the configured project before credentials are attached, while metadata-only edits and recovered retries can incorrectly report failed tasks.

3 open issues

3 resolved since last review

_{Review effort: Balanced}

Validate native A2A 1.0 contracts and collect checked JSON-RPC Task artifact evidence through the shared runner. Preserve multi-agent deployments with explicit target, specialist endpoint bindings and cell-owned toolbox lifecycle. Add policy, transport, runner and toolbox integration regressions; keep existing Responses and Invocations behavior. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Hameed Kunkanoor (Hameedkunkanoor) · 2026-11-06T16:35:25Z

Fixed the native-A2A CI blocker in 755c0ce. The previously failing Hosted-agent contract policy now passes, and all executed GitHub checks on this commit are green. This adds real A2A 1.0 Task/artifact validation, preserves all three Travel services with explicit specialist endpoint bindings, and uses the existing temporary-toolbox lifecycle rather than a skiplist or fake Responses protocol. Local validation: 111 Python CI regressions, both existing shell suites, and actual discovery of all four Echo/Travel code/container cells passed. This does not claim a new live Foundry deployment; the cloud validation job remains skipped under the normal pipeline gating.

Copilot

🟡 Changes recommended

The CI setup omits the planner managed identity’s required project-scoped Foundry Agent Consumer grant, blocking protected specialist discovery and invocation on clean deployments.

6 open issues

_{Review effort: Balanced}

Verify completed Echo artifact and exact saved Task retrieval in a fresh hosted deployment. Separate only recognized azd update notices from raw JSON-RPC evidence; preserve protocol errors and reject unexpected trailing output. Add regressions for the actual CLI output shape. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

CLI stderr is omitted from persisted diagnostics, bypassing quota/readiness retries, while stale specialist failure records cause successful retries to return failed tasks.

6 open issues

_{Review effort: Balanced}

Return failed Tasks without rethrowing, preserve partial planner and failed-specialist receipts, clear recovered specialist failures and align public Agent Cards. Correct service-key cleanup, GitHub init prerequisites and RBAC cache hints. Include sharing-branch backports of partial-search success and version-bound research, with real SDK failed Task send/list/get regressions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Hameed Kunkanoor (Hameedkunkanoor) · 2026-11-09T03:16:22Z

Implemented the sample-side bug-bash fixes: failed Tasks now return normally after updater.failed(), partial planner state and separate failed-specialist receipts are retained, recovered specialist retries clear only matching failures, and public AgentCard metadata matches the manifests. Cleanup uses service keys with explicit --force guidance; setup documents GitHub authentication and masked Card 404/observed auth-cache behavior. Validation: 19 focused regressions pass with the existing public beta SDKs, including real handler SendMessage/ListTasks/GetTask roundtrips for failed Tasks; five existing compact-output regressions also pass. The same runtime fixes and earlier search/version-binding fixes are backported to sharing PR #1126. No SDK source changes or new cloud deployment; upstream CLI/platform defects remain tracked separately.

Copilot

🔵 Needs a closer look

A critical URL-validation flaw can send bearer credentials and caller headers to another project through dot-segment paths, while lost stderr diagnostics also prevent quota retries.

5 open issues

1 resolved since last review

Recovered delegation failures still cause the request to fail

_{Review effort: Balanced}

Hameed Kunkanoor (Hameedkunkanoor) · 2026-11-09T10:12:20Z

Hosted deployment validation completed for the latest bug-bash fixes (7301d99 runtime, also present in sharing PR 45c9459). Existing test project: Flight v3, Hotel v3, Planner v4; Echo v2. Normal planning and revised-date research completed and saved unverified results with both actual specialist Tasks; each initial specialist recorded two successful web searches. Read-only and metadata-only requests had no specialist calls; direct datastore snapshots proved recommendation/requirements preservation. A real storage failure returned TASK_STATE_FAILED with retained get_plan error receipts, and GetTask returned the identical failed Task. A separate model content-filter failure was returned as a failed Task, retrievable by GetTask and visible in ListTasks. A successful metadata write followed by a storage failure retained both write and error receipts. Final plan version 6/revision 2/history 6. Live Cards match aligned metadata; Echo returned exactly Echo: hello. No roles, model or toolbox changed. Retry recovery and mixed search receipts remain deterministic-local-test coverage, not live fault injection; no restart/cross-user or booking claims. Raw evidence and assertions are retained locally in results/bugfix-live-nov9.

Copilot

🟡 Changes recommended

The runner does not recognize the saved A2A diagnostic for Model rate limit exceeded, so it stops after one attempt instead of applying bounded throttling retries; the classifier needs a fix and a runner-level regression test.

1 open issue

Retry A2A model rate-limit errors · New

3 resolved since last review

_{Review effort: Balanced}

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

An unpublished moderate-severity finding indicates that retryable JSON-RPC throttling errors can stop after one attempt, requiring human assessment.

No open issues 🎉

1 resolved since last review

Retry A2A model rate-limit errors

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

The retry classifier misses HTTP 429 within A2A service-error diagnostics, causing throttled invocations to stop after one attempt instead of using bounded retries.

1 open issue

Retry A2A task failures reporting HTTP 429 · New

_{Review effort: Balanced}

Apply bounded throttling retries to failed-Task and JSON-RPC HTTP 429 messages without scanning successful artifacts. Cover recovery, retry exhaustion, and nonmatching prose/status codes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

Offline mocks cannot establish deployment behavior, persistent RBAC propagation, or specialist/toolbox isolation for the new multi-agent lifecycle, so trusted-cloud maintainer verification is needed.

No open issues 🎉

1 resolved since last review

Retry A2A task failures reporting HTTP 429

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

Active issues can expose sensitive provider or tool diagnostics in logs and prematurely terminate retries for sessions that are still being provisioned.

2 open issues

Exception logs expose sensitive diagnostics · New
Readiness errors are treated as terminal · New

_{Review effort: Balanced}

Copilot

🔵 Needs a closer look

Maintainer validation in the trusted Azure pipeline is needed to verify persistent RBAC grants, deployment-version isolation, and toolbox cleanup beyond what offline mocks can establish.

No open issues 🎉

2 resolved since last review

_{Review effort: Balanced}

Hameed Kunkanoor (Hameedkunkanoor) · 2026-11-11T15:59:28Z

Created repository-branch replacement PR #1158 with the exact same head commit (4e60cda). Its source branch is in microsoft-foundry/foundry-samples rather than the contributor fork. Please use #1158 for subsequent review and CI. Leaving this PR open for history until the replacement is confirmed.

Hameed Kunkanoor (Hameedkunkanoor) requested a review from a team as a code owner November 6, 2026 07:43

Copilot AI balanced review requested due to automatic review settings November 6, 2026 07:43

Hameed Kunkanoor (Hameedkunkanoor) temporarily deployed to L4-validation November 6, 2026 07:44 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Hameed Kunkanoor (Hameedkunkanoor) November 6, 2026 07:44

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings November 6, 2026 09:58

Hameed Kunkanoor (Hameedkunkanoor) temporarily deployed to L4-validation November 6, 2026 09:59 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Hameed Kunkanoor (Hameedkunkanoor) November 6, 2026 09:59

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings November 6, 2026 16:33

Hameed Kunkanoor (Hameedkunkanoor) temporarily deployed to L4-validation November 6, 2026 16:33 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Hameed Kunkanoor (Hameedkunkanoor) November 6, 2026 16:34

View session

Copilot AI reviewed Nov 6, 2026

View reviewed changes

Comment thread .azure-pipelines/scripts/hosted-agents/scripts/prepare_hosted_agent_a2a.py Resolved

Comment thread .azure-pipelines/scripts/hosted-agents/scripts/invoke_hosted_agent_a2a.py Resolved

Comment thread samples/python/hosted-agents/bring-your-own/a2a/echo/README.md Resolved

Copilot AI balanced review requested due to automatic review settings November 9, 2026 02:01

Hameed Kunkanoor (Hameedkunkanoor) temporarily deployed to L4-validation November 9, 2026 02:01 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Hameed Kunkanoor (Hameedkunkanoor) November 9, 2026 02:01

View session

Copilot AI reviewed Nov 9, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings November 9, 2026 03:16

Hameed Kunkanoor (Hameedkunkanoor) temporarily deployed to L4-validation November 9, 2026 03:16 — with GitHub Actions Inactive

Copilot started reviewing on behalf of Hameed Kunkanoor (Hameedkunkanoor) November 9, 2026 03:16

View session

Copilot AI reviewed Nov 9, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings November 11, 2026 05:54

Hameed Kunkanoor (Hameedkunkanoor) deployed to L4-validation November 11, 2026 05:54 — with GitHub Actions Active

Copilot started reviewing on behalf of Hameed Kunkanoor (Hameedkunkanoor) November 11, 2026 05:55

View session