testing: expose a unified MCP+A2A in-process app builder

[bokelley]

Problem

adcp.testing.build_asgi_app() in 8.0.0b4 still builds only the MCP leg. There
is no public in-process builder for the unified MCP+A2A application that
adcp.decisioning.serve(transport="both") runs in production.

The original request in #618 explicitly required the unified MCP+A2A app, but
the shipped helper calls create_mcp_server() and returns
mcp.streamable_http_app(). Its public signature has no transport option.

As a result, a production seller serving both transports cannot run
high-fidelity ASGI tests against its production topology. Our current test
builder must import private internals:

from adcp.server.serve import _apply_asgi_middleware, _build_mcp_and_a2a_app

app = _build_mcp_and_a2a_app(handler, ...)
app = _apply_asgi_middleware(app, asgi_middleware)

This is more than a convenience issue. The two legs use different paths and
authentication conventions, and the combined builder is where routing,
middleware order, discovery, and auth parity can be verified without binding
a socket.

Requested API

Either extend the existing helper:

app = build_asgi_app(platform, transport="both", ...)

or add a clearly named unified builder. It should:

• support the same "mcp", "a2a", and "both" transport choices as
  production serve();
• reuse the production composition path rather than duplicating it;
• forward auth, ASGI middleware, context factory, validation hooks, response
  enhancer, and discovery/public URL configuration consistently;
• return the app without starting uvicorn;
• include tests that exercise MCP at /mcp and A2A at host root through the
  same returned app.

Relationship to #618

#618 delivered a useful public MCP-only builder. This issue tracks the
unfulfilled combined-transport part of that original request so adopters can
remove their remaining private server imports.

[bokelley]

Triage

Classification: Feature request
Bucket(s): client / testing surface (adcp.testing)
Status: ready-to-implement
Milestone: (omitted — no target version specified)

What the experts said:

• code-reviewer: Two implementation blockers before anything lands: _build_mcp_and_a2a_app requires non-optional port: int and host: str (must be stubbed with in-process defaults); no _build_a2a_app counterpart exists for transport="a2a" — needs extraction from _serve_a2a (line 1677 of src/adcp/server/serve.py) before that branch is wired.
• dx-expert: The right fix — private-API leakage is confirmed in SDK-internal test files (tests/test_unified_mcp_a2a.py, tests/test_serve_auth_both.py). build_test_client must gain transport= in the same PR; the discovery_base_url branch hardcodes transports=["mcp"] and must be made transport-aware.

My take: Well-scoped non-breaking addition. New optional transport param defaults to "mcp", preserving every existing call site. The implementation surface is a bit wider than it first appears (two-function extraction + port/host stub), but the scope is bounded and testable.

Implementation brief:

• src/adcp/testing/decisioning.py — Add transport: Literal["mcp", "a2a", "both"] = "mcp" to both build_asgi_app and build_test_client. Existing "mcp" branch: current behavior unchanged. "both" branch: call _build_mcp_and_a2a_app(handler, ..., port=0, host="127.0.0.1") (no socket bound; port/host only influence the discovery manifest). "a2a" branch: delegate to new _build_a2a_app (see below).

• src/adcp/server/serve.py — Extract _build_a2a_app from _serve_a2a (line 1677) that returns the app without binding a socket, mirroring the existing _build_mcp_and_a2a_app / _serve_mcp_and_a2a split. _serve_a2a then becomes a thin socket-binding wrapper over it.

• discovery_base_url branch (line 292, decisioning.py) — pass transports=["mcp"] / ["a2a"] / ["mcp", "a2a"] based on the transport value rather than hardcoding ["mcp"].

• A2A-specific kwargs (message_parser, public_url, task_store, push_config_store, push_sender) — defer to a follow-up; add # TODO(#1047) comments at the call sites so the hook is visible. Do not silently accept via **kwargs.

• Tests (new file or additions to tests/test_testing_decisioning.py):

  • Routing: build_asgi_app(platform, transport="both") → POST /mcp/ returns MCP JSON-RPC; GET / returns A2A agent card.
  • Auth parity: auth=BearerTokenAuth(...) → both /mcp/ and POST / reject unauthenticated; agent card endpoint exempt.
  • Discovery: discovery_base_url="http://test", transport="both" → /.well-known/adcp-agents.json lists both "mcp" and "a2a" transports.

• Docstring: note the "streamable-http" → "mcp" mapping so adopters who read both serve() and build_asgi_app signatures aren't confused.

Required checks before PR: pytest tests/test_testing_decisioning.py, mypy src/adcp/testing/, ruff check ., black --check ..

---

Triaged by Claude Code. Session: https://claude.ai/code/${CLAUDE_CODE_REMOTE_SESSION_ID}

---

Generated by Claude Code