[Dineshsuriya D (droideronline)]

Motivation & Context

A2AExecutor receives the inbound RequestContext, including context.metadata (SendMessageRequest.metadata), but ignores it, and run_kwargs is fixed at construction. Runtime context a caller passes as function_invocation_kwargs and client_kwargs therefore never reaches the hosted agent, so middleware and tools see different context.kwargs than they would locally. These two kwargs plus session and stream are the whole SupportsAgentRun.run contract.

Description & Review Guide

• What are the major changes?
  • New A2AExecutor(accepted_function_invocation_kwargs=[...], accepted_client_kwargs=[...]) options, two independent allowlists of key names.
  • execute() reads SendMessageRequest.metadata["agent_framework"] (written by A2AAgent(forwarded_kwargs=...) in Python: A2AAgent: forward selected run kwargs in request metadata #9192), keeps only the allowed keys of function_invocation_kwargs and client_kwargs according to their own allowlist, and passes them to agent.run(...) in both streaming and non-streaming mode.
• What is the impact of these changes?
  • Not breaking. The default (None) accepts nothing for both destinations, so behavior is unchanged.
  • The values come from a remote caller, so only allowlisted keys are accepted. The two destinations are authorized independently: opting into a tool-context key in accepted_function_invocation_kwargs does not let the caller inject the same key into client_kwargs, which reaches the chat client. Keys configured in run_kwargs win on conflict, framework-owned names such as stream, messages, options, session and middleware (and underscore-prefixed names) are rejected with ValueError at construction in either allowlist, and missing or malformed metadata is ignored.
  • _run and _run_stream take an optional run_kwargs argument that defaults to the configured kwargs, so existing callers are unaffected.
• What do you want reviewers to focus on?
  • The precedence and reserved-key rules.
  • The wire key agent_framework, which is defined separately in the client PR so the two PRs stay independent.

Client side: #7973 and #9192.

Related Issue

Fixes #9191

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Dineshsuriya D (droideronline)]

Eduard van Valkenburg (@eavanvalkenburg) Evan Mattson (@moonbox3) - I would appreciate if you could take a look at this one and #9192 when you get a chance, we are in need for these two. thanks!

[Eduard van Valkenburg (eavanvalkenburg)]

/review

[github-actions]

MAF Automated Review — Iteration 1

Result: Findings reported
Scope: full PR (2 commit(s)): 0dcc5a5a6be5, 243b12d994b1
Model: gpt-5.6-sol

Overview

The PR adds a default-off, allowlist-gated path for forwarding selected request metadata into agent run kwargs, with server-configured values taking precedence and malformed metadata ignored. The fresh per-request merge, explicit reserved keys, and streaming/non-streaming tests provide useful guardrails. One residual collision remains: because one allowlist governs both forwarded destinations, a remote caller can place an allowed framework-owned name in client_kwargs and reliably fail the task.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
1 verified finding remained after source verification (1 medium) across 1 file. Details are attached to the affected lines below.

Affected areas: python/packages/a2a/agent_framework_a2a/_a2a_executor.py

[Dineshsuriya D (droideronline)]

The pipeline failure is fixed. The Test Typing Checks (3.11) failure came from the parametrized reserved-name test in test_a2a_executor.py, where passing the allowlist via **{allowlist: [...]} could not be type-checked by pyright, ty or zuban. It now passes the two allowlists as explicit keyword arguments (7f0cb4e), and the a2a tests, ruff and pyright are clean locally.

The only other failure was Python Tests (3.10, ubuntu-latest), a timing-sensitive event loop heartbeat assertion in core/tests/core/test_harness_file_access.py, unrelated to this change. The other jobs were cancelled as a result. Latest main is merged and the checks are re-running.