git:20260513.084ea60 to git:20260914.08f85a3

3 added, 5 removed. Audit A to A.

---

name: ucp-checkout-a2a

- description: >

- Implement UCP Checkout over the A2A (Agent-to-Agent) binding — enable

- autonomous agent-to-agent commerce using Agent Cards and structured message

- parts. Use when building agent-to-agent commerce flows.

+ description: Implement UCP Checkout over the A2A (Agent-to-Agent) binding — enable autonomous agent-to-agent commerce using Agent Cards and structured message parts. Use when building agent-to-agent commerce flows.

+ allowed-tools: Read, Write, Edit, Bash, Grep, Glob, WebSearch, WebFetch

---

# UCP Checkout — A2A Binding

## Before writing code

**Fetch live spec**: Web-search `site:ucp.dev specification checkout-a2a` and fetch the page for the exact message structure, DataPart keys, and Agent Card format.

- Also review Google's A2A protocol spec for the underlying transport: https://google.github.io/A2A/

+ Also review Google's A2A protocol spec for the underlying transport: https://a2a-protocol.org/latest/specification/

## Conceptual Architecture

### What is A2A?

A2A (Agent-to-Agent) is a protocol for autonomous inter-agent communication. UCP's A2A binding lets a Platform agent talk to a Business agent using structured messages rather than REST calls.

### How It Works

1. **Discovery**: Business publishes an Agent Card at the URL declared in their `/.well-known/ucp` profile under `services.dev.ucp.shopping.a2a.endpoint`.

2. **Communication**: Platform sends messages with checkout data in `DataPart` objects. Business agent responds with checkout state in `DataPart` objects.

3. **Identification**: Platform includes `UCP-Agent` header and `X-A2A-Extensions` header referencing the UCP spec version.

### Key Data Part Keys

| Key | Direction | Purpose |

|-----|-----------|---------|

| `a2a.ucp.checkout` | Both | Checkout session data |

| `a2a.ucp.checkout.payment_data` | Platform → Business | Payment credentials for completion |

| `a2a.ucp.checkout.risk_signals` | Platform → Business | Optional risk signals |

| `ap2.merchant_authorization` | Business → Platform | Merchant's JWS detached content signature for AP2 mandate flow |

| `ap2.checkout_mandate` | Platform → Business | SD-JWT+kb credential proving user-authorized agent checkout |

### Message Structure

Messages use A2A's standard format:

- `messageId`: Unique ID (used for idempotency)

- `contextId`: Session/conversation ID

- `kind`: `"message"`

- `role`: `"user"` (from platform) or `"agent"` (from business)

- `parts`: Array of TextPart and DataPart objects

Checkout data is carried in `DataPart` with the appropriate key.

### Idempotency

The Business agent uses `messageId` to detect duplicate requests. Task tracking uses `taskId` with `contextId`.

### When to Use A2A

- Fully autonomous agent-to-agent commerce (no human in the loop for most steps)

- Multi-agent architectures where commerce is one capability among many

- When you want the Business to maintain its own agent logic (not just expose tools)

### Implementation Guidance

Before implementing, fetch the latest sample A2A Business Agent from https://github.com/Universal-Commerce-Protocol/samples (look for the `a2a/` directory) to see the reference pattern.