OpenCode: serve and delegate A2A tasks

[dimavrem22]

Decisions

• Live protocol coverage: Exercise inbound and outbound behavior at both single-turn and multi-turn lengths. Serialize the four cases because they share live identities and one tunnel endpoint.
• Contact-rule contract: Remove obsolete paused lifecycle guidance while keeping contact-rule mutation console-only.
• Durability: Store each receiver delivery before acknowledgement, reconcile the registry first on restart, and then page all submitted tasks.
• Session isolation: Serialize inbound work in a2a:{identity}:{context} sessions and authorize complete, ask-caller, and fail through active turn context only.
• Cross-process authorization: Share active inbound turn context with the host tool process through an atomic mode-0600 file keyed by the isolated session, then remove it when the turn ends.
• Delegation continuity: Persist outbound message/retry data before SendMessage, promote it to (identity, RPC origin, context), and inject later task updates into the original OpenCode session.
• Write controls: Reuse the existing outbound approval and recipient allowlist for A2A calls and replies.
• Compatibility: Keep the base SDK range for non-A2A users, while documenting that A2A requires @inkbox/sdk 0.5.6 or newer.

Changes

• Add a published-SDK live A2A workflow that boots the real host and verifies all four protocol legs.
• Remove paused lifecycle interpretation from the bundled contact-rule guidance.
• Add default-enabled A2A call, check/wait, reply, and inbound outcome tools.
• Add durable inbound serving, task-addressed cancellation, context serialization, restart recovery, and guarded default completion.
• Preserve verified inbound task authorization across sidecar and host processes.
• Prevent default completion from overwriting input-required or auth-required outcomes.
• Add durable caller-side delegation routing and sent-task update injection.
• Document the A2A tool group and staged-rollout behavior.

Related pull requests

• Inkbox SDK PR 123
• Hermes PR 75
• Claude Code PR 45
• Codex PR 26
• OpenClaw PR 43

Prerequisites

Merge after A2A server support is available and Inkbox SDK 0.5.6 or newer is released.

Verification

• npm run lint
• npm run typecheck
• npm test: 645 passed
• npm run build
• Unit, loader, and latest-host contract checks passed.
• Full-stack live checks passed, including mock and real channels, inbound and outbound A2A at single-turn and multi-turn lengths, voice, external events, and the aggregate gate.