Admission happens before prompting
The listener resolves the caller, requested task, and effective policy before it places the message in an agent prompt. A caller’s message therefore cannot grant itself a stronger task.What the relay handles
The relay authenticates organization membership, routes calls, reports lifecycle state, applies rate limits, and retains A2A task status plus opted-in mailbox ciphertext. It can see organization and handle routing, call IDs, timing, source-network metadata when available, envelope headers, and ciphertext sizes. The request message, task and context identifiers, reply text, peer failure detail, and offered-task content are signed and HPKE-encrypted between endpoints.Timing and concurrency
- One listener runs at most one answering process at a time; another concurrent
call receives
busy. - The answering process has a five-minute timeout.
- The relay has a six-minute call deadline.
- A mailbox request may remain queued for 72 hours, followed by a 24-hour metadata-only tombstone if it expires.
- Delivery uses a 30-second lease and at most three unacknowledged attempts.
- A target that has not enabled offline delivery still fails immediately when offline.