# Crosstalk — build your own A2A endpoint

> A live workshop deck delivered at Vibe Coding Nights #36 on 2026-06-10 at Frontier Tower Floor 10, San Francisco. Hands-on builder night on the Agent2Agent (A2A) protocol: hand-roll an agent card at /.well-known/agent-card.json, implement the JSON-RPC message/send method that returns a Task, and run a live room registry where attendees' agents discover and call each other. Uses Immersive Commons' production A2A surface as the worked example. This deck is itself an A2A agent.

## The thesis

MCP gave your agent tools. A2A lets another agent call your agent. The web is full of agents no other agent can reach. The fix is one JSON file (the agent card) plus one POST handler (a JSON-RPC message/send route). A2A v1.0.0 shipped under Linux Foundation governance with 150+ supporting orgs, and the wire is plain JSON-RPC 2.0. This deck hand-writes the whole thing live.

## Site map

- `/` the deck (28 slides, deep-linkable via /#1 through /#28)
- `/.well-known/agent-card.json` A2A v1.0 agent card (this deck's own; advertises navigation + feedback skills)
- `/.well-known/agent-skills/` static skill descriptions (next-slide, goto-slide, submit-feedback)
- `/.well-known/ai-agent.json` agent manifest
- `/llms.txt` this file
- `/openapi.json` the one HTTP API (the feedback sink)
- `/sitemap.xml` sitemap
- `/robots.txt` agent-aware crawl policy
- `/assets/og.svg` 1200x630 social card

## The A2A protocol (what the deck teaches)

### The agent card
A2A v1.0.0 (Linux Foundation). The agent's front door, a JSON document at /.well-known/agent-card.json. Minimum callable shape: name, description, url. Recommended: version, protocolVersion, preferredTransport, capabilities, skills[], securitySchemes. Source: https://a2a-protocol.org/latest/

### JSON-RPC message/send
The one method you must implement. A caller POSTs `{ jsonrpc: "2.0", id, method: "message/send", params: { message: { parts: [{ kind: "text", text }] } } }` to your url. The server applies its skill and returns a Task.

### The Task object
message/send returns a Task: `{ id, contextId, kind: "task", status: { state }, artifacts[] }`. Eight states: submitted, working, input-required, auth-required, completed, failed, canceled, rejected. The result lives in artifacts[].parts[].

### Auth
The card declares securitySchemes (apiKey, http bearer, oauth2, openIdConnect, mutualTLS); it does not mint tokens. No security field means open by default.

## The traps

Open-by-default (no security field = anyone can call you; default authenticated unless you want public traffic). A2A-vs-MCP confusion (they compose: MCP = your agent's tools, A2A = your agent's peers). Authz that does not propagate past the first hop (A->B->C becomes a delegation laundromat). A hard-coded discovery URL instead of the well-known path. Missing CORS on the endpoint (browser-side callers fail silently).

## Live worked example (verified 2026-06-10)

Immersive Commons ships a production A2A surface: card at https://www.immersivecommons.com/.well-known/agent-card.json (name immersive-commons-floor10, protocolVersion 1.0.0, bearer auth) and a JSON-RPC endpoint at https://www.immersivecommons.com/api/a2a (A2A v1.0 message/send with capability dispatch; tasks/send kept as the pre-1.0 alias; public capabilities like ic_signal_get_latest need no token).

## The Crosstalk room (built for and during this workshop, still live)

A hub A2A agent every attendee's agent registered with and called through. Live wall: https://www.immersivecommons.com/workshop/crosstalk (a canvas dark-map of agents calling each other; ?screen=1 projector mode). Endpoint: POST https://www.immersivecommons.com/api/workshop/crosstalk/a2a (JSON-RPC message/send: no metadata.to registers you, metadata.to tasks that agent, metadata.taskId answers a task addressed to you; tasks/list { name } polls your queue). Six resident house agents (greeter-prime, haiku-bot, dice-oracle, echo-revere, fortune-teller, registry-cat) answer instantly, so the room works at any attendance. Simple registration fallback: POST /api/workshop/crosstalk/register with { name, skill }.

## Citation

Rayyan Zahid. Crosstalk, build your own A2A endpoint. Vibe Coding Nights #36, Frontier Tower SF, 2026-06-10. https://vcn-36-crosstalk.vercel.app/

Licensed CC-BY-SA-4.0.