refactor(a2a): every inbound A2A call needs a credential — drop the keyless trusted-network path; the trusted list becomes an outbound allowlist (ent#885)

[vybe]

Fixes abilityai/trinity-enterprise#885. One of the freeze-week chains (chain-freeze-1013). This one gates rc4 (/release-plan v1.0.0 cluster C2 / M2). Draft until the operator merges.

What

Every inbound A2A call needs a credential again: a Trinity key, an x402 payment, or a verified AAuth identity. Nothing is let through because of the network the call came from. This removes the keyless "trusted network" inbound path that #3361 added. The path was on dev through rc1–rc3 and never shipped in a stable release.

• Inbound (removed): routers/a2a.py loses the keyless branch, its rate limiters, the source-address checks and _InternalGate. Also removed:
  • the card-URL override;
  • the get/set_a2a_scope mixin and its delegators;
  • the source_host dispatch plumbing;
  • the inbound half of services/a2a_trusted_networks.py;
  • the "internal-only" scope, which has no writer on dev.
• Outbound (kept, narrowed; operator ruling 2026-10-13): the trusted-networks list stays, but only as an admin allowlist for outbound endpoints.
  • An A2A endpoint on a private or CGNAT address (100.64.0.0/10, e.g. a Tailscale peer) or on plain http:// can be registered and called only when its host is on the list.
  • Hosts not on the list get the v0.9.5 SSRF refusal.
  • Nothing inbound reads the list.
  • The setting key and PUT /api/settings/a2a-trusted-networks are unchanged; there is no rename in freeze week.
• Frontend: A2aPanel.vue loses its scope select, keyless toggle and internal-URL row. stores/agents.js::setA2aExposure(name, enabled) goes back to its v0.9.5 shape.
• Docs: the trusted-network sections are rewritten as outbound-only, not deleted: the MCP requirements, the A2A inbound and outbound flows, the security architecture and the user docs.
• Kept on purpose:
  • Migration 0096 and its SQLite twin. Upgraded rc databases already carry them, so the columns stay, unread, with comments marking them inert. A drop goes under Collapse schema.py + migrations.py into single source of truth (follow-up to #713) #746 after 1.0.
  • The Vite X-Real-IP line, which protects dev-mode rate limiting.
• AAuth (feat(a2a): AAuth agent identity across instances, behind an off-by-default flag (abilityai/trinity-enterprise#623) #2956 / feat(aauth): person-token binding through a person server — an agent acts for its owner (abilityai/trinity-enterprise#878) #3659 / feat(aauth): outbound resource client + call_aauth_resource — an agent calls an external AAuth resource through the full challenge ladder (abilityai/trinity-enterprise#879) #3667, merged): the branch merges dev with feat(aauth): outbound resource client + call_aauth_resource — an agent calls an external AAuth resource through the full challenge ladder (abilityai/trinity-enterprise#879) #3667. The AAuth hooks, the _not_authenticated() returned response that AAuth decorates, and the outbound client are all intact.

Why the outbound list stays

Managed instances talk to each other over a tailnet on plain HTTP. The builder-agent cross-instance test (ent#762, a keyed call) has to run there before 1.0. Token sign-in between instances (ent#862) stays after 1.0.

Review + security

/review (Fable, report-only): MERGEABLE, 0 critical findings.

• _anonymous_jsonrpc, _not_authenticated, _serve_card and _card_base_url are byte-identical to the pre-feat(a2a): trusted internal networks — call agents across your own instances over a private network without keys (abilityai/trinity-enterprise#838) #3361 tree.
• Every inbound method returns 401 for a keyless call from a trusted CIDR against a row seeded as internal, keyless=1.
• The only readers of the list are the outbound validator, the admin GET/PUT and the generic-PUT refusal.
• One Alembic head on a merge-tree against live dev.

Both informational items are fixed in 897c7f9a9: the inert column comments and the §32.7 status line. /cso --diff: zero findings.

Tests

• New: test_ent885_keyless_refused.py. It is red on dev in 7 of 10 cases and green on this branch, so it is a real regression test.
• New: test_ent885_outbound_allowlist.py. It goes through the real stored list in both directions: on the list → registered and called; off the list → refused; removed from the list → the next call is refused.
• Verification set: 509 + 375 passed, plus 31 AAuth tests. Vitest: the panel spec and the three ratchets passed.
• Mutations: re-adding a get_a2a_scope read, and putting source_host back in DISPATCH_FIELDS, each turn the static pin red.

Disclosures

• A database row hand-edited to a2a_scope='internal' is now treated as a public agent with a credential required, never as keyless.
• An endpoint registered on an rc with a private or plain-http URL now fails at call time with a named error unless its host is on the admin list. It fails closed.
• No trusted-networks UI control exists in the OSS frontend or the enterprise submodule, so the ruling's "UI wording" item has nothing to change. The list is set through the API.
• No release-notes line: the keyless path never shipped in a stable release.

Before merge

• On rc4: run ent#847 row B11 as "keyless call refused" plus the keyed A2A smoke test, and record the build SHA in ent#847.

🤖 Generated with Claude Code

[trinity-ability]

PR Validation Report — /validate-pr

PR: #3684, ent#885: drop the keyless trusted-network A2A path; the trusted list becomes outbound-only
Branch: feature/885-drop-keyless-a2a @ 84fe4d358 → dev · Files: 36 (+654/−889)
Lane: B, with the schema flag set. No Lane C path is touched. The schema hunks change comments only, and routers/a2a.py is an auth surface, so I read it at Lane C depth anyway.

Category	Status	Notes
Commit messages / base branch / size	✅	Conventional prefixes; targets dev; 36 files
Status auto-promotion	⚠️	Fixes abilityai/trinity-enterprise#885 is a cross-tracker link, so it won't promote itself. Set status-in-dev on ent#885 by hand after merge; it closes at release
Requirements / architecture / flows	✅	mcp.md §32.7, security.md §5b, both A2A flows and the user docs are rewritten as outbound-only, not deleted
Enterprise disclosure	✅	The guard pattern finds 0 matches in added lines
Security §4.1–4.10	✅	No keys, emails, .env files, hardcoded secrets, mode flips or host paths. The IPs that appear (100.64.0.0, 100.70.1.2, 8.8.8.8, 1.2.3.4) are CGNAT/public test fixtures
+schema	✅	No DDL change. schema.py and tables.py only add "inert since ent#885" comments. Migration 0096 and its SQLite twin are kept on purpose, so no new revision and no fork
Config / build packaging	➖	No new env reads; no new backend directory
Binding ruling (2026-10-13T19:25Z)	✅	The only readers of a2a_trusted_networks are utils/url_validation.py:881 (outbound, via _validate_trusted_a2a_url) and the admin routes in routers/settings/integrations.py:713,730. Nothing inbound reads it. a2a_jsonrpc now sends every caller without credentials straight to _anonymous_jsonrpc, with no source lookup
Leftovers	✅	grep over src/ and tests/ for internal_source, _proxy_ips, internal_base_url, _internal_gate, get/set_a2a_scope, caller_source finds nothing. The only remaining matches are the inert columns and tests that assert nothing reads them
Structural review	✅	/review and /cso --diff are on file (ent-885-review.md): 0 critical, 0 CSO findings, attack surface shrinks
Merge gate	✅	Tier 1 green, including regression diff and pytest (head, seed 12345). journey-smoke and frontend-e2e/e2e also passed on the PR. dev-ci is success; no open dev-ci red issue

Execution coverage (§5.4)

Test file / changed symbol	What runs it	Live consumer	Verdict
Keyless door removed from a2a_jsonrpc	test_ent885_keyless_refused.py: drives the real route with no credential for each method	routers/a2a.py::a2a_jsonrpc	✅
Outbound allowlist (registration and call time)	test_ent885_outbound_allowlist.py: both sides, host on and off the list	url_validation.py:878-885	✅ This pins kept behaviour, so it passes on dev too, as it should
A2aPanel.vue scope controls removed	a2aPanelNoScope.spec.js: jsdom mount over the real store, PUT body asserted	the component	✅ (mounted, not source-text)

Mutation: I ran the PR's new tests against dev's code (5a52f35). test_ent885_keyless_refused.py goes red: 7 of 9 tests fail, including every test_a_trusted_peer_with_no_credential_is_refused[...] case. The regression test really does test the behaviour.

Local run in the PR worktree: 451 of 452 passed across 14 related files: A2A (157/736/838/623/679/751/885), 1482, 3215, 186, 1028, ent435.

Warnings

• ⚠️ Flaky, not caused by this PR. test_ent751_gate_callers.py::TestPortal::test_a_held_turn_is_answered_with_the_notice_never_failed failed in 2 of 11 runs on the PR head; both failures came in the first two runs. It passed in the next 9 runs, and in 5 of 5 runs on dev. The PR changes nothing in that file's portal path: it drops one get_a2a_scope stub from the A2A fixture and the source_host FREEZE entry from DISPATCH_FIELDS, neither of which the portal turn reads. CI regression diff is green. Recorded so whoever next sees it red has a starting point; it does not block merge.

Recommendation

APPROVE. The inbound keyless door, the internal-only scope and the source-address code are gone. Every inbound principal is now a key, an x402 payment or a verified AAuth identity. The trusted list is kept outbound-only, as the operator ruled. A two-sided test covers that list, and a mutation-proven regression test covers the removed door. The live B11 proof on rc4 is a later ops step and is outside this review.