[marekdano]

Summary

A caller can now answer an agent that paused in an input-required or auth-required state. Before, the invoke routes had no task identifier, so interaction stopped at a single-shot request and response.

Closes #6703
Part of #5936

Depends on #7372, which adds the routes that read task state. Merge #7372 first. This branch does not include that change. After #7372 merges, rebase onto main.

Changes

New route: POST /v1/a2a/{agent_id}/tasks/{task_id}/messages, with permission a2a.invoke.

• The body holds either message (an A2A message object) or text (one text part). The request needs exactly one of them. message.parts must not be empty.
• A2AAgentService.continue_task() finds the task with the same visibility scoping as get_task. It adds taskId and the stored contextId to the message, and defaults messageId and role.
• The message goes through invoke_agent. A2A 0.3 and 1.0 both carry taskId and contextId on the message, and the existing normalization converts the rest. A 1.0 agent gets SendMessage with ROLE_USER. A 0.3 agent gets message/send with kind markers.
• The task row takes its state from the agent response, through the existing persistence in invoke_agent.
• A task_continued event in a2a_task_events records the previous and new state, with a per-task sequence number. A failed event write is logged and does not fail the request, because the agent already received the message.
• The route returns the agent response unchanged.
• TokenScopingMiddleware maps the new path to a2a.invoke.

Condition	Response
A2A service unavailable	503
Task does not exist or is not visible	404
Task is in a terminal state	409, names the state
message.taskId names a different task	400
Invalid body	422

Related fix

cancel_task and upsert_task only recognized the 0.3 terminal states. Cancelling a finished 1.0 task, stored as TASK_STATE_COMPLETED, overwrote its state. Both now use the new is_terminal_task_state() helper, which also drives the 409 check.

Limits

• The route takes the agent UUID only, not a UAID, because a UAID can contain slashes.
• If an agent answers a follow-up with a different task ID, the original row stays unchanged.
• The route does not serialize two simultaneous follow-ups to one task.

Checklist

• Tests cover task binding, both protocol versions, the 404, 409, 400, 422 and 503 paths, the event sequence, and the terminal-state fix
• make pre-commit ruff interrogate pylint verify pass
• CHANGELOG entry added

[Lang-Akshay]

Blocking Changes

#	Area	File	Line	Blocking reason	Required change
1	Security (subagent SECURITY_VERDICT=BLOCK) / Issue	mcpgateway/services/a2a_service.py	3615-3617	{"messageId": ..., "role": "user", **message, "taskId": task_id} lets the client override the gateway-generated messageId and role. The contextId guard (if task.get("contextId") and not follow_up.get("contextId")) only fills a missing value. A client-supplied contextId is forwarded and stored in the task_continued event. taskId mismatch returns 400, but contextId mismatch passes silently. The PR claims the message is bound to the stored task and context.	Set contextId from the stored task after the spread, or reject a mismatching value with 400 as for taskId. Set role and messageId after the spread, or reject client values. Add a regression test for each override.