[ningyixi]

Description

JSON-RPC requests with id: true or id: false currently reach the request handler and produce responses containing the same boolean ID. Python's bool satisfies the existing integer check, but JSON-RPC 2.0 distinguishes Boolean from Number and permits only String, Number or Null identifiers.

Reject boolean IDs before dispatch with Invalid Request (-32600) and a null response ID. Add request-level tests for both boolean values and passing controls for integer zero, a positive integer, an empty string and a nonempty string. The invalid requests must not invoke the handler.

• Follow the CONTRIBUTING guide.
• Use a Conventional Commits PR title.
• Ensure tests and linter pass.
• Update appropriate docs if necessary. No documentation change is needed; this enforces the existing JSON-RPC identifier contract.

No existing issue found for boolean request IDs.

Validation:

• On the unchanged base, both boolean regressions fail and all four valid-ID controls pass (initial reproduction on Python 3.12).
• bash scripts/lint.sh: Ruff lint/format and ty pass. ty reports three unused-ignore warnings in unchanged optional gRPC imports.
• uv run pytest: 2,290 passed, 183 skipped, 3 xfailed and 1 xpassed on the repository-pinned Python 3.10.22.
• uv run pytest --cov=src --cov-report=term-missing --cov-fail-under=88: same results; 93.29% coverage, exceeding the 88% requirement.
• git diff --check: passed.

The xfail/xpass cases are marked against #869. Skips include PostgreSQL/MySQL and externally configured multi-server cases. Local HTTP/gRPC and sample integration tests ran as part of the full suite; no live model-provider calls were used.

AI assistance: OpenAI Codex implementation, reproduction and validation.

[github-actions]

🧪 Code Coverage (vs main)

⬇️ Download Full Report

	Base	PR	Delta
src/a2a/server/routes/jsonrpc_dispatcher.py	85.50%	86.47%	🟢 +0.97%
Total	92.90%	92.92%	🟢 +0.02%

Generated by coverage-comment.yml

[mykytanetipa]

lets have "integer" instead of "number" since float values are also against spec

[mykytanetipa]

design comment: I'd move this check to the "# 1) Validate base JSON-RPC structure only (-32600 on failure)" validate step, because right now it skips the request body logging + placed separately from the rest of request body validations.

smth like this:

body = await request.json()
if isinstance(body, dict):
    request_id = body.get('id')
    # Ensure request_id is valid for JSON-RPC response (str/int/None only;
    # exclude bool since bool is a subclass of int in Python)
    if isinstance(request_id, bool) or (
        request_id is not None
        and not isinstance(request_id, str | int)
    ):
        request_id = None
logger.debug('Request body: %s', body)
# 1) Validate base JSON-RPC structure only (-32600 on failure)
try:
    base_request = JSONRPC20Request.from_data(body)
    if not isinstance(base_request, JSONRPC20Request):
        ...
    if body.get('jsonrpc') != '2.0':
        ...
    if isinstance(base_request._id, bool):  # noqa: SLF001
        return self._generate_error_response(
            request_id,
            InvalidRequestError(
                message='Invalid request: id must be a string, integer, or null'
            ),
        )