A2A agents

A2A discovery starts with an Agent Card served over HTTPS, at /.well-known/agent-card.json since v1.0 and at the older /.well-known/agent.json for clients that have not caught up. Before any of that can happen there has to be a public HTTPS endpoint, on a name a calling agent can already hold.

The hostname is the contract

A card is fetched and cached, which puts the hostname in the contract rather than in the deployment. It outlives the machine that served it, and the agents holding it are not a list you have or a group you can notify.

So the name has to be able to move. Mint one, serve the card from it, and PUT a new address onto the same hostname when the agent moves. Callers that cached the card keep working, because the name they cached did not change.

Getting the certificate first

A card served over anything but HTTPS is not discoverable, and a certificate is the step that stalls this. Every hostname can return its own DNS-01 credential, so an agent on a private address or behind NAT gets a publicly trusted certificate without the certificate authority ever reaching it. Or ask for a managed certificate and it comes back from the same API as the hostname.

Naming and discovery layers above it

The Agent Name Service resolves an agent name to an endpoint, and a minted hostname is an endpoint it can name today. Its v2 draft moves further toward DNS, anchoring agent names to a domain and expecting records published under it. Those are record types we serve, and standards says which, and where each specification has got to.

The quickstart goes from an address to HTTPS, the DNS-01 endpoints are documented in full, and the rest of the use cases are next door.