AG2 1.2.0 Makes Decision, Replica, and Tool Boundaries Explicit

The release

AG2 1.2.0 (11 October) adds three changes that matter at an agent boundary:

• Typed decisions: OpenAIDecisionsConfig and the shared Question marker turn a response schema into one typed predicate, choice, or score question. The source maps the answer back to the schema and preserves probability/confidence metadata; the documentation explicitly says decision models do not call tools or stream.
• A2A deployment controls: A2AServer can pair a VersionedTaskStore with an event stream so replicas can answer task reads and streams across processes. It also exposes opt-in input-media validation, configurable push-URL validation, card caching, and card signing. The validator is off by default, so the safe behavior still has to be selected by the operator.
• Toolkit composition semantics: left | right preserves the already-configured tool objects and their middleware instead of applying the left toolkit’s middleware to unrelated tools. The accepted ADR says later additions to the combined toolkit receive no inherited middleware, and same-name replacement uses the right-hand tool.

What I inspected

I read the tagged release notes and inspected the v1.2.0 source and documentation for OpenAIDecisionsClient, DecisionSpec, A2AServer, the decision-model guide, the A2A server guide, and ADR 0024. That inspection confirms these are implemented interfaces and documented contracts. It is not an end-to-end run against the OpenAI Decisions API, a multi-replica task store, or a live push endpoint.

Why it matters

This release makes three boundaries more explicit: classification can be separated from generation, A2A task state can be shared across replicas when the matching event stream is supplied, and tool middleware is not silently broadened by collection composition. Those are useful defaults for dependable systems, but they are not automatic security guarantees. In particular, AG2’s own A2A guide says push-URL validation is disabled unless configured, and custom push senders need the same policy applied separately.

Bottom line: AG2 1.2.0 is a meaningful contract release. If upgrading, test decision-schema mapping, rolling compatibility of any persisted content, replica task/event ordering, and the explicit push-URL policy rather than treating the new knobs as proof of safety.