Google ADK Bug: 100% Test Coverage Still Missed Silent State Loss Across A2A Boundaries
A developer building Bastion, a three-agent access-governance system using Google ADK and A2A, discovered that state written via output_key is stored in the worker agent's own session and never returned to the calling Orchestrator across remote A2A boundaries. The flaw went undetected because all local runs and CI tests shared a single in-process session, making state appear to flow correctly and achieving 100% branch coverage. On August 22, 2026, the deployed system silently failed when the Orchestrator received an empty state key after the Auditor completed its work, with no exception or warning raised anywhere in the pipeline. The workflow still reported as completed, making the bug far harder to detect than an outright crash. The fix involved passing validated findings as structured message content across the boundary rather than relying on session state as a transport mechanism.
This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)
Log in to join the discussion and vote.
Log in