One task, end to end, on real protocol endpoints: discover an A2A v1.0 agent, authenticate, delegate a payment-exception review, enforce per-tool policy at a gateway, pause for human approval, withhold poisoned data, trace every call — then gate a release on trajectory evaluation.
Northwind Finance and every vendor, invoice, and amount are fictional. The agent is deterministic (no model calls), so each run is reproducible. No money moves.