fix(server): address pre-PR review findings on alias route fix

- Remove brand name from inline comment (use generic "A2A 0.3 buyer SDKs")
- Expand A2ABearerAuthMiddleware docstring to mention 0.3 alias path
- Add comment to inverse-drift-guard test noting it's structural-only

https://claude.ai/code/session_01JHq6DLPhFf2kQQpUkPtfZe

Author: claude

src/adcp/server/a2a_server.py

@@ -919,7 +919,7 @@ def create_a2a_server(
         jsonrpc_kwargs["context_builder"] = context_builder
     routes = (
         list(create_agent_card_routes(agent_card=agent_card))
-        # 0.3 alias: buyer SDKs (e.g. @adcp/sdk) probe /.well-known/agent.json
+        # 0.3 alias: A2A 0.3 buyer SDKs probe /.well-known/agent.json
         # as a positive A2A signal. Same handler, no redirect round-trip.
         + list(
             create_agent_card_routes(

src/adcp/server/auth.py

@@ -763,7 +763,8 @@ class A2ABearerAuthMiddleware:
     :func:`adcp.server.a2a_server.create_a2a_server` with this
     middleware to require a valid bearer header on every JSON-RPC
     request, while leaving the spec-mandated public discovery
-    surface (``/.well-known/agent-card.json``) accessible.
+    surface (``/.well-known/agent-card.json`` and the 0.3 alias
+    ``/.well-known/agent.json``) accessible.
 
     Designed to compose with a2a-sdk's
     :class:`DefaultServerCallContextBuilder`: on auth success the

tests/test_serve_auth_both.py

@@ -629,6 +629,8 @@ def test_all_discovery_paths_are_registered_routes() -> None:
     from adcp.server.auth import _A2A_DISCOVERY_PATHS
 
     app = create_a2a_server(_OkHandler(), name="inverse-drift-guard", validation=None)
+    # Structural check only (r.path membership). Live dispatch is validated by
+    # test_a2a_agent_card_served_on_root_path in test_unified_mcp_a2a.py.
     app_paths = {r.path for r in app.routes}
 
     not_routed = [p for p in _A2A_DISCOVERY_PATHS if p not in app_paths]