[josemontespg]

Summary

Adds the JSON Schema for the iframe catalog, so agents, renderers and validators share one canonical definition of the sandboxed web frame components instead of the copy that lives in the Angular MCP calculator sample. The catalog targets A2UI v1.0: protocolVersion is 1.0 and the shared shapes come from specification/v1_0. The MCP catalog's McpApp schema is a separate PR on top of this stack.

Changes

• catalogs/iframe/catalog.json ($id https://a2ui.org/specification/v1_0/catalogs/iframe/catalog.json) declares WebAppFrameUrl and WebAppFrameSrcdoc. The shared properties (allowedEvents, allowedFunctions, mutableData, data.paths, config, height, disableSchemaValidation) are inlined into both components, as the v1.0 Catalog Schema Rules require: no ComponentCommon allOf or unevaluatedProperties, relative common_types.json#/$defs/... refs, and $defs with only anyComponent (with discriminator) and anyFunction. The catalog has no functions.
• specification/v1_0/test/run_tests.py: registers catalogs/iframe/catalog.json in the structural, identifier and $ref target checks.
• conformance/core/catalog.yaml adds a from_json selfContained case for the published catalog, like the other extension catalogs.
• The component specification moves from the Angular MCP calculator sample to catalogs/iframe/web_app_frame_specification.md and is rewritten against the protocol the stack implements: plain postMessage and the handshake MessagePort (no client SDK), allowlists as name to JSON Schema maps, the real error codes, kept author CSP, the actual sandbox flags, and no controls nobody implements (URL allowlist, rate limiting, a permissions property). It stays implementation-neutral and names @a2ui/catalog-iframe as the reference host. Section 4 points to catalog.json for the schemas.
• specification/scripts/validate.py adds an iframe config that validates examples under catalogs/iframe/examples/ against agent_to_renderer.json with this catalog merged into the v1 basic catalog. This PR ships no examples: each of the two working examples lands with its end-to-end test, in [iFrame] Add the srcdoc tip calculator example to the iframe catalog #3008 (WebAppFrameSrcdoc) and [iFrame] Add the url order tracker example to the iframe catalog #3009 (WebAppFrameUrl).
• .github/workflows/docs.yml publishes the catalog at specification/v1_0/catalogs/iframe/, so the $id URL resolves.
• catalogs/iframe/README.md documents the components and links the specification; catalogs/README.md lists the new directory.

Verification

• python3 specification/scripts/validate.py: all configs pass; the iframe config finds no examples yet.
• python3 specification/v1_0/test/run_tests.py: 182 passed.
• uv run pytest python/a2ui_core/tests/test_conformance.py: 575 passed.
• ./scripts/fix_format.sh --check passes; every relative link in the added or moved markdown files resolves.

Pre-launch Checklist

• I read the Contributors Guide.
• My code changes have tests (schema and examples are covered by validate.py).

Related to #3157

[gemini-code-assist]

Code Review

This pull request introduces the iframe catalog (featuring WebAppFrameUrl and WebAppFrameSrcdoc components) and updates the MCP catalog to include the McpApp component, along with corresponding specifications, examples, and validation script updates. The review feedback suggests two key improvements: first, updating WebAppFrameSrcdoc's htmlContent to use DynamicString for consistency and dynamic data binding support; second, adding a mutableData property to McpApp to validate incoming state mutations against a JSON Schema, thereby enhancing security and aligning it with WebAppFrame's validation model.