diff --git a/docs/superpowers/plans/2026-09-17-a2ui-research-note.md b/docs/superpowers/plans/2026-09-17-a2ui-research-note.md
new file mode 100644
index 0000000..4720328
--- /dev/null
+++ b/docs/superpowers/plans/2026-09-17-a2ui-research-note.md
@@ -0,0 +1,26 @@
+# A2UI Research Note Implementation Plan
+
+> **For agentic workers:** Execute inline with validation checkpoints.
+
+**Goal:** Add a sourced A2UI research note and assess its Cloud Foundry relevance.
+
+**Architecture:** Describe A2UI as a data-only UI protocol: agents emit declarative component/data messages, clients resolve them against trusted native component catalogs, and renderers map them to platform UI widgets.
+
+**Tech Stack:** Markdown, YAML frontmatter, Devbox, Git, GitHub CLI.
+
+---
+
+### Task 1: Write `research/a2ui.md`
+
+- [ ] Add valid frontmatter with A2UI sources, tags `[inter-agent-comms, governance, ecosystem-survey]`, and `cf_areas: [capi, uaa]`.
+- [ ] Explain A2UI’s agent-to-client generation, transport, resolution, and rendering flow.
+- [ ] Cover declarative safety, trusted component catalogs, incremental flat-list updates, data models/actions, framework portability, and renderer implementations.
+- [ ] State the current early public-preview/version status accurately.
+- [ ] Assess CF relevance for agents hosted on CF sending safe UI descriptions to client applications, including identity, session, and audit boundaries.
+- [ ] Add questions about catalog governance, action authorization, client compatibility, transport, and sensitive data.
+
+### Task 2: Validate and publish
+
+- [ ] Run `devbox run validate`, `devbox run test`, and `git diff --check`.
+- [ ] Stage only the note and approved spec/plan, commit `docs: add A2UI research note`, push `research/a2ui`, and open a checklist-complete PR targeting `main`.
+- [ ] Verify PR metadata and CI with `gh pr view`.
diff --git a/docs/superpowers/specs/2026-09-17-a2ui-research-note-design.md b/docs/superpowers/specs/2026-09-17-a2ui-research-note-design.md
new file mode 100644
index 0000000..1ffce08
--- /dev/null
+++ b/docs/superpowers/specs/2026-09-17-a2ui-research-note-design.md
@@ -0,0 +1,24 @@
+# A2UI Research Note Design
+
+## Goal
+
+Capture a sourced research note on A2UI as a declarative, cross-platform protocol for agent-generated user interfaces.
+
+## Scope
+
+Cover A2UI's JSON component descriptions, trusted client catalogs, incremental updates, data
+model/actions, transport independence, renderers, and early-preview maturity. Assess CF
+relevance for agent-facing application UIs, keeping rendering and security in the client while
+CF hosts agents, gateways, and backends.
+
+## Structure and evidence
+
+Create `research/a2ui.md` with the required four sections and frontmatter. Use the A2UI
+repository, README, architecture, specification/version material, and renderer documentation.
+Distinguish the public-preview status from a ratified standard and label CF analysis as
+proposed integration.
+
+## Validation
+
+Run Devbox validation and tests, inspect whitespace/staged files, commit the note and plan on
+`research/a2ui`, push, and open a PR targeting `main` without unrelated artifacts.
diff --git a/generated/research-map.html b/generated/research-map.html
index 75016a8..0aacdfd 100644
--- a/generated/research-map.html
+++ b/generated/research-map.html
@@ -23,9 +23,6 @@
Focus use cases
Attested Workload Authority and Mediated Tool AccessExchange platform-attested workload identity for scoped authority while credentials and outbound tool access remain mediated by the platform.Strategic decision: Decide whether CF should become the portable trust and policy layer between agent workloads and the tools they invoke.Gap, experiments, and evidence
Current CF gap
CF issues workload identity certificates but does not exchange them for scoped tool authority, keep third-party credentials out of workloads, mediate off-platform access, or record delegation-aware audit events.
Candidate POC
Exchange a Diego instance identity certificate for a short-lived scoped token, invoke one allowed tool through a credential proxy and egress mediator, deny another, and emit attributable audit events.
Candidate RFC scope
Define workload token exchange, authority and delegation claims, credential brokering, outbound mediation and policy enforcement, audit events, revocation, and integration boundaries for UAA, routing, and service brokers.
CF can stage apps and run ephemeral tasks but cannot cheaply compose a reusable environment with per-session workspace state, select stronger isolation, constrain session networking, or resume the session lifecycle.
Candidate POC
Start two isolated sessions from one content-addressed staged environment, attach separate mutable workspaces, apply per-session egress policy, stop one session, and resume it on fresh compute.
Candidate RFC scope
Define environment and workspace references, session identity and lifecycle, isolation classes, network policy, workspace persistence and cleanup, scheduling, quotas, and compatibility with existing CF staging and task APIs.