From f190acc419a525004d66fa3c98d6f5f13b2e8b3d Mon Sep 17 00:00:00 2001 From: Imran Siddique Date: Thu, 1 Oct 2026 08:44:32 -0700 Subject: [PATCH] feat(research): add DOI for cA2A version 2 10.5281/zenodo.23086110; the Zenodo file matches the site PDF. Co-Authored-By: Claude Opus 5.5 --- data/research.json | 3 ++- research/ca2a/index.html | 6 ++++-- research/ca2a/v2/CITATION.cff | 1 + research/ca2a/v2/citation.bib | 1 + research/ca2a/v2/index.html | 6 ++++-- 5 files changed, 12 insertions(+), 5 deletions(-) diff --git a/data/research.json b/data/research.json index 9ccfe6c..6526ba8 100644 --- a/data/research.json +++ b/data/research.json @@ -181,7 +181,8 @@ "sha256": { "paper.pdf": "275927a47972fd9ae5f08df97dc29c2e2baa2daa2ebf53e90820e59c68d885aa", "source.zip": "be0428adb5ae8ba81d9c809c60af89812e104d70e7bd45a92b4f393bbd78ef12" - } + }, + "doi": "10.5281/zenodo.23086110" } ] }, diff --git a/research/ca2a/index.html b/research/ca2a/index.html index 4621f74..49dfe59 100644 --- a/research/ca2a/index.html +++ b/research/ca2a/index.html @@ -23,7 +23,8 @@ - + + @@ -69,7 +70,7 @@

cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A

October 1, 2026Not peer reviewedPatent Pending

Abstract

The Agent2Agent (A2A) protocol moves tasks between agents, and its Signed Agent Card lets a client check that a domain owner issued a card. The card does not bound the authority a delegating agent passes on, establish what code a peer runs, keep a task payload from the peer's host, or leave an offline record of who delegated what to whom. This technical report describes cA2A (Confidential A2A), a trust profile layered on A2A rather than a new transport. It composes four mechanisms: signed delegation credentials whose scope can only narrow at each hop, appraisal of a peer's attestation evidence before a task is sent, a payload sealed to the channel key that evidence vouches for, and a signed per-hop provenance record linked to its parent. Attenuated delegation and provenance binding are covered by prior capability-token work and IETF drafts; the contribution here is their composition on A2A with an open implementation. We state six properties and report software experiments rerun against ca2a 0.3.1: attenuation checks over 5,400 generated chains, rejection of in-chain replay and cross-chain splicing, intersection of delegated scope with local policy, sealed-payload behavior at the cryptographic layer, structural checks on linked provenance records, and a cross-operator attestation protocol exercised with synthetic evidence. Chain verification cost about 0.22 ms per hop in this environment. These results do not show that a peer's key is confined to attested code or that attestation works across independent operators. Recorded hardware runs cover one-directional appraisal of an Intel TDX peer by an AMD SEV-SNP peer in another cloud and a same-operator mutual SEV-SNP diagnostic; mutual attestation between independent operators has not been demonstrated.

- +

What this report contributes

A trust profile on A2A composing narrowing delegation credentials, peer attestation appraisal, sealed payloads and linked per-hop provenance records.

Evidence and limits

  • Software experiments were rerun on September 27, 2026 against ca2a 0.3.1: correctness counts matched the July 2026 draft, and chain verification cost about 216 rather than 195 microseconds per hop.
  • Cross-operator attestation was exercised only with synthetic evidence. Recorded hardware runs cover one-directional appraisal across clouds and a same-operator diagnostic, not mutual attestation between independent operators.
  • The results do not show that a peer's key is confined to attested code. Provenance checks on unsigned records establish structural consistency only; authenticity rests on signed records.

The source package preserves the recorded inputs and results. The software experiments were rerun against ca2a 0.3.1 for this edition; no hardware run was repeated. No independent replication is claimed.

@@ -82,6 +83,7 @@

cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A

year = {2026}, type = {Technical report}, note = {Version 2; not peer reviewed}, + doi = {10.5281/zenodo.23086110}, url = {https://agentrust-io.com/research/ca2a/v2/} }
diff --git a/research/ca2a/v2/CITATION.cff b/research/ca2a/v2/CITATION.cff index 3708e9d..be829df 100644 --- a/research/ca2a/v2/CITATION.cff +++ b/research/ca2a/v2/CITATION.cff @@ -21,6 +21,7 @@ ], "url": "https://agentrust-io.com/research/ca2a/v2/", "license": "CC-BY-4.0", + "doi": "10.5281/zenodo.23086110", "preferred-citation": { "type": "report", "title": "cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A", diff --git a/research/ca2a/v2/citation.bib b/research/ca2a/v2/citation.bib index 8f20ef3..1a8d828 100644 --- a/research/ca2a/v2/citation.bib +++ b/research/ca2a/v2/citation.bib @@ -5,5 +5,6 @@ @techreport{agentrust2026ca2a year = {2026}, type = {Technical report}, note = {Version 2; not peer reviewed}, + doi = {10.5281/zenodo.23086110}, url = {https://agentrust-io.com/research/ca2a/v2/} } diff --git a/research/ca2a/v2/index.html b/research/ca2a/v2/index.html index fedfbfa..df58ecb 100644 --- a/research/ca2a/v2/index.html +++ b/research/ca2a/v2/index.html @@ -23,7 +23,8 @@ - + + @@ -69,7 +70,7 @@

cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A

October 1, 2026Not peer reviewedPatent Pending

Abstract

The Agent2Agent (A2A) protocol moves tasks between agents, and its Signed Agent Card lets a client check that a domain owner issued a card. The card does not bound the authority a delegating agent passes on, establish what code a peer runs, keep a task payload from the peer's host, or leave an offline record of who delegated what to whom. This technical report describes cA2A (Confidential A2A), a trust profile layered on A2A rather than a new transport. It composes four mechanisms: signed delegation credentials whose scope can only narrow at each hop, appraisal of a peer's attestation evidence before a task is sent, a payload sealed to the channel key that evidence vouches for, and a signed per-hop provenance record linked to its parent. Attenuated delegation and provenance binding are covered by prior capability-token work and IETF drafts; the contribution here is their composition on A2A with an open implementation. We state six properties and report software experiments rerun against ca2a 0.3.1: attenuation checks over 5,400 generated chains, rejection of in-chain replay and cross-chain splicing, intersection of delegated scope with local policy, sealed-payload behavior at the cryptographic layer, structural checks on linked provenance records, and a cross-operator attestation protocol exercised with synthetic evidence. Chain verification cost about 0.22 ms per hop in this environment. These results do not show that a peer's key is confined to attested code or that attestation works across independent operators. Recorded hardware runs cover one-directional appraisal of an Intel TDX peer by an AMD SEV-SNP peer in another cloud and a same-operator mutual SEV-SNP diagnostic; mutual attestation between independent operators has not been demonstrated.

- +

What this report contributes

A trust profile on A2A composing narrowing delegation credentials, peer attestation appraisal, sealed payloads and linked per-hop provenance records.

Evidence and limits

  • Software experiments were rerun on September 27, 2026 against ca2a 0.3.1: correctness counts matched the July 2026 draft, and chain verification cost about 216 rather than 195 microseconds per hop.
  • Cross-operator attestation was exercised only with synthetic evidence. Recorded hardware runs cover one-directional appraisal across clouds and a same-operator diagnostic, not mutual attestation between independent operators.
  • The results do not show that a peer's key is confined to attested code. Provenance checks on unsigned records establish structural consistency only; authenticity rests on signed records.

The source package preserves the recorded inputs and results. The software experiments were rerun against ca2a 0.3.1 for this edition; no hardware run was repeated. No independent replication is claimed.

@@ -82,6 +83,7 @@

cA2A: Confidential Agent-to-Agent Delegation as a Profile on A2A

year = {2026}, type = {Technical report}, note = {Version 2; not peer reviewed}, + doi = {10.5281/zenodo.23086110}, url = {https://agentrust-io.com/research/ca2a/v2/} }