feat(channel): sealed peer channel (Tier 2)

CHANGELOG.md

@@ -16,13 +16,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `experiments/`: reproducible claim suite C1-C6. C1 (attenuation), C2 (cross-chain replay), and C5 (provenance DAG) are fully reproducible; C3, C4, C6 SKIP until their Tier 2/3 dependency lands. Each claim has a CI test.
 - SEV-SNP attestation backend (Tier 3): `ca2a_runtime.tee.sev_snp` (report parsing, `SevSnpProvider`) and `ca2a_verify.sev_snp` (VCEK chain verification, ECDSA-P384 report-signature verification, measurement/report-data binding), all fail-closed. Chain path validated against the real AMD Milan root; report-signature path validated with synthetic vectors. Report generation requires a real SEV-SNP guest.
 - Peer-call enforcement decision core (Tier 2): `ca2a_runtime.policy.LocalPolicy` and `ca2a_runtime.peer` (`effective_scope`, `enforce_peer_call`). Effective permission is the delegated leaf scope intersected with the callee's local policy; a granted call emits a linked provenance record. New error `SCOPE_NOT_PERMITTED`. Claim C3 (scope-policy intersection) is now a validated experiment. Cedar-engine binding of the local policy and live A2A transport wiring remain open.
+- Sealed peer channel (Tier 2): `ca2a_runtime.channel` (`SealedChannel`, `generate_channel_keypair`, `open_sealed`). HPKE-style X25519 -> HKDF-SHA256 -> ChaCha20-Poly1305 sealing a payload to the peer's attested key; only the peer's private key opens it, and a wrong key or tampered ciphertext fails closed. Claim C4 (sealed-payload confidentiality) is now a validated experiment at the cryptographic layer. The enclave-binding of the private key (a hardware property) and live-path wiring remain open.
 - Repository scaffold: governance, CI/CD, docs framework, and packaging at parity with the agentrust-io house standard
 
 ### Not yet implemented
 
-- Live A2A transport wiring for the peer-enforcement decision core (Tier 2)
+- Live A2A transport wiring for the peer-enforcement decision core, including binding the seal to a verified attestation report (Tier 2)
 - Cedar policy engine binding for the local policy (Tier 2)
-- Sealed peer channel (Tier 2)
 - Intel TDX and TPM attestation backends (Tier 3); end-to-end SEV-SNP validation against real hardware vectors
 
 [Unreleased]: https://github.com/agentrust-io/ca2a/commits/main

LIMITATIONS.md

@@ -1,25 +1,25 @@
-# Limitations
-
-cA2A is a pre-release profile in active design. This document states plainly what is built, what is stubbed, and what is out of scope, so no claim in the documentation runs ahead of the code. This is a deliberate discipline: proof, not promises.
-
-## What is built
-
-- The delegation credential model and the offline chain verifier skeleton: signature checks, scope attenuation (a child grant must be a provable subset of its parent), depth limits, and cross-chain replay rejection. The hardest of these semantics is reused from [agent-manifest](https://github.com/agentrust-io/agent-manifest), where it is implemented and tested.
-- Configuration, error registry, and the CLI surface.
-
-## What is stubbed or not yet implemented
-
-- **Runtime peer-delegation enforcement.** The runtime does not yet accept a delegation credential on a live inbound peer call, verify it in the request path, and intersect the delegated scope with a local Cedar policy. This is Tier 2 on the roadmap.
-- **Sealed peer channel.** Payloads are not yet sealed to a peer's attested measurement. Until this lands, do not send confidential task payloads across a trust boundary and assume they are protected.
-- **Real hardware attestation.** The **SEV-SNP verifier is implemented**: report parsing, VCEK certificate chain verification, ECDSA-P384 report-signature verification, and measurement/report-data binding, all fail-closed. The chain path is validated against the genuine AMD Milan root chain; the report-signature path is validated with synthetic vectors, since a real report plus VCEK pair needs SEV-SNP hardware. Report generation (`SevSnpProvider.attest`) still requires a real SEV-SNP guest. **Intel TDX and TPM backends are not yet implemented (Tier 3).** Until a backend verifies a real quote end to end against a golden measurement on hardware, cA2A must not be described as fully attested across trust domains.
-
-## Out of scope
-
-- The A2A transport itself. cA2A is a profile on A2A, not a replacement for it.
-- Agent identity issuance beyond delegation.
-- AI model governance beyond delegation and provenance.
-- Hardware TEE platform SDKs and firmware.
-
-## Dependencies on sibling projects
-
-cA2A composes primitives from [agent-manifest](https://github.com/agentrust-io/agent-manifest), [cmcp](https://github.com/agentrust-io/cmcp), and [trace-spec](https://github.com/agentrust-io/trace-spec). Version skew across those repos can change cA2A behavior; pin compatible versions before relying on cross-repo guarantees.
+# Limitations
+
+cA2A is a pre-release profile in active design. This document states plainly what is built, what is stubbed, and what is out of scope, so no claim in the documentation runs ahead of the code. This is a deliberate discipline: proof, not promises.
+
+## What is built
+
+- The delegation credential model and the offline chain verifier skeleton: signature checks, scope attenuation (a child grant must be a provable subset of its parent), depth limits, and cross-chain replay rejection. The hardest of these semantics is reused from [agent-manifest](https://github.com/agentrust-io/agent-manifest), where it is implemented and tested.
+- Configuration, error registry, and the CLI surface.
+
+## What is stubbed or not yet implemented
+
+- **Runtime peer-delegation enforcement.** The runtime does not yet accept a delegation credential on a live inbound peer call, verify it in the request path, and intersect the delegated scope with a local Cedar policy. This is Tier 2 on the roadmap.
+- **Sealed peer channel.** The channel is implemented: a payload is sealed to the peer's attested X25519 key (X25519 ECDH, HKDF-SHA256, ChaCha20-Poly1305), and only the holder of the peer's private key can open it. The remaining gap is the hardware property that the private key never leaves the peer's enclave (established by attestation), and wiring the seal to a verified report on a live inbound call. Until that end-to-end binding lands on hardware, do not assume a payload is confined to a specific attested measurement.
+- **Real hardware attestation.** The **SEV-SNP verifier is implemented**: report parsing, VCEK certificate chain verification, ECDSA-P384 report-signature verification, and measurement/report-data binding, all fail-closed. The chain path is validated against the genuine AMD Milan root chain; the report-signature path is validated with synthetic vectors, since a real report plus VCEK pair needs SEV-SNP hardware. Report generation (`SevSnpProvider.attest`) still requires a real SEV-SNP guest. **Intel TDX and TPM backends are not yet implemented (Tier 3).** Until a backend verifies a real quote end to end against a golden measurement on hardware, cA2A must not be described as fully attested across trust domains.
+
+## Out of scope
+
+- The A2A transport itself. cA2A is a profile on A2A, not a replacement for it.
+- Agent identity issuance beyond delegation.
+- AI model governance beyond delegation and provenance.
+- Hardware TEE platform SDKs and firmware.
+
+## Dependencies on sibling projects
+
+cA2A composes primitives from [agent-manifest](https://github.com/agentrust-io/agent-manifest), [cmcp](https://github.com/agentrust-io/cmcp), and [trace-spec](https://github.com/agentrust-io/trace-spec). Version skew across those repos can change cA2A behavior; pin compatible versions before relying on cross-repo guarantees.

ROADMAP.md

@@ -23,7 +23,7 @@ Already implemented and tested elsewhere; cA2A depends on it rather than reimple
 ## v0.2: Runtime enforcement and sealed channel
 
 - Runtime peer-delegation enforcement: **decision core landed** (`ca2a_runtime.peer.enforce_peer_call`: verify chain, intersect delegated scope with local policy, enforce, emit provenance record; claim C3 validated). Remaining: bind a Cedar policy engine as the local policy, and wire the decision core to a live A2A transport (Tier 2)
-- Sealed peer channel: extend the attestation-gated key pattern to peer-to-peer, so the task payload decrypts only inside the peer's verified enclave (Tier 2)
+- Sealed peer channel: **landed** (`ca2a_runtime.channel`: HPKE-style X25519 -> HKDF-SHA256 -> ChaCha20-Poly1305 sealing to the peer's attested key; claim C4 validated). Remaining: bind the seal to a verified attestation report on a live call, and rely on the enclave to hold the private key (hardware property)
 - Linked runtime evidence: each hop's TRACE record references the parent record hash and delegation credential id, producing a verifiable delegation DAG (Tier 2)
 
 ## Critical path, sequenced first (Tier 3)

docs/spec/call-graph.md

@@ -19,8 +19,8 @@ inbound A2A task
 3. intersect scope with policy  effective_scope(chain, local_policy)   [IMPLEMENTED (decision core)]
       |  the effective grant is delegated scope AND local policy
       v
-4. seal payload to measurement  SealedChannel.seal(...)   [PENDING, Tier 2]
-      |  payload readable only inside the peer's enclave
+4. seal payload to measurement  SealedChannel(peer_pub).seal(...)   [IMPLEMENTED (crypto); attestation binding pending]
+      |  payload readable only with the peer's enclave-bound key
       v
 5. emit linked provenance       enforce_peer_call(...) -> DelegationRecord
       |  DelegationRecord chained to the parent record   [IMPLEMENTED]
@@ -37,7 +37,7 @@ If any step raises, the call is denied. Absence of evidence is denial, not a war
 | 1. Chain verification | Signature, continuity, attenuation, depth bound, anti-replay | `verify_chain` | Implemented |
 | 2. Peer attestation | Peer measurement matches an expected value | `ca2a_verify.sev_snp.verify_sev_snp_report` | SEV-SNP verifier implemented; not yet wired into the call path; report needs hardware |
 | 3. Scope intersection | Delegated scope intersected with local policy | `ca2a_runtime.peer.effective_scope`, `enforce_peer_call` | Implemented (decision core); Cedar engine binding pending (#10) |
-| 4. Payload sealing | Payload sealed to the peer measurement | `SealedChannel.seal` | Pending, Tier 2 (fails closed) |
+| 4. Payload sealing | Payload sealed to the peer's attested key | `SealedChannel.seal`, `open_sealed` | Implemented (crypto); binding to a verified report on the live path pending |
 | 5. Provenance record | A `DelegationRecord` emitted and linked to its parent | `enforce_peer_call`, `record_for`, `verify_dag` | Implemented (emitted by the decision core) |
 | Live A2A transport wiring | The decision core runs off an actual inbound A2A request | (design) | Pending, Tier 2 |
 
@@ -75,9 +75,9 @@ enforce_peer_call(chain, "read", policy=policy, record_id="rec-c")  # raises SCO
 
 A capability is granted only when it is both delegated down the chain and allowed by the local policy; a capability in one but not the other is denied with `SCOPE_NOT_PERMITTED`. The `LocalPolicy` here is a capability allow set; binding a full Cedar policy engine (as cMCP does) is tracked separately (#10). What is not yet wired is the live inbound transport: `enforce_peer_call` is the decision the runtime makes, not yet driven off an actual A2A request. See [cedar-policy.md](cedar-policy.md).
 
-## Step 4: seal the payload to the peer measurement (pending, Tier 2)
+## Step 4: seal the payload to the peer's attested key (crypto implemented)
 
-Once the peer measurement is verified (step 2), the task payload is intended to be sealed to that measurement so it decrypts only inside the peer's verified enclave. Today `SealedChannel.seal` and `SealedChannel.open` raise `SEALED_CHANNEL_ERROR` rather than send plaintext. Do not send confidential payloads across a trust boundary and assume they are protected. See [sealed-channel.md](sealed-channel.md).
+Once the peer's attested public key is known (from its report, step 2), the task payload is sealed to it so only the holder of the peer's private key can open it. The channel is implemented (`SealedChannel(peer_pub).seal(...)` and `open_sealed(...)`, an HPKE-style X25519 -> HKDF-SHA256 -> ChaCha20-Poly1305 scheme). `open_sealed` fails closed with `SEALED_CHANNEL_ERROR` on a wrong key or tampered ciphertext. The property that the payload decrypts *only inside the attested measurement* rests on the private key being enclave-bound (a hardware property from attestation), and binding the seal to a verified report on the live path is still to be wired. See [sealed-channel.md](sealed-channel.md).
 
 ## Step 5: emit a linked provenance record (implemented)