fix(a2a): add Agent Card JWS signature verification and trust policy

.zeph/skills/setup-guide/SKILL.md

@@ -130,6 +130,7 @@ setting that actually governs outbound `--connect` requests.
 ```bash
 export ZEPH_A2A_CLIENT_REQUIRE_TLS=true
 export ZEPH_A2A_CLIENT_SSRF_PROTECTION=true
+export ZEPH_A2A_CARD_TRUST_POLICY=ignore
 ```
 
 Security policy for `zeph --tui --connect <URL>` (remote-TUI attach to another
@@ -142,6 +143,13 @@ as `[a2a]`'s (now-reserved) checks (10.x, 172.16.x, 192.168.x, 127.x) — not sh
 enforcement, since `[a2a]` no longer enforces anything on either path.
 Max body size: request payload limit in bytes (default 1 MiB).
 
+`ZEPH_A2A_CARD_TRUST_POLICY` (`ignore` | `prefer` | `require`, default `ignore`)
+controls peer AgentCard signature + URL-origin verification during discovery (A2A
+1.0.0 §8.4, #5928). `require` needs the crate's `card-signing` feature compiled in
+(part of the `a2a` feature bundle) or config validation fails at startup. Trusted
+verification keys are configured via `[[a2a_client.trusted_agent_keys]]` in
+`config.toml` (no env-var equivalent — see `config/default.toml` for the shape).
+
 ## Tools
 
 Config: `tools.enabled` (default: true) — master toggle for all tool execution.

CHANGELOG.md

@@ -67,6 +67,36 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ### Added
 
+- **A2A**: added optional JWS Agent Card signature verification (A2A 1.0.0 §8.4) and a
+  `require`/`prefer`/`ignore` trust policy for peer discovery (#5928):
+  - `AgentCard.signatures: Vec<AgentCardSignature>` — new, additive, `#[serde(default,
+    skip_serializing_if = "Vec::is_empty")]` field; unsigned/0.2.x peer cards round-trip
+    unchanged (empty on the wire).
+  - New `card-signing` Cargo feature (`crates/zeph-a2a`, `p256` + `serde_json_canonicalizer`,
+    pure-Rust, no `openssl-sys`) enabling ES256 (P-256) verification. Off by default; propagated
+    through the root `a2a` feature (and `full`) alongside the existing `ibct`/`server` features
+    so CI actually compiles and tests the crypto path.
+  - `AgentRegistry::with_trust(policy, trusted_keys)` runs a crypto-free URL-origin
+    (scheme+host+port) consistency check plus signature verification in `discover()`, combining
+    both axes by taking the most severe outcome (reject > warn > accept) and returning
+    `A2aError::UntrustedCard` / `A2aError::UrlMismatch`.
+  - `[a2a_client]` gains `card_trust_policy` (`CardTrustPolicy`, default `ignore` — byte-identical
+    to prior behavior) and `trusted_agent_keys` (`Vec<TrustedAgentKey>`, public keys stored
+    inline, not vault-referenced). `Config::validate()` fails fast if `card_trust_policy =
+    "require"` is set without the `card-signing` feature compiled in, rather than silently
+    degrading or bricking discovery. New `ZEPH_A2A_CARD_TRUST_POLICY` env override and
+    `--migrate-config` step 82 (commented advisory block for existing configs).
+  - **Known limitations, tracked as follow-ups**: the JCS canonicalization and signing-input
+    construction were implemented from the A2A 1.0.0 spec text, not validated against a real
+    `a2a-sdk`-produced signed card (no network access to obtain a reference vector in this
+    environment) — treat `require` as unproven for real-peer interop until a vector lands.
+    `AgentRegistry` still has no runtime construction site in `zeph-core`/`src/`, so
+    `card_trust_policy` is a fully-implemented library knob with no consumer yet (pre-existing
+    gap, not created by this change). The well-known discovery path remains
+    `/.well-known/agent.json` (0.2.x); a pure-1.0.0 peer serving `/.well-known/agent-card.json`
+    is not yet discoverable. `A2A_PROTOCOL_VERSION` stays `"0.2.1"` — this change is one additive
+    1.0.0 feature, not full 1.0.0 conformance. `jku`/JWKS auto-fetch, EdDSA/RS256, and signing
+    our own served card are all deferred.
 - **Config**: documented `[security.shadow_sentinel]` (`ShadowSentinelConfig`) as a commented
   advisory block in `config/default.toml`, and added migration step 81
   (`migrate_shadow_sentinel_config`) so existing configs gain the same discoverable block via