Summary

• Adds optional, feature-gated (card-signing) A2A 1.0.0 AgentCardSignature (JWS/ES256) verification to AgentRegistry::discover(), closing the unauthenticated Agent Card trust gap described in research(a2a): no Agent Card signing/verification — protocol version stuck at 0.2.1 vs. current spec 1.0.0 #5928: peer cards were previously accepted with no signature check and no cross-check between the queried base_url and the card's own url field.
• Adds a tri-state card_trust_policy (ignore/prefer/require, default ignore) that combines signature verification and URL-origin consistency via a most-severe-wins precedence, backed by an out-of-band operator-configured trusted-key store ([a2a_client].trusted_agent_keys) rather than the card-supplied jku URL, which would reopen an SSRF surface this crate already guards against.
• A2A_PROTOCOL_VERSION intentionally stays at "0.2.1" rather than claiming full 1.0.0 conformance — this PR adds one 1.0.0 feature (signatures), not the full spec delta. Well-known path rename, transport bindings, and method-name reconciliation remain unimplemented and are documented as deferred.
• Config validation fails fast at load time if require is set without the card-signing feature compiled in, rather than silently degrading.

Known limitations (tracked as follow-ups, not silently deferred)

• Canonicalization is implemented per the A2A spec §8.4 text but not validated against a real a2a-sdk signed-card vector — no network access to the reference implementation during development. require/prefer may reject genuinely valid peers until this is proven; a tracing::warn! fires at with_trust() call time to surface this to operators. Tracked in validate A2A card signature JWS canonicalization against a real signed-card vector #6201.
• AgentRegistry has no runtime construction site anywhere in this codebase (verified independently by multiple review passes) — card_trust_policy/trusted_agent_keys are fully implemented and tested as a library + config primitive, but nothing in the running agent wires them up yet, so require currently enforces nothing live. Tracked in wire AgentRegistry construction site so card_trust_policy actually enforces #6200.
• No --init wizard or CLI flag for the new [a2a_client] knobs — there is no existing precedent for the sibling require_tls/ssrf_protection fields either (TOML + env only), so none was invented here.

Review process

This went through the full architecture → critique → implementation → parallel validation (tests/perf/security/adversarial critique) → code review pipeline:

• Architecture critic pass found 5 significant gaps (raw-JSON canonicalization vs. typed-struct reserialization, policy axis-combination precedence, require fail-fast, default policy, CI feature wiring) — all folded into the implementation.
• Implementation critic pass found one concrete bug (multi-signature verification was order-dependent — a tampered-but-trusted signature earlier in the array could veto a later valid one, breaking key-rotation scenarios) — fixed with a regression test pinning order-independence in both directions.
• Security audit: PASS, no critical/high findings; a handful of low/informational findings already reflected in code comments and the two follow-up issues above.
• Code review: one round of changes requested (config docs for the new keys/env var were missing from config/default.toml, the setup-guide skill, and both docker-compose files) — fixed and re-approved.

Test plan

• cargo nextest run -p zeph-a2a --features ibct,server,card-signing — 207 passed
• cargo nextest run -p zeph-a2a (no features) — 124 passed
• cargo nextest run -p zeph-config --features card-signing — 778 passed
• cargo nextest run -p zeph-config (no features) — 773 passed
• cargo nextest run --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins — full CI feature set green
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings — clean
• cargo +nightly fmt --check — clean
• Rustdoc gate + cargo test --doc (workspace + per-crate zeph-a2a/zeph-config) — clean
• cargo deny check — advisories/bans/licenses/sources all ok for new deps (p256, serde_json_canonicalizer); no openssl-sys pulled in
• gitleaks protect --staged — clean
• New unit/integration tests cover: legacy unsigned-card backward compat, tampered signature/payload rejection, unknown kid, every policy × axis severity combination, config-load fail-fast, migration idempotency, order-independent multi-signature verification
• Testing playbook (.local/testing/playbooks/a2a.md) and coverage-status row added — status Untested pending a live session (no runtime consumer yet per wire AgentRegistry construction site so card_trust_policy actually enforces #6200)

Closes #5928