rfc: propose delegation-link verification, with the vectors that argue it

[lywinged]

Rehearsal PR on the fork. Not for upstream yet — this is where the shape gets reviewed before it is proposed to anyone.

What this is

The delegation block is normative in v0.2 and nothing says what a verifier does with a chain of them. spec/trace-v0.2.md never mentions parent_record_hash or credential_id. The only prose is one sentence in docs/schema.md:

a verifier walks parent_record_hash from a leaf record back to the root and confirms each hop acted under a credential in the delegation chain

Every operative term in it is open — which bytes the digest covers, what "the delegation chain" is when no credential object exists in the schema, what happens to a link the verifier cannot compute. Two implementations can satisfy every constraint this repository states today and agree on nothing.

• docs/rfcs/a2a-delegation-profile.md — ten rules over fields that already exist. No schema change.
• examples/delegation-link/ — 23 vectors, generator, published seed.
• tests/test_delegation_vectors.py — the reference walk and the correctness run.
• tests/test_delegation_completeness.py — margin, independence, and the ratchet.

Requirement keywords in the RFC are lowercase on purpose. It binds nothing until adopted, and a proposal that writes itself in the imperative is a specification nobody agreed to.

Three forks that had to be settled before a vector could exist

Each is in the RFC with its derivation, not asserted.

The digest covers the complete parent record, signature included. A digest over the signed body alone does not bind the parent's signer: anyone may re-sign identical bytes under another key and satisfy the child's commitment, so the child would have committed to what its parent said and not to who said it. Vector 05 is a complete, correctly signed chain whose only defect is which bytes its link was computed over — under one reading it verifies, under the other the link resolves to nothing.

A consequence worth stating, because it changes what an attacker can reach: every ancestor's bytes are committed to by its child, so no record on a chain can be altered in place except the leaf. An ancestor with an invalid signature has to be built that way before its child signs. That is why every defect here is a build-time parameter of the generator and none is a post-hoc mutation.

There is no cycle rule. A cycle needs each record's block to carry a digest covering the block that names it back, which is a hash collision — a rule against it would be untestable by construction. The reachable analogue is an unbounded chain, and that is the only reason the depth bound exists. Said out loud so a reader can tell which of the two was decided and which was forgotten.

A link naming an algorithm the verifier cannot compute makes the chain unverifiable, not invalid. Reporting parent_not_found for it would be a finding nobody made: the verifier did not fail to find the parent, it did not look. This is the delegation-surface instance of the semantics merged in docs/verification.md, and parent_not_found is explicitly guarded on algorithm support so the two cannot be produced for one link.

Coverage

Ten rules, two load-bearing vectors each, and for every rule at least one declared implementation defect that one vector catches and the other misses — agentrust-io#124's criterion, applied from vector 1 rather than as a later hardening pass. The defects model real shortcuts: verifying the leaf only, anchoring on any trusted key found, an off-by-one bound, case-insensitive lookup of an opaque identifier, issuer and holder compared to the wrong ends of the hop, half a validity window, narrowing checked at one hop, the link algorithm read once and assumed uniform.

Two of those declarations found faults in the walk while it was being written, which is the argument for declaring them rather than asserting margin and stopping:

• The walk's break condition repeated the depth comparison, so a weakened bound never got to walk further than a correct one. Both depth vectors moved together under every mutation — margin without independence, which is precisely what test(conformance): single-vector coverage has no margin — define and enforce independence agentrust-io/trace-spec#124 says a second vector must not be. The walk now breaks for one reason and terminates on a visited set.
• Deleting digest_algorithm_unsupported from the registry made the walk step off the end of the index and raise, because control flow was reading the registry's contents. A registry whose entries exist to be mutated cannot carry cross-rule invariants that crash. Whether the walk can continue is now asked as a structural question; the registry only says why not.

Neither is visible from a green test run. Both came out of mutation.

Reproducibility

Keys derive from one published seed by role label — no secret, reissuable by anyone. tests/test_generators_reproduce_fixtures.py (agentrust-io#171) discovered the generator with no new guard code and holds it to byte reproduction with no entry in the NOT_GENERATED ledger. That is the bar agentrust-io#178 proposes for this repository's corpora, adopted here from the first vector rather than retrofitted.

Every record in every vector — including the ones built to fail — validates against schema/trace-claim.json. A defect the schema already rejects is not a profile defect, and a rule that looks covered only because its vector is malformed in some louder way is not covered.

Scope

Nothing enters the package's public API. The walk lives in tests/, beside the action-receipt verifier it is modelled on, because the rules it implements are not normative yet. Vector ids are TRACE-DELEG-NNN and deliberately not ACTION-* — that namespace belongs to ca2a's conformance set, whose own rule is that its identifiers are never reused.

Not covered, and named in the RFC rather than left to be noticed: credential format, revocation, authorization withdrawn before execution and authority-epoch staleness (the two gaps agentrust-io#66 has already named), and cross-verifier agreement.

That last one is the load-bearing omission. One implementation passing its own corpus is self-agreement. What would make this a profile rather than a local convention is these same vectors run through ca2a_verify and agent_manifest.verify_delegation_chain — both public, both shipping, and ca2a/src/ca2a_runtime/delegation/credential.py already claims the two are cross-verifiable while nothing in any of the three repositories tests that claim.

Checks

585 passed, 1 skipped
ruff check .            All checks passed!

tests/test_sign.py::test_verify_record_future_skew_is_deployment_configurable flaked once during this work and is unrelated: it sets iat = int(time.time()) + 601 and asserts a raise at max_future_skew_seconds=600, so crossing a single second boundary between the two calls makes the skew exactly 600 and the raise does not happen. A one-second margin, pre-existing, reproducible on a clean tree by timing alone. Filed separately rather than touched here.

Review focus

1. §4.1 — is the complete-record reading right, and is the re-signing argument the actual reason or a rationalisation of a choice made for convenience?
2. The credential registry as verifier context. It is modelled this way because nothing in the schema describes a credential. The alternative is a schema change and a much larger proposal.
3. data_class narrowing (D-9). It is the only scope-like comparison the current fields support, and it may belong with a general scope model rather than with delegation.
4. Whether tests/ is the right home for a reference walk that a third party might want to run.

---

Generated by Claude Code

[github-actions]

❔ Contributor Check: UNKNOWN

Check	Result
Profile	UNKNOWN
Credential	LOW
Overall	UNKNOWN

Automated check by AgenTrust Contributor Check.

[lywinged]

Closing: this landed upstream as agentrust-io#184 on 23 August, and leaving the branch open here makes it look like the work is still pending when it is merged.

Checked rather than assumed. Of the 31 paths this branch touches, 30 are byte-identical on upstream/main: the 23 delegation-link vectors, gen_delegation_vectors.py, examples/delegation-link/README.md, tests/test_delegation_vectors.py, tests/test_delegation_completeness.py, tests/delegation_margins.json and the test_adequacy_all_sets.py registration.

$ git diff --stat upstream/main origin/a2a/delegation-link-conformance -- $(git diff --name-only \
    $(git merge-base upstream/main origin/a2a/delegation-link-conformance) \
    origin/a2a/delegation-link-conformance)
 CHANGELOG.md | 14 --------------
 1 file changed, 14 deletions(-)

The single remaining file is CHANGELOG.md, and the direction of that diff is the point: it is 14 lines upstream has that the branch does not, from agentrust-io#199, agentrust-io#219 and agentrust-io#222, all merged after this branch was cut. Nothing that originated here is missing upstream.

---

Generated by Claude Code