Bilateral signed interaction records as the trust primitive for A2A

## Summary

A2A has identity proposals, trust scoring proposals, audit proposals, and delegation proposals. They're all separate systems that need to be wired together. There's a simpler path: one data structure that handles all of them.

A bilateral signed interaction record is one JSON object, signed by both parties, recording what happened between two agents. Trust, reputation, audit trails, Sybil resistance, and delegation evidence all derive from the graph of these records.

## Problem

The current proposal landscape for trust in A2A:

- Identity: Agent Cards, DID documents, OATR registry (#1672, #1575, #1712)
- Trust scoring: signal taxonomies, behavioral attestation (#1628, #1501)
- Audit: evidence envelopes, action receipts, hash chains (#1713, #1583)
- Delegation: scoped tokens, capability chains (#1716)
- Sybil resistance: token gating, vouching, manual review

Each one solves its own problem but they don't compose. An agent that wants identity, trust, AND audit needs to integrate 3+ separate protocols. And most of these rely on single-party attestation, where one entity reports what happened. If that entity is compromised or lying, the data is worthless.

## Proposed solution

One record type. Both the requesting agent and the serving agent sign it.

```json
{
"type": "interaction",
"public_key_a": "ed25519:abc...",
"public_key_b": "ed25519:def...",
"sequence_number_a": 42,
"sequence_number_b": 17,
"previous_hash_a": "sha256:...",
"previous_hash_b": "sha256:...",
"timestamp": 1743897600000,
"transaction": {
"task_id": "a2a:task/uuid",
"action": "task_completed",
"quality": 0.87,
"skill": "code_review"
},
"signature_a": "ed25519:...",
"signature_b": "ed25519:..."
}
```

Each record links to the previous one for both parties (like a personal chain per agent, no global ledger). What falls out of this:

**Identity** is the Ed25519 keypair. No registry required, works offline.

**Trust scores** are computed from the graph using NetFlow or MeritRank. An agent with 50 cosigned interactions across diverse counterparties has a verifiable track record. Graph topology catches Sybil rings automatically since fake identities cluster together with few external connections.

**Audit trails** are the records themselves. Both parties hold matching copies. EU AI Act Article 12 ready.

**Delegation** is a scoped record: agent A authorizes agent B to act on its behalf, with TTL bounds and depth limits. The delegation record is cosigned.

**Sybil detection** comes from graph analysis. Clustering coefficient, subgraph independence, connectivity diversity. Five fake agents rating each other stick out because they form an isolated cluster.

**Negative reputation** works because both parties signed. You can't fabricate a negative review since it requires the counterparty's signature. And you can't deny a bad outcome since the other party holds the same record.

The graph also powers trust-weighted agent discovery (same idea as PageRank, but over interactions instead of links), behavioral anomaly detection at runtime, and dispute resolution where both parties hold cosigned evidence a mediator can verify.

## How this maps to existing A2A concepts

- `AgentCard.trust_profile` could include `interaction_count`, `trust_tier`, `graph_metrics`
- `trust.signals[]` from #1628 gets a new type: `cosigned_interaction_history`
- Task completion in A2A could optionally produce a bilateral record as post-task evidence (complementing #1713 OBO envelopes)
- The `verifiedIdentity` work from #1672 provides the identity layer; bilateral records provide the behavioral layer on top

## Reference implementation

Built and running:
- Rust sidecar with 23 HTTP endpoints, gRPC, MCP server with 7 trust tools, ~500 tests
- Python SDK with 475 tests, `@audited` decorator, sidecar auto-download
- TypeScript SDK with 165 tests, zero deps
- 12 framework adapters including LangGraph, CrewAI, AutoGen, Google ADK
- Transparent HTTP proxy for zero-code integration

Live demo with 21 LLM agents in a full economy with trust-based hiring, quality verification, graduated sanctions, and 10 economic mechanisms running: http://5.161.255.238:8888

Source: https://github.com/viftode4/trustchain

## Related issues

- #1672 (identity verification): bilateral records complement Agent Cards with behavioral history
- #1628 (trust signals): cosigned interaction history as a signal type
- #1713 (OBO accountability): bilateral records as the evidence primitive underneath OBO envelopes
- #1583 (closed, audit evidence): similar direction but unilateral; bilateral cosigning is the missing piece
- #1575 (APS implementation): bilateral records could be the evidence layer APS consumes
- #1667 (offline agents): bilateral records verify with just two public keys, no online dependency

## Questions

1. Would `cosigned_interaction_history` fit as a signal type in the trust.signals[] taxonomy from #1628?
2. Should post-task bilateral records be an optional extension to A2A task completion, or a separate protocol that references A2A task IDs?
3. Is there interest in test vectors for bilateral record verification that other implementations could use for interoperability testing?