Where should verifier-side trust / permit / receipt artifacts for risky external actions live relative to A2A?

I recently published an early discussion draft called **Verifiable Agent Trust Envelope**:

- repo: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope
- release: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/releases/tag/v0.1.0

This is **not** intended as a replacement for A2A.

The narrow question I am trying to isolate is:

> when an external agent wants to perform a risky write against a remote system, what portable artifacts should the relying party verify before allowing the action?

The current `v0.1` wedge is verifier-centered and focuses on `AL2` external digital write decisions.
The repo currently makes that concrete with a verifier flow that evaluates:

`status -> identity -> runtime -> permit -> policy`

and returns:

`allow / attenuate / deny`

with a machine-readable receipt.

My current read is:

- A2A is strong for discovery, messaging, and delegation flow
- but the verifier-side admission decision for higher-risk external actions may need more than an Agent Card or transport-level auth alone
- specifically, it may need portable semantics across actor identity, principal linkage, runtime proof, task-scoped permit, status / attenuation, and receipt

Relevant entry points:

- README: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope#readme
- close adjacent work: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/blob/main/docs/close-adjacent-work-2026-04.md
- spec intro: https://github.com/Poke-nushi/Verifiable-Agent-Trust-Envelope/blob/main/docs/verifiable-agent-trust-envelope-spec-v0.1.md

The question I want help with is narrower than “should A2A adopt this draft?”:

1. if this boundary is real, where should it live relative to A2A
2. should the relevant pieces be modeled as Agent Card extensions, profile-level conventions, or an adjacent spec
3. which parts of the envelope should travel through A2A directly, and which parts should only be referenced
4. should receipt semantics stay entirely outside A2A core

Useful critique would be especially welcome on:

- whether this boundary is already covered by existing A2A mechanisms
- whether the draft is still too broad
- whether the verifier-side ordering is a bad fit for A2A-adjacent use cases

I am explicitly posting this as a discussion draft and requirements question, not as a finished standard proposal.

Review the linked Verifiable Agent Trust Envelope repository and its spec documents. Understand the A2A protocol's existing mechanisms for discovery, messaging, and delegation. The goal is to analyze where trust/permit/receipt artifacts for risky external actions should fit: as Agent Card extensions, profile conventions, or an adjacent spec. Determine which parts should travel through A2A directly versus being referenced.

Scritto dal modello di indicizzazione a partire dal testo della issue.