[QUESTION]Delegation Validator Check

The current delegation validator checks as_signature presence but does not verify it, and the least-privilege/scope-escalation integration tests are placeholders. Draft-02 requires per-record AS signature verification and cumulative scope narrowing. Would you accept a focused PR adding a pluggable delegation-record verifier, AS-key resolution, real negative tests, and a scope-narrowing interface, without attempting the complete agent-to-agent issuance flow?

Start with the delegation validator and the placeholder least-privilege and scope-escalation integration tests mentioned in the issue, then compare their behavior with Draft-02. Define what the pluggable verifier, AS-key resolution, per-record signature checks, negative tests, and cumulative scope-narrowing interface must cover; done means those checks are real without implementing the complete agent-to-agent issuance flow.

Written by the indexing model from the issue text.