Probity A2A-Mesh-Scorecard,v2

predicateType: https://getprobity.dev/predicate/v2/a2a-mesh-scorecard

An A2A-mesh-scorecard is a signed, offline-verifiable, composition-safety verdict about a mesh of agent-to-agent (A2A) microVMs. Where an adversarial-execution-evidence attestation records one SUT's bounded adversarial campaign, and a security-verdict reports one artifact's outcome against an attack corpus, an A2A-mesh-scorecard binds an aggregate subject - the whole mesh - and carries the verdict of an offline mesh evaluator over the delegation graph the mesh produced: did authority attenuate correctly as it flowed hop-to-hop, or did some hop broaden scope, break lineage, or escape its token?

The aggregate subject is a MeshManifest: the N member microVMs, each bound to its frozen-VM byte-identity substrate root and its execution-grounded model bill-of-materials, plus the transport hop-observation log and the closed-world egress-policy digest. The verdict surface is the MeshVerdict produced by an offline evaluator that replays the hop log - never re-run at verification time, and never parsed by the transport layer that recorded it (the layering rule below).

This document specifies the predicate body. The signing envelope, subject binding, and offline-verify mechanics are in signing-envelope.md. The member substrate roots are byteident proofs and the per-member model BOM is the ml-bom shape; the freeze-atomicity soundness of the underlying substrate is the mesh-quiescence attestation.

The key words MUST, MUST NOT, REQUIRED, SHOULD, MAY, and OPTIONAL are to be interpreted as in RFC 2119.

Subject

The subject is the MeshManifest, by aggregate digest - a single SHA-256 that commits to WHO ran (member ids), on WHAT frozen substrate (per-member substrate roots), with WHAT model weights (per-member ModelBOM digests), over WHAT delegation graph (hop log), under WHAT closed-world boundary (egress-policy digest).

"subject": [
  { "name": "<mesh-topology-label>", "digest": { "sha256": "<64-hex-mesh-manifest-digest>" } }
]

The MeshManifest digest is computed over a member-id-sorted canonical projection of the manifest, so the digest is stable regardless of the order in which members were discovered. A producer MUST NOT synthesize a missing member substrate root, ModelBOM, or egress-policy digest; an empty or incomplete mesh is refused, never bound. The manifest schema is the reference implementation's MeshManifest (cited below); this predicate binds it by digest and projects the per-member evidence, rather than re-embedding the full BOMs.

Predicate

{
  "member_count": 2,
  "bound_members": [
    {
      "member_id": "mesh-member-a",
      "substrate_root": "<64-hex>",
      "substrate_proof_type": "fold-correctness-v1",
      "model_bom_digest": "<64-hex>",
      "model_bom_entries": 1,
      "model_bom_unresolved": 0
    }
  ],
  "hop_count": 2,
  "hop_log_sha256": "<64-hex>",
  "egress_policy_digest": "<64-hex>",
  "verdict": {
    "scope": "ATTENUATED",
    "lineage": "CONTINUOUS",
    "reason": "all downstream hops attenuate under the root grant",
    "causes": []
  },
  "composition_safe": true,
  "verdict_rendered": "SAFE",
  "quiescence_sound": true,
  "quiescence_evidence_digest": null,
  "honest_scope": {
    "substrate_roots_real": false,
    "hop_graph_live": false,
    "note": "ILLUSTRATIVE SUBSTRATE: ...",
    "quiescence_tier": "..."
  },
  "engine_commit": "<engine/schema-commit>"
}

Field semantics

• member_count (REQUIRED, integer) - the number of mesh members. Equals len(bound_members).

• bound_members (REQUIRED, array) - the per-member evidence projection, sorted by member_id. Each entry binds one frozen microVM's substrate and model surface so a reader can join the routing graph (the hop log's target_agent) to the member that ran it, and fetch the full BOM by id:

  • member_id (REQUIRED, string) - the member microVM's mesh identity. It matches the target_agent a hop records when delegating to this member.
  • substrate_root (REQUIRED, 64-hex) - the per-page Merkle root of this member's frozen-VM byte-identity capture (the byteident substrate-integrity root). Binding by root, not the whole proof, keeps the scorecard a pure subject-binding artifact; the proof is served alongside, keyed by the root.
  • substrate_proof_type (REQUIRED, string) - the byteident proof-family discriminator the root came from (for example fold-correctness-v1, clone-uniqueness-v1, entropy-uniqueness-v1), so a reader knows which proof family to fetch and verify for this member.
  • model_bom_digest (REQUIRED, 64-hex) - the SHA-256 of this member's canonical ml-bom ModelBOM, binding WHAT model surface the member ran without re-embedding it.
  • model_bom_entries (REQUIRED, integer) - the count of resolved BOM entries.
  • model_bom_unresolved (REQUIRED, integer) - the count of unresolved (honest-gap) BOM regions.

• hop_count (REQUIRED, integer) - the number of delegation hops in the hop log.

• hop_log_sha256 (REQUIRED, 64-hex) - the SHA-256 of the deterministic JSONL hop-observation log. The hop log is the closed-world who-called-whom record over which the offline evaluator's verdict was computed; this digest binds the exact graph the verdict was derived from. The HopObservation record schema is specified below.

• egress_policy_digest (REQUIRED, 64-hex) - the SHA-256 of the canonical egress policy in force, the closed-world boundary that makes the proxy the sole inter-agent channel. Equal to the manifest's egress digest and to the mesh-quiescence attestation's egress_policy_digest for the same mesh.

• verdict (REQUIRED) - the offline mesh evaluator's MeshVerdict. The producer carries it verbatim; it never re-runs the evaluator at verification time. Fields:

  • scope (REQUIRED, string) - the AttenuationClass: the worst downstream authority scope observed across the graph. The benign value is ATTENUATED (no provable escalation). Other values name a broadening relationship.
  • lineage (REQUIRED, string) - the ContinuityClass: whether the delegation lineage (context-id continuity across hops) is intact. The benign value is CONTINUOUS.
  • reason (REQUIRED, string) - a human-readable summary of the verdict.
  • causes (REQUIRED, array of strings) - the trace-to-auth-downgrade invariant cause set: the specific composition-safety violations the evaluator found. Each value MUST be from the closed auth_downgrade_cause vocabulary (see below); an unknown cause is rejected, not silently bound. An empty array means no composition-safety violation was found.

• composition_safe (REQUIRED, boolean) - the derived safety flag: true iff verdict.scope equals ATTENUATED and verdict.causes is empty. This is the single machine-readable admission bit a consumer reads.

• verdict_rendered (REQUIRED, string) - "SAFE" or "UNSAFE", derived from composition_safe. A display convenience; automated consumers read composition_safe and the structured verdict.

• quiescence_sound (REQUIRED, boolean) - whether the freeze-atomicity tier for this mesh's substrate was demonstrated sound (the mesh-quiescence leg). For a synthetic fixture this is a TEMPLATE value, not a measured result; the honest_scope block says which.

• quiescence_evidence_digest (OPTIONAL) - the SHA-256 of the companion mesh-quiescence bundle this scorecard cross-references, or null when none is bound. When present, a verifier can fetch and verify that the freeze-atomicity evidence behind quiescence_sound exists and is itself signed.

• honest_scope (REQUIRED, object) - the maturity-honesty block. Two orthogonal booleans replace the retired coarse is_synthetic_fixture flag, because "real jailed mesh" is two independent claims:

  • substrate_roots_real (REQUIRED, boolean) - true iff each member's substrate root was computed over a real frozen .mem from a jailed microVM (vs an illustrative placeholder).
  • hop_graph_live (REQUIRED, boolean) - true iff the A→B→C delegation was observed live on the wire by the host mesh-relay (vs replayed from the canonical adversarial chain). hop_graph_live=true with substrate_roots_real=false is incoherent (a live hop implies the members ran sealed). A conformant PRODUCER MUST NOT emit this pair - it has no legal state and the producer fails closed at construction; a VERIFIER, by the verifier-tolerant rule, still treats a received (false, true) as illustrative rather than rejecting the whole predicate.
  • note (REQUIRED, string) - the human-readable scope statement. For a synthetic fixture it states plainly that the per-member roots, BOM digests, and hop-graph verdict are illustrative and that this is NOT a live certification.
  • quiescence_tier (REQUIRED, string) - a note on what the quiescence_sound flag reflects and that a synthetic fixture's flag is a template value.

• engine_commit (REQUIRED, string) - the auditor-pinnable engine/manifest-schema commit, in the spirit of an SLSA builder.id. Honesty: an identity to compare, not a means to re-derive the producer.

• resident_members (OPTIONAL, array of strings) - the subset of member ids whose VMs were frozen WITH in-flight delegation state at the freeze instant - the memory-co-resident set the host relay reports. This is orthogonal to honest_scope.hop_graph_live: hop_graph_live says the delegation topology was observed on a real wire, whereas resident_members says which members were still memory-resident when the cohort was frozen. The two can diverge for async/streaming delegations, where an upstream member can tear down before the terminal freeze even though its hop was observed live; in a synchronous-nested run every member is resident, in an async run only a subset is. Every id MUST be a member id present in bound_members; a producer MUST NOT bind an id that is not in the mesh. The field is absent when the producer reports no resident set (an old verifier ignores it), and an empty array means no member was resident. It does NOT change the two honest_scope booleans. Values are sorted and deduplicated.

Forward-compatibility: a verifier MUST ignore unknown fields in the predicate and unknown keys in honest_scope or in a bound_members entry. A producer MAY add fields additively within v2.

auth_downgrade_cause vocabulary (closed)

verdict.causes draws from the closed trace-to-auth-downgrade invariant cause set. As with the vocabulary registry, this enumeration is fail-closed at a version: a verifier MUST reject any cause not in this list. The registered causes are:

IDENTITY_MISMATCH
TEMPORAL
DOWNGRADE
SCOPE_BROADENING
TOKENLESS_BREAK

• IDENTITY_MISMATCH - a hop's verified identity does not match the identity the delegation graph requires (the callee is not who the lineage says it should be).
• TEMPORAL - a hop violates a temporal ordering invariant (a delegation references a task or context that, by timestamp, could not yet exist).
• DOWNGRADE - an authentication or attenuation downgrade across a hop (the invariant's namesake: authority that should only narrow instead loses a binding).
• SCOPE_BROADENING - a downstream hop requests or is granted a broader scope than its caller held - the core composition-safety failure.
• TOKENLESS_BREAK - a hop proceeds without the attenuation token the lineage required (an authority break with no token to bound it).

The full vocabulary registration is in vocabulary-registry.md.

HopObservation record schema

The hop log committed by hop_log_sha256 is deterministic JSONL: one HopObservation per line, sorted keys. The record is the transport-level subset of one observed delegation hop. The recording layer (the host mesh-router in the reference implementation) observes only what it can see at the wire chokepoint without parsing the forwarded card-JWS or attenuation token - it records WHO forwarded to WHOM and WHETHER a token was present by header presence only. The scope / identity / token-grant fields are emitted at their empty encodings; the offline evaluator derives those facts (Tier-1 from the callee card, Tier-2 from the token) when it replays the log. Parsing a JWS at the transport layer would be a layering violation.

Per-hop record (the mesh-router's hopWire contract):

The router emits compact-separator JSON; the offline evaluator's record_hops produces the same key set with spaced separators. The two are SEMANTICALLY identical JSON and replay to the same verdict - the conformance property that matters is verdict-equality on replay, not byte-equality across the language boundary (cited from the mesh-router's documentation).

Verification (third-party, offline)

After the envelope checks in signing-envelope.md succeed:

1. Confirm the subject digest equals the MeshManifest aggregate digest the verifier intends to bind to (recomputing it from the served manifest if available).
2. Validate every verdict.causes value against the closed auth_downgrade_cause vocabulary; reject any unknown cause.
3. Confirm composition_safe == (verdict.scope == "ATTENUATED" and verdict.causes == []) and that verdict_rendered agrees.
4. For each bound_members entry, optionally resolve substrate_root to its byteident proof (the substrate_proof_type names the family) and model_bom_digest to the served ml-bom, confirming the served BOM canonical-hashes to the bound digest.
5. If quiescence_evidence_digest is present, resolve and verify the companion mesh-quiescence bundle and confirm it backs the quiescence_sound claim.
6. Read honest_scope.substrate_roots_real + hop_graph_live: when substrate_roots_real is false the per-member roots are illustrative (not a jailed run); when hop_graph_live is false the delegation is the canonical chain, not observed live. Only (true, true) is a fully live jailed-mesh certification; (true, false) is real sealed images with replayed delegation. (false, true) is incoherent — treat as illustrative.
7. If resident_members is present, confirm every id is one of the bound_members[].member_id, and read it as the frozen-mid-delegation subset - the members memory-co-resident at the freeze. Do NOT conflate it with hop_graph_live: a member can be observed on the wire (counted toward hop_graph_live) yet not be in resident_members if it tore down before the terminal freeze. When the field is absent, the producer reported no resident set; an empty array means none were resident.

No live execution environment is required, and the offline evaluator is NOT re-run; the verdict it produced is carried under the signature.

What a verifier can and cannot independently check (honesty)

• A verifier CAN confirm the scorecard is authentic, bound to its MeshManifest subject, signed by a trusted key, that the causes are all registered, and that composition_safe is consistent with the recorded verdict; and it can fetch and verify the per-member byteident proofs, the model BOMs, and the companion quiescence evidence to confirm the bound evidence exists.
• A verifier CANNOT, from the scorecard alone, confirm that the offline evaluator ran the way the producer reports, nor that the hop log is the real delegation graph the mesh produced (the verdict and the hop log are producer self-assertions carried under the signature). The scorecard's guarantee is integrity, provenance, subject binding, and internal consistency - plus the ability to chase every bound digest to its served evidence - not external re-execution of the mesh evaluation.

Why no perimeter sandbox can emit it (rationale)

The aggregate subject is the standards-capture point. A perimeter sandbox can record an application's A2A calls, but it cannot bind each mesh member to a frozen-VM byte-identity substrate root (byteident is a hypervisor-boundary capture) nor to an execution-grounded ml-bom (the BOM's identity sources read the host's view of guest memory, not the application's API). The hop log's value is that it is recorded at the sole inter-agent proxy chokepoint in a closed-world mesh - a topology a perimeter sandbox does not impose. A competitor can copy the verdict shape; it cannot honestly fill substrate_root, model_bom_digest, or a closed-world hop log without the hypervisor-boundary substrate.

Status and maturity

• Format and verification: stable, real. The envelope, the aggregate subject binding, the auth_downgrade_cause vocabulary check, and the offline-verify procedure are implemented; the shipped bundle verifies under the pinned key (see the conformance vectors in conformance.json).
• Shipped bundle: real escalation verdict over the A->B->C fixture (illustrative substrate). The shipped signed bundle binds the non-trivial escalating A->B->C delegation mesh: the orchestrator A holds a read grant, delegates to B (which attenuates faithfully), and B delegates to C which broadens to write. The hop graph (hop_count == 3) and the offline evaluate_mesh verdict are REAL -- the evaluator's verbatim output: scope == "ESCALATED", lineage == "CONTINUOUS", causes == ["SCOPE_BROADENING"] (the RUNTIME-CS-DELEGATION gate catch), so composition_safe == false and verdict_rendered == "UNSAFE". honest_scope is (substrate_roots_real=true, hop_graph_live=false): the three members were booted sealed in their own microVMs and frozen, so the per-member substrate_root values are REAL page-merkle byte-identity roots (substrate_proof_type == "page-merkle-root-v1", three byte-distinct values, each cross-checked against the member's signed freeze-binding). The A→B→C delegation is still the canonical adversarial chain, not observed live. The ModelBOM is honestly empty for every member. The detection + substrate legs are real and re-verifiable; only the on-the-wire-observation leg is not yet.
• Shipped: Phase 1a (real sealed substrate roots). cmd/mesh-assemble over three frozen .mem snapshots → real roots → (substrate_roots_real=true, hop_graph_live=false).
• Open deliverable: Phase 2 (live on-the-wire delegation). A host-side L7 mesh-relay observes a live A→B→C delegation and freezes the cohort in-flight at the escalating hop → (true, true). The builder and signer consume the real manifest unchanged (the --manifest path; --hops-live flips the second boolean). See research/62-mesh-cli-substrate-roots/PLAN.md.
• quiescence_sound here is a template value carried alongside the fixture-derived manifest, not a measured freeze result tied to this specific mesh.

Related standards

• adversarial-execution-evidence - the single-agent adversarial-execution attestation; this is its multi-member composition-safety analog.
• mesh-quiescence - the freeze-atomicity attestation behind quiescence_sound.
• ml-bom - the per-member execution-grounded model bill-of-materials bound by digest.
• in-toto / DSSE
  • the envelope; see signing-envelope.md.
• SLSA VSA - engine_commit follows the VSA builder.id idea.

Versioning

Why v2 exists

v2 renames the engine-identity field to engine_commit. v1 spelled that field with a vendor-specific name, which a vendor-neutral standard other implementers are expected to emit must not require. Renaming a REQUIRED key is breaking under the rule stated below, so it takes a new predicateType URI rather than a silent in-place edit: one type URI never means two shapes. There is no alias and no dual-read compatibility path, and v1 is withdrawn - a verifier reads engine_commit or it rejects the statement.

Rule

This is the a2a-mesh-scorecard v2 predicate. Adding a new optional field is additive and stays within v2; a verifier ignores fields it does not recognize. The OPTIONAL resident_members field was added additively (it does not change predicateType, the subject digest, or any required field). A rename or removal of a field, a change to the verdict shape, a change to the composition_safe derivation, or a change to the HopObservation record key set is breaking and requires a new major version. The auth_downgrade_cause vocabulary follows the vocabulary registry's own versioning (an added cause is a registry revision; a renamed or removed cause is breaking).