Agent-to-Agent (A2A)
Accountability Protocol v0.6.0

Abstract

TrustAgentAI A2A Accountability Protocol v0.6.0 extends the previous A2A receipt model with a hardened evidence lifecycle for AI-driven financial actions.

Earlier versions established signed Intent, Acceptance, Execution, optional Ack, DAG-based receipt history, Merkle anchoring, and Content Provenance. Version 0.6.0 focuses on a harder operational question:

A signature can stop an outsider from forging a transaction. It does not fully solve insider disputes, record deletion, ambiguous key rotation, missing content, or two counterparties presenting conflicting histories after the fact.

New in v0.6.0: the protocol adds durable custodied keys, append-only hash-chain continuity, independent inline witness co-signing, public checkpoint anchoring with heartbeat, encrypted WORM content storage, key transparency, and disciplined degraded-mode operation.

Threat Model NEW v0.6

v0.6.0 is designed for high-value workflows where AI agents trigger financial actions such as refunds, payouts, wire transfers, vendor payments, inter-company settlements, or regulated operational changes.

Terminology

Evidence Lifecycle

The base A2A flow remains: Intent → Acceptance → Execution → optional Ack. v0.6.0 hardens the evidence lifecycle around this flow.

Intent
  → Acceptance
  → Execution
  → Witness Co-Signature
  → Append-Only Hash-Chain
  → Encrypted WORM Store
  → Public Checkpoint Anchor
  → Dispute Pack

Data Formats

5.1 Intent Envelope

{
  "envelope_type": "IntentEnvelope",
  "spec_version": "0.6",
  "trace_id": "urn:uuid:550e8400-e29b-41d4-a716-446655440000",
  "timestamp": "2026-04-20T10:15:30.123Z",
  "expires_at": "2026-04-20T10:16:00.000Z",

  "initiator": {
    "did": "did:workload:refund-agent-01",
    "vc_ref": "urn:credential:refund-limit-policy-099"
  },

  "target": {
    "did": "did:workload:payment-mcp-server",
    "mcp_deployment_id": "payments-prod-cluster-1",
    "tool_name": "issue_refund",
    "tool_schema_hash": "sha256:e3b0...285",
    "mcp_session_id": "sess_98765abc"
  },

  "payload": {
    "args_hash": "sha256:a5b9...9f1",
    "nonce": "8f42d9a1"
  },

  "signatures": [{
    "role": "proxy",
    "kid": "did:workload:proxy-A#key-7",
    "alg": "EdDSA",
    "signed_digest": "sha256:c4d3...e21",
    "value": "eyJhbGciOiJFZERTQSJ9..."
  }]
}

5.2 Witness Receipt NEW v0.6

{
  "envelope_type": "WitnessReceipt",
  "spec_version": "0.6",
  "trace_id": "urn:uuid:550e8400-e29b-41d4-a716-446655440000",
  "timestamp": "2026-04-20T10:15:31.180Z",

  "witness": {
    "did": "did:workload:independent-witness-01",
    "jurisdiction": "US",
    "service_policy_hash": "sha256:ab12...ff9"
  },

  "observed": {
    "intent_hash": "sha256:c4d3...e21",
    "acceptance_hash": "sha256:8f42...1a2",
    "execution_hash": "sha256:9f86...d46",
    "hash_chain_head": "sha256:3a91...c0f"
  },

  "decision": "WITNESSED",
  "finality_required": true,

  "signatures": [{
    "role": "witness",
    "kid": "did:workload:independent-witness-01#key-3",
    "alg": "EdDSA",
    "signed_digest": "sha256:77b4...31c",
    "value": "eyJhbGciOiJFZERTQSJ9..."
  }]
}

5.3 Checkpoint Anchor

{
  "checkpoint_type": "PublicCheckpoint",
  "spec_version": "0.6",
  "checkpoint_id": "chk_20260420_000042",
  "timestamp": "2026-04-20T10:16:00.000Z",
  "chain_head": "sha256:3a91...c0f",
  "merkle_root": "sha256:0b54...9ab",
  "entry_count": 128,
  "anchor_ref": {
    "network": "base-sepolia",
    "tx_hash": "0x63d0...8c0b"
  },
  "heartbeat_status": "ON_TIME"
}

5.4 Key Transparency Event NEW v0.6

{
  "event_type": "KEY_ROTATION",
  "spec_version": "0.6",
  "subject_did": "did:workload:proxy-A",
  "timestamp": "2026-04-20T09:00:00.000Z",

  "previous_kid": "did:workload:proxy-A#key-6",
  "new_kid": "did:workload:proxy-A#key-7",
  "new_public_key_hash": "sha256:f14a...91c",

  "endorsement": {
    "signed_by": "did:workload:proxy-A#key-6",
    "signed_digest": "sha256:ab87...d11"
  },

  "registry_entry_hash": "sha256:0f98...c3e"
}

5.5 Degraded Mode Marker NEW v0.6

{
  "degraded_mode": true,
  "reason": "WITNESS_UNAVAILABLE",
  "started_at": "2026-04-20T10:14:00.000Z",
  "max_value_usd": 50,
  "max_duration_seconds": 300,
  "reconciliation_deadline": "2026-04-20T10:24:00.000Z",
  "requires_post_facto_witness": true
}

Validation Rules

Time and Replay

• →expires_at MUST be strictly greater than timestamp.
• →Verifier MUST reject if current_time > expires_at + skew_tolerance.
• →Recommended skew tolerance is 5 seconds.
• →Nonce uniqueness MUST be enforced per (initiator.did, nonce).

Witness Finality

• →High-value actions SHOULD require a valid WitnessReceipt before finality.
• →Witness signature MUST verify against the current key-transparency registry state at the time of the action.
• →Witness MUST bind intent, acceptance, execution, and hash-chain head into the signed observation.

Key Transparency

• →Key rotation MUST be endorsed by the prior valid key unless an explicit recovery process is invoked.
• →Revocation events MUST be append-only and MUST NOT silently overwrite prior key state.
• →Dispute verification MUST use key state as of the event timestamp, not current database state.

Independent Inline Witness NEW v0.6

The independent witness is an inline co-signing party for high-value transactions. It does not replace the initiator or executor. It creates an additional evidence surface outside the two primary parties.

The witness MAY see only cryptographic commitments and policy metadata, not raw transaction contents. The witness signs what it observed: the transaction hashes, timestamps, policy reference, chain head, and finality state.

Append-Only Hash-Chain NEW v0.6

v0.6.0 adds hash-chain continuity on top of the DAG ledger. Each local evidence entry references the previous chain head. Editing or deleting prior entries breaks continuity or creates a provable gap.

{
  "entry_id": 104594,
  "trace_id": "urn:uuid:550e...",
  "event_type": "WITNESS_RECORD",
  "prev_entry_hashes": [
    "sha256:f8a...1b9",
    "sha256:2c4...e81"
  ],
  "prev_chain_head": "sha256:3a91...c0f",
  "artifact": { /* WitnessReceipt */ },
  "entry_hash": "sha256:7a2...8c4",
  "new_chain_head": "sha256:5bc...9aa"
}

Checkpoint Anchoring + Heartbeat

Public checkpoint anchoring commits compact cryptographic state to an external timeline. Raw transaction data, PII, secrets, prompts, arguments, and outputs MUST NOT be written on-chain.

The heartbeat mechanism makes downtime or anchoring failure visible. Missing checkpoints become part of the evidence record rather than silent gaps.

Encrypted WORM Content Store NEW v0.6

Hashes prove integrity, but disputes often require recoverable evidence. v0.6.0 introduces encrypted WORM storage for full transaction records while keeping sensitive content confidential.

The store is write-once-read-many. Records may be cross-held across parties or custodians. TrustAgentAI itself SHOULD NOT have unilateral access to plaintext records. Access can be governed through customer-controlled keys, regulator escrow, or multi-party release rules.

Key-Transparency Registry NEW v0.6

Key state must be auditable as of the event time. A party must not be able to silently rewrite whether a key existed, was valid, had been rotated, or had been revoked.

The key-transparency registry is append-only. Rotations require prior-key endorsement. Revocations are recorded as new events. Dispute verification uses registry state at the historical timestamp, not current database state.

KEY_CREATE
  → KEY_ROTATION endorsed by previous key
  → KEY_REVOCATION append-only event
  → HISTORICAL_KEY_STATE used during dispute verification

Degraded-Mode Discipline NEW v0.6

Distributed systems fail. A witness can be unavailable, a network can partition, or anchoring can be delayed. A secure protocol should not choose only between “block everything” and “trust everything.”

v0.6.0 defines degraded mode as a constrained and auditable state. Degraded actions are capped, labeled, time-bounded, and reconciled when the missing dependency returns.

• →Degraded receipts MUST be explicitly marked.
• →High-value thresholds MUST be lowered during degraded mode.
• →Each degraded action MUST include a reconciliation deadline.
• →Post-facto witness reconciliation MUST be attempted before normal finality is restored.

Dispute Packs

A v0.6.0 Dispute Pack combines signed receipts, ledger continuity proofs, witness evidence, key-history evidence, WORM references, and checkpoint anchors.

The pack does not eliminate all trust. It makes trust assumptions explicit, bounded, and independently verifiable.

Privacy Guidance

v0.6.0 preserves the hash-only principle for public evidence surfaces.

• →Raw arguments MUST NOT be written to public ledgers or anchors.
• →Raw outputs MUST NOT be written to public ledgers or anchors.
• →PII, secrets, API keys, prompts, and bank account details MUST NOT be stored on-chain.
• →Encrypted WORM records SHOULD be recoverable only under customer, regulator, or multi-party governance.

Open Threat Models

v0.6.0 is explicit about what it does not fully solve yet.

Changelog