trust-verdict/v1: an Agent Card extension that points to a signed, recomputable check of that card

[kenneives]

I'm Kenne, founder of AgentAvow. We check the tools an agent connects to, and since November that includes A2A Agent Cards. I've published a small data-only extension so a card can point to our check of it, and I'm sharing it here for feedback.

What it does. The card carries a pointer, not a verdict, so nothing in the card goes stale. The pointer leads to a live, signed result: Safe to connect, Review before you connect, or Do not connect, with the reason and a 0-100 trust score.

Spec: https://agentavow.com/ext/trust-verdict/v1

{
  "uri": "https://agentavow.com/ext/trust-verdict/v1",
  "params": {
    "verdict_url": "https://agentavow.com/api/v1/public/scan/a2a?card=<URL-encoded URL of this card>"
  }
}

It goes in capabilities.extensions. Leave required out, so a client that doesn't know the extension loses nothing. verdict_url has exactly one valid form.

Example. Our own signed card declares it: https://agentavow.com/.well-known/agent-card.json

Verifying it.

1. Check that the card parameter names the card you fetched.
2. GET verdict_url. You get decision, decision_reason, trust_score and a JWS.
3. Verify the JWS (EdDSA) against https://agentavow.com/.well-known/jwks.json.
4. Compare the signed digest (scan.agentCard.digest, SHA-256 of the card's RFC 8785 form) with the card you hold. If they differ, the card changed after it was checked: treat the verdict as unknown.

Once you have the response and the keys, steps 3 and 4 run offline. No call back to us.

What it does not claim. It covers the card only: interface URLs, auth schemes, skill and card text, and the card's own signature. It doesn't look at the agent's code or behavior, and it doesn't vouch for who runs the agent. It isn't an A2A standard and doesn't ask to be one. If a card points at another card's verdict, our checker flags it.

I'd like to hear whether the pointer-plus-digest shape is useful to client authors, and what you'd change.