Skip to content

Audit chain trust depends on a single Guardian, no cross-Guardian verification protocol #18

@rocklambros

Description

@rocklambros

Tail risk surfaced during the v0.1.0 review (PR #2). Filing for v0.2+ tracking.

§8 puts SessionContext "only on the Guardian Agent." The chain integrity story rests on the assumption that the Guardian is trustworthy. The chain_hash echo issue raised in the PR #2 review addresses the wire-visible commitment for a single Guardian. Even with that fix, there's no cross-party verification protocol.

If a regulator or external auditor wants to validate an incident reconstruction across multiple Guardian deployments (e.g., a multi-tenant SaaS where two agents interacted via A2A through two different Guardians, or a post-incident comparison between a vendor's logs and an enterprise's logs), there's no standardized way to compare or reconcile chains.

§8 says: "Cross-Guardian interoperability is achieved through the standardized wire artifacts, not through a standardized container format." That's accurate for normal operation. It's insufficient for adversarial reconstruction where you don't trust the Guardians.

Proposed direction (longer-term, ecosystem work):

  • External commitment: optional periodic chain_hash signing under a long-lived audit key, exported as a signed checkpoint
  • Cross-Guardian protocol for A2A: when two Guardians mediate an inter-agent interaction, exchange and commit to each other's chain head
  • Optional transparency-log integration (Sigstore/Rekor-style) where the Guardian publishes signed chain heads to an external append-only log

Why deferred from v0.1.0: out of scope for the wire format itself. Requires significant ecosystem work and probably an external standardization effort. Reasonable to defer until at least one production deployment surfaces a concrete cross-Guardian audit requirement.

Trigger for raising priority: external auditor request for cross-Guardian comparable evidence post-incident, or any regulatory framework adopting ACS that requires multi-party verification.

References: specification.md §8

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions