feat(a2a-trust-header): Week 3 dual-provider consumer verifier + canonical schema

[aeoess]

Summary

Week 3 of the Week 1 (schema lock) → Week 2 (APS fixtures, PR #2) → Week 3 arc for the A2A x-agent-trust header under a2aproject/A2A#1742.

This PR turns the Week 1 schema lock into runnable artifacts and adds MolTrust-shaped placeholder fixtures so the consumer verifier can exercise both provider shapes end-to-end before MolTrust ships their half.

What landed

• Canonical JSON Schema (a2a-trust-header/schema/a2a-trust-header.schema.json): Draft 2020-12. 5 required fields: trust_level / attestation_count / last_verified / evidence_bundle / delegation_chain_root. delegation_chain_root is pattern-constrained to the self-describing sha256:<hex> OR uri:https?://… form. additionalProperties: true so providers can emit vendor-specific sibling fields without coupling the canonical contract.
• Dual-provider consumer verifier (a2a-trust-header/consumer-verify.ts): discovers every fixture at the top of a2a-trust-header/ and under moltrust-placeholder/, classifies each by issuer (APS / MolTrust / unknown), derives the canonical composite view (direct for MolTrust-shape, synthesized for APS-shape), schema-validates via ajv + ajv-formats, and verifies every Ed25519 signature via @noble/ed25519 (no APS SDK dependency for signature verification, so MolTrust-side consumers can run it as-is). Emits per-fixture compliance rows and aggregate summary. Exit codes: 0 all-pass, 1 signature/chain-root failure, 2 schema failure.
• 3 MolTrust-shaped placeholder fixtures (a2a-trust-header/moltrust-placeholder/): trust-trajectory-decay.json (4→3→2), attestation-accumulation.json (2→7→15), shared-happy-path-moltrust.json (re-signs the APS happy-path chain under the MolTrust placeholder key). All marked _placeholder: true / _replace_with_real_moltrust_emission: true. Signed with a deterministic test seed (tail 0xAA), public half embedded for round-trip verification. Generator committed so MolTrust can see exactly how the shape was constructed.
• README Week 3 section covering the canonical schema, consumer-verifier contract + usage + exit codes, MolTrust placeholder catalog with clear replacement workflow, and shared Ed25519 / JCS conventions. Week 2 content preserved verbatim.

Week 2 → Week 3 diff

	Week 2	Week 3
Fixtures	6 APS	6 APS + 3 MolTrust placeholder
Schema	informal in #1742 thread	schema/a2a-trust-header.schema.json, Draft 2020-12
Verifier	APS-only round-trip (verify.ts)	dual-provider consumer (consumer-verify.ts) + Week 2 round-trip
APS SDK coupling	required for verification	only for canonicalization; @noble/ed25519 for signatures
Portability	verify.ts imported APS SDK via laptop-local absolute path	npm-resolved

The Week 2 verify.ts absolute-path import (/Users/tima/agent-passport-system/src/index.js) was replaced with a portable import 'agent-passport-system' so any consumer, including MolTrust and CI, can run it. Week 2 round-trip is byte-identical otherwise: 6/6 fixtures still pass.

MolTrust placeholder replacement workflow

When MolTrust ships Week 3 on their side:

1. Replace each fixture under moltrust-placeholder/ with their real emission. Keep filenames so the consumer verifier picks them up automatically.
2. Drop the _placeholder / _replace_with_real_moltrust_emission fields.
3. Replace moltrust_signing_key with production kid + pubkey and re-sign every emission under that key.
4. Re-run npx tsx consumer-verify.ts. All 9 fixtures (6 APS + 3 MolTrust real) must pass schema + signature + chain-root checks, exit 0.

The consumer verifier does not implement MolTrust import weighting (0.3 weight, 45-day half-life, POST /identity/resolve before import) — that is a downstream policy decision. What this PR guarantees is the preconditions weighting sits on top of: every 5-field composite is schema-conformant, cryptographically verifiable, and chain-root consistent.

Verification output

$ npx tsx a2a-trust-header/verify.ts
6/6 fixtures round-trip through APS verifier.
(exit 0)

$ npx tsx a2a-trust-header/consumer-verify.ts
Consumer verify: aggregate
  APS fixtures:       6 / 6 pass
  MolTrust fixtures:  3 / 3 pass (placeholder)
  Unknown issuer:     0
  Schema failures:    0
  Signature failures: 0
  Chain-root drift:   0
(exit 0)

Not touched

• None of the 6 Week 2 fixture JSON files (happy-path.json, drift-explicit-flag.json, revocation-mid-chain.json, shared-card-crossorg.json, trust-level-ascending.json, trust-level-descending.json), _keys.json, or generate.ts. Locked at the hashes committed in PR feat(a2a-trust-header): APS Week 2 fixture set per A2A#1742 #2.

Refs

• a2aproject/A2A#1742 — the issue this arc lives under
• PR #2 — Week 2 APS fixture set