docs: clarify agent-manifest delegation relationship

[solomonconah]

What

Clarifies the relationship between cA2A DelegationCredential objects and agent-manifest DelegationHop objects.

The previous wording could be read as implying that shared RFC 8785 canonicalization makes the two signed delegation formats directly cross-verifiable. This change clarifies that the two projects share delegation security goals and semantics, while their signed wire objects and signature pre-images remain distinct.

Why

This follows the interoperability question discussed in #36 around use of the public agent-manifest delegation verifier in delegation-linked action evidence.

The current implementations use different signed delegation representations. Documenting that boundary helps prevent implementers from assuming that a cA2A DelegationCredential can be directly verified as an agent-manifest DelegationHop.

Related: #36

Security impact

Documentation only. No runtime, cryptographic, trust-store, authorization, or verification behavior is changed.

The clarification is security-relevant because it avoids implying signature interoperability between differently structured delegation objects.

Test plan

• git diff --check passes
• Documentation-only change reviewed against the current delegation specification
• pytest passes
• ruff check passes
• mypy passes
• bandit passes

[imran-siddique]

Checked both claims against the code at pinned main rather than against the prose, because this PR is asserting something about two of our own signature formats.

The two pre-images share zero fields.

	signed pre-image fields
cA2A DelegationCredential (src/ca2a_runtime/delegation/credential.py:75)	credential_id, issuer, subject, scope, depth, parent_id, not_before, not_after
agent-manifest _hop_pre_image (python/src/agent_manifest/_delegation.py:84)	hop, manifest_id, principal_id, principal_type, delegated_at, scope_grant

Not merely different shapes: no field appears on both sides. The signature encodings differ too, raw lowercase hex here against base64url there. So the old sentence was not a small overstatement, it was describing interoperability that has no mechanism behind it. Your framing, that JCS makes each side's bytes deterministic and reproducible without making differently structured objects interchangeable, is exactly right and is the distinction implementers get wrong.

The sentence you deleted was also false, which is worth stating explicitly. The old text said cA2A's runtime "calls that verifier on inbound peer requests". credential.py imports ca2a_runtime.canonical and cryptography and does not import agent_manifest anywhere; verification is local Ed25519 over our own canonical bytes. A docs PR that removes a claim usually reads as losing detail, so: that detail was wrong, and removing it is the fix rather than a side effect.

One process note so you are not left guessing. This PR shows 2 checks where ca2a normally runs 15, because CI and CodeQL are both held in action_required pending maintainer release for a first-time contributor. That is not a signal about your change. I am releasing them now and will report what they say before merging.

Approving. Holding the merge until CI has actually reported.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[imran-siddique]

CI reported, as promised. Releasing the held runs took this from 2 checks to 12, all green: tests on 3.11, 3.12 and 3.13 across ubuntu and windows, CodeQL, governance and check. benchmark skipped, gate is our maintainer hold rather than a result.

Merging. Thanks for catching a wrong claim in our own spec.

[solomonconah]

Thanks for the detailed review and for verifying the claims against the implementations. I appreciate the clarification around the pre-images and the CI process. Glad the documentation correction was useful.