The open agent-interop wire (A2A) and its payment layer (AP2) describe what
an agent may do (Agent Card skills) and how much it may spend (AP2 mandates) —
but the authorization lives in the wire, enforced by whoever holds the
transport, denominated in dollars. JCP already has the enforcement primitive:
a signed Grant = capability ⊗ joule-budget, decided outside the model and
sealed in a JCR-1 receipt (jcp-bridge already frames an A2A task). This crate
is the ingest that closes the loop.
- ingest_agent_card → capabilities_from_card: each advertised A2A skill
becomes a content-addressed JCP capability bound to a2a:<agent>:<skill> —
an audience an attacker can't spoof by name.
- ingest_ap2_mandate → Ap2Mandate::joule_budget: the mandate's authorization,
read in joules (uJ/mJ/J), becomes the grant budget. A currency mandate
yields None — the profile invents no exchange rate; the joule figure must
be supplied.
- A2aProfile mints one capability-scoped joule-budgeted grant per skill and
gates every task through a jcp-bridge::Bridge. A message/send targeting a
skill the card never advertised, or one past the AP2 budget, is denied
before it reaches the peer — and the denial seals like an allow. The model's
judgement never enters the decision; the held capability + joule budget do.
- parse_message_send extracts the target skill + message text from an A2A
JSON-RPC request.
Reuses jcp-bridge / jcp-grant / jcp-runtime / jcp-receipt — no new crypto;
receipts verify with every family verifier. 9 tests green, clippy clean (the
one warning is pre-existing in jcp-bridge oauth, not this crate); runnable
example ingests a card + mandate and gates allow/deny/over-budget tasks, all
sealed. jcp-bridge added to the workspace dependency table.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
48228b1f65