Architecture Follow-up: Trust Layer & Card Envelope

[mindpower]

Recently we had a great discussion on PR #4 which is now merged. Now we have:

• a unified discovery layer (pointing to mcp, a2a, or ai-card)
• a baseline ai-card with identity/trust information.

To follow up on the next step on how the trust/identity layer should interact with the underlying agent cards (MCP, A2A), here are a few approaches for attaching trust metadata. Below is the drawing of the options we looked at:

Alignment & Recommendation:
The strong preference is for Option 3 (Envelope + Reference) as the path forward.

Why this works best for the ecosystem:

• Zero Impact on Existing Protocols: The absolute biggest win here is that underlying MCP and A2A card schemas don't have to be modified at all. We aren't forcing trust metadata into protocols that don't natively need it.
• Clean Separation of Concerns: It keeps enterprise routing and signing logic isolated in the outer envelope, rather than leaking it into the agent's native card structure.
• Opt-in Flexibility: As established in PR spec: AI card and AI catalog draft proposal #4, the ai-catalog can simply point directly to a native MCP card (when no outer envelope is needed), or point to the AI-Card envelope (when identity/routing is required).

Sharing this here so we have a permanent record of the architectural context as we iterate together!