Writing
@treeship/a2a
Treeship and @treeship/a2a, by Agent2Agent.
Treeship 0.27: the custody handshake
Foreign work handed over A2A or MCP is refused until the other agent proves live key control, and the handoff receipt records that it did.
Treeship 0.19: the security-hardening release
Two adversarial audits, every confirmed finding in the default binary fixed with a regression test, and a receipt export any Ed25519 library can verify.
Treeship 0.18: onboard once, present anywhere
Signed work history, certificate chains to the ship, offline presentations with a challenge handshake, and a checkpoint-pinned track record.
Treeship 0.15: bridges sign with their own keys
The MCP and A2A bridges provision per-agent keys by default, A2A skills become cards, and audit proves a hub log was only appended to.
Capability Cards: Proving What an Agent Can Do, Not Just What It Says
Descriptor formats like A2A's AgentCard tell you what an agent claims it can do. None of them tell you whether the claim is bound to a key you trust, or whether the agent's actual behavior matches. Here is the arc we shipped to close that gap: a predicate registry, signed capability cards, per-actor signing that makes an agent's identity provable, revocation, and the same verdict in the browser as on the command line.
Treeship 0.9: verify a receipt anywhere it lands
treeship verify takes a URL, a package, or an id and cross-checks against an Agent Certificate. The same checks ship as WASM for Node, Deno, edge runtimes, and browsers.
Treeship 0.7: session receipts you can verify offline
A closed session now becomes a .treeship package with a Merkle root, a static verifier page, a public hub URL, and A2A middleware.
A2A Makes Agents Interoperable. Treeship Makes That Interoperability Trustworthy.
Google's Agent2Agent protocol gives every agent a way to talk to every other agent. It does not give you a way to verify what any of them actually did. Here is how @treeship/a2a closes that gap, with worked examples you can run end-to-end.