A2A bridge: project sovereign SA/SKL/AC state into A2A discovery, auth, task, and funding flows

[OV1-Kenobi]

Summary

This PR turns the A2A ↔ Nostr bridge work into an implementation-ready spec pack for OpenAgents.

As per Epic #3959

It aligns the bridge design across the repo's canonical docs and freezes the first-slice interoperability rules:

• A2A is the wire/discovery/orchestration surface
• Nostr remains canonical for identity, skills, lifecycle, and funding state
• Task.id == SA session d-tag
• saSessionRef = 39230:<agent_hex_pubkey>:<task_id>
• agentProfileRef = 39200:<agent_hex_pubkey>:
• initial funding handoff is by-reference via osceEnvelopeRef

This PR does not implement the bridge yet. It defines the boundaries, contracts, rollout order, and issue structure needed to implement it cleanly.

What changed

• tightened docs/A2A_INTEROP_PROFILE.md to reflect the v1 bridge invariants
• tightened docs/plans/a2a-sovereign-agent-integration-plan.md to match the same locked decisions
• added a maintainer-facing implementation plan:
  • docs/plans/a2a-bridge-pr-implementation-plan.md
• added an epic/tracker draft:
  • docs/plans/a2a-nostr-bridge-epic.md
• added a crate/module breakdown:
  • docs/plans/a2a-nostr-bridge-crate-breakdown.md
• added a child-issue filing pack for the 8 implementation slices:
  • docs/plans/a2a-nostr-bridge-issues.md

Why

The bridge design was already directionally agreed, but key v1 decisions were still split across planning docs or left as optional/open choices.

This PR makes those decisions explicit so implementation can proceed without reopening core architecture questions around:

• where A2A ends and sovereign Nostr state begins
• how A2A tasks correlate to SA trajectory sessions
• how identity and funding refs are represented
• which crate/app owns which part of the bridge
• what the initial HTTP surface, metadata contract, and test matrix should be

Implementation shape captured here

Initial implementation target:

• new workspace crate: crates/a2a-bridge
• first host: apps/autopilot-desktop

Planned surface:

• GET /.well-known/agent-card.json
• POST /auth/nostr/challenge
• POST /auth/nostr/complete
• POST /message:send
• POST /message:stream
• GET /tasks/:id
• GET /tasks
• POST /tasks/:id:cancel
• POST /tasks/:id:subscribe

Planned sovereign reuse:

• SA profile + trajectory
• SKL manifests + auth challenge profile
• AC envelopes / spend / settlement
• NIP-90 for long-running or billable compute

Out of scope for this PR

• bridge runtime implementation
• crate creation or workspace wiring
• desktop HTTP mounting
• gRPC transport
• webhook/push delivery
• delegation/sub-agent inheritance in v1
• changes to A2A core semantics or NIP kind allocations

Acceptance criteria for this spec PR

• repo docs consistently preserve the rule that A2A is the interoperability surface and Nostr is canonical state
• the v1 bridge invariants are explicit and stable across the docs
• maintainers can file the epic and child issues directly from repo content
• developers have clear file targets, crate boundaries, endpoint expectations, and test requirements for implementation

Validation

• docs-only change
• reviewed for consistency against:
  • docs/A2A_INTEROP_PROFILE.md
  • docs/plans/a2a-sovereign-agent-integration-plan.md
  • docs/PROTOCOL_SURFACE.md
  • docs/OWNERSHIP.md

Follow-up

Implementation should proceed as tracked in the epic that will be filed after this PR is reviewed.

Files

• docs/A2A_INTEROP_PROFILE.md
• docs/plans/a2a-sovereign-agent-integration-plan.md
• docs/plans/a2a-bridge-pr-implementation-plan.md
• docs/plans/a2a-nostr-bridge-epic.md
• docs/plans/a2a-nostr-bridge-crate-breakdown.md
• docs/plans/a2a-nostr-bridge-issues.md

[AtlantisPleb]

Thanks - will circle back to this later when we do more with interop