Update from code changes: A2A attestation context binding

[mintlify]

Summary

Document the breaking change to A2ACryptoService.verify_attestation(), which now requires an AttestationContext argument for context-bound verification.

Changes

• Rewrote the "Verifying an attestation" section in a2a/crypto-attestations.mdx to introduce the AttestationContext dataclass, list its fields, and show the new two-argument call signature.
• Documented the updated ordered verification steps, including the new context-binding check (sender, receiver, payload hash, session) and its placement after the deployment check but before the jti replay check.
• Expanded the verification-outcomes table with the new structured rejection messages.
• Added a before/after migration snippet for callers upgrading from the single-argument form.
• Tightened the tamper-detection note (payload-hash comparison is now performed internally by verify_attestation) and refreshed the cross-service example to use the new A2ACryptoService.payload_hash() helper.
• Added a Changelog entry describing the breaking change and linking back to the reference docs.

Context

Follows qwed-ai/qwed-a2a#41 — "fix(crypto): add AttestationContext binding to verify_attestation (#14)".

[codeant-ai]

Skipping PR review because a bot author is detected.

If you want to trigger CodeAnt AI, comment @codeant-ai review to trigger a manual review.

[qwed-security]

QWED Security Verification Report

2 files scanned | 0 blocked | 0 warnings | 1 info | 0 suppressed | 1 verified

Informational Findings

File	Line	Context	Issue
a2a/crypto-attestations.mdx	L100	DOCUMENTATION	Hardcoded credential-like material detected.

Engines

• entropy_scan: ✅
• pattern_scan: ⚠️ 1 finding(s)

Verified Files

• changelog.mdx

---

Verified by QWED — deterministic security verification. No LLM used.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
qwed-ai	🟢 Ready	View Preview	Jul 28, 2026, 4:14 AM

[greptile-apps]

Greptile Summary

Documents context-bound A2A attestation verification and its migration path.

• Introduces the AttestationContext fields, verification sequence, rejection outcomes, and two-argument API.
• Updates payload-tampering and cross-service examples for context-bound verification.
• Adds a changelog entry for the breaking API change and updates changelog metadata.

Confidence Score: 3/5

The PR should be fixed before merging because its new cross-service example fails immediately when copied and run.

The context-binding documentation is otherwise coherent, but the cross-service example passes an undefined payload name to both signing and verification.

Files Needing Attention: a2a/crypto-attestations.mdx

Important Files Changed

Filename	Overview
a2a/crypto-attestations.mdx	Adds the context-bound verification reference and migration examples, but the expanded cross-service snippet uses an undefined payload variable.
changelog.mdx	Adds a consistent breaking-change announcement, migration guidance, and links to the updated reference documentation.

_{Reviews (1): Last reviewed commit: "docs: sharpen changelog page title for S..." | Re-trigger Greptile}

[greptile-apps]

Undefined cross-service payload

When a reader copies the cross-service example, it passes the undefined payload name to both A2ACryptoService.payload_hash() and AttestationContext, causing a NameError before the attestation can be signed or verified.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
qwed-ai	🟡 Building	–	Jul 28, 2026, 4:14 AM