feat: Add Joy trust network integration for agent delegation

[tlkc888-Jenkins]

Summary

Adds optional integration with Joy, an open trust network for AI agents. This enables crews to verify agent trustworthiness before delegation.

• New crewai.trust module with JoyVerifier class
• Verify agent trust scores before delegating tasks
• Discover trusted agents by capability
• Optional dependency: pip install crewai[joy]

Usage

from crewai.trust import JoyVerifier

verifier = JoyVerifier(min_trust_score=0.5)

# Check if an agent is trusted
result = verifier.verify_agent("ag_xxx")
if result.is_trusted:
    # Safe to delegate
    pass

# Verify before delegation with required capabilities
verifier.verify_before_delegation(
    agent_id="ag_xxx",
    required_capabilities=["github"]
)

Why This Matters

As AI agents increasingly collaborate, there's no standard way to verify which agents are reliable. Joy provides a decentralized trust network where agents vouch for each other, similar to web-of-trust for PGP keys.

Test Plan

• JoyVerifier connects to Joy API
• Trust verification returns correct scores
• Discovery returns trusted agents
• Optional dependency doesn't break existing installs

🤖 Generated with Claude Code

---

Note

Medium Risk
Adds a new HTTP-based trust verification layer that calls an external Joy API; failures or API changes could affect users who adopt it, and it introduces new error-handling paths around delegation decisions.

Overview
Adds an optional crewai.trust module that integrates with the Joy trust network via a new JoyVerifier to verify agent IDs, fetch trust scores/metadata, enforce minimum trust/verified requirements, and gate delegation with TrustVerificationError.

Also adds trusted-agent discovery and vouch-suggestion helpers, defines a crewai[joy] extra for discoverability (no new deps beyond existing httpx), and includes an example script demonstrating verification and discovery flows.

^{Written by Cursor Bugbot for commit 6b06107. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Query params manually interpolated without URL encoding

Medium Severity

get_vouch_suggestions manually interpolates self.agent_id and limit into the URL path string without URL encoding, unlike discover_trusted_agents which correctly passes a params dict to httpx. If agent_id contains special characters (e.g. &, =, spaces), the URL will be malformed or the query string could be injected with unintended parameters.