feat: optional independent signed catalog authority receipt

[altrudev]

Summary

Adds an opt-in, independently signed Ed25519 correspondence receipt binding the Agent Manifest signing digest, agent identity, policy bundle hash, complete sealed cMCP catalog hash, and Agent Manifest Merkle root. Preserves upstream #713 native tool projection and verification; no replacement or bypass of SDK validation.

Assurance

• Domain-separated signed receipt, strict canonical fields and validity interval
• Fail-closed startup when configured receipt, measurements or signer are invalid
• Native upstream catalog verification remains mandatory
• Operator deployment/rotation and limitation documentation
• Local VPS: pytest -q tests/unit tests/integration: 2382 passed, 6 skipped, 4 deprecation warnings; git diff --check clean
• Six skips: real Azure SEV-SNP fixture (2), real TDX quote (2), optional Agent Governance Toolkit package (2)

Review requests

Please review whether an independent issuer receipt is useful alongside native Merkle binding; specifically JSON/COSE signing preimages, trust anchor management, optional deployment semantics, and cryptographic canonicalization. This is a draft for independent maintainer review, not a claim of hardware attestation or release approval.

No private keys or proprietary runtime implementation are included.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[imran-siddique]

@altrudev on your review question: not in core. The gap the bridge covers, server identity and output schemas that the tool Merkle root leaves out, is already bound by the manifest itself. Under evidence-requirements-experimental-v1, _require_sealed_catalog_requirement refuses startup unless a signed tool-catalog component carries the sealed catalog digest as expected_observed_digest, and the SDK checks policy_bundle_hash (L395). A second issuer key signing values the gateway already recomputes adds a trust root without adding a measurement. If the experimental label is what blocks you, a proposal to promote that profile is the change I would review.

Separately, Lint fails on 6 ruff errors (ruff check src/ tests/), which cancelled the test matrix.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 92.47312% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/cmcp_runtime/catalog/authority_bridge.py	95.38%	3 Missing ⚠️
src/cmcp_runtime/config.py	76.92%	3 Missing ⚠️
src/cmcp_runtime/startup.py	93.33%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[altrudev]

@imran-siddique The latest EDRG verification is complete for commit "fecb430".

The full local suite passed 2,384 tests, with 6 documented skips. Ruff, mypy, startup binding, signature validation, and adversarial regression checks also passed.

The PR remains in draft pending independent maintainer review. Could you review the implementation and advise whether any further changes are required before approval?

The software-only assurance boundaries remain unchanged. No hardware attestation or production certification is claimed.

Val Rukhaylo / Altru.dev

[altrudev]

@imran-siddique I reviewed your architectural objection against the existing cMCP implementation and agree that the additional signed bridge should not go into Core in its present form. The experimental evidence-requirements profile already requires a signed tool-catalog component whose expected_observed_digest matches the runtime sealed-catalog hash, while the SDK independently checks the policy bundle. A second operator key over recomputed values does not itself give us a new independent measurement. I will keep #741 in draft rather than seek approval for this design.

I propose the smaller alternative you suggested: separately evaluate promoting evidence-requirements-experimental-v1, without weakening its existing signature, sealed catalog, policy, tool projection or fail-closed startup checks. Acceptance should include negative fixtures for missing/wrong catalog digest, catalog/server or output-schema substitution, wrong policy, stale/revoked credentials, signing-key replacement, unsupported requirements, and COSE/JSON equivalence; verify actual startup wiring and run the full CI matrix. The profile name/status should only change after these requirements and the compatibility boundary are independently reviewed.

For this review I reproduced the current 29 relevant manifest/tool-binding tests successfully. This is not a conformance or release claim. If this is the right direction, I can produce a narrowly scoped replacement PR after we agree the graduation criteria; the bridge PR should then close unmerged.

Val Rukhaylo / Altru.dev

[imran-siddique]

@altrudev yes. Open it in agent-manifest, where the profile lives (docs/evidence-requirements-experimental.md, evidence_requirements.py); cMCP only consumes it. The fixtures and startup-wiring tests can land there now as non-normative work. Dropping "experimental" puts the profile into normative text, which needs an organisational sponsor or a maintainer carry, so that step waits.

Every fixture on your list is a refusal. Give each a conformant twin differing only in the field under test, so a verifier that refuses everything fails half the set. Close #741 once that issue is open.