altrudev · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026 · Oct 16, 2026
@@ -43,5 +43,7 @@ jobs:
       - name: Test AGT Marketplace snapshot generation
         run: python -m pytest tests/test_generate_agt_marketplace_catalog.py -q
       - name: Test confidential workflow harness
-        run: python -m unittest discover -s tests -v
+        run: |
+          python -m pip install --require-hashes -r ../../requirements/confidential-workflow-probe.txt
+          python -m unittest discover -s tests -v
         working-directory: integrations/agentrust-confidential-workflow-harness
@@ -0,0 +1,98 @@
+# Evidence-driven release gate: composed first-party SOFTWARE federation
+
+**Date:** October 16, 2026  
+**Scope:** AgenTrust integrations #199, Frequency two-host software laboratory  
+**Decision:** **Software integration pilot PASS; full independently accepted
+confidential workflow gate remains OPEN.**
+
+## Verified execution boundary
+
+The origin first uses released `cmcp-runtime==0.7.0` for `conduit.inspect`
+authorization. A separately restricted SSH forced-command peer on the VPS
+then challenges the caller and verifies the released
+`ca2a-runtime==0.4.0` signed delegation/holder proof against an explicitly
+pinned issuer. A persistent SQLite ledger consumes the challenge before any
+side effect. The remote peer launches only Frequency Conduit's fixed
+network-disabled `inspect` job, observes its completion, and returns the
+authenticated released cA2A 0.4.0 response envelope.
+
+The VPS separately signs a TRACE 0.11.0 / TRACE v0.2 Level 0
+**software-only** provenance record and companion receipt-binding manifest.
+The origin verifies both with the pinned remote Ed25519 key; the semantic
+`policy.bundle_hash` remains the hash of the actual scope/repo/root policy,
+not a disguised execution artifact. The signed manifest separately binds the
+exact request hash, transaction, nonce, job result, start/end receipt hashes,
+and TRACE record hash.
+
+**Real sample transaction:**
+`live-ca2a-a40f23585ad2451f9c738971ae64c050`
+
+**Pinned replay fixture:** `evidence/live-software-20261016.json`
+
+**Historical TRACE record hash:**
+`sha256:f830659f2af40ff74a42b48e04b1a6c544c41f25e9863c18aae56adc70ff77a5`
+
+**Fixture SHA-256:**
+`402a8f0cc05bc517d2918e7a49b10051cb60122fcac8909f1a9ed308c12fdc13`
+
+## Adversarial evidence
+
+The live two-host matrix passed **11/11** scenarios on October 16, including
+valid control, local cMCP denial, remote untrusted issuer, expired signed delegation, missing TRACE trust,
+wrong TRACE public key, mutated credential scope, response MAC alteration,
+post-execution receipt loss reported as unknown, a fresh valid replay twin,
+and a consumed challenge replay refused by the peer.
+
+The repository unit/mutation suite passed **81/81** on Prometheus,
+including signature/refusal controls, offline software TRACE replay and
+historical evidence tampering. Source and dependency versions are pinned in
+the PR and hash-locked requirements, and the captured packet includes only
+a public, non-confidential `inspect` execution.
+
+## Required acceptance outcomes
+
+| Gate | Result | Qualification |
+|---|---|---|
+| cMCP permission before dispatch | PASS | Released gateway |
+| cA2A signed delegation + holder proof | PASS | VPS independently checks proof within same-operator trust domain |
+| Remote transport / bounded execution | PASS | Pinned SSH forced command and Conduit sandbox |
+| Persistent replay refusal | PASS | SQLite consumed challenge, not hardware anti-replay |
+| cA2A authenticated response | PASS | Live source, ephemeral session MAC |
+| TRACE signature and companion result binding | PASS | Level 0 signed software evidence |
+| Positive / refusal adversarial controls | PASS | Local suite and 11-case live matrix |
+| Offline independently runnable signature check | PASS | Public packet; key provenance remains self-asserted |
+| External independently operated peer | OPEN | No second organizational trust domain |
+| Confidential model/tool execution and disclosure | OPEN | Only a read-only `inspect` job was exercised |
+| Independently enrolled revocation/custody | OPEN | No authoritative revocation snapshot or external signer custody |
+| Physical TPM / TEE confidential execution | OPEN | No hardware-backed measurement or key release |
+| Independent replay by Dinakar | OPEN | Requires another reviewer to perform and record it |
+| Maintainer signoff/merge | OPEN | Cannot be self-issued or bypassed |
+
+## Non-equivalence rules
+
+A successful software Level 0 TRACE record proves the pinned software
+signing key endorsed its claims and the content was not altered since signing.
+It does **not** prove a hardware identity, a confidential runtime, complete
+monitoring, independent custody or any claim about a secret not exercised by
+this test. Likewise, a positive cA2A response is not proof of independent
+organizational acceptance. A missing post-dispatch response is an **unknown
+execution state**, never a clean refusal or proof of no side effect.
+
+Historical offline replay validates signatures while deliberately not making
+a *freshness* claim. The live cA2A per-occurrence state is non-exportable and
+must be freshly exercised to verify the session.
+
+For implementation About, licensing boundaries, protocol/version pinning,
+dependency attribution and glossary mapping, see
+[REMOTE-CA2A-PEER.md](REMOTE-CA2A-PEER.md), the reproducible packet in
+[evidence/](evidence/), and the original [README](README.md).
+
+## Replay-observation qualification
+
+The exact old-request replay row observes a returned status 403 only. Its
+original client occurrence has already been consumed, so the matrix does not
+verify a second response MAC for it. The row reports
+`response_authentication: not-verified`; it is not an authenticated cA2A
+refusal claim. A fresh client occurrence reusing the consumed challenge can
+provide a separately authenticated refusal control. The historical packet's
+peer channel key is also unsigned metadata, as reported by the offline verifier.
@@ -0,0 +1,64 @@
+# Live Frequency Conduit bridge acceptance, October 16 2026
+
+The `harness.conduit_live` bounded adapter performs cMCP 0.7.0 authorization
+before dispatching one fixed `inspect` intent to the VPS with the preexisting
+Frequency Conduit CLI. That CLI uses restricted-key SSH transport and a
+whitelisted, resource-limited, network-disabled worker intent.
+
+The consumer verifies the start and finish receipt hashes, immediate hash-chain
+link, session identity, remote node identity, clean worktree, pinned commit,
+network-disabled plan, and successful completion. It fails closed to unknown
+rather than treating a lost response as refusal or confirmed execution.
+
+Reproduced locally as 45 unit tests passing (six new controls). Live run:
+
+- Transaction: `edrg-632c5f773d8d42d980f59b4dbcaf72fb`
+- Result: `observed-live-conduit-inspect`
+- VPS commit: `53c3399c1fa74a985cd74de3c40d48ca02e53bfb`
+- Start receipt: `24656869ff9decd0bc3fff92f06f8932eb68f14f268b71eb0236cce8c2eedfe5`
+- Final receipt: `80474eeaa16bdc78cd6c6bf5bc3f3c146049d74be02c2bd9c7d6c798de8eb2a8`
+- Classification: live two-host, same operator; SHA-256 chained software receipts
+
+Run the *optional, host-specific* probe on a configured Prometheus:
+`PYTHONPATH=integrations/agentrust-confidential-workflow-harness python -c 'from harness.conduit_live import run; print(run(transaction_id="unique-id", repo="/home/ubuntu/src/integrations", cli="/home/triangulatorium/.local/bin/frequency-conduit"))'`
+
+This bridge does **not** issue a cA2A credential, verify a real cA2A peer
+attestation, create a remote cA2A authenticated response, or produce a TRACE
+standard-conforming externally attested execution receipt. It also does not
+provide independently operated or hardware-backed evidence. The validated
+hash-chain alone is not a digital signature and is not tamper proof against
+the operator who controls the receipt store. Those distinctions remain release
+gates for upstream Issue #199 and should not be elided.
+
+## Released cA2A holder-bound delegation preflight
+
+The `released_delegation` and `delegated_conduit` modules now verify a
+released `ca2a-runtime==0.4.0` signed delegation against an explicitly supplied
+trusted root, a challenge-bound holder-possession proof, requested capability,
+and local policy **before** the cMCP/Conduit job begins. Negative tests prove
+untrusted roots, holder substitution, and altered scope cannot dispatch. This
+extends the local composition to 55 tests.
+
+The challenge and peer appraisal are process-local to the origin and the test
+keys are ephemeral. The remote VPS has not checked a cA2A credential. Therefore
+this remains **not cA2A peer delivery or independently enrolled verification**.
+Neither cryptographic authentication of the remote Conduit job receipt nor a
+TRACE-standard external attestation has been added. Do not mark full Issue #199
+acceptance complete based on these tests.
+
+### Composed software live control (October 16)
+
+The origin verified an ephemeral signed cA2A 0.4.0 delegation and
+holder-possession proof, then the published cMCP 0.7.0 tool gate, then invoked
+the existing VPS Conduit restricted `inspect` job over SSH. Results:
+
+- Origin transaction: `composed-14243eb31122473282b779da9daf0551`
+- Software Conduit start receipt SHA-256: `425dd606ea4a887424d18be6981abd4a72a5aced60d96d1a207b3e8bb845d4d6`
+- Software Conduit final receipt SHA-256: `a37c5933fb472416fa8fb0cd9d5b7d2cafd5ad15ba5733fbe882eec93a8df92b`
+- Result: `observed-live-conduit-inspect`
+- cA2A peer transport: **false**; remote TRACE verification: **false**
+
+The issuer and holder keys were generated and trusted on the origin during this
+experiment. No separate remote peer enrolled or verified them. This is genuine
+remote Conduit software execution after origin-side preflight, not a claim of
+end-to-end remotely enforced cA2A delegation or TRACE acceptance.
@@ -6,7 +6,7 @@ and preserves unavailable evidence instead of inferring success from dispatch.
 
 ## Scope of this PR
 
-This initial implementation provides:
+The expanded experimental implementation provides:
 
 - a fixed harness core;
 - machine-readable manifest and result schemas;
@@ -16,20 +16,21 @@ This initial implementation provides:
 - branch-preserving observations for retries;
 - causal provenance fields (`caused_by`) on observations.
 
-It does **not** claim cMCP or cA2A conformance, live-peer acceptance, hardware
-attestation, or completion of the full software milestone.
+The published release API calls and one first-party software peer path are
+exercised, but this is not a claim of independently established protocol
+conformance, hardware attestation or completed Issue #199 acceptance.
+See [About, licensing, IP boundaries, glossary and live-peer threat model](REMOTE-CA2A-PEER.md).
 
 ## Reproduce
 
 ```bash
 python -m unittest discover -s tests -v
 ```
 
-The deterministic adapter records the package release targets that will be used
-when protocol-specific adapters are wired:
+The released component and bounded live-peer experiments use:
 
-- `cmcp-runtime==0.5.0`
-- `ca2a-runtime==0.2.0`
+- `cmcp-runtime==0.7.0`
+- `ca2a-runtime==0.4.0`
 
 Protocol/API changes remain in the owning repositories. Any scenario that needs
 an unreleased surface must carry `waiting_on_release`; a blocked required case

@@ -0,0 +1,33 @@
+# Experimental released-protocol interoperability and authenticated response
+
+This deterministic acceptance milestone executes the published `cmcp-runtime==0.7.0`
+`MCPGateway.intercept_tool_call` and `ca2a-runtime==0.4.0`
+`emit_dag` / `trace_record_hash` APIs, plus
+`PendingResponse` / `ResponseProducer` authenticated response verification.
+Positive and refusal tests are paired. All dependencies are transitively pinned
+by the SHA-256 hash-locked requirements file.
+
+A local test-generated X25519 peer key is marked assurance `none`, rather than
+hardware-verified. Signed TRACE DAG records use temporary Ed25519 keys and a
+synthetic source. The actual dispatch count is zero. This is **not** a live
+model, tool or network workflow.
+
+Reproduce from the repository root with Python 3.12:
+
+```sh
+python -m pip install --require-hashes -r requirements/confidential-workflow-probe.txt
+cd integrations/agentrust-confidential-workflow-harness
+python -m unittest discover -s tests -v
+```
+
+The authenticated-response probe covers permitted execution, unauthorized tool,
+MAC alteration, single-use replay, expiry, signed denial, request/response
+context mismatch, and unobserved receipt remaining unknown. The valid twin is
+executed independently for each adversarial case. It does **not** establish
+independent issuer enrollment, externally operated peer receipt, a real execution
+side effect, secure confinement or hardware-backed runtime measurement.
+
+Issue #199 must remain open until actual mediated tool and peer network transport,
+independent boundary observations, composed mutation testing, and independently
+operated live evidence are produced and externally reproduced. Component
+interoperability may not be substituted for these requirements.