diff --git a/CHANGELOG.md b/CHANGELOG.md index a237a3b1..247324ef 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,20 @@ Format: [Semantic Versioning](https://semver.org/). Spec versions follow `MAJOR. ## [Unreleased] +- **Accuracy pass on non-normative text.** Examples, schema descriptions, adapter + docstrings and unsigned test records use vendor-neutral placeholders + (`example-provider`, `example-model`), the Section 6.2 list keeps confidential-computing and standards + organizations, and the Appendix B reference titles use each project's own name. The Acta crosswalk now cites v0.2 sections. Platform pages no + longer name a cMCP provider value. The package description, spec abstract, charter, + schema descriptions and conformance messages no longer say "hardware-attested": a + record is a signed governance record that can carry hardware attestation evidence, and + `verify_record()` performs no attestation verification. + Signed and digest-pinned vectors are unchanged. No normative text changes. +- **Conformance site links** point at trace.agentrust-io.com/conformance/, where the + combined docs build publishes it; the stale `conformance/CNAME` is removed. +- **Generators write LF on every platform.** `gen_number_spelling.py` and the + anchor-inclusion generator opened their output in text mode, so a Windows run wrote + CRLF and the byte-for-byte regeneration check failed. - **BREAKING:** Successful `provenance.verify_record()` calls previously returned `None`; they now return `RevocationCheck` (#279). Callers can distinguish `no_check_performed` when no revocation store is supplied from `verified` when diff --git a/CHARTER.md b/CHARTER.md index 365aa3d2..111ea7f2 100644 --- a/CHARTER.md +++ b/CHARTER.md @@ -10,7 +10,7 @@ ## 1. Mission -The TRACE project develops and maintains an open, portable, hardware-attested governance record for AI agents and other confidential workloads. The mission is to make execution governance evidence verifiable by any party: without trusting the operator, without callbacks to the issuer, and without vendor lock-in to any cloud, silicon vendor, or AI provider. +The TRACE project develops and maintains an open, portable, signed governance record for AI agents and other confidential workloads, which can carry hardware attestation evidence. The mission is to make execution governance evidence verifiable by any party: without trusting the operator, without callbacks to the issuer, and without vendor lock-in to any cloud, silicon vendor, or AI provider. ## 2. Scope diff --git a/conformance/CHANGELOG.md b/conformance/CHANGELOG.md index 725f7ceb..c3b49e75 100644 --- a/conformance/CHANGELOG.md +++ b/conformance/CHANGELOG.md @@ -2,6 +2,15 @@ ## Unreleased +### Changed + +- Vendor-neutral placeholders (`example-provider`, `example-model`) in the unsigned + vectors and the policy-resolution generator; the policy-resolution set is regenerated + and every verdict is unchanged. Signed vectors are untouched. +- The anchor-inclusion generator writes LF on every platform. +- Documentation links and robots.txt name trace.agentrust-io.com/conformance/; the stale + CNAME file is removed. + ## v0.6.2 - 2026-10-02 ### Added diff --git a/conformance/CNAME b/conformance/CNAME deleted file mode 100644 index 129e9b5c..00000000 --- a/conformance/CNAME +++ /dev/null @@ -1 +0,0 @@ -tests.agentrust-io.com \ No newline at end of file diff --git a/conformance/overrides/main.html b/conformance/overrides/main.html index 82d963a4..d71ae9b5 100644 --- a/conformance/overrides/main.html +++ b/conformance/overrides/main.html @@ -71,7 +71,6 @@ "https://cmcp.agentrust-io.com", "https://ca2a.agentrust-io.com", "https://wcm.agentrust-io.com", - "https://tests.agentrust-io.com", "https://governance.agentrust-io.com" ] }, diff --git a/conformance/robots.txt b/conformance/robots.txt index 734a195f..acf29c71 100644 --- a/conformance/robots.txt +++ b/conformance/robots.txt @@ -1,4 +1,4 @@ -# tests.agentrust-io.com: search and answer-engine crawlers are welcome. +# trace.agentrust-io.com/conformance/: search and answer-engine crawlers are welcome. User-agent: * Allow: / @@ -35,4 +35,4 @@ Allow: / User-agent: CCBot Allow: / -Sitemap: https://tests.agentrust-io.com/sitemap.xml +Sitemap: https://trace.agentrust-io.com/conformance/sitemap.xml diff --git a/conformance/schemas/trace-claim.json b/conformance/schemas/trace-claim.json index 2b079712..de8722a7 100644 --- a/conformance/schemas/trace-claim.json +++ b/conformance/schemas/trace-claim.json @@ -2,7 +2,7 @@ "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://agentrust-io.com/schema/trace-v0.2.json", "title": "TRACE Trust Record", - "description": "A TRACE v0.2 Trust Record — hardware-attested governance evidence for an AI agent execution.", + "description": "A TRACE v0.2 Trust Record: a signed governance record for an AI agent execution, which can carry hardware attestation evidence.", "type": "object", "required": [ "eat_profile", @@ -42,7 +42,7 @@ "properties": { "provider": { "type": "string", - "description": "Model provider (e.g. 'anthropic', 'openai', 'meta')." + "description": "Model provider (e.g. 'example-provider')." }, "model_id": { "type": "string", @@ -329,7 +329,7 @@ }, "cnf": { "type": "object", - "description": "Confirmation key (RFC 8747) — binds the Trust Record to the TEE-held signing key.", + "description": "Confirmation key (RFC 8747) that binds the Trust Record to the TEE-held signing key.", "required": [ "jwk" ], diff --git a/conformance/src/trace_tests/modules/tr_rte.py b/conformance/src/trace_tests/modules/tr_rte.py index e43bd251..ca875fdf 100644 --- a/conformance/src/trace_tests/modules/tr_rte.py +++ b/conformance/src/trace_tests/modules/tr_rte.py @@ -62,7 +62,7 @@ def check( Status.FAIL, f"TR-RTE-001: runtime.platform {platform!r} is development-mode " "and not acceptable for " - f"hardware-attested levels (Level {level} requires a hardware TEE platform)", + f"Level {level}, which requires a hardware TEE platform", ) ) elif isinstance(platform, str) and platform in _VALID_PLATFORMS: diff --git a/conformance/tests/test_software_only_platform.py b/conformance/tests/test_software_only_platform.py index 02fa4949..c9f0179c 100644 --- a/conformance/tests/test_software_only_platform.py +++ b/conformance/tests/test_software_only_platform.py @@ -3,7 +3,7 @@ Spec note: trace-spec added `software-only` as a valid `runtime.platform` value for development and CI use. It carries no hardware attestation evidence and is therefore only acceptable at Level 0. Level 1+ must reject it with a -clear message that names the reason (development-mode, not hardware-attested) +clear message that names the reason (development-mode, not a hardware TEE platform) rather than the generic "unknown platform" error. Covers: diff --git a/conformance/tests/vectors/anchor-inclusion/generate.py b/conformance/tests/vectors/anchor-inclusion/generate.py index 5ed2cfc8..9ed3b1d0 100644 --- a/conformance/tests/vectors/anchor-inclusion/generate.py +++ b/conformance/tests/vectors/anchor-inclusion/generate.py @@ -172,7 +172,7 @@ def utf16_order(value): def main() -> None: for i, v in enumerate(vectors(), 1): (HERE / f"{i:02}-{v['name']}.json").write_text( - json.dumps(v, indent=2, ensure_ascii=True) + "\n", encoding="utf-8" + json.dumps(v, indent=2, ensure_ascii=True) + "\n", encoding="utf-8", newline="\n" ) diff --git a/conformance/tests/vectors/invalid_missing_runtime.json b/conformance/tests/vectors/invalid_missing_runtime.json index 62d0d9c4..9b4539bd 100644 --- a/conformance/tests/vectors/invalid_missing_runtime.json +++ b/conformance/tests/vectors/invalid_missing_runtime.json @@ -2,7 +2,7 @@ "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", "iat": 1748000000, "subject": "spiffe://example.org/agent/test/001", - "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-5"}, + "model": {"provider": "example-provider", "model_id": "example-model"}, "policy": {"bundle_hash": "sha256:a3f8d2b4e1c9f7a5b2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8", "enforcement_mode": "enforce"}, "data_class": "internal", "build_provenance": {"slsa_level": 2, "digest": "sha256:b4e1c9f7a5b2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4"}, diff --git a/conformance/tests/vectors/invalid_wrong_profile.json b/conformance/tests/vectors/invalid_wrong_profile.json index bb912d49..2e6c981b 100644 --- a/conformance/tests/vectors/invalid_wrong_profile.json +++ b/conformance/tests/vectors/invalid_wrong_profile.json @@ -2,7 +2,7 @@ "eat_profile": "tag:example.com,2024:wrong-profile", "iat": 1748000000, "subject": "spiffe://example.org/agent/test/001", - "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-5"}, + "model": {"provider": "example-provider", "model_id": "example-model"}, "runtime": {"platform": "intel-tdx", "measurement": "sha256:a3f8d2b4e1c9f7a5b2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8"}, "policy": {"bundle_hash": "sha256:b4e1c9f7a5b2d4e6f8a0b2c4d6e8f0a2b4c6d8e0f2a4b6c8d0e2f4a6b8c0d2e4", "enforcement_mode": "enforce"}, "data_class": "internal", diff --git a/conformance/tests/vectors/policy-resolution/01-no-policy-uri.json b/conformance/tests/vectors/policy-resolution/01-no-policy-uri.json index 2f02f65f..e8abe01f 100644 --- a/conformance/tests/vectors/policy-resolution/01-no-policy-uri.json +++ b/conformance/tests/vectors/policy-resolution/01-no-policy-uri.json @@ -8,8 +8,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/policy-resolution/02-resolved-and-matches.json b/conformance/tests/vectors/policy-resolution/02-resolved-and-matches.json index 0c6b5dfd..1dc973a3 100644 --- a/conformance/tests/vectors/policy-resolution/02-resolved-and-matches.json +++ b/conformance/tests/vectors/policy-resolution/02-resolved-and-matches.json @@ -8,8 +8,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/policy-resolution/03-digest-mismatch-minimal-mutation.json b/conformance/tests/vectors/policy-resolution/03-digest-mismatch-minimal-mutation.json index e3fd69dc..1098e1ae 100644 --- a/conformance/tests/vectors/policy-resolution/03-digest-mismatch-minimal-mutation.json +++ b/conformance/tests/vectors/policy-resolution/03-digest-mismatch-minimal-mutation.json @@ -8,8 +8,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/policy-resolution/04-digest-mismatch-different-object.json b/conformance/tests/vectors/policy-resolution/04-digest-mismatch-different-object.json index 3df4fcef..4e191c53 100644 --- a/conformance/tests/vectors/policy-resolution/04-digest-mismatch-different-object.json +++ b/conformance/tests/vectors/policy-resolution/04-digest-mismatch-different-object.json @@ -8,8 +8,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/policy-resolution/05-referent-unreachable-no-route.json b/conformance/tests/vectors/policy-resolution/05-referent-unreachable-no-route.json index a02e76af..65bd3e26 100644 --- a/conformance/tests/vectors/policy-resolution/05-referent-unreachable-no-route.json +++ b/conformance/tests/vectors/policy-resolution/05-referent-unreachable-no-route.json @@ -8,8 +8,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/policy-resolution/06-resolved-and-matches-sha384.json b/conformance/tests/vectors/policy-resolution/06-resolved-and-matches-sha384.json index 4564fa30..d7144520 100644 --- a/conformance/tests/vectors/policy-resolution/06-resolved-and-matches-sha384.json +++ b/conformance/tests/vectors/policy-resolution/06-resolved-and-matches-sha384.json @@ -8,8 +8,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/policy-resolution/07-digest-bound-to-other-referent.json b/conformance/tests/vectors/policy-resolution/07-digest-bound-to-other-referent.json index 0e5d399b..8c4066d1 100644 --- a/conformance/tests/vectors/policy-resolution/07-digest-bound-to-other-referent.json +++ b/conformance/tests/vectors/policy-resolution/07-digest-bound-to-other-referent.json @@ -8,8 +8,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/policy-resolution/08-policy-uri-is-a-relative-reference.json b/conformance/tests/vectors/policy-resolution/08-policy-uri-is-a-relative-reference.json index 7ed84251..c50234df 100644 --- a/conformance/tests/vectors/policy-resolution/08-policy-uri-is-a-relative-reference.json +++ b/conformance/tests/vectors/policy-resolution/08-policy-uri-is-a-relative-reference.json @@ -8,8 +8,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/policy-resolution/09-sha384-bound-to-other-referent.json b/conformance/tests/vectors/policy-resolution/09-sha384-bound-to-other-referent.json index f0af0b63..7f6ef1c3 100644 --- a/conformance/tests/vectors/policy-resolution/09-sha384-bound-to-other-referent.json +++ b/conformance/tests/vectors/policy-resolution/09-sha384-bound-to-other-referent.json @@ -8,8 +8,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/policy-resolution/10-policy-uri-carries-a-space.json b/conformance/tests/vectors/policy-resolution/10-policy-uri-carries-a-space.json index 0e378453..8bdc7e62 100644 --- a/conformance/tests/vectors/policy-resolution/10-policy-uri-carries-a-space.json +++ b/conformance/tests/vectors/policy-resolution/10-policy-uri-carries-a-space.json @@ -8,8 +8,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/policy-resolution/11-referent-unreachable-route-fails.json b/conformance/tests/vectors/policy-resolution/11-referent-unreachable-route-fails.json index 75032b25..faac5caf 100644 --- a/conformance/tests/vectors/policy-resolution/11-referent-unreachable-route-fails.json +++ b/conformance/tests/vectors/policy-resolution/11-referent-unreachable-route-fails.json @@ -8,8 +8,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/policy-resolution/gen_policy_resolution.py b/conformance/tests/vectors/policy-resolution/gen_policy_resolution.py index acf88231..436fabe9 100644 --- a/conformance/tests/vectors/policy-resolution/gen_policy_resolution.py +++ b/conformance/tests/vectors/policy-resolution/gen_policy_resolution.py @@ -22,8 +22,8 @@ WHAT EACH VECTOR ASSERTS One thing: the status of the TR-POL-003 finding. That is the unit of measurement for this set, and it is deliberately narrower than a whole - record's verdict. These records carry other findings — they are unsigned, - so TR-SIG-005 has an opinion about them — and reading the set at record + record's verdict. These records carry other findings (they are unsigned, + so TR-SIG-005 has an opinion about them), and reading the set at record granularity would blur the check under test with everything around it. ANCHORS @@ -152,7 +152,7 @@ def record_with(policy: dict[str, object]) -> dict[str, object]: "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", "iat": RECORD_IAT, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", - "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-5"}, + "model": {"provider": "example-provider", "model_id": "example-model"}, "runtime": { "platform": "intel-tdx", "measurement": @@ -271,7 +271,7 @@ def main(out_dir: Path | None = None) -> int: The parameter exists so the byte-reproduction guard can regenerate into a temporary directory and compare, rather than overwriting the committed - files and comparing them to themselves — which would agree no matter what. + files and comparing them to themselves, which would agree no matter what. """ here = Path(out_dir) if out_dir is not None else HERE policies = here / "policies" diff --git a/conformance/tests/vectors/valid_appraisal_full.json b/conformance/tests/vectors/valid_appraisal_full.json index b7c3e696..b1c88a72 100644 --- a/conformance/tests/vectors/valid_appraisal_full.json +++ b/conformance/tests/vectors/valid_appraisal_full.json @@ -3,8 +3,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/valid_level0.json b/conformance/tests/vectors/valid_level0.json index 84035811..78e85241 100644 --- a/conformance/tests/vectors/valid_level0.json +++ b/conformance/tests/vectors/valid_level0.json @@ -3,8 +3,8 @@ "iat": 1748000000, "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "intel-tdx", diff --git a/conformance/tests/vectors/valid_level0_with_transcript.json b/conformance/tests/vectors/valid_level0_with_transcript.json index 37c1b2d7..841d2b81 100644 --- a/conformance/tests/vectors/valid_level0_with_transcript.json +++ b/conformance/tests/vectors/valid_level0_with_transcript.json @@ -3,8 +3,8 @@ "iat": 1748000001, "subject": "spiffe://example.org/agent/payments/01926b4c-1234-7abc-9def-000000000002", "model": { - "provider": "anthropic", - "model_id": "claude-opus-4-8", + "provider": "example-provider", + "model_id": "example-model-large", "version": "2026-06" }, "runtime": { diff --git a/conformance/tests/vectors/valid_openshell_import.json b/conformance/tests/vectors/valid_openshell_import.json index ab6ecfc1..745e45a3 100644 --- a/conformance/tests/vectors/valid_openshell_import.json +++ b/conformance/tests/vectors/valid_openshell_import.json @@ -3,8 +3,8 @@ "iat": 1775014139, "subject": "spiffe://example.org/agent/codex", "model": { - "provider": "openai", - "model_id": "gpt-5" + "provider": "example-provider", + "model_id": "example-model" }, "runtime": { "platform": "software-only", diff --git a/docs/crosswalks/acta-decision-receipts.md b/docs/crosswalks/acta-decision-receipts.md index f93cab07..aee25c65 100644 --- a/docs/crosswalks/acta-decision-receipts.md +++ b/docs/crosswalks/acta-decision-receipts.md @@ -2,13 +2,13 @@ Acta is an IETF draft format for signed receipts that record whether an AI agent's tool call was allowed before it ran. This page shows how such a receipt can travel next to a TRACE record as supporting evidence, and which Acta fields a TRACE verifier checks. It is for teams that already produce Acta receipts; neither format changes. -> **Non-normative.** This document is informative only. Nothing here changes TRACE v0.1 schema fields, wire formats, required claims, or conformance requirements. References to "TRACE" mean the TRACE v0.1 Trust Record as defined in [`spec/trace-v0.1.md`](../../spec/trace-v0.1.md). References to "Acta" mean the receipt format specified in [draft-farley-acta-signed-receipts](https://datatracker.ietf.org/doc/draft-farley-acta-signed-receipts/) (revision 02); section references of the form "Acta s2.1" are to that draft. +> **Non-normative.** This document is informative only. Nothing here changes TRACE v0.2 schema fields, wire formats, required claims, or conformance requirements. References to "TRACE" mean the TRACE v0.2 Trust Record as defined in [`spec/trace-v0.2.md`](../../spec/trace-v0.2.md). References to "Acta" mean the receipt format specified in [draft-farley-acta-signed-receipts](https://datatracker.ietf.org/doc/draft-farley-acta-signed-receipts/) (revision 02); section references of the form "Acta s2.1" are to that draft. --- ## Purpose -[Spec section 3.3.2](../../spec/trace-v0.1.md#332-action-receipts-for-embodied-workflows-informative) describes action receipts as evidence that sits below a Trust Record: a per-action signed statement, bound to a call or session, that a verifier checks independently of the core record. The [embodied-workflow fixtures](https://github.com/agentrust-io/trace-spec/blob/main/examples/action-receipts/README.md) show one profile of that pattern, for a physical controller (a robot arm, a safety monitor) signing an assertion about a physical action. +[Spec section 3.3.3](../../spec/trace-v0.2.md#333-action-receipts-for-embodied-workflows-informative) describes action receipts as evidence that sits below a Trust Record: a per-action signed statement, bound to a call or session, that a verifier checks independently of the core record. The [embodied-workflow fixtures](https://github.com/agentrust-io/trace-spec/blob/main/examples/action-receipts/README.md) show one profile of that pattern, for a physical controller (a robot arm, a safety monitor) signing an assertion about a physical action. This cross-walk describes a second profile of the same pattern: an **Acta decision receipt**, evidencing a software decision (an AI agent's tool call, decided by a local policy gate before it runs) rather than a physical one. The verification pattern in 3.3.2 is deliberately domain-agnostic; the intent here is to show it composes with an existing, independently specified receipt format without a wire-format change to either side. @@ -49,12 +49,12 @@ Working fixtures: [`examples/action-receipts/acta/`](https://github.com/agentrus ## Field mapping -Field names on the left are exact TRACE terms as used in [spec section 3.3.2](../../spec/trace-v0.1.md#332-action-receipts-for-embodied-workflows-informative) and the [embodied fixture shape](https://github.com/agentrust-io/trace-spec/blob/main/examples/action-receipts/README.md#shared-receipt-shape). Field names on the right are exact Acta draft-02 fields. +Field names on the left are exact TRACE terms as used in [spec section 3.3.3](../../spec/trace-v0.2.md#333-action-receipts-for-embodied-workflows-informative) and the [embodied fixture shape](https://github.com/agentrust-io/trace-spec/blob/main/examples/action-receipts/README.md#shared-receipt-shape). Field names on the right are exact Acta draft-02 fields. | TRACE action-receipt obligation | Acta field(s) | Notes | |---|---|---| | `receipt.issuer` | `payload.issuer_id` | REQUIRED common field (Acta s2.2); MUST match `signature.kid`, so issuer identity and key identity cannot silently diverge inside one receipt. | -| `receipt.issuer_key_id` | `signature.kid` | Resolved the same way 3.3.2 describes: through a pinned, manifest-bound, or otherwise trusted key set, not carried in the receipt as a public key. | +| `receipt.issuer_key_id` | `signature.kid` | Resolved the same way 3.3.3 describes: through a pinned, manifest-bound, or otherwise trusted key set, not carried in the receipt as a public key. | | `receipt.linked_call_id` / `session_id` | `payload.session_id` | Acta s3.1 binds at session level; `session_id` is OPTIONAL, and when present MUST NOT contain PII or be correlatable across sessions unless the operator explicitly configures session binding. Acta has no per-call identifier field; a TRACE-composing deployment gets call-level binding by carrying the tool input's digest in `payload_digest` (below) or by a deployment extension field, and should say which. | | `receipt.evidence_type` | `payload.type` | Namespaced receipt type (Acta s2.2), here `protectmcp:decision`. | | `receipt.evidence_hash` | `payload.payload_digest` | OPTIONAL common field (Acta s2.2): `{hash, size, preview?}` over associated data (tool input/output) too large to embed. Serves exactly the external-evidence-by-digest role 3.3.2 describes. | @@ -96,7 +96,7 @@ An Acta decision receipt proves that a specific policy decision, over a specific - that the decided tool call's real-world side effect was safe, correct, or reversible (out of scope for both Acta and TRACE); - that the receipt occupies the chain position it claims, that its policy binding is still current, or that it is being presented under the session it was issued for, if only the signature was checked (fixtures `04`, `05`, `06` respectively; each is validly signed and fails exactly one non-signature check); -- physical completion or functional-safety certification of any kind, which is the boundary [spec section 2.4](../../spec/trace-v0.1.md#24-permanent-scope-boundaries) and the [external-execution-evidence decision on trace-spec#34](https://github.com/agentrust-io/trace-spec/issues/34) already state for the embodied case, and which applies identically here. +- physical completion or functional-safety certification of any kind, which is the boundary [spec section 2.4](../../spec/trace-v0.2.md#24-permanent-scope-boundaries) and the [external-execution-evidence decision on trace-spec#34](https://github.com/agentrust-io/trace-spec/issues/34) already state for the embodied case, and which applies identically here. ## Conformance fixtures @@ -104,8 +104,8 @@ Six real fixtures in [`examples/action-receipts/acta/`](https://github.com/agent ## References -- TRACE v0.1 specification, section 3.3.2: [`spec/trace-v0.1.md`](../../spec/trace-v0.1.md#332-action-receipts-for-embodied-workflows-informative) -- TRACE v0.1 specification, section 2.4 (permanent scope boundaries): [`spec/trace-v0.1.md`](../../spec/trace-v0.1.md#24-permanent-scope-boundaries) +- TRACE v0.2 specification, section 3.3.3: [`spec/trace-v0.2.md`](../../spec/trace-v0.2.md#333-action-receipts-for-embodied-workflows-informative) +- TRACE v0.2 specification, section 2.4 (permanent scope boundaries): [`spec/trace-v0.2.md`](../../spec/trace-v0.2.md#24-permanent-scope-boundaries) - trace-spec#34 (external execution evidence, closed): - trace-spec#66 (verification depth + action_receipts): - trace-spec#95 (action receipt conformance cases): diff --git a/docs/platforms/bernstein.md b/docs/platforms/bernstein.md index a4b53563..68e1c12b 100644 --- a/docs/platforms/bernstein.md +++ b/docs/platforms/bernstein.md @@ -98,7 +98,7 @@ Steps 1 to 3 need the records alone. Step 4 needs the journal, which is run-priv ## Assurance boundary -Bernstein records sit at Level 0, the software-signed level. Without hardware evidence a record cannot reach Level 1: the conformance suite's `TR-RTE-001` refuses `software-only` at hardware-attested levels and `TR-RTE-004` wants a verifier-issued nonce that a committed record cannot carry. A committed corpus also cannot pass `TR-ENV-002` without `--max-age`, since a record that regenerates byte-for-byte carries a fixed `iat`; this repository's own `examples/amd-sev-snp.json` has the same property. None of that is a defect of the producer; it is what a published record is. See [trust levels](../trust-levels.md). +Bernstein records sit at Level 0, the software-signed level. Without hardware evidence a record cannot reach Level 1: the conformance suite's `TR-RTE-001` refuses `software-only` at Levels 1 and 2 and `TR-RTE-004` wants a verifier-issued nonce that a committed record cannot carry. A committed corpus also cannot pass `TR-ENV-002` without `--max-age`, since a record that regenerates byte-for-byte carries a fixed `iat`; this repository's own `examples/amd-sev-snp.json` has the same property. None of that is a defect of the producer; it is what a published record is. See [trust levels](../trust-levels.md). What the producer's evidence establishes, once verified: that the install identity signed these digests over this journal, that the chain of hops is the chain the parent signed, and, when the claim is carried, that the coordination sequence re-derives from its recorded inputs. What it does not establish: that the journal is complete, beyond what the seal says; and anything about the workload's side effects or the model's answers, which are inputs. diff --git a/docs/platforms/index.md b/docs/platforms/index.md index 2b67418a..58da6fe1 100644 --- a/docs/platforms/index.md +++ b/docs/platforms/index.md @@ -8,7 +8,7 @@ Choosing a hardware platform does not give a record either level by itself. Whoe ## Platform names and evidence -A standalone TRACE record names its platform in the `runtime.platform` field, using the values in the [canonical schema](https://github.com/agentrust-io/trace-spec/blob/main/schema/trace-claim.json). Other tools have their own names: cMCP's configuration names `sev-snp`, `tdx` and `opaque` are not the same values and cannot be swapped in. +A standalone TRACE record names its platform in the `runtime.platform` field, using the values in the [canonical schema](https://github.com/agentrust-io/trace-spec/blob/main/schema/trace-claim.json). Other tools have their own names: cMCP's configuration names, such as `sev-snp` and `tdx`, are not the same values and cannot be swapped in. | Platform guide | Standalone `runtime.platform` | Evidence to appraise | |---|---|---| diff --git a/docs/platforms/nvidia-h100.md b/docs/platforms/nvidia-h100.md index b9075a79..9e834fc1 100644 --- a/docs/platforms/nvidia-h100.md +++ b/docs/platforms/nvidia-h100.md @@ -8,7 +8,7 @@ NVIDIA GPU attestation is a signed report about which GPU this is and what firmw Standalone TRACE registers `runtime.platform="nvidia-h100"` and `"nvidia-blackwell"`. A registered identifier does not mean this Python SDK collects GPU evidence or verifies an NRAS result. The producer must define how its `runtime.measurement` relates to authenticated GPU evidence. -The cMCP configuration name `opaque` belongs to that runtime's provider interface; it is not a standalone TRACE platform value. Follow the producing runtime's envelope and verifier documentation rather than substituting names between formats. +cMCP's configuration names belong to that runtime's provider interface; they are not standalone TRACE platform values. Follow the producing runtime's envelope and verifier documentation rather than substituting names between formats. ## CPU, GPU, and signing-key binding diff --git a/docs/trust-levels.md b/docs/trust-levels.md index 8a4a1774..612fca0f 100644 --- a/docs/trust-levels.md +++ b/docs/trust-levels.md @@ -22,7 +22,7 @@ TRACE's conformance suite (the public set of tests an implementation runs to sho | 1: hardware evidence | Runtime and build-provenance checks | Actual quote appraisal, expected measurements, key binding, provider-specific limits | | 2: transparency | Transcript and anchoring checks | Authenticated log/checkpoint, inclusion proof, record binding, completeness of the submitted history | -See the [suite's level definitions](https://tests.agentrust-io.com/docs/levels/) for required modules and its [limitations](https://tests.agentrust-io.com/LIMITATIONS/) for what a pass establishes. Record-format checks must not be described as a fresh hardware appraisal unless that evidence was actually verified. +See the [suite's level definitions](https://trace.agentrust-io.com/conformance/docs/levels/) for required modules and its [limitations](https://trace.agentrust-io.com/conformance/LIMITATIONS/) for what a pass establishes. Record-format checks must not be described as a fresh hardware appraisal unless that evidence was actually verified. diff --git a/examples/action-receipts/acta/README.md b/examples/action-receipts/acta/README.md index ae3c3a14..e4d2f37c 100644 --- a/examples/action-receipts/acta/README.md +++ b/examples/action-receipts/acta/README.md @@ -5,7 +5,7 @@ in the parent directory. Where that profile evidences a physical action taken by an external controller (a robot arm, a safety monitor), this one evidences a **software decision**: an AI agent's tool call, evaluated and decided by a local policy gate before it runs. Same verification pattern from -[spec section 3.3.2](../../../spec/trace-v0.1.md#332-action-receipts-for-embodied-workflows-informative), +[spec section 3.3.3](../../../spec/trace-v0.2.md#333-action-receipts-for-embodied-workflows-informative), different action class, and the two should not be conflated: nothing here claims a physical outcome. diff --git a/examples/amd-sev-snp.json b/examples/amd-sev-snp.json index eeb3ce0d..7141578f 100644 --- a/examples/amd-sev-snp.json +++ b/examples/amd-sev-snp.json @@ -3,10 +3,10 @@ "iat": 1782212142, "subject": "spiffe://trust.example.org/agent/payments-processor/prod", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-6", + "provider": "example-provider", + "model_id": "example-model", "version": "20251001", - "aibom_uri": "https://registry.agentrust-io.com/aibom/claude-sonnet-4-6-20251001" + "aibom_uri": "https://registry.agentrust-io.com/aibom/example-model-20251001" }, "runtime": { "platform": "amd-sev-snp", diff --git a/examples/intel-tdx.json b/examples/intel-tdx.json index 42f049a0..13b86afb 100644 --- a/examples/intel-tdx.json +++ b/examples/intel-tdx.json @@ -3,11 +3,11 @@ "iat": 1782212200, "subject": "spiffe://trust.example.org/agent/document-processor/staging", "model": { - "provider": "meta", - "model_id": "llama-3.3-70b-instruct", + "provider": "example-provider", + "model_id": "example-model-open", "version": "3.3", "weights_digest": "sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2", - "aibom_uri": "https://registry.agentrust-io.com/aibom/llama-3.3-70b-20260101" + "aibom_uri": "https://registry.agentrust-io.com/aibom/example-model-open-20260101" }, "runtime": { "platform": "intel-tdx", diff --git a/examples/number-spelling/gen_number_spelling.py b/examples/number-spelling/gen_number_spelling.py index 37dc11f3..4e4bba19 100644 --- a/examples/number-spelling/gen_number_spelling.py +++ b/examples/number-spelling/gen_number_spelling.py @@ -239,7 +239,7 @@ def fixture(vector: dict[str, Any]) -> str: def main() -> None: for vector in VECTORS: path = OUT / vector["file"] - path.write_text(fixture(vector), encoding="utf-8") + path.write_text(fixture(vector), encoding="utf-8", newline="\n") print("wrote", path.name) diff --git a/examples/nvidia-h100.json b/examples/nvidia-h100.json index ff380a97..976daecd 100644 --- a/examples/nvidia-h100.json +++ b/examples/nvidia-h100.json @@ -3,11 +3,11 @@ "iat": 1782212300, "subject": "spiffe://trust.example.org/agent/image-analysis/prod", "model": { - "provider": "anthropic", - "model_id": "claude-opus-4-8", + "provider": "example-provider", + "model_id": "example-model-large", "version": "20260601", "weights_digest": "sha256:d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5", - "aibom_uri": "https://registry.agentrust-io.com/aibom/claude-opus-4-8-20260601" + "aibom_uri": "https://registry.agentrust-io.com/aibom/example-model-large-20260601" }, "runtime": { "platform": "nvidia-h100", diff --git a/examples/sandbox-runtime.json b/examples/sandbox-runtime.json index 1b6541b5..97a0f058 100644 --- a/examples/sandbox-runtime.json +++ b/examples/sandbox-runtime.json @@ -3,8 +3,8 @@ "iat": 1785936000, "subject": "spiffe://runtime.example.org/sandbox/code-review-7f2a", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-6", + "provider": "example-provider", + "model_id": "example-model", "version": "20251001" }, "runtime": { diff --git a/examples/tpm2.json b/examples/tpm2.json index dfb1772e..fee785f7 100644 --- a/examples/tpm2.json +++ b/examples/tpm2.json @@ -3,11 +3,11 @@ "iat": 1782212200, "subject": "spiffe://trust.example.org/agent/document-processor/staging", "model": { - "provider": "meta", - "model_id": "llama-3.3-70b-instruct", + "provider": "example-provider", + "model_id": "example-model-open", "version": "3.3", "weights_digest": "sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08", - "aibom_uri": "https://registry.agentrust-io.com/aibom/llama-3.3-70b-20260101" + "aibom_uri": "https://registry.agentrust-io.com/aibom/example-model-open-20260101" }, "runtime": { "platform": "tpm2", diff --git a/index.md b/index.md index f7fbb9e5..99014ccd 100644 --- a/index.md +++ b/index.md @@ -48,7 +48,7 @@ TRACE is a free, open format for a signed receipt of what an AI agent did: which --- - TRACE is the evidence step, the last of four. Publish records to the public [TRACE Registry](https://agentrust-io.com/registry/) and test an implementation with the [conformance suite](https://tests.agentrust-io.com). + TRACE is the evidence step, the last of four. Publish records to the public [TRACE Registry](https://agentrust-io.com/registry/) and test an implementation with the [conformance suite](https://trace.agentrust-io.com/conformance/). [See the chain](https://agentrust-io.com/#chain) @@ -72,7 +72,7 @@ Every field is the producer's claim. A valid signature alone does not show that ## Where to go next - [TRACE v0.2](spec/trace-v0.2.md): the specification itself, with the fields, the publishing protocol and the checking rules. -- [Conformance suite](https://tests.agentrust-io.com): test an implementation, level by level, before saying it complies. +- [Conformance suite](https://trace.agentrust-io.com/conformance/): test an implementation, level by level, before saying it complies. - [Integration guides](docs/integration/agt.md): produce and read Trust Records from AGT, cMCP and sandboxed agent runtimes. ## What it is built on diff --git a/mkdocs.yml b/mkdocs.yml index 31822e9f..bb38dfe5 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -266,7 +266,7 @@ nav: - Intel TDX: docs/platforms/intel-tdx.md - NVIDIA H100: docs/platforms/nvidia-h100.md - Bernstein (software-only): docs/platforms/bernstein.md - - Conformance test suite: https://tests.agentrust-io.com + - Conformance test suite: https://trace.agentrust-io.com/conformance/ - Project: - Limitations: LIMITATIONS.md - Roadmap: ROADMAP.md diff --git a/overrides/main.html b/overrides/main.html index 5520deb1..f1e70558 100644 --- a/overrides/main.html +++ b/overrides/main.html @@ -65,7 +65,6 @@ "https://cmcp.agentrust-io.com", "https://ca2a.agentrust-io.com", "https://wcm.agentrust-io.com", - "https://tests.agentrust-io.com", "https://governance.agentrust-io.com" ] }, diff --git a/pyproject.toml b/pyproject.toml index 12d1f30e..3b0d5aeb 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -5,7 +5,7 @@ build-backend = "hatchling.build" [project] name = "agentrust-trace" version = "0.11.0" -description = "TRACE v0.2: hardware-attested governance records for AI agents" +description = "TRACE v0.2: signed governance records for AI agents" readme = "README.md" license = { text = "Apache-2.0" } requires-python = ">=3.11" diff --git a/schema/trace-claim-v0.3-draft.json b/schema/trace-claim-v0.3-draft.json index 776e77b3..24d73cb4 100644 --- a/schema/trace-claim-v0.3-draft.json +++ b/schema/trace-claim-v0.3-draft.json @@ -74,7 +74,7 @@ "properties": { "provider": { "type": "string", - "description": "Model provider (e.g. 'anthropic', 'openai', 'meta')." + "description": "Model provider (e.g. 'example-provider')." }, "model_id": { "type": "string", diff --git a/schema/trace-claim.json b/schema/trace-claim.json index 370f635e..129e3bd8 100644 --- a/schema/trace-claim.json +++ b/schema/trace-claim.json @@ -33,7 +33,7 @@ } }, "title": "TRACE Trust Record", - "description": "A TRACE v0.2 Trust Record: hardware-attested governance evidence for an AI agent execution.", + "description": "A TRACE v0.2 Trust Record: a signed governance record for an AI agent execution, which can carry hardware attestation evidence.", "type": "object", "required": [ "eat_profile", @@ -74,7 +74,7 @@ "properties": { "provider": { "type": "string", - "description": "Model provider (e.g. 'anthropic', 'openai', 'meta')." + "description": "Model provider (e.g. 'example-provider')." }, "model_id": { "type": "string", diff --git a/spec/trace-v0.1.md b/spec/trace-v0.1.md index daa54814..1e7d6ec8 100644 --- a/spec/trace-v0.1.md +++ b/spec/trace-v0.1.md @@ -135,8 +135,8 @@ Each field is independently verifiable. Sub-records (e.g., per-tool-call transcr "iat": 1750676142, "subject": "spiffe://trust.example.org/agent/payments-processor/prod", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-6", + "provider": "example-provider", + "model_id": "example-model", "version": "20251001", "weights_digest": "sha256:a3f8d2c1e9b04756..." }, @@ -333,7 +333,7 @@ TRACE is a **profile**, not a parallel stack. It binds existing primitives into ### 4.3 Bindings TRACE adds -These components exist in their respective ecosystems. TRACE adds the binding rule that places each into a hardware-attested envelope: +These components exist in their respective ecosystems. TRACE adds the binding rule that places each into one signed envelope that can carry hardware attestation evidence: - **`policy` claim.** Policy artifacts (OPA bundles, Cedar policies, custom DSLs) and policy hashing are established. TRACE adds the binding: the policy bundle hash is sealed to the TEE measurement, the enforcement mode is recorded, and substituting the policy invalidates the runtime claim. Gateways MUST default `enforcement_mode` to `enforce`. A deployment MUST explicitly configure `silent` mode; `silent` MUST NOT be the default. In `silent` mode, the audit chain still records every would-have-denied decision; only operational log lines are suppressed. - **`data_class` claim.** Data classification schemes are established (DLP labels, NIST SP 800-60, sensitivity tags). TRACE adds: a classification label is attached to inputs and outputs at the per-call layer and recorded in the Trust Record alongside the runtime evidence. @@ -382,7 +382,7 @@ Other standards bodies participate as technical-liaison partners: OpenSSF (SLSA The following organizations have been identified as natural contributors to this standard based on their work in confidential computing, AI safety, and open governance. Formal participation is subject to each organization's independent decision. -Anthropic, NVIDIA, Intel, AMD, Microsoft, Google, Linux Foundation, Confidential Computing Consortium, ATRC, TII, AI71. +NVIDIA, Intel, AMD, Microsoft, Linux Foundation, Confidential Computing Consortium, ATRC, TII, AI71. ### 6.3 IP and licensing @@ -421,7 +421,7 @@ These need input before v0.2: | SPIFFE | Secure Production Identity Framework For Everyone (CNCF). Workload identity | | AIBOM | AI Bill of Materials (SPDX 3.0 AI Profile, CycloneDX 1.7 ML-BOM) | | MCP | Model Context Protocol. Agent tool-call surface | -| A2A | Agent-to-Agent (Google). Inter-agent communication protocol | +| A2A | Agent2Agent protocol (Linux Foundation). Inter-agent communication protocol | | C2PA | Coalition for Content Provenance and Authenticity. Content origin manifests | | RIM | Reference Integrity Manifest. Vendor-published reference measurements | | Trust Record | TRACE's portable signed artifact — see §3 | @@ -467,8 +467,8 @@ These need input before v0.2: ### Adjacent Work -- Project Oak (Google DeepMind) — https://github.com/project-oak/oak -- Anthropic MCP Specification — https://modelcontextprotocol.io/specification/ -- Google A2A Specification — https://a2a-protocol.org/latest/specification/ +- Project Oak — https://github.com/project-oak/oak +- Model Context Protocol Specification — https://modelcontextprotocol.io/specification/ +- Agent2Agent (A2A) Protocol Specification — https://a2a-protocol.org/latest/specification/ - MITRE ATLAS — https://atlas.mitre.org/ - OWASP Top 10 for Agentic Applications — https://genai.owasp.org/ diff --git a/spec/trace-v0.2.md b/spec/trace-v0.2.md index 2e1d0675..41322448 100644 --- a/spec/trace-v0.2.md +++ b/spec/trace-v0.2.md @@ -74,7 +74,7 @@ Records already issued under v0.1 remain verifiable against the v0.1 specificati ## Abstract -TRACE (Trust, Runtime Attestation, and Compliance Evidence) defines an open, portable, hardware-attested governance record for AI agents and other confidential workloads. It binds *what executed* (model, code, runtime), *under what policy*, *on what data class*, *invoking which tools*, into a single signed artifact rooted in silicon attestation. The record travels with the workload across hosts, clouds, and providers and is verifiable offline by any party. +TRACE (Trust, Runtime Attestation, and Compliance Evidence) defines an open, portable, signed governance record for AI agents and other confidential workloads, which can carry hardware attestation evidence. It binds *what executed* (model, code, runtime), *under what policy*, *on what data class*, *invoking which tools*, into a single signed artifact. The reference SDK does not verify attestation evidence. The record travels with the workload across hosts, clouds, and providers and is verifiable offline by any party. TRACE composes existing standards rather than replacing them. It profiles RATS/EAT (RFC 9711) for the wire envelope, SLSA for build-time provenance, SCITT for transparency anchoring, SPIFFE for workload identity, EAR for evidence appraisal, and MCP / A2A for the agent execution surface. Where gaps exist, notably the AI-agent execution profile, TRACE proposes the minimum new schema to close them. @@ -445,8 +445,8 @@ Example result, for a reference composite in which one layer holds a separator o "iat": 1750676142, "subject": "spiffe://trust.example.org/agent/payments-processor/prod", "model": { - "provider": "anthropic", - "model_id": "claude-sonnet-4-6", + "provider": "example-provider", + "model_id": "example-model", "version": "20251001", "weights_digest": "sha256:a3f8d2c1e9b04756..." }, @@ -831,7 +831,7 @@ TRACE is a **profile**, not a parallel stack. It binds existing primitives into ### 4.3 Bindings TRACE adds -These components exist in their respective ecosystems. TRACE adds the binding rule that places each into a hardware-attested envelope: +These components exist in their respective ecosystems. TRACE adds the binding rule that places each into one signed envelope that can carry hardware attestation evidence: @@ -886,7 +886,7 @@ Other standards bodies participate as technical-liaison partners: OpenSSF (SLSA The following organizations have been identified as natural contributors to this standard based on their work in confidential computing, AI safety, and open governance. Formal participation is subject to each organization's independent decision. -Anthropic, NVIDIA, Intel, AMD, Microsoft, Google, Linux Foundation, Confidential Computing Consortium, ATRC, TII, AI71. +NVIDIA, Intel, AMD, Microsoft, Linux Foundation, Confidential Computing Consortium, ATRC, TII, AI71. ### 6.3 IP and licensing @@ -925,7 +925,7 @@ These need input before v1.0. Two are now resolved and are kept here, marked, so | SPIFFE | Secure Production Identity Framework For Everyone (CNCF). Workload identity | | AIBOM | AI Bill of Materials (SPDX 3.0 AI Profile, CycloneDX 1.7 ML-BOM) | | MCP | Model Context Protocol. Agent tool-call surface | -| A2A | Agent-to-Agent (Google). Inter-agent communication protocol | +| A2A | Agent2Agent protocol (Linux Foundation). Inter-agent communication protocol | | C2PA | Coalition for Content Provenance and Authenticity. Content origin manifests | | RIM | Reference Integrity Manifest. Vendor-published reference measurements | | Trust Record | TRACE's portable signed artifact: see §3 | @@ -972,8 +972,8 @@ These need input before v1.0. Two are now resolved and are kept here, marked, so ### Adjacent Work -- Project Oak (Google DeepMind): https://github.com/project-oak/oak -- Anthropic MCP Specification: https://modelcontextprotocol.io/specification/ -- Google A2A Specification: https://a2a-protocol.org/latest/specification/ +- Project Oak: https://github.com/project-oak/oak +- Model Context Protocol Specification: https://modelcontextprotocol.io/specification/ +- Agent2Agent (A2A) Protocol Specification: https://a2a-protocol.org/latest/specification/ - MITRE ATLAS: https://atlas.mitre.org/ - OWASP Top 10 for Agentic Applications: https://genai.owasp.org/ diff --git a/src/agentrust_trace/adapters/agt.py b/src/agentrust_trace/adapters/agt.py index 8bd6ed62..8223901b 100644 --- a/src/agentrust_trace/adapters/agt.py +++ b/src/agentrust_trace/adapters/agt.py @@ -96,8 +96,8 @@ class TraceAGTAdapter: once per AGT session:: adapter = TraceAGTAdapter( - model_provider="anthropic", - model_id="claude-sonnet-4-6", + model_provider="example-provider", + model_id="example-model", model_version="20251001", build_provenance_digest="sha256:e5f6a7b8...", transparency="https://registry.agentrust-io.com/claim/...", diff --git a/src/agentrust_trace/adapters/sandbox.py b/src/agentrust_trace/adapters/sandbox.py index d91fc973..af618f2c 100644 --- a/src/agentrust_trace/adapters/sandbox.py +++ b/src/agentrust_trace/adapters/sandbox.py @@ -264,8 +264,8 @@ class TraceSandboxAdapter: then call :meth:`build_trust_record` per session:: adapter = TraceSandboxAdapter( - model_provider="anthropic", - model_id="claude-sonnet-4-6", + model_provider="example-provider", + model_id="example-model", data_class="confidential", enforcement_mode="enforce", ) diff --git a/src/agentrust_trace/models.py b/src/agentrust_trace/models.py index f9f85f84..326867cd 100644 --- a/src/agentrust_trace/models.py +++ b/src/agentrust_trace/models.py @@ -563,7 +563,10 @@ class ConfirmationKey(_TraceModel): class TrustRecord(_TraceModel): - """TRACE v0.2 Trust Record: hardware-attested governance evidence for an AI agent execution.""" + """TRACE v0.2 Trust Record: a signed governance record for an AI agent execution. + + It can carry hardware attestation evidence; the SDK does not verify that evidence. + """ model_config = ConfigDict(extra="forbid") diff --git a/src/agentrust_trace/schema/trace-v0.1.json b/src/agentrust_trace/schema/trace-v0.1.json index 14468a23..0bf2cb2f 100644 --- a/src/agentrust_trace/schema/trace-v0.1.json +++ b/src/agentrust_trace/schema/trace-v0.1.json @@ -2,7 +2,7 @@ "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://agentrust.io/schema/trace-v0.1.json", "title": "TRACE Trust Record", - "description": "A TRACE v0.1 Trust Record: hardware-attested governance evidence for an AI agent execution.", + "description": "A TRACE v0.1 Trust Record: a signed governance record for an AI agent execution, which can carry hardware attestation evidence.", "type": "object", "required": [ "eat_profile", @@ -40,7 +40,7 @@ "properties": { "provider": { "type": "string", - "description": "Model provider (e.g. 'anthropic', 'openai', 'meta')." + "description": "Model provider (e.g. 'example-provider')." }, "model_id": { "type": "string", diff --git a/src/agentrust_trace/schema/trace-v0.2.json b/src/agentrust_trace/schema/trace-v0.2.json index 370f635e..129e3bd8 100644 --- a/src/agentrust_trace/schema/trace-v0.2.json +++ b/src/agentrust_trace/schema/trace-v0.2.json @@ -33,7 +33,7 @@ } }, "title": "TRACE Trust Record", - "description": "A TRACE v0.2 Trust Record: hardware-attested governance evidence for an AI agent execution.", + "description": "A TRACE v0.2 Trust Record: a signed governance record for an AI agent execution, which can carry hardware attestation evidence.", "type": "object", "required": [ "eat_profile", @@ -74,7 +74,7 @@ "properties": { "provider": { "type": "string", - "description": "Model provider (e.g. 'anthropic', 'openai', 'meta')." + "description": "Model provider (e.g. 'example-provider')." }, "model_id": { "type": "string", diff --git a/tests/test_agt_adapter.py b/tests/test_agt_adapter.py index 4c78c679..5f1470e1 100644 --- a/tests/test_agt_adapter.py +++ b/tests/test_agt_adapter.py @@ -36,8 +36,8 @@ def _make_adapter(**overrides) -> TraceAGTAdapter: defaults = { - "model_provider": "anthropic", - "model_id": "claude-sonnet-4-6", + "model_provider": "example-provider", + "model_id": "example-model", "model_version": "20251001", "data_class": "confidential", "build_provenance_slsa_level": 2, @@ -199,8 +199,8 @@ def test_enforcement_mode_has_no_default() -> None: # Spec section 4.3: `declared` MUST NOT be a default, and an `enforce` default # would claim an evaluation the adapter never observed (#416, #417). kwargs = { - "model_provider": "anthropic", - "model_id": "claude-sonnet-4-6", + "model_provider": "example-provider", + "model_id": "example-model", "build_provenance_digest": "sha256:" + "a" * 64, "transparency": TRANSPARENCY, } diff --git a/tests/test_cnf_jwk_carries_key_material.py b/tests/test_cnf_jwk_carries_key_material.py index 979414a3..ff1b867d 100644 --- a/tests/test_cnf_jwk_carries_key_material.py +++ b/tests/test_cnf_jwk_carries_key_material.py @@ -43,7 +43,7 @@ "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", "iat": 1750000000, "subject": "spiffe://factory.example/agent/payments/prod", - "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-6"}, + "model": {"provider": "example-provider", "model_id": "example-model"}, "runtime": {"platform": "software-only", "measurement": "sha256:" + "0" * 64}, "policy": {"bundle_hash": "sha256:" + "a" * 64, "enforcement_mode": "enforce"}, "data_class": "confidential", diff --git a/tests/test_revocation_policy_types.py b/tests/test_revocation_policy_types.py index e06e411a..9842ee07 100644 --- a/tests/test_revocation_policy_types.py +++ b/tests/test_revocation_policy_types.py @@ -15,7 +15,7 @@ def _record() -> dict: "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", "iat": int(time.time()), "subject": "did:mesh:spiffe://factory.example/agent/payments/prod", - "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-6"}, + "model": {"provider": "example-provider", "model_id": "example-model"}, "runtime": { "platform": "software-only", "measurement": "sha256:" + "0" * 64, diff --git a/tests/test_sandbox_adapter.py b/tests/test_sandbox_adapter.py index 25e2469d..44952997 100644 --- a/tests/test_sandbox_adapter.py +++ b/tests/test_sandbox_adapter.py @@ -50,8 +50,8 @@ def _make_adapter(**overrides: Any) -> TraceSandboxAdapter: defaults: dict[str, Any] = { - "model_provider": "anthropic", - "model_id": "claude-sonnet-4-6", + "model_provider": "example-provider", + "model_id": "example-model", "model_version": "20251001", "data_class": "confidential", "enforcement_mode": "enforce", @@ -512,7 +512,7 @@ def test_enforcement_mode_has_no_default() -> None: # Spec section 4.3: `declared` MUST NOT be a default, and an `enforce` default # would claim an evaluation the adapter never observed (#416, #417). with pytest.raises(TypeError, match="enforcement_mode"): - TraceSandboxAdapter(model_provider="anthropic", model_id="claude-sonnet-4-6") + TraceSandboxAdapter(model_provider="example-provider", model_id="example-model") @pytest.mark.parametrize("mode", ["enforce", "advisory", "silent", "declared"]) diff --git a/tests/test_sign.py b/tests/test_sign.py index b662c0ad..f26af2ad 100644 --- a/tests/test_sign.py +++ b/tests/test_sign.py @@ -37,7 +37,7 @@ def _minimal_record() -> dict: "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", "iat": 1750000000, "subject": "did:mesh:spiffe://factory.example/agent/payments/prod", - "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-6"}, + "model": {"provider": "example-provider", "model_id": "example-model"}, "runtime": { "platform": "software-only", "measurement": "sha256:" + "0" * 64, diff --git a/tests/test_the_exported_schema_is_not_the_live_one.py b/tests/test_the_exported_schema_is_not_the_live_one.py index 9ea2472d..362d15fd 100644 --- a/tests/test_the_exported_schema_is_not_the_live_one.py +++ b/tests/test_the_exported_schema_is_not_the_live_one.py @@ -25,7 +25,7 @@ "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", "iat": 1750000000, "subject": "did:mesh:spiffe://factory.example/agent/payments/prod", - "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-6"}, + "model": {"provider": "example-provider", "model_id": "example-model"}, "runtime": {"platform": "software-only", "measurement": "sha256:" + "0" * 64}, "policy": {"bundle_hash": "sha256:" + "a" * 64, "enforcement_mode": "enforce"}, "data_class": "confidential", diff --git a/tests/test_the_model_round_trip_preserves_a_record.py b/tests/test_the_model_round_trip_preserves_a_record.py index 5d96db0d..0785d62c 100644 --- a/tests/test_the_model_round_trip_preserves_a_record.py +++ b/tests/test_the_model_round_trip_preserves_a_record.py @@ -44,7 +44,7 @@ def _record(**over: Any) -> dict[str, Any]: "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", "iat": 1750000000, "subject": "did:mesh:spiffe://factory.example/agent/payments/prod", - "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-6"}, + "model": {"provider": "example-provider", "model_id": "example-model"}, "runtime": {"platform": "software-only", "measurement": "sha256:" + "0" * 64}, "policy": {"bundle_hash": "sha256:" + "a" * 64, "enforcement_mode": "enforce"}, "data_class": "confidential", diff --git a/tests/test_the_schema_and_the_models_agree.py b/tests/test_the_schema_and_the_models_agree.py index 58daeedf..c81ba568 100644 --- a/tests/test_the_schema_and_the_models_agree.py +++ b/tests/test_the_schema_and_the_models_agree.py @@ -75,7 +75,7 @@ "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", "iat": 1750000000, "subject": "did:mesh:spiffe://factory.example/agent/payments/prod", - "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-6"}, + "model": {"provider": "example-provider", "model_id": "example-model"}, "runtime": {"platform": "software-only", "measurement": "sha256:" + "0" * 64}, "policy": {"bundle_hash": "sha256:" + "a" * 64, "enforcement_mode": "enforce"}, "data_class": "confidential", @@ -254,7 +254,7 @@ def test_no_integer_field_accepts_a_boolean(path: tuple[str, ...], value: bool) #: be mutated into a disagreement. Section 3.1.4 added five more, all optional. FULL: dict[str, Any] = { **copy.deepcopy(BASE), - "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-6", + "model": {"provider": "example-provider", "model_id": "example-model", "weights_digest": "sha256:" + "d" * 64}, "delegation": {"parent_record_hash": "sha256:" + "e" * 64, "credential_id": "trace-spec-delegation-credential"}, diff --git a/tests/test_uri_formats_are_enforced.py b/tests/test_uri_formats_are_enforced.py index 57ef72a0..a7e81414 100644 --- a/tests/test_uri_formats_are_enforced.py +++ b/tests/test_uri_formats_are_enforced.py @@ -46,7 +46,7 @@ "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2", "iat": 1750000000, "subject": "did:mesh:spiffe://factory.example/agent/payments/prod", - "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-6"}, + "model": {"provider": "example-provider", "model_id": "example-model"}, "runtime": {"platform": "software-only", "measurement": "sha256:" + "0" * 64}, "policy": {"bundle_hash": "sha256:" + "a" * 64, "enforcement_mode": "enforce"}, "data_class": "confidential",