agentrust-trace-tests 0.2.0__tar.gz → 0.4.0__tar.gz

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/.github/workflows/ci.yml

@@ -17,7 +17,7 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v5.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.3.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install package and test deps

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/.github/workflows/docs.yml

@@ -30,7 +30,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: "3.11"
           cache: pip

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/.github/workflows/release.yml

@@ -14,7 +14,7 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
@@ -41,4 +41,4 @@ jobs:
           name: dist
           path: dist/
 
-      - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+      - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/.gitignore

@@ -4,3 +4,7 @@ __pycache__/
 dist/
 *.egg-info/
 .coverage
+
+# Local virtual environments
+.venv/
+venv/

agentrust_trace_tests-0.4.0/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+## Unreleased
+
+## v0.4.0 — 2026-07-28
+
+### Changed
+
+- **BREAKING: the suite now conforms to TRACE v0.2.** `TR-ENV` requires the profile `tag:agentrust-io.com,2026:trace-v0.2` and fails a record carrying the v0.1 identifier. The v0.1 URI named `agentrust.io`, a domain this project never controlled, which RFC 4151 does not permit for a tag URI; see agentrust-io/trace-spec#107. Nothing else about the record format changed, so a producer migrates by updating the profile string and bumping `agentrust-trace` to 0.5.0.
+
+  This is a deliberate cutover rather than dual acceptance: a conformance suite that passed both identifiers would certify records minted under a domain we do not own. A v0.1 record is checked with the 0.3.x releases of this suite, which stay published.
+
+- Registry, verifier, and documentation hosts moved from `agentrust.io` to `agentrust-io.com`.
+
+## v0.3.0 — 2026-07-21
+
+- `azure-cvm-sev-snp` platform accepted (`runtime.platform`): Azure confidential VMs run SEV-SNP behind a Hyper-V paravisor (vTPM-rooted). Added to the bundled schema enum and the TR-RTE valid-platform set so Azure TRACE records pass conformance. Matches `agentrust-trace>=0.4`.
+
+## v0.2.0 — 2026-06-19
+
+- DID subject support: `subject` now accepts `did:` URIs in addition to `spiffe://`.
+- Embedded signature verification: plain TRACE records signed with `agentrust-trace sign_record()` are now cryptographically verified at all levels.
+- SLSA Level 0: `build_provenance.slsa_level: 0` is now valid for software-only / development records.
+- Software-only platform: `runtime.platform: "software-only"` accepted at Level 0.
+- Private key leak detection: TR-SIG now fails records that embed a private key (`d` member) in `cnf.jwk`.
+
+## v0.1.0 — 2026-05-01
+
+- Initial release with 7 test modules: TR-ENV, TR-SIG, TR-RTE, TR-POL, TR-TXN, TR-ANC, TR-SCA.
+- Conformance levels 0, 1, 2.

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/PKG-INFO

@@ -1,12 +1,12 @@
 Metadata-Version: 2.4
 Name: agentrust-trace-tests
-Version: 0.2.0
+Version: 0.4.0
 Summary: TRACE conformance test suite
 Project-URL: Homepage, https://github.com/agentrust-io/trace-tests
 Project-URL: Repository, https://github.com/agentrust-io/trace-tests
 Project-URL: Documentation, https://github.com/agentrust-io/trace-tests#readme
 Project-URL: Bug Tracker, https://github.com/agentrust-io/trace-tests/issues
-Author: agentrust.io
+Author: agentrust-io.com
 License: Apache-2.0
 License-File: LICENSE
 Keywords: ai-agents,attestation,conformance,provenance,trace

agentrust_trace_tests-0.4.0/PRIVACY.md

@@ -0,0 +1,9 @@
+# Privacy
+
+agentrust-trace-tests (the TRACE conformance suite) collects and transmits no personal data.
+
+It runs locally as a command-line tool. It processes only the inputs you give it, entirely on your machine, and sends no telemetry, analytics, or usage data to agentrust-io, OPAQUE, or any third party. There is no account, login, or tracking, and no cookies or background network calls.
+
+It reads only the record file you pass on the command line and makes no outbound calls.
+
+Uninstalling removes it completely. Questions or corrections: https://github.com/agentrust-io/trace-tests/issues

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/docs/error-codes.md

@@ -6,7 +6,7 @@ All TRACE test failures emit a structured error code of the form `TR-<MODULE>-<N
 
 | Code | Description | How to fix |
 |------|-------------|------------|
-| TR-ENV-001 | Missing or invalid `eat_profile` URI | Set `eat_profile` to `"tag:agentrust.io,2026:trace-v0.1"` |
+| TR-ENV-001 | Missing or invalid `eat_profile` URI | Set `eat_profile` to `"tag:agentrust-io.com,2026:trace-v0.2"` |
 | TR-ENV-002 | `iat` is missing, not an integer, or out of range | Set `iat` to a Unix timestamp integer (e.g. `int(time.time())`) |
 | TR-ENV-003 | `subject` does not match SPIFFE URI or DID pattern | Use `spiffe://<trust-domain>/<path>` or a `did:` URI |
 | TR-ENV-004 | One or more required fields are absent | Add the missing field(s); check the [Schema Reference](https://trace.agentrust-io.com/schema) for the full required set |
@@ -47,7 +47,7 @@ All TRACE test failures emit a structured error code of the form `TR-<MODULE>-<N
 | Code | Description | How to fix |
 |------|-------------|------------|
 | TR-ANC-001 | `transparency` field missing or empty | Submit the record to a SCITT transparency log and set `transparency` to the returned receipt URI |
-| TR-ANC-002 | `transparency` URI does not use `https://` scheme | Only `https://` URIs are accepted; update the URI or use the agentrust registry at `https://registry.agentrust.io` |
+| TR-ANC-002 | `transparency` URI does not use `https://` scheme | Only `https://` URIs are accepted; update the URI or use the agentrust registry at `https://registry.agentrust-io.com` |
 
 ## TR-SCA — Provenance
 

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/docs/levels.md

@@ -16,7 +16,7 @@ Level 0 records are signed with a software key. The `runtime.platform` must be `
 
 ```json
 {
-  "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
   "iat": 1750000000,
   "subject": "spiffe://trust.example.org/agent/my-agent",
   "model": {
@@ -41,7 +41,7 @@ Level 0 records are signed with a software key. The `runtime.platform` must be `
     "status": "none",
     "verifier": "https://verifier.example.org"
   },
-  "transparency": "https://registry.agentrust.io/claim/placeholder",
+  "transparency": "https://registry.agentrust-io.com/claim/placeholder",
   "cnf": {
     "jwk": {
       "kty": "OKP",
@@ -73,7 +73,7 @@ Level 1 adds hardware attestation. `runtime.platform` must be one of: `tpm2`, `s
 
 ```json
 {
-  "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
   "iat": 1750000000,
   "subject": "spiffe://trust.example.org/agent/my-agent",
   "model": {
@@ -96,9 +96,9 @@ Level 1 adds hardware attestation. `runtime.platform` must be one of: `tpm2`, `s
   },
   "appraisal": {
     "status": "affirming",
-    "verifier": "https://verifier.agentrust.io"
+    "verifier": "https://verifier.agentrust-io.com"
   },
-  "transparency": "https://registry.agentrust.io/claim/placeholder",
+  "transparency": "https://registry.agentrust-io.com/claim/placeholder",
   "cnf": {
     "jwk": {
       "kty": "OKP",
@@ -133,9 +133,9 @@ Level 2 adds tool transcript and transparency anchor requirements. The `transpar
     "hash": "sha256:c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4",
     "call_count": 4
   },
-  "transparency": "https://registry.agentrust.io/claim/01J3XKWP4NQZ8R5HT6YD7VMBCE",
+  "transparency": "https://registry.agentrust-io.com/claim/01J3XKWP4NQZ8R5HT6YD7VMBCE",
   "anchor": {
-    "log_id": "https://registry.agentrust.io",
+    "log_id": "https://registry.agentrust-io.com",
     "leaf_hash": "sha256:f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5"
   }
 }

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/docs/modules/tr-env.md

@@ -6,7 +6,7 @@ Tests the top-level EAT envelope structure of a TRACE Trust Record.
 
 | Test ID | Description | Positive Case | Negative Case |
 |---------|-------------|---------------|---------------|
-| TR-ENV-001 | `eat_profile` present and correct URI | `tag:agentrust.io,2026:trace-v0.1` | missing or wrong |
+| TR-ENV-001 | `eat_profile` present and correct URI | `tag:agentrust-io.com,2026:trace-v0.2` | missing or wrong |
 | TR-ENV-002 | `iat` is a valid Unix timestamp | integer, reasonable range | string, future date |
 | TR-ENV-003 | `subject` matches SPIFFE URI or DID | `spiffe://trust.example/agent/x` or `did:key:z6Mk...` | bare string |
 | TR-ENV-004 | Required fields present | all of: eat_profile, iat, subject, model, runtime, policy, data_class, build_provenance, appraisal | missing any |

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/docs/quickstart.md

@@ -22,7 +22,7 @@ from agentrust_trace import generate_key, sign_record
 key = generate_key()
 
 record = {
-    "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+    "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
     "iat": int(time.time()),
     "subject": "spiffe://trust.example.org/agent/sample",
     "model": {
@@ -49,7 +49,7 @@ record = {
         "status": "none",
         "verifier": "https://verifier.example.org",
     },
-    "transparency": "https://registry.agentrust.io/claim/placeholder",
+    "transparency": "https://registry.agentrust-io.com/claim/placeholder",
 }
 
 signed = sign_record(record, key)

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/docs/tutorials/writing-conformance-tests.md

@@ -193,7 +193,7 @@ def build_signed_cmcp_record(platform: str = "tpm2") -> dict:
     record = {
         "cmcp_version": "1.0",
         "trace": {
-            "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+            "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
             "iat": int(time.time()) - 30,
             "subject": "spiffe://cmcp.gateway/session/my-test",
             "runtime": {
@@ -228,7 +228,7 @@ Common codes you will encounter:
 
 | Code | Field | Fix |
 |------|-------|-----|
-| TR-ENV-001 | `eat_profile` | Must be `tag:agentrust.io,2026:trace-v0.1` |
+| TR-ENV-001 | `eat_profile` | Must be `tag:agentrust-io.com,2026:trace-v0.2` |
 | TR-ENV-002 | `iat` | Must be a Unix timestamp in the last 24 hours |
 | TR-SIG-001 | `signature` | Signature missing or does not verify |
 | TR-SIG-002 | `cnf.jwk` | Key must be OKP/Ed25519 |

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentrust-trace-tests"
-version = "0.2.0"
+version = "0.4.0"
 description = "TRACE conformance test suite"
 readme = "README.md"
 license = { text = "Apache-2.0" }
 authors = [
-    { name = "agentrust.io" },
+    { name = "agentrust-io.com" },
 ]
 keywords = ["trace", "conformance", "attestation", "ai-agents", "provenance"]
 classifiers = [

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/requirements-docs.txt

@@ -1,6 +1,6 @@
 mkdocs>=1.6.1
-mkdocs-material>=9.7.6
+mkdocs-material>=9.7.7
 mkdocs-minify-plugin>=0.8
 pymdown-extensions>=11.0.1
-mkdocstrings[python]>=1.0.4
+mkdocstrings[python]>=1.0.6
 griffe>=2.1.0

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/schemas/trace-claim.json

@@ -1,15 +1,15 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://agentrust.io/schema/trace-v0.1.json",
+  "$id": "https://agentrust-io.com/schema/trace-v0.1.json",
   "title": "TRACE Trust Record",
-  "description": "A TRACE v0.1 Trust Record — hardware-attested governance evidence for an AI agent execution.",
+  "description": "A TRACE v0.2 Trust Record — hardware-attested governance evidence for an AI agent execution.",
   "type": "object",
   "required": [
     "eat_profile", "iat", "subject", "model", "runtime", "policy",
     "data_class", "build_provenance", "appraisal", "transparency", "cnf"
   ],
   "properties": {
-    "eat_profile": {"type": "string", "const": "tag:agentrust.io,2026:trace-v0.1"},
+    "eat_profile": {"type": "string", "const": "tag:agentrust-io.com,2026:trace-v0.2"},
     "iat": {"type": "integer", "minimum": 1700000000},
     "subject": {"type": "string", "pattern": "^(spiffe://|did:)"},
     "model": {
@@ -28,7 +28,7 @@
       "type": "object",
       "required": ["platform", "measurement"],
       "properties": {
-        "platform": {"type": "string", "enum": ["intel-tdx", "amd-sev-snp", "nvidia-h100", "nvidia-blackwell", "aws-nitro", "arm-cca", "google-confidential-space", "tpm2", "software-only"]},
+        "platform": {"type": "string", "enum": ["intel-tdx", "amd-sev-snp", "azure-cvm-sev-snp", "nvidia-h100", "nvidia-blackwell", "aws-nitro", "arm-cca", "google-confidential-space", "tpm2", "software-only"]},
         "measurement": {"type": "string", "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"},
         "rim_uri": {"type": "string", "format": "uri"},
         "nonce": {"type": "string"},

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/src/trace_tests/modules/tr_env.py

@@ -8,7 +8,7 @@ from typing import Any
 
 from trace_tests.result import Finding, Status
 
-_PROFILE = "tag:agentrust.io,2026:trace-v0.1"
+_PROFILE = "tag:agentrust-io.com,2026:trace-v0.2"
 _SUBJECT_RE = re.compile(r'^(spiffe://[^/]+/.+|did:[a-z0-9]+:.+)$')
 _IAT_MIN = 1_700_000_000
 

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/src/trace_tests/modules/tr_rte.py

@@ -11,6 +11,8 @@ _DIGEST_RE = re.compile(r"^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$")
 _VALID_PLATFORMS = frozenset({
     "intel-tdx",
     "amd-sev-snp",
+    # Azure confidential VM: SEV-SNP behind a Hyper-V paravisor (vTPM-rooted).
+    "azure-cvm-sev-snp",
     "nvidia-h100",
     "nvidia-blackwell",
     "aws-nitro",

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/tests/conftest.py

@@ -41,7 +41,7 @@ def _build_signed_cmcp_record(*, platform: str = "tpm2", nonce: str | None = Non
     iat = int(time.time()) - 30  # fresh but not future-dated
 
     trace: dict = {
-        "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+        "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
         "iat": iat,
         "subject": "spiffe://cmcp.gateway/session/conformance-test",
         "runtime": {
@@ -135,7 +135,7 @@ def _build_software_only_record() -> dict:
     record: dict = {
         "cmcp_version": "1.0",
         "trace": {
-            "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+            "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
             "iat": iat,
             "subject": "spiffe://cmcp.gateway/session/level2-test",
             "runtime": {

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/tests/test_level0.py

@@ -5,7 +5,7 @@ import jsonschema
 SUBJECT_RE = re.compile(r"^(spiffe://|did:)")
 DIGEST_RE = re.compile(r"^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$")
 VALID_PLATFORMS = {
-    "intel-tdx", "amd-sev-snp", "nvidia-h100", "nvidia-blackwell",
+    "intel-tdx", "amd-sev-snp", "azure-cvm-sev-snp", "nvidia-h100", "nvidia-blackwell",
     "aws-nitro", "arm-cca", "google-confidential-space", "tpm2",
 }
 VALID_ENFORCEMENT = {"enforce", "advisory", "silent"}
@@ -18,7 +18,7 @@ class TestLevel0Conformance:
         jsonschema.validate(valid_level0, schema)
 
     def test_eat_profile_sentinel(self, valid_level0):
-        assert valid_level0["eat_profile"] == "tag:agentrust.io,2026:trace-v0.1"
+        assert valid_level0["eat_profile"] == "tag:agentrust-io.com,2026:trace-v0.2"
 
     def test_iat_is_positive_integer(self, valid_level0):
         assert isinstance(valid_level0["iat"], int)

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/tests/test_level1.py

@@ -48,11 +48,11 @@ class TestLevel1Conformance:
 
         In the cMCP profile the eat_profile field inside trace serves the role
         of the COSE protected header content-type: it binds the record to the
-        TRACE v0.1 specification and prevents cross-profile replay.
+        TRACE v0.2 specification and prevents cross-profile replay.
         """
         trace = signed_eat_fixture["trace"]
-        assert trace.get("eat_profile") == "tag:agentrust.io,2026:trace-v0.1", (
-            "trace.eat_profile must be 'tag:agentrust.io,2026:trace-v0.1'"
+        assert trace.get("eat_profile") == "tag:agentrust-io.com,2026:trace-v0.2", (
+            "trace.eat_profile must be 'tag:agentrust-io.com,2026:trace-v0.2'"
         )
 
     def test_signature_verifies_against_cnf_key(self, signed_eat_fixture):

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/tests/unit/test_loader.py

@@ -13,13 +13,13 @@ from trace_tests.loader import LoadError, load_record
 
 VALID_CMCP = {
     "cmcp_version": "1.0",
-    "trace": {"eat_profile": "tag:agentrust.io,2026:trace-v0.1"},
+    "trace": {"eat_profile": "tag:agentrust-io.com,2026:trace-v0.2"},
     "gateway": {"session_id": "s1"},
     "signature": "sig",
 }
 
 VALID_TRACE = {
-    "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+    "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
     "iat": 1748000000,
     "subject": "spiffe://example.org/agent/test",
 }

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/tests/unit/test_tr_env.py

@@ -6,7 +6,7 @@ from trace_tests.modules.tr_env import check
 from trace_tests.result import Status
 
 _VALID = {
-    "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+    "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
     "iat": int(time.time()) - 600,  # fresh: 10 minutes old
     "subject": "spiffe://example.org/agent/test",
     "cnf": {"jwk": {"kty": "OKP", "crv": "Ed25519", "x": "dGVzdA"}},

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/tests/unit/test_tr_rte.py

@@ -17,6 +17,13 @@ def test_valid_runtime_passes():
     assert all(not f.failed() for f in findings), findings
 
 
+def test_azure_cvm_platform_passes():
+    """azure-cvm-sev-snp is a recognized hardware platform (vTPM-rooted SEV-SNP)."""
+    trace = {"runtime": {"platform": "azure-cvm-sev-snp", "measurement": "sha384:" + "a" * 96}}
+    findings = check(trace, level=2)
+    assert all(not f.failed() for f in findings), findings
+
+
 def test_invalid_platform_fails():
     trace = {"runtime": {**_VALID["runtime"], "platform": "unknown-tee"}}
     codes = {f.code for f in check(trace) if f.failed()}

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/tests/unit/test_tr_sig.py

@@ -28,7 +28,7 @@ def _make_signed_record() -> dict:
     record = {
         "cmcp_version": "1.0",
         "trace": {
-            "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+            "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
             "iat": 1748000000,
             "subject": "spiffe://cmcp.gateway/session/unit-test",
             "runtime": {
@@ -111,7 +111,7 @@ def test_plain_trace_embedded_ed25519_signature_passes():
     x = _b64url(pub.public_bytes_raw())
 
     trace: dict = {
-        "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+        "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
         "iat": 1748000000,
         "subject": "did:mesh:spiffe://example.org/agent/test",
         "runtime": {"platform": "software-only", "measurement": "sha256:" + "a" * 64},
@@ -135,7 +135,7 @@ def test_plain_trace_tampered_embedded_signature_fails():
     x = _b64url(pub.public_bytes_raw())
 
     trace: dict = {
-        "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+        "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
         "iat": 1748000000,
         "subject": "did:mesh:spiffe://example.org/agent/test",
         "runtime": {"platform": "software-only", "measurement": "sha256:" + "a" * 64},

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/tests/vectors/invalid_missing_runtime.json

@@ -1,5 +1,5 @@
 {
-  "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
   "iat": 1748000000,
   "subject": "spiffe://example.org/agent/test/001",
   "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-5"},

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/tests/vectors/valid_cmcp_runtime.json

@@ -1,7 +1,7 @@
 {
   "cmcp_version": "1.0",
   "trace": {
-    "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+    "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
     "iat": 1748000000,
     "subject": "spiffe://cmcp.gateway/session/test-session-001",
     "runtime": {

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/tests/vectors/valid_level0.json

@@ -1,5 +1,5 @@
 {
-  "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
   "iat": 1748000000,
   "subject": "spiffe://example.org/agent/credit-risk/01926b4c-1234-7abc-9def-000000000001",
   "model": {

{agentrust_trace_tests-0.2.0 → agentrust_trace_tests-0.4.0}/tests/vectors/valid_level0_with_transcript.json

@@ -1,5 +1,5 @@
 {
-  "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+  "eat_profile": "tag:agentrust-io.com,2026:trace-v0.2",
   "iat": 1748000001,
   "subject": "spiffe://example.org/agent/payments/01926b4c-1234-7abc-9def-000000000002",
   "model": {

agentrust_trace_tests-0.2.0/CHANGELOG.md

@@ -1,14 +0,0 @@
-# Changelog
-
-## v0.2.0 — 2026-06-19
-
-- DID subject support: `subject` now accepts `did:` URIs in addition to `spiffe://`.
-- Embedded signature verification: plain TRACE records signed with `agentrust-trace sign_record()` are now cryptographically verified at all levels.
-- SLSA Level 0: `build_provenance.slsa_level: 0` is now valid for software-only / development records.
-- Software-only platform: `runtime.platform: "software-only"` accepted at Level 0.
-- Private key leak detection: TR-SIG now fails records that embed a private key (`d` member) in `cnf.jwk`.
-
-## v0.1.0 — 2026-05-01
-
-- Initial release with 7 test modules: TR-ENV, TR-SIG, TR-RTE, TR-POL, TR-TXN, TR-ANC, TR-SCA.
-- Conformance levels 0, 1, 2.