agentrust-trace-tests 0.4.0__tar.gz → 0.5.0__tar.gz

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.5.0}/.github/workflows/codeql.yml

@@ -28,16 +28,16 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.37.4
         with:
           languages: python
           queries: +security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@v4.37.4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.37.4
         continue-on-error: true
         with:
           category: /language:python

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.5.0}/.github/workflows/contributor-check.yml

@@ -30,7 +30,10 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: agentrust-io/.github
-          ref: main
+          # Pinned deliberately: this workflow runs on pull_request_target
+          # with a write-capable token, so the code it checks out must not
+          # track a mutable ref. Bump this SHA after reviewing the diff.
+          ref: 0fe4520ee71a743fcd33f409fe366ee3e1da6f86 # main as of 2026-08-01
           persist-credentials: false
           sparse-checkout: |
             scripts

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.5.0}/.github/workflows/release.yml

@@ -41,4 +41,4 @@ jobs:
           name: dist
           path: dist/
 
-      - uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.5.0}/.github/workflows/scorecard.yml

@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Scorecard
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: scorecard-results.sarif
           results_format: sarif
@@ -35,6 +35,6 @@ jobs:
           publish_results: false
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.4
         with:
           sarif_file: scorecard-results.sarif

agentrust_trace_tests-0.5.0/CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog
+
+## Unreleased
+
+## v0.5.0 — 2026-08-09
+
+### Added
+
+- **`trace-tests report`: conformance results as an artifact somebody can forward.** `verify` answers a question for whoever ran it; a pass/fail in a terminal is useless to an auditor, a counterparty or an acquirer. The new command emits self-contained HTML, a machine-readable JSON document (`schema: agentrust-io/trace-tests/report/1`), and an SVG level badge.
+
+  It runs every level up to `--max-level` instead of one, because the answer a reader needs is the highest level the record reaches, not whether it cleared the level the person running the tool happened to choose. `--fail-under N` gates CI on a level; without it the command exits `0`, since producing an artifact and enforcing a threshold are different jobs.
+
+  **The report states that it is not evidence.** It is unsigned HTML describing one run of one suite version, and anyone can edit it, so every report carries the record's digest, the suite and authoring-library versions, and the command to reproduce the result — and tells a reader who does not trust the sender to go check the record instead. A conformance report that looks authoritative and cannot be checked is the same shape of thing as a control plane writing its own log, which is the problem this project exists to fix.
+
+  Self-contained by construction: no scripts, no external CSS, no fonts, no badge service. A badge served from someone else's infrastructure would add a dependency to an artifact whose whole point is needing none. A test asserts the HTML fetches nothing.
+
+  The HTML and the JSON are rendered from one assembled structure so they cannot disagree about the verdict, and unverified findings count as failures from Level 1 up exactly as they do in `verify`.
+
+## v0.4.1 — 2026-08-03
+
+### Fixed
+
+- **`--version` reported the wrong version.** `__version__` was a second hardcoded literal alongside `pyproject.toml` and never moved, so it sat at `0.2.0` through both the 0.3.0 and 0.4.0 releases: `trace-tests --version` printed `0.2.0` from a 0.4.0 install while `importlib.metadata` correctly returned `0.4.0`. It is now read from installed distribution metadata, so there is one source of truth and the value cannot fall behind a release again.
+
+  This mattered more than a wrong string usually would. The v0.2 profile cutover shipped in 0.4.0, and a 0.2.x suite rejects every v0.2 record, so `--version` is exactly the command someone runs to work out whether their suite matches their producer. It was the one command that could not answer.
+
+## v0.4.0 — 2026-07-28
+
+### Changed
+
+- **BREAKING: the suite now conforms to TRACE v0.2.** `TR-ENV` requires the profile `tag:agentrust-io.com,2026:trace-v0.2` and fails a record carrying the v0.1 identifier. The v0.1 URI named `agentrust.io`, a domain this project never controlled, which RFC 4151 does not permit for a tag URI; see agentrust-io/trace-spec#107. Nothing else about the record format changed, so a producer migrates by updating the profile string and bumping `agentrust-trace` to 0.5.0.
+
+  This is a deliberate cutover rather than dual acceptance: a conformance suite that passed both identifiers would certify records minted under a domain we do not own. A v0.1 record is checked with the 0.3.x releases of this suite, which stay published.
+
+- Registry, verifier, and documentation hosts moved from `agentrust.io` to `agentrust-io.com`.
+
+## v0.3.0 — 2026-07-21
+
+- `azure-cvm-sev-snp` platform accepted (`runtime.platform`): Azure confidential VMs run SEV-SNP behind a Hyper-V paravisor (vTPM-rooted). Added to the bundled schema enum and the TR-RTE valid-platform set so Azure TRACE records pass conformance. Matches `agentrust-trace>=0.4`.
+
+## v0.2.0 — 2026-06-19
+
+- DID subject support: `subject` now accepts `did:` URIs in addition to `spiffe://`.
+- Embedded signature verification: plain TRACE records signed with `agentrust-trace sign_record()` are now cryptographically verified at all levels.
+- SLSA Level 0: `build_provenance.slsa_level: 0` is now valid for software-only / development records.
+- Software-only platform: `runtime.platform: "software-only"` accepted at Level 0.
+- Private key leak detection: TR-SIG now fails records that embed a private key (`d` member) in `cnf.jwk`.
+
+## v0.1.0 — 2026-05-01
+
+- Initial release with 7 test modules: TR-ENV, TR-SIG, TR-RTE, TR-POL, TR-TXN, TR-ANC, TR-SCA.
+- Conformance levels 0, 1, 2.

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentrust-trace-tests
-Version: 0.4.0
+Version: 0.5.0
 Summary: TRACE conformance test suite
 Project-URL: Homepage, https://github.com/agentrust-io/trace-tests
 Project-URL: Repository, https://github.com/agentrust-io/trace-tests
@@ -64,17 +64,44 @@ Description-Content-Type: text/markdown
 
 > **Test suite v0.2.** Tracks [TRACE Spec v0.2](https://github.com/agentrust-io/trace-spec).
 
-Conformance tests for TRACE — Trust Runtime Attestation and Compliance Evidence. Run this suite against your implementation to verify it meets the spec before claiming TRACE compliance.
+Conformance tests for TRACE (Trust Runtime Attestation and Compliance Evidence). Run this suite against your implementation to verify it meets the spec before claiming TRACE compliance.
 
 Seven test modules covering the full specification: envelope structure, signature algorithms, TEE runtime claims, policy binding, tool-call transcripts, SCITT transparency anchoring, and supply chain provenance.
 
 ## Quick start
 
 ```bash
-pip install trace-tests
+pip install agentrust-trace-tests
 trace-tests verify --record path/to/trust-record.jwt --level 1
 ```
 
+## A report you can hand to someone else
+
+`verify` answers a question for the person running it. `report` produces an artifact for
+somebody who was not there: an auditor, a counterparty, an acquirer.
+
+```bash
+trace-tests report --record trust-record.json   --html report.html --json report.json --badge trace.svg
+```
+
+It runs **every** level up to `--max-level` rather than one, because the useful answer for
+a reader is the highest level the record reaches, not whether it cleared the level someone
+happened to pick. The HTML is self-contained: no scripts, no fonts, no external CSS, no
+badge service, nothing fetched at open time.
+
+Use `--fail-under 1` to gate CI on a level. Without it the command always exits `0`, which
+is what you want when you are producing an artifact rather than enforcing a threshold.
+
+**The report is not evidence, and it says so on its face.** It is unsigned HTML describing
+one run of one suite version, and anybody can edit it. So it carries the record's digest,
+the suite and library versions, and the exact command to reproduce the result. A reader who
+does not trust the sender is told, in the artifact, to go check the record instead. A
+conformance report that looks authoritative and cannot be checked is the same shape of
+thing as a control plane writing its own log.
+
+`report.json` is stable under `schema: agentrust-io/trace-tests/report/1` for dashboards
+and CI.
+
 ## Test modules
 
 | Module | ID | Tests |

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.5.0}/README.md

@@ -27,17 +27,44 @@
 
 > **Test suite v0.2.** Tracks [TRACE Spec v0.2](https://github.com/agentrust-io/trace-spec).
 
-Conformance tests for TRACE — Trust Runtime Attestation and Compliance Evidence. Run this suite against your implementation to verify it meets the spec before claiming TRACE compliance.
+Conformance tests for TRACE (Trust Runtime Attestation and Compliance Evidence). Run this suite against your implementation to verify it meets the spec before claiming TRACE compliance.
 
 Seven test modules covering the full specification: envelope structure, signature algorithms, TEE runtime claims, policy binding, tool-call transcripts, SCITT transparency anchoring, and supply chain provenance.
 
 ## Quick start
 
 ```bash
-pip install trace-tests
+pip install agentrust-trace-tests
 trace-tests verify --record path/to/trust-record.jwt --level 1
 ```
 
+## A report you can hand to someone else
+
+`verify` answers a question for the person running it. `report` produces an artifact for
+somebody who was not there: an auditor, a counterparty, an acquirer.
+
+```bash
+trace-tests report --record trust-record.json   --html report.html --json report.json --badge trace.svg
+```
+
+It runs **every** level up to `--max-level` rather than one, because the useful answer for
+a reader is the highest level the record reaches, not whether it cleared the level someone
+happened to pick. The HTML is self-contained: no scripts, no fonts, no external CSS, no
+badge service, nothing fetched at open time.
+
+Use `--fail-under 1` to gate CI on a level. Without it the command always exits `0`, which
+is what you want when you are producing an artifact rather than enforcing a threshold.
+
+**The report is not evidence, and it says so on its face.** It is unsigned HTML describing
+one run of one suite version, and anybody can edit it. So it carries the record's digest,
+the suite and library versions, and the exact command to reproduce the result. A reader who
+does not trust the sender is told, in the artifact, to go check the record instead. A
+conformance report that looks authoritative and cannot be checked is the same shape of
+thing as a control plane writing its own log.
+
+`report.json` is stable under `schema: agentrust-io/trace-tests/report/1` for dashboards
+and CI.
+
 ## Test modules
 
 | Module | ID | Tests |

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.5.0}/docs/quickstart.md

@@ -3,9 +3,12 @@
 ## Install
 
 ```bash
-pip install trace-tests
+pip install agentrust-trace-tests
 ```
 
+The distribution is `agentrust-trace-tests`; `trace-tests` is the command it
+installs. `pip install trace-tests` returns 404.
+
 ## Create a sample fixture
 
 The test suite runs against a signed TRACE Trust Record. Generate a Level 0 development record with the `agentrust-trace` library:

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.5.0}/mkdocs.yml

@@ -25,6 +25,7 @@ exclude_docs: |
 
 theme:
   name: material
+  custom_dir: overrides
   font: false
   palette:
     - scheme: slate
@@ -59,6 +60,32 @@ theme:
 plugins:
   - search:
       lang: en
+  - llmstxt:
+      full_output: llms-full.txt
+      markdown_description: >-
+        TRACE Tests is the conformance suite for TRACE (Trust Runtime
+        Attestation and Compliance Evidence), the AgenTrust open standard for
+        signed, hardware-attested AI agent governance records. Use it to check
+        that your attestation receipts satisfy the specification, at each
+        conformance level, before shipping them to production.
+      sections:
+        Getting started:
+          - README.md
+          - docs/quickstart.md
+          - docs/levels.md
+        Test modules:
+          - docs/modules.md
+          - docs/modules/tr-env.md
+          - docs/modules/tr-sig.md
+          - docs/modules/tr-rte.md
+          - docs/modules/tr-pol.md
+          - docs/modules/tr-txn.md
+          - docs/modules/tr-anc.md
+          - docs/modules/tr-sca.md
+        Reference:
+          - docs/error-codes.md
+          - docs/tutorials/writing-conformance-tests.md
+          - docs/tutorials/ci-integration.md
   - minify:
       minify_html: true
   - mkdocstrings:

agentrust_trace_tests-0.5.0/overrides/main.html

@@ -0,0 +1,87 @@
+{% extends "base.html" %}
+
+{#
+  SEO and AEO head additions for the TRACE conformance suite.
+
+  1. The homepage <title> is overridden. Material falls back to site_name when a
+     page has no front-matter title, which left the homepage titled "TRACE
+     Tests". Front matter is not an option: docs_dir is the repository root, so
+     README.md is also the GitHub landing page and YAML would render as noise
+     there.
+
+  2. Open Graph and Twitter meta, so links produce a card instead of a bare URL,
+     plus JSON-LD so answer engines can model what this suite is.
+
+  Asset paths derive from config.site_url. Do not hardcode them: assets are
+  served under /docs/assets/ here because docs_dir is the repository root and
+  CI copies docs/ into the build directory. That differs between sibling
+  repositories, and a hardcoded path is how cMCP shipped a broken card.
+#}
+
+{% block htmltitle %}
+  {% if page and page.is_homepage %}
+    <title>Verify your TRACE implementation - {{ config.site_name }}</title>
+  {% else %}
+    {{ super() }}
+  {% endif %}
+{% endblock %}
+
+{% block extrahead %}
+  {{ super() }}
+  {% set page_desc = page.meta.description if page and page.meta and page.meta.description else config.site_description %}
+  {% set page_url = page.canonical_url if page and page.canonical_url else config.site_url %}
+  {% set og_image = config.site_url ~ 'docs/assets/og.png' %}
+  {% set social_title = 'Verify your TRACE implementation' %}
+
+  <meta property="og:type" content="website">
+  <meta property="og:site_name" content="{{ config.site_name }}">
+  <meta property="og:title" content="{% if page and page.title and not page.is_homepage %}{{ page.title }} - {{ config.site_name }}{% else %}{{ config.site_name }}: {{ social_title }}{% endif %}">
+  <meta property="og:description" content="{{ page_desc }}">
+  <meta property="og:url" content="{{ page_url }}">
+  <meta property="og:image" content="{{ og_image }}">
+  <meta property="og:image:width" content="1200">
+  <meta property="og:image:height" content="630">
+  <meta property="og:image:alt" content="TRACE Tests: the AgenTrust conformance suite">
+  <meta property="og:locale" content="en_US">
+
+  <meta name="twitter:card" content="summary_large_image">
+  <meta name="twitter:title" content="{% if page and page.title and not page.is_homepage %}{{ page.title }} - {{ config.site_name }}{% else %}{{ config.site_name }}: {{ social_title }}{% endif %}">
+  <meta name="twitter:description" content="{{ page_desc }}">
+  <meta name="twitter:image" content="{{ og_image }}">
+
+  <script type="application/ld+json">
+  {
+    "@context": "https://schema.org",
+    "@graph": [
+      {
+        "@type": "SoftwareApplication",
+        "name": "TRACE Tests",
+        "applicationCategory": "DeveloperApplication",
+        "description": "Conformance tests and an integration harness for TRACE implementations. Verify that attestation receipts meet the specification before shipping to production.",
+        "url": "{{ config.site_url }}",
+        "offers": { "@type": "Offer", "price": "0", "priceCurrency": "USD" },
+        "author": { "@type": "Organization", "name": "AgenTrust", "url": "https://agentrust-io.com" },
+        "isPartOf": { "@type": "WebSite", "name": "{{ config.site_name }}", "url": "{{ config.site_url }}" }
+      },
+      {
+        "@type": "Organization",
+        "name": "AgenTrust",
+        "url": "https://agentrust-io.com",
+        "sameAs": [
+          "https://github.com/agentrust-io",
+          "https://agentrust-io.com/demos/",
+          "https://trace.agentrust-io.com",
+          "https://cmcp.agentrust-io.com",
+          "https://manifest.agentrust-io.com",
+          "https://ca2a.agentrust-io.com"
+        ]
+      },
+      {
+        "@type": "WebSite",
+        "name": "{{ config.site_name }}",
+        "url": "{{ config.site_url }}"
+      }
+    ]
+  }
+  </script>
+{% endblock %}

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentrust-trace-tests"
-version = "0.4.0"
+version = "0.5.0"
 description = "TRACE conformance test suite"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{agentrust_trace_tests-0.4.0 → agentrust_trace_tests-0.5.0}/requirements-docs.txt

@@ -4,3 +4,4 @@ mkdocs-minify-plugin>=0.8
 pymdown-extensions>=11.0.1
 mkdocstrings[python]>=1.0.6
 griffe>=2.1.0
+mkdocs-llmstxt>=0.5,<1.0

agentrust_trace_tests-0.5.0/src/trace_tests/__init__.py

@@ -0,0 +1,20 @@
+"""TRACE conformance test suite."""
+
+from importlib.metadata import PackageNotFoundError, version
+
+# Read the version from installed distribution metadata rather than restating it
+# here. `pyproject.toml` is what the build and PyPI publish, so a second literal
+# in this file is a copy that can fall behind silently: it sat at "0.2.0" through
+# both the 0.3.0 and 0.4.0 releases, so `trace-tests --version` reported 0.2.0
+# from a 0.4.0 install. That is worse than cosmetic, because the v0.2 profile
+# cutover landed in 0.4.0 and `--version` is the command someone runs to find out
+# whether they have a suite that accepts v0.2 records.
+try:
+    __version__ = version("agentrust-trace-tests")
+except PackageNotFoundError:  # pragma: no cover - source tree with no install
+    # Importable without being installed (e.g. PYTHONPATH against a checkout).
+    # There is no metadata to read here, and guessing a number would reintroduce
+    # the drift this exists to prevent.
+    __version__ = "0.0.0+unknown"
+
+__all__ = ["__version__"]

agentrust_trace_tests-0.5.0/src/trace_tests/cli.py

@@ -0,0 +1,211 @@
+"""trace-tests CLI."""
+
+from __future__ import annotations
+
+import datetime as _dt
+import importlib.metadata
+import pathlib
+import sys
+from typing import Any
+
+import click
+
+from trace_tests import __version__
+from trace_tests import report as report_mod
+from trace_tests.loader import LoadError, load_record
+from trace_tests.modules.tr_env import DEFAULT_MAX_AGE_SECONDS
+from trace_tests.result import Status
+from trace_tests.runner import run
+
+
+def _library_version() -> str | None:
+    """Version of the authoring library, when it is installed alongside the suite.
+
+    Recorded on the report because the two cut over to the v0.2 profile together
+    and neither dual-accepts, so a mismatched pair produces a confident failure on
+    a record that is fine. A reader of the report should be able to see the pair.
+    """
+    try:
+        return importlib.metadata.version("agentrust-trace")
+    except importlib.metadata.PackageNotFoundError:
+        return None
+
+
+def _fmt_status(status: Status) -> str:
+    return status.value.upper().ljust(10)
+
+
+def _print_report(path: str, fmt: str, level: int, results: dict[str, list[Any]]) -> int:
+    """Print the conformance report and return exit code (0=pass, 1=fail)."""
+    click.echo(f"\nTRACE Conformance Report -- Level {level}")
+    click.echo(f"Format : {fmt}")
+    click.echo(f"Record : {path}")
+    click.echo("")
+
+    failures = 0
+    skips = 0
+    passes = 0
+    unverified = 0
+
+    for module, findings in results.items():
+        for f in findings:
+            prefix = _fmt_status(f.status)
+            click.echo(f"  {module}  {prefix}  {f.message}")
+            if f.failed():
+                failures += 1
+            elif f.passed():
+                passes += 1
+            elif f.unverified():
+                unverified += 1
+            else:
+                skips += 1
+
+    # Defense in depth: unverified findings must fail the run at any level that
+    # requires signatures, even if a module forgot to emit a hard FAIL.
+    if unverified and level >= 1:
+        failures += unverified
+
+    total = passes + failures + skips + (unverified if level == 0 else 0)
+    click.echo("")
+    if failures == 0:
+        if unverified:
+            click.echo(
+                f"Result: PASS  ({total} checks, {skips} skipped, {unverified} UNVERIFIED "
+                f"-- record is NOT cryptographically verified)"
+            )
+        else:
+            click.echo(f"Result: PASS  ({total} checks, {skips} skipped)")
+        return 0
+    else:
+        click.echo(f"Result: FAIL  ({total} checks, {failures} failure(s), {skips} skipped)")
+        return 1
+
+
+@click.group()
+@click.version_option(__version__)
+def main() -> None:
+    """TRACE conformance test suite."""
+
+
+@main.command()
+@click.option("--record", required=True, type=click.Path(), help="Path to the trust record (JSON)")
+@click.option("--level", default=0, type=click.IntRange(0, 2), show_default=True, help="Conformance level to check (0, 1, or 2)")
+@click.option(
+    "--max-age",
+    "max_age",
+    default=DEFAULT_MAX_AGE_SECONDS,
+    type=click.IntRange(min=1),
+    show_default=True,
+    help="Maximum allowed record age in seconds (iat freshness window)",
+)
+def verify(record: str, level: int, max_age: int) -> None:
+    """Verify a TRACE trust record against the conformance suite."""
+    try:
+        data, fmt = load_record(record)
+    except LoadError as exc:
+        click.echo(f"Error: {exc}", err=True)
+        sys.exit(2)
+
+    results = run(data, fmt, level, max_age_seconds=max_age)
+    exit_code = _print_report(record, fmt, level, results)
+    sys.exit(exit_code)
+
+
+@main.command()
+@click.option("--record", required=True, type=click.Path(), help="Path to the trust record (JSON)")
+@click.option(
+    "--max-level",
+    default=2,
+    type=click.IntRange(0, 2),
+    show_default=True,
+    help="Highest level to attempt; every level up to it is run",
+)
+@click.option(
+    "--max-age",
+    "max_age",
+    default=DEFAULT_MAX_AGE_SECONDS,
+    type=click.IntRange(min=1),
+    show_default=True,
+)
+@click.option(
+    "--html", "html_out", type=click.Path(), help="Write a self-contained HTML report here"
+)
+@click.option(
+    "--json", "json_out", type=click.Path(), help="Write the machine-readable report here"
+)
+@click.option("--badge", "badge_out", type=click.Path(), help="Write a level badge (SVG) here")
+@click.option(
+    "--fail-under",
+    type=click.IntRange(0, 2),
+    help="Exit non-zero unless the record reaches this level. Omit to always exit 0, "
+    "which is what you want when generating an artifact rather than gating on one.",
+)
+def report(
+    record: str,
+    max_level: int,
+    max_age: int,
+    html_out: str | None,
+    json_out: str | None,
+    badge_out: str | None,
+    fail_under: int | None,
+) -> None:
+    """Produce a conformance report you can hand to someone else.
+
+    Runs every level up to --max-level rather than one, because the useful answer
+    for a reader is the highest level the record reaches, not whether it cleared
+    the single level the person running the tool happened to pick.
+    """
+    try:
+        data, fmt = load_record(record)
+    except LoadError as exc:
+        click.echo(f"Error: {exc}", err=True)
+        sys.exit(2)
+
+    results_by_level = {
+        level: run(data, fmt, level, max_age_seconds=max_age)
+        for level in range(max_level + 1)
+    }
+
+    built = report_mod.build(
+        record=data,
+        record_path=record,
+        record_format=fmt,
+        results_by_level=results_by_level,
+        suite_version=__version__,
+        library_version=_library_version(),
+        generated_at=_dt.datetime.now(_dt.timezone.utc).strftime("%Y-%m-%d %H:%M UTC"),
+    )
+
+    wrote = []
+    for path, render in (
+        (html_out, report_mod.to_html),
+        (json_out, report_mod.to_json),
+        (badge_out, report_mod.badge_svg),
+    ):
+        if path:
+            pathlib.Path(path).write_text(render(built), encoding="utf-8")
+            wrote.append(path)
+
+    click.echo(f"TRACE Conformance Report -- {built.verdict}")
+    click.echo(f"Record : {record}")
+    click.echo(f"Digest : {built.digest}")
+    for lv in built.levels:
+        mark = "PASS" if lv.passed else "FAIL"
+        click.echo(f"  Level {lv.level}  {mark}")
+    for path in wrote:
+        click.echo(f"Wrote  : {path}")
+    if not wrote:
+        click.echo("")
+        click.echo(report_mod.to_json(built))
+
+    if fail_under is not None:
+        top = built.highest_level
+        if top is None or top < fail_under:
+            click.echo(
+                f"Result: below the required Level {fail_under}", err=True
+            )
+            sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()