agentrust-trace-tests 0.5.1__tar.gz → 0.6.0__tar.gz

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/.github/dependabot.yml

@@ -17,3 +17,7 @@ updates:
       interval: "weekly"
       day: "monday"
     open-pull-requests-limit: 5
+    groups:
+      codeql-action:
+        patterns:
+          - "github/codeql-action*"

agentrust_trace_tests-0.6.0/.github/workflows/actionlint.yml

@@ -0,0 +1,41 @@
+name: Workflow lint
+
+# actionlint catches what a YAML parser cannot: duplicate mapping keys that
+# make GitHub refuse to load a workflow, invalid ${{ }} expressions, and shell
+# problems inside run: blocks. A duplicate env: key silently broke this repo
+# family's release workflow once; yaml.safe_load keeps the last value without
+# complaining, so local validation passed while Actions rejected the file.
+on:
+  push:
+    branches: [main]
+    paths: ['.github/workflows/**']
+  pull_request:
+    paths: ['.github/workflows/**']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # Fetched and checksum-verified rather than run as a third-party action,
+      # so this check adds no new action to the supply chain it exists to guard.
+      - name: Install actionlint
+        env:
+          ACTIONLINT_VERSION: 1.7.12
+          ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8
+        run: |
+          set -euo pipefail
+          archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          curl -sSfL -o "$archive" \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${archive}"
+          echo "${ACTIONLINT_SHA256}  ${archive}" | sha256sum -c -
+          tar -xzf "$archive" actionlint
+          install -m 0755 actionlint /usr/local/bin/actionlint
+
+      - name: Lint workflows
+        run: actionlint -color

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/.github/workflows/ci.yml

@@ -9,6 +9,9 @@ on:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -16,12 +19,17 @@ jobs:
       matrix:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v5.3.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install package and test deps
-        run: pip install -e ".[test]"
+        # Third-party dependencies come from the hash-pinned lock first; the
+        # local package then goes in with --no-deps, because pip cannot
+        # hash-pin an editable install in the same invocation.
+        run: |
+          pip install --require-hashes -r requirements/test.txt
+          pip install --no-deps -e .
       - name: Level 0 conformance (schema + structural)
         run: python -m pytest -v -m "level0 or negative" --tb=short
       - name: Unit tests (modules and CLI)

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/.github/workflows/codeql.yml

@@ -25,18 +25,18 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.7
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: python
           queries: +security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.37.7
+        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.7
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           category: /language:python

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/.github/workflows/contributor-check.yml

@@ -27,7 +27,7 @@ jobs:
       github.actor != 'imran-siddique'
     steps:
       - name: Checkout org action
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: agentrust-io/.github
           # Pinned deliberately: this workflow runs on pull_request_target

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/.github/workflows/docs.yml

@@ -14,8 +14,12 @@ on:
       - "measurement/**"
       - "PRIVACY.md"
       - "overrides/**"
+      - "hooks/**"
+      - "robots.txt"
       - "index.md"
       - "CODE_OF_CONDUCT.md"
+      - "LIMITATIONS.md"
+      - "SPONSORS.md"
   workflow_dispatch:
 
 permissions:
@@ -31,19 +35,19 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
           cache: pip
 
       - name: Install docs dependencies
         run: |
-          pip install -r requirements-docs.txt
-          pip install -e "."
+          pip install --require-hashes -r requirements/docs.txt
+          pip install --no-deps -e .
 
       - name: Configure git for gh-deploy
         run: |
@@ -59,7 +63,7 @@ jobs:
           # measurement/REPORT.md is in the nav as Self-verification.
           if [ -d measurement ]; then cp -r measurement $BUILD/measurement; fi
 
-          for fname in index.md CHANGELOG.md CONTRIBUTING.md CODE_OF_CONDUCT.md PRIVACY.md CNAME; do
+          for fname in index.md CHANGELOG.md CONTRIBUTING.md CODE_OF_CONDUCT.md LIMITATIONS.md SPONSORS.md PRIVACY.md CNAME robots.txt; do
             if [ -f "$fname" ]; then cp "$fname" "$BUILD/$fname"; fi
           done
 

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/.github/workflows/release.yml

@@ -12,14 +12,14 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
       - name: Install build
-        run: python -m pip install build
+        run: python -m pip install --require-hashes -r requirements/release.txt
 
       - name: Build distributions
         run: python -m build

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/.github/workflows/require-maintainer-approval.yml

@@ -25,7 +25,7 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const MAINTAINERS = ['imran-siddique', 'lywinged'];
+            const MAINTAINERS = ['imran-siddique', 'lywinged', 'pforest', 'Qiang-Xu'];
 
             const author = context.payload.pull_request.user.login;
             if (MAINTAINERS.includes(author)) {

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/.github/workflows/scorecard.yml

@@ -20,7 +20,7 @@ jobs:
       actions: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -35,6 +35,6 @@ jobs:
           publish_results: false
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v4.37.7
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           sarif_file: scorecard-results.sarif

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/CHANGELOG.md

@@ -2,6 +2,59 @@
 
 ## Unreleased
 
+## v0.6.0 - 2026-09-25
+
+### Changed
+
+- **Level 2 now verifies the anchor instead of parsing its URI (#79, closes #70).**
+  `TR-ANC-001` only ever checked that `transparency` was a well-formed https URI,
+  so any record could clear Level 2 by typing a string. The new `TR-ANC-002`
+  replays the record's RFC 9162 inclusion proof against the committed Merkle
+  root, offline and standard library only. The receipt is passed with the new
+  `--receipt` option on `verify` and `report`; without one, `TR-ANC-002` fails.
+  A record that passed Level 2 on 0.5.1 without a receipt will fail it on 0.6.0.
+
+### Added
+
+- **`TR-ENV-005`: `cnf.jwk` must carry no private key material (#98).** A record
+  carrying its own private key (`d` and the other private JWK members) passed
+  the whole suite, because `TR-ENV-004` only checked that `kty` was present. The
+  packaged `schemas/trace-claim.json` copy is closed the same way. This is the
+  trace-tests half of GHSA-vc4p-h84j-7qxj; trace-spec#296 fixed the other two
+  schema copies.
+- **`TR-APR`: appraisal well-formedness at every level (#82, closes #63).**
+  `appraisal` is required by the schema and no module read it. Five codes now
+  check the status enum, the verifier URI and appraisal timing. No network, no
+  filesystem, no resolver.
+- **`TR-POL-003` resolves `policy_uri` against `bundle_hash` (#69).** A
+  `policy_resolver` callable on `runner.run` and a `--policy-dir` option on the
+  CLI supply the policy bytes; the check compares their digest to the record.
+- Machine-readable execution accounting in CLI JSON reports for the bounded
+  `TR-APR-001`, `TR-POL-003` and `TR-SCA-002` pilot (#93). Accounted findings
+  and accounting come from one immutable execution snapshot; unreconciled
+  accounting is rejected on that path, the operational policy-correspondence rule
+  is separated from supporting schema locators and all carry value digests for
+  comparison against the referenced trace-spec bytes, scheduler non-execution
+  carries a reason, and existing verdict policy and CLI exit behavior are unchanged.
+
+### Fixed
+
+- `TR-SIG` reports a record with no RFC 8785 canonical form (an integer outside
+  the safe range, a non-finite float) as a finding instead of raising and ending
+  the run (#86).
+- Malformed arrays or objects in `policy.enforcement_mode`, `runtime.platform`,
+  `build_provenance.slsa_level` and `cnf.jwk.kty` raised
+  `TypeError` before the runner could return findings; boolean SLSA levels
+  passed as `1` and `0`. Both are now findings (#85, closes #84).
+
+### Internal
+
+- The finding to level failure decision lives in one place, read by both the
+  CLI and the JSON report (#88).
+- Release and CI actions pinned to SHAs with a token permissions floor (#97);
+  CI installs from hash-pinned locks (#101); actionlint and a test-environment
+  guard added (#100).
+
 ## v0.5.1 — 2026-08-22
 
 - Level 1 and Level 2 verification now requires a verifier-issued challenge via

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/CONTRIBUTING.md

@@ -9,6 +9,14 @@ Thank you for your interest in contributing to the TRACE test suite.
 3. Commit using [Conventional Commits](https://www.conventionalcommits.org)
 4. Open a pull request against `main`
 
+## Using AI to contribute
+
+Use agents. A lot of this was built with them and saying otherwise would be dishonest.
+
+The rule is that you have to understand what you submit. If you cannot explain what your change does and how it interacts with the rest of the system, with the agent closed, do not open the pull request. Reviewing a change nobody can explain costs more than writing it did, and it becomes someone else's problem the moment it merges.
+
+That is a rule about understanding, not about tooling.
+
 ## Reporting Security Issues
 
 Use [GitHub Security Advisories](https://github.com/agentrust-io/trace-tests/security/advisories/new) rather than public issues.

agentrust_trace_tests-0.6.0/LIMITATIONS.md

@@ -0,0 +1,103 @@
+# Known Limitations
+
+What this suite does **not** establish. A conformance report is only useful if the reader knows
+what it was never checking, so this is the companion to the report rather than a footnote to it.
+
+## What a pass means
+
+**A pass describes the record, not the agent.**
+Conformance means the record is well formed, internally consistent, and carries what its level
+requires. It says nothing about whether the agent behaved well, whether the policy it ran under
+was a sensible policy, or whether the run should have been allowed. A record of a bad run passes
+exactly as cleanly as a record of a good one.
+
+**The suite is one implementation, not the definition.**
+[trace-spec](https://github.com/agentrust-io/trace-spec) is normative. Where this suite and the
+specification disagree, the specification is what other implementations were written against and
+the disagreement is a bug worth reporting here.
+
+## Where the checks stop
+
+**`TR-RTE` checks the shape of the attestation fields, not the attestation.**
+It validates that `runtime.platform` is a recognised value, that `runtime.measurement` is a well
+formed digest, and that the RIM URI parses. It does not obtain a quote, and it does not verify one
+against AMD, Intel or a TPM manufacturer root. A record can satisfy `TR-RTE` at Level 1 carrying a
+syntactically perfect measurement that no hardware ever produced. Verifying the quote against the
+silicon vendor is the relying party's job, and `cmcp_verify` is where that happens.
+
+**`TR-ANC-002` proves inclusion relative to the receipt you hand it.**
+It replays the audit path against the Merkle root carried in that receipt. It does not fetch the
+`transparency` URI, and it does not establish that the root is one a public log actually
+published. A self-consistent receipt over a tree the submitter built themselves will pass. What
+the check rules out is a record that has been modified since anchoring, or that was never in the
+tree the receipt commits to. Establishing that the tree is real is a separate step and is not in
+scope here.
+
+`TR-ANC-001` is explicit that it checks the pointer rather than the anchor. Supplying no receipt
+fails `TR-ANC-002`, so Level 2 cannot be reached on a well formed URI alone.
+
+## Statuses that are easy to misread
+
+**`UNVERIFIED` is about reachability, not correctness.**
+It means the check could not be run against the evidence the record cites. The evidence may be
+perfectly good and simply out of reach. It is deliberately held apart from a skip so that it can
+never be read as a benign omission.
+
+Whether an unverified finding fails a run is decided per code, in
+`src/trace_tests/modules/unverified.py`, not by one blanket rule. `TR-POL-003` is tolerated until
+Level 2; anything the table does not name fails from Level 1, so a newly added code fails closed
+rather than turning a run quietly permissive.
+
+**A `TR-ENV` profile failure is a version mismatch before it is a defect.**
+Suite 0.4.0 and later require v0.2 records. Run against a v0.1 record, the profile sentinel
+produces a confident failure on a record that is fine. Check the suite and record versions before
+believing that result.
+
+**Results are perishable.**
+`TR-ENV` validates `iat`, so a record that passes today can fail later with nothing about the
+record having changed. A report is a statement about a moment, and it needs its timestamp to be
+read correctly.
+
+## Who is asserting what
+
+**Nothing here is independently assessed.**
+A report is produced by whoever ran the suite, on evidence they supplied. There is no third-party
+assessor and no certification programme behind it. This is why the generated report tells a reader
+who does not trust the sender to go and check the record themselves rather than trusting the
+summary.
+
+## Bounded obligation accounting
+
+**`accounting_complete` describes the pilot, not all of TRACE.**
+The accounting extension covers only `TR-APR-001`, `TR-POL-003`, and `TR-SCA-002`.
+Complete means that every attempted level has exactly one reconciled row for each of those three
+obligations. It does not mean every TRACE obligation was accounted for, every obligation was
+evaluated, or that the report independently proves which code ran or which fields it accessed.
+An obligation absent from both the bounded registry and its rows is outside this completeness
+claim and cannot be discovered by registry-to-row reconciliation alone.
+
+The pilot records `TR-SCA-002` at Level 0 as applicable but not attempted: the pinned schema
+requires `build_provenance.digest`, while the scheduler first runs `TR-SCA` at Level 1. The row
+carries that scheduler reason rather than silently presenting the state without an explanation.
+
+Each source locator includes a digest of the exact value resolved at its pinned trace-spec
+revision. JSON sources use RFC 6901 pointers and RFC 8785-canonical value bytes. The operational
+TR-POL-003 rule uses the unique exact text of verification item 5 in the pinned specification;
+its schema fragments are listed separately as structural support. A reader who holds those
+pinned bytes can resolve and compare the values. The suite does not fetch or authenticate
+trace-spec at report time, and a matching value does not prove that a locator is sufficient or
+that its checker is correct.
+
+Findings and accounting share one validated execution snapshot during supported report
+construction. The emitted report remains editable and unsigned. Its registry hash identifies
+registry content; it does not authenticate the rows, the report, or its producer.
+
+The optional policy resolver is trusted in-process Python code supplied by the caller. The
+accounted path isolates nested public runs and freezes ordinary decision inputs, but it is not a
+sandbox against a callback that rewrites interpreter globals, functions, classes, or source files.
+
+`producer_branch` is a checker-owned same-execution diagnostic. Some branches with the same
+accounting meaning return indistinguishable findings, so the emitted report alone cannot
+independently reconstruct every branch label. Applicability, evaluation state, prerequisite,
+contribution, findings, and report tallies are revalidated at emission; the label is not
+presented as independent proof of checker control flow.

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentrust-trace-tests
-Version: 0.5.1
+Version: 0.6.0
 Summary: TRACE conformance test suite
 Project-URL: Homepage, https://github.com/agentrust-io/trace-tests
 Project-URL: Repository, https://github.com/agentrust-io/trace-tests
@@ -42,7 +42,9 @@ Description-Content-Type: text/markdown
 
 # TRACE Conformance Test Suite
 
-### Verify your TRACE implementation before shipping
+Community updates and contributor highlights: [AgenTrust on LinkedIn](https://www.linkedin.com/company/agentrust-io/).
+
+### Check a TRACE record and see which conformance level it reaches
 
 <p align="center">
   <a href="https://tests.agentrust-io.com">
@@ -59,15 +61,15 @@ Description-Content-Type: text/markdown
 
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
 [![TRACE Spec](https://img.shields.io/badge/TRACE-Spec_v0.2-0ea5e9)](https://github.com/agentrust-io/trace-spec)
-[![Tests](https://img.shields.io/badge/Conformance_Tests-7_modules-green)]()
+[![Tests](https://img.shields.io/badge/Conformance_Tests-8_modules-green)](docs/modules.md)
 [![CI](https://github.com/agentrust-io/trace-tests/actions/workflows/ci.yml/badge.svg)](https://github.com/agentrust-io/trace-tests/actions/workflows/ci.yml)
 [![Discord](https://img.shields.io/badge/Discord-Join-5865F2?logo=discord&logoColor=white&style=flat)](https://discord.gg/grgzFEHgkj)
 
-> **Test suite v0.2.** Tracks [TRACE Spec v0.2](https://github.com/agentrust-io/trace-spec).
+> Tracks [TRACE Spec v0.2](https://github.com/agentrust-io/trace-spec).
 
-Conformance tests for TRACE (Trust Runtime Attestation and Compliance Evidence). Run this suite against your implementation to verify it meets the spec before claiming TRACE compliance.
+Check a TRACE record, inspect the findings, and produce a reproducible conformance report. The suite checks the record and supplied evidence; a passing report does not establish that an entire implementation meets every specification requirement.
 
-Seven test modules covering the full specification: envelope structure, signature algorithms, TEE runtime claims, policy binding, tool-call transcripts, SCITT transparency anchoring, and supply chain provenance.
+Eight modules cover envelope, signature, runtime, policy, appraisal, transcript, transparency, and provenance checks. Read the [limitations](LIMITATIONS.md) to interpret their results.
 
 ## Quick start
 
@@ -102,7 +104,25 @@ conformance report that looks authoritative and cannot be checked is the same sh
 thing as a control plane writing its own log.
 
 `report.json` is stable under `schema: agentrust-io/trace-tests/report/1` for dashboards
-and CI.
+and CI. Reports produced by the CLI include an additive, version-tagged
+`obligation_accounting` object for the bounded `TR-APR-001`, `TR-POL-003`, and
+`TR-SCA-002` pilot. During supported report construction, its rows are reconciled
+against the executable registry identified by `registry_id` and `registry_sha256`.
+The operational `TR-POL-003` rule is identified separately from schema fragments
+that support its field shape. Every source locator carries a digest of the exact
+resolved value so a reader holding the pinned trace-spec bytes can re-resolve and
+compare it. Accounted JSON, HTML, badge, and verdict projections consume one
+immutable execution-derived snapshot. A JSON-only request does not pre-render
+unrequested formats; when multiple formats are requested, they are emitted in the
+CLI's existing order. The existing contribution policy continues to determine the
+report verdict.
+The tag identifies this emitted object shape; the repository does not currently
+ship a separate formal JSON Schema for it.
+
+This treats `report/1` as additively extensible: existing members retain their meaning,
+and `obligation_accounting` is the sole new top-level member. Compatibility with
+consumers that require the exact historical key set is not established. The report
+remains an unsigned self-report; see [Known Limitations](LIMITATIONS.md).
 
 ## Test modules
 
@@ -125,6 +145,7 @@ and CI.
 | 🗂 Test schemas | [schemas/](schemas/) |
 | 💬 Discussions | [GitHub Discussions](https://github.com/orgs/agentrust-io/discussions) |
 | 📋 Changelog | [CHANGELOG.md](CHANGELOG.md) |
+| ⚠️ Known limitations | [LIMITATIONS.md](LIMITATIONS.md) |
 
 ## Contributing
 

agentrust_trace_tests-0.6.0/PRIVACY.md

@@ -0,0 +1,9 @@
+# Privacy
+
+The TRACE test suite reads the record and optional evidence you supply. CLI options can also load policy bundles, receipts, and related local files. Findings and exported reports may reproduce identifiers, artifact locations, and error details from those inputs; review reports before sharing them.
+
+The CLI does not send project telemetry or analytics and does not fetch arbitrary record URLs. Its policy-directory resolver uses local files. Library callers can supply their own resolver callbacks, whose network and data handling behavior belongs to the calling application.
+
+Uninstalling the package does not delete input records, evidence files, exported reports, badges, logs, or backups. Manage those artifacts through your application's retention and deletion procedures.
+
+[Report a correction](https://github.com/agentrust-io/trace-tests/issues).

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/README.md

@@ -4,7 +4,9 @@
 
 # TRACE Conformance Test Suite
 
-### Verify your TRACE implementation before shipping
+Community updates and contributor highlights: [AgenTrust on LinkedIn](https://www.linkedin.com/company/agentrust-io/).
+
+### Check a TRACE record and see which conformance level it reaches
 
 <p align="center">
   <a href="https://tests.agentrust-io.com">
@@ -21,15 +23,15 @@
 
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
 [![TRACE Spec](https://img.shields.io/badge/TRACE-Spec_v0.2-0ea5e9)](https://github.com/agentrust-io/trace-spec)
-[![Tests](https://img.shields.io/badge/Conformance_Tests-7_modules-green)]()
+[![Tests](https://img.shields.io/badge/Conformance_Tests-8_modules-green)](docs/modules.md)
 [![CI](https://github.com/agentrust-io/trace-tests/actions/workflows/ci.yml/badge.svg)](https://github.com/agentrust-io/trace-tests/actions/workflows/ci.yml)
 [![Discord](https://img.shields.io/badge/Discord-Join-5865F2?logo=discord&logoColor=white&style=flat)](https://discord.gg/grgzFEHgkj)
 
-> **Test suite v0.2.** Tracks [TRACE Spec v0.2](https://github.com/agentrust-io/trace-spec).
+> Tracks [TRACE Spec v0.2](https://github.com/agentrust-io/trace-spec).
 
-Conformance tests for TRACE (Trust Runtime Attestation and Compliance Evidence). Run this suite against your implementation to verify it meets the spec before claiming TRACE compliance.
+Check a TRACE record, inspect the findings, and produce a reproducible conformance report. The suite checks the record and supplied evidence; a passing report does not establish that an entire implementation meets every specification requirement.
 
-Seven test modules covering the full specification: envelope structure, signature algorithms, TEE runtime claims, policy binding, tool-call transcripts, SCITT transparency anchoring, and supply chain provenance.
+Eight modules cover envelope, signature, runtime, policy, appraisal, transcript, transparency, and provenance checks. Read the [limitations](LIMITATIONS.md) to interpret their results.
 
 ## Quick start
 
@@ -64,7 +66,25 @@ conformance report that looks authoritative and cannot be checked is the same sh
 thing as a control plane writing its own log.
 
 `report.json` is stable under `schema: agentrust-io/trace-tests/report/1` for dashboards
-and CI.
+and CI. Reports produced by the CLI include an additive, version-tagged
+`obligation_accounting` object for the bounded `TR-APR-001`, `TR-POL-003`, and
+`TR-SCA-002` pilot. During supported report construction, its rows are reconciled
+against the executable registry identified by `registry_id` and `registry_sha256`.
+The operational `TR-POL-003` rule is identified separately from schema fragments
+that support its field shape. Every source locator carries a digest of the exact
+resolved value so a reader holding the pinned trace-spec bytes can re-resolve and
+compare it. Accounted JSON, HTML, badge, and verdict projections consume one
+immutable execution-derived snapshot. A JSON-only request does not pre-render
+unrequested formats; when multiple formats are requested, they are emitted in the
+CLI's existing order. The existing contribution policy continues to determine the
+report verdict.
+The tag identifies this emitted object shape; the repository does not currently
+ship a separate formal JSON Schema for it.
+
+This treats `report/1` as additively extensible: existing members retain their meaning,
+and `obligation_accounting` is the sole new top-level member. Compatibility with
+consumers that require the exact historical key set is not established. The report
+remains an unsigned self-report; see [Known Limitations](LIMITATIONS.md).
 
 ## Test modules
 
@@ -87,6 +107,7 @@ and CI.
 | 🗂 Test schemas | [schemas/](schemas/) |
 | 💬 Discussions | [GitHub Discussions](https://github.com/orgs/agentrust-io/discussions) |
 | 📋 Changelog | [CHANGELOG.md](CHANGELOG.md) |
+| ⚠️ Known limitations | [LIMITATIONS.md](LIMITATIONS.md) |
 
 ## Contributing
 

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/SPONSORS.md

@@ -1,9 +1,9 @@
 # Sponsors
 
-TRACE Tests is an open-source AgenTrust project. Sponsors provide funding,
-engineering time, infrastructure, or other in-kind support. Sponsorship does
-not confer project ownership, governance authority, or control over technical
-decisions or conformance results.
+TRACE Tests is an open-source AgenTrust project. It is sponsored by OPAQUE
+Systems, which funds the engineering, infrastructure and confidential-computing
+work behind it. Organisations that want to support the project are welcome to
+join as sponsors.
 
 ## Current sponsors
 

{agentrust_trace_tests-0.5.1 → agentrust_trace_tests-0.6.0}/docs/error-codes.md

@@ -10,6 +10,7 @@ All TRACE test failures emit a structured error code of the form `TR-<MODULE>-<N
 | TR-ENV-002 | `iat` is missing, not an integer, or out of range | Set `iat` to a Unix timestamp integer (e.g. `int(time.time())`) |
 | TR-ENV-003 | `subject` does not match SPIFFE URI or DID pattern | Use `spiffe://<trust-domain>/<path>` or a `did:` URI |
 | TR-ENV-004 | `cnf` is absent or not an object, `cnf.jwk` is absent or not an object, or `cnf.jwk.kty` is absent | Populate `cnf.jwk` with at least `kty`. This checks that one field, not the schema's full required set, which structural validation covers |
+| TR-ENV-005 | `cnf.jwk` carries private key material (`d`, `p`, `q`, `dp`, `dq`, `qi`, `k`) | Publish the public half only. RFC 8747 makes `cnf` a confirmation key, and a record is signed and usually anchored, so a key exposed this way must be treated as compromised and the identity revoked |
 
 ## TR-SIG — Signature
 
@@ -33,8 +34,19 @@ All TRACE test failures emit a structured error code of the form `TR-<MODULE>-<N
 
 | Code | Description | How to fix |
 |------|-------------|------------|
-| TR-POL-001 | `policy.bundle_hash` is not a valid `sha256:` digest | Compute `sha256:` + hex digest of your Cedar policy bundle bytes |
+| TR-POL-001 | `policy.bundle_hash` is not a valid `sha256:` or `sha384:` digest | Compute `sha256:` + 64 hex chars, or `sha384:` + 96 hex chars, over your policy bundle bytes. Both are accepted by the schema and by the module |
 | TR-POL-002 | `policy.enforcement_mode` is not `enforce`, `advisory`, `silent`, or `declared` | Replace `"strict"` or `"monitor"` with one of the four accepted values; `"declared"` is the honest value for a producer that binds a policy without evaluating it |
+| TR-POL-003 | `policy.policy_uri` is not an absolute URI, or the bundle it resolves to does not have the digest `policy.bundle_hash` declares. Unverified when a resolver was supplied and the bundle could not be read; skipped when no `policy_uri` is present or no resolver was supplied | Point `policy_uri` at the bundle whose bytes hash to `bundle_hash`. A record that cites a bundle it cannot be checked against is reported as unverified rather than passed |
+
+## TR-APR — Appraisal
+
+| Code | Description | How to fix |
+|------|-------------|------------|
+| TR-APR-001 | `appraisal` is absent or not an object, or `appraisal.status` is absent or not one of `affirming`, `warning`, `contraindicated`, `none` | Set `appraisal.status` to one of the four values the schema enumerates. An absent or non-object `appraisal` is reported as this code alone, not as a cascade |
+| TR-APR-002 | `appraisal.verifier` is absent, not a string, or not an absolute URI | Set `appraisal.verifier` to the absolute URI identifying the verifier that produced the appraisal. A relative reference is rejected: the schema asks for `format: "uri"`, and a reader cannot dereference a name with no scheme |
+| TR-APR-003 | `appraisal.policy_ref` is present and is not an absolute URI. Skipped when the field is absent, which is permitted | Point `policy_ref` at the appraisal policy with an absolute URI, or omit it. Only the shape of the name is checked; TR-APR never resolves it |
+| TR-APR-004 | `appraisal.timestamp` is present and is not an integer of epoch seconds, or is in the future. Skipped when the field is absent, which is permitted | Set `appraisal.timestamp` to the epoch second the appraisal was produced. An appraisal dated in the future asserts something that has not happened, on the same ground TR-ENV-002 applies to `iat` |
+| TR-APR-005 | `appraisal.status` is not `affirming` at Level 1 or above. Skipped at Level 0, where `docs/levels.md`'s own minimum conformant record carries `none` | Re-run the appraisal until it affirms, or check the record at Level 0 |
 
 ## TR-TXN — Transcript
 
@@ -47,7 +59,8 @@ All TRACE test failures emit a structured error code of the form `TR-<MODULE>-<N
 
 | Code | Description | How to fix |
 |------|-------------|------------|
-| TR-ANC-001 | `transparency` is absent or empty, is not a string, or is not an `https://` URI with a host | Submit the record to a SCITT transparency log and set `transparency` to the returned receipt URI. The URI is not resolved and the receipt behind it is not fetched; this is a format check |
+| TR-ANC-001 | `transparency` is absent or empty, is not a string, or is not an `https://` URI with a host | Submit the record to a SCITT transparency log and set `transparency` to the returned receipt URI. The URI is not resolved and the receipt behind it is not fetched; this is a format check on the pointer, and TR-ANC-002 is what checks the anchor |
+| TR-ANC-002 | No anchor receipt was supplied, the receipt is malformed, or replaying its inclusion proof does not reproduce the committed `merkle_root` | Pass the receipt with `--receipt`. Without one, nothing proves the record is in the log the URI names, so Level 2 cannot pass. If a receipt is supplied and the proof does not verify, the record is not in that tree or it has been modified since it was anchored |
 
 ## TR-SCA — Provenance