agentrust-trace 0.1.0__tar.gz → 0.1.1__tar.gz

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches: ["main", "feat/**", "fix/**"]
   pull_request:
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -15,7 +18,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.python-version }}
 

agentrust_trace-0.1.1/.github/workflows/contributor-check.yml

@@ -0,0 +1,42 @@
+name: Contributor reputation check
+
+on:
+  pull_request_target:
+    types: [opened]
+  issues:
+    types: [opened]
+  workflow_dispatch:
+    inputs:
+      username:
+        description: GitHub username to check
+        required: true
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    if: |
+      github.actor != 'dependabot[bot]' &&
+      github.actor != 'github-actions[bot]' &&
+      github.actor != 'copilot-swe-agent[bot]' &&
+      github.actor != 'claude-code[bot]' &&
+      github.actor != 'imran-siddique'
+    steps:
+      - name: Checkout org action
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          repository: agentrust-io/.github
+          ref: main
+          persist-credentials: false
+          sparse-checkout: |
+            scripts
+            .github/actions/contributor-check
+
+      - name: Run contributor check
+        uses: ./.github/actions/contributor-check
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/.github/workflows/publish.yml

@@ -9,13 +9,16 @@ permissions:
   contents: read
   id-token: write  # OIDC trusted publishing — no stored API token needed
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v4
         with:
           python-version: "3.11"
 

agentrust_trace-0.1.1/.github/workflows/require-maintainer-approval.yml

@@ -0,0 +1,84 @@
+name: Require maintainer approval
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches: [main]
+  # Re-evaluate the gate when a review is submitted or dismissed so an
+  # approval clears the failing status without waiting for a new push.
+  # Note: pull_request_review does not support a branches filter, so the
+  # base-branch check lives in the job-level `if` below.
+  pull_request_review:
+    types: [submitted, dismissed]
+
+permissions:
+  contents: read
+  pull-requests: read
+  statuses: write
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.base.ref == 'main'
+    steps:
+      - name: Check for maintainer approval
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const MAINTAINERS = ['imran-siddique'];
+
+            const author = context.payload.pull_request.user.login;
+            if (MAINTAINERS.includes(author)) {
+              core.info(`Author ${author} is a maintainer, skipping gate`);
+              return;
+            }
+
+            const association = context.payload.pull_request.author_association;
+            if (association === 'MEMBER' || association === 'OWNER') {
+              core.info(`Author is ${association}, skipping gate`);
+              return;
+            }
+
+            // Both pull_request_target and pull_request_review payloads
+            // carry the PR at context.payload.pull_request.
+            const prNumber = context.payload.pull_request.number;
+
+            // Re-fetch the PR so we compare against the head SHA at
+            // evaluation time, not a possibly stale SHA from the payload.
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+            const headSha = pr.head.sha;
+
+            // Paginate: listReviews otherwise returns only the first 30.
+            const reviews = await github.paginate(github.rest.pulls.listReviews, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+
+            // Only a maintainer's most recent non-comment review counts,
+            // and it must approve the current head commit. An approval of
+            // an older commit does not clear the gate after a later push
+            // (prevents approve-then-swap).
+            const latestByMaintainer = new Map();
+            for (const review of reviews) {
+              if (
+                review.user &&
+                review.user.type === 'User' &&
+                MAINTAINERS.includes(review.user.login) &&
+                review.state !== 'COMMENTED'
+              ) {
+                latestByMaintainer.set(review.user.login, review);
+              }
+            }
+
+            const approved = [...latestByMaintainer.values()].some(
+              (r) => r.state === 'APPROVED' && r.commit_id === headSha
+            );
+
+            if (!approved) {
+              core.setFailed('Waiting for maintainer approval of the current head commit before merging.');
+            }

agentrust_trace-0.1.1/.github/workflows/sbom.yml

@@ -0,0 +1,30 @@
+name: SBOM
+
+on:
+  push:
+    branches: [main]
+  release:
+    types: [published]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  sbom:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          format: spdx-json
+          output-file: sbom.spdx.json
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom
+          path: sbom.spdx.json

agentrust_trace-0.1.1/ADOPTERS.md

@@ -0,0 +1,11 @@
+# ADOPTERS
+
+Organizations using or evaluating the TRACE specification.
+
+To add your organization, open a pull request editing this file.
+
+---
+
+| Organization | Usage |
+|---|---|
+| Opaque Systems | Founding contributor — developed the initial specification, reference implementation, and TRACE registry infrastructure |

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/CHARTER.md

@@ -1,7 +1,9 @@
 # Technical Charter — TRACE
 
 **Proposed hosting**: CoSAI (Coalition for Secure AI) for the technical workstream; Linux Foundation entity hosting the Model Context Protocol for specification, IP, trademark, and conformance mark.  
-**Status**: Pre-acceptance draft — effective upon host organization acceptance.  
+**Status**: Pre-acceptance draft — effective upon host organization acceptance.
+
+> **Note for external contributors:** This charter is a working draft and has not yet been accepted by a host organization. Governance terms, IP policy, and conformance mark ownership described here are proposed, not final. Do not implement production systems based on governance commitments in this document until v1.0 ratification.  
 **Version**: 0.1 (aligned with spec v0.1)
 
 ---

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentrust-trace
-Version: 0.1.0
+Version: 0.1.1
 Summary: TRACE v0.1 — hardware-attested governance records for AI agents
 Project-URL: Homepage, https://github.com/agentrust-io/trace-spec
 Project-URL: Repository, https://github.com/agentrust-io/trace-spec
@@ -29,13 +29,27 @@ Requires-Dist: ruff>=0.4; extra == 'dev'
 Requires-Dist: types-jsonschema; extra == 'dev'
 Description-Content-Type: text/markdown
 
-<p align="center">
+<p align="center">
   <img src="docs/assets/icon.svg" width="96" height="96" alt="TRACE"/>
 </p>
 
-# TRACE — Trust Runtime Attestation and Compliance Evidence
+# TRACE: Trust Runtime Attestation and Compliance Evidence
+
+[![License: CC BY 4.0](https://img.shields.io/badge/License-CC_BY_4.0-lightgrey.svg)](LICENSE)
+[![AAIF](https://img.shields.io/badge/Targeting-AAIF_%2F_Linux_Foundation-6366f1)](https://agenticai.foundation)
+[![Spec](https://img.shields.io/badge/Spec-v0.1-0ea5e9)](spec/trace-v0.1.md)
+
+> **Developer Preview.** Launching at Confidential Computing Summit, June 23 2026. May have breaking changes before v1.0.
+
+<p align="center">
+  <a href="spec/trace-v0.1.md">Specification</a> &nbsp;|&nbsp;
+  <a href="schema/trace-claim.json">Schema</a> &nbsp;|&nbsp;
+  <a href="examples/">Examples</a> &nbsp;|&nbsp;
+  <a href="https://github.com/agentrust-io/trace-registry">Registry</a> &nbsp;|&nbsp;
+  <a href="https://github.com/agentrust-io/cmcp">Reference Impl</a>
+</p>
 
-An open specification for hardware-attested AI agent governance records. TRACE defines the format, anchoring protocol, and verification rules for cryptographically provable evidence that an AI agent ran under a specific policy, in a verified hardware environment, on classified data, invoking identified tools — bound into a single signed artifact rooted in silicon attestation.
+An open specification for hardware-attested AI agent governance records. TRACE defines the format, anchoring protocol, and verification rules for cryptographically provable evidence that an AI agent ran under a specific policy, in a verified hardware environment, on classified data, invoking identified tools, bound into a single signed artifact rooted in silicon attestation.
 
 ## What a TRACE Trust Record Is
 
@@ -84,11 +98,21 @@ An open specification for hardware-attested AI agent governance records. TRACE d
 
 The record is a single EAT envelope (RFC 9711). Each field is independently verifiable. No callback to the issuer is required.
 
+### Supported platforms
+
+| Platform | v0.1 | v0.2 (planned) | Notes |
+|---|---|---|---|
+| `intel-tdx` | Yes | Yes | |
+| `amd-sev-snp` | Yes | Yes | |
+| `nvidia-h100` | Yes | Yes | |
+| `gpu-cc` | No | Planned | Generic GPU confidential compute |
+| `opaque` | Yes | Yes | Explicit opt-in; contact maintainers |
+
 ## Specification
 
-- [`spec/trace-v0.1.md`](spec/trace-v0.1.md) — full specification
-- [`schema/trace-claim.json`](schema/trace-claim.json) — JSON Schema
-- [`examples/`](examples/) — example Trust Records for Intel TDX, AMD SEV-SNP, and NVIDIA H100
+- [`spec/trace-v0.1.md`](spec/trace-v0.1.md) -- full specification
+- [`schema/trace-claim.json`](schema/trace-claim.json) -- JSON Schema
+- [`examples/`](examples/) -- example Trust Records for Intel TDX, AMD SEV-SNP, and NVIDIA H100
 
 ## Standards composition
 
@@ -106,7 +130,7 @@ TRACE profiles existing standards rather than replacing them:
 
 ## Reference implementation
 
-[agentrust-io/cmcp](https://github.com/agentrust-io/cmcp) — Confidential MCP Gateway. Hardware-attested policy enforcement at the MCP tool-call boundary on Intel TDX, AMD SEV-SNP, and NVIDIA H100/Blackwell.
+[agentrust-io/cmcp](https://github.com/agentrust-io/cmcp) -- Confidential MCP Runtime. Hardware-attested policy enforcement at the MCP tool-call boundary on Intel TDX, AMD SEV-SNP, and NVIDIA H100/Blackwell.
 
 ## Registry
 
@@ -114,7 +138,7 @@ A public append-only Merkle registry of TRACE Trust Record anchors: [agentrust-i
 
 ## Status
 
-Draft v0.1 — publishing at Confidential Computing Summit, San Francisco, June 23 2026. Targeting submission to the [Agentic AI Foundation (AAIF)](https://agenticai.foundation) under the Linux Foundation.
+Draft v0.1. Publishing at Confidential Computing Summit, San Francisco, June 23 2026. Targeting submission to the [Agentic AI Foundation (AAIF)](https://agenticai.foundation) under the Linux Foundation.
 
 ## License
 

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/README.md

@@ -1,10 +1,24 @@
-<p align="center">
+<p align="center">
   <img src="docs/assets/icon.svg" width="96" height="96" alt="TRACE"/>
 </p>
 
-# TRACE — Trust Runtime Attestation and Compliance Evidence
+# TRACE: Trust Runtime Attestation and Compliance Evidence
+
+[![License: CC BY 4.0](https://img.shields.io/badge/License-CC_BY_4.0-lightgrey.svg)](LICENSE)
+[![AAIF](https://img.shields.io/badge/Targeting-AAIF_%2F_Linux_Foundation-6366f1)](https://agenticai.foundation)
+[![Spec](https://img.shields.io/badge/Spec-v0.1-0ea5e9)](spec/trace-v0.1.md)
+
+> **Developer Preview.** Launching at Confidential Computing Summit, June 23 2026. May have breaking changes before v1.0.
+
+<p align="center">
+  <a href="spec/trace-v0.1.md">Specification</a> &nbsp;|&nbsp;
+  <a href="schema/trace-claim.json">Schema</a> &nbsp;|&nbsp;
+  <a href="examples/">Examples</a> &nbsp;|&nbsp;
+  <a href="https://github.com/agentrust-io/trace-registry">Registry</a> &nbsp;|&nbsp;
+  <a href="https://github.com/agentrust-io/cmcp">Reference Impl</a>
+</p>
 
-An open specification for hardware-attested AI agent governance records. TRACE defines the format, anchoring protocol, and verification rules for cryptographically provable evidence that an AI agent ran under a specific policy, in a verified hardware environment, on classified data, invoking identified tools — bound into a single signed artifact rooted in silicon attestation.
+An open specification for hardware-attested AI agent governance records. TRACE defines the format, anchoring protocol, and verification rules for cryptographically provable evidence that an AI agent ran under a specific policy, in a verified hardware environment, on classified data, invoking identified tools, bound into a single signed artifact rooted in silicon attestation.
 
 ## What a TRACE Trust Record Is
 
@@ -53,11 +67,21 @@ An open specification for hardware-attested AI agent governance records. TRACE d
 
 The record is a single EAT envelope (RFC 9711). Each field is independently verifiable. No callback to the issuer is required.
 
+### Supported platforms
+
+| Platform | v0.1 | v0.2 (planned) | Notes |
+|---|---|---|---|
+| `intel-tdx` | Yes | Yes | |
+| `amd-sev-snp` | Yes | Yes | |
+| `nvidia-h100` | Yes | Yes | |
+| `gpu-cc` | No | Planned | Generic GPU confidential compute |
+| `opaque` | Yes | Yes | Explicit opt-in; contact maintainers |
+
 ## Specification
 
-- [`spec/trace-v0.1.md`](spec/trace-v0.1.md) — full specification
-- [`schema/trace-claim.json`](schema/trace-claim.json) — JSON Schema
-- [`examples/`](examples/) — example Trust Records for Intel TDX, AMD SEV-SNP, and NVIDIA H100
+- [`spec/trace-v0.1.md`](spec/trace-v0.1.md) -- full specification
+- [`schema/trace-claim.json`](schema/trace-claim.json) -- JSON Schema
+- [`examples/`](examples/) -- example Trust Records for Intel TDX, AMD SEV-SNP, and NVIDIA H100
 
 ## Standards composition
 
@@ -75,7 +99,7 @@ TRACE profiles existing standards rather than replacing them:
 
 ## Reference implementation
 
-[agentrust-io/cmcp](https://github.com/agentrust-io/cmcp) — Confidential MCP Gateway. Hardware-attested policy enforcement at the MCP tool-call boundary on Intel TDX, AMD SEV-SNP, and NVIDIA H100/Blackwell.
+[agentrust-io/cmcp](https://github.com/agentrust-io/cmcp) -- Confidential MCP Runtime. Hardware-attested policy enforcement at the MCP tool-call boundary on Intel TDX, AMD SEV-SNP, and NVIDIA H100/Blackwell.
 
 ## Registry
 
@@ -83,7 +107,7 @@ A public append-only Merkle registry of TRACE Trust Record anchors: [agentrust-i
 
 ## Status
 
-Draft v0.1 — publishing at Confidential Computing Summit, San Francisco, June 23 2026. Targeting submission to the [Agentic AI Foundation (AAIF)](https://agenticai.foundation) under the Linux Foundation.
+Draft v0.1. Publishing at Confidential Computing Summit, San Francisco, June 23 2026. Targeting submission to the [Agentic AI Foundation (AAIF)](https://agenticai.foundation) under the Linux Foundation.
 
 ## License
 

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/SECURITY.md

@@ -14,7 +14,7 @@ Vulnerabilities in the reference implementation (cMCP) should be reported at [ag
 
 **Do not open a public GitHub issue for security vulnerabilities.**
 
-Report vulnerabilities by email to: **security@opaque.co**
+Report vulnerabilities via [GitHub Security Advisories](https://github.com/agentrust-io/trace-spec/security/advisories/new). Do not use public issues.
 
 Include:
 - A description of the vulnerability and the affected spec section or schema path

agentrust_trace-0.1.1/examples/README.md

@@ -0,0 +1,11 @@
+# TRACE v0.1 example Trust Records
+
+Each file is a canonical TRACE v0.1 Trust Record that validates as-is against
+`schema/trace-claim.json` (no preprocessing, no comment stripping).
+
+- `intel-tdx.json`: Intel TDX example.
+- `amd-sev-snp.json`: AMD SEV-SNP example.
+- `nvidia-h100.json`: NVIDIA H100 Confidential Computing example.
+
+The schema sets `additionalProperties: false`, so examples must not carry
+non-schema keys such as `_comment`. Keep descriptive notes in this file.

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/examples/amd-sev-snp.json

@@ -1,5 +1,4 @@
 {
-  "_comment": "TRACE v0.1 Trust Record — AMD SEV-SNP example. Truncated digests shown with '...' suffix.",
   "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
   "iat": 1750676142,
   "subject": "spiffe://trust.example.org/agent/payments-processor/prod",
@@ -11,28 +10,28 @@
   },
   "runtime": {
     "platform": "amd-sev-snp",
-    "measurement": "sha384:c9e4b1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4...",
+    "measurement": "sha384:c9e4b1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6",
     "rim_uri": "https://kdsintf.amd.com/vcek/v1/Milan/cert_chain",
     "firmware_version": "1.53.0",
     "nonce": "ZRVkXG1wbVJhY2tSZWNvcmQ"
   },
   "policy": {
-    "bundle_hash": "sha256:b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2...",
+    "bundle_hash": "sha256:b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3",
     "enforcement_mode": "enforce",
     "version": "1.2.0",
     "policy_uri": "https://registry.agentrust.io/policy/payments-v1.2.0"
   },
   "data_class": "confidential",
   "tool_transcript": {
-    "hash": "sha256:d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4...",
+    "hash": "sha256:d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5",
     "call_count": 3,
     "transcript_uri": "https://registry.agentrust.io/transcript/amd-2026-06-23T09:15:42Z"
   },
   "build_provenance": {
     "slsa_level": 2,
     "builder": "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml",
-    "digest": "sha256:e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5...",
-    "provenance_uri": "https://rekor.sigstore.dev/api/v1/log/entries/..."
+    "digest": "sha256:e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6",
+    "provenance_uri": "https://rekor.sigstore.dev/api/v1/log/entries/def456"
   },
   "appraisal": {
     "status": "affirming",
@@ -45,8 +44,8 @@
     "jwk": {
       "kty": "EC",
       "crv": "P-256",
-      "x": "MEkwEwYHKoZIzj0CAQY...",
-      "y": "GHkVPyQs9bXm2A...",
+      "x": "MEkwEwYHKoZIzj0CAQY",
+      "y": "GHkVPyQs9bXm2A",
       "kid": "sev-snp-workload-key-2026-06-23"
     }
   }

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/examples/intel-tdx.json

@@ -1,5 +1,4 @@
 {
-  "_comment": "TRACE v0.1 Trust Record — Intel TDX example. Truncated digests shown with '...' suffix.",
   "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
   "iat": 1750676200,
   "subject": "spiffe://trust.example.org/agent/document-processor/staging",
@@ -7,33 +6,33 @@
     "provider": "meta",
     "model_id": "llama-3.3-70b-instruct",
     "version": "3.3",
-    "weights_digest": "sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2...",
+    "weights_digest": "sha256:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
     "aibom_uri": "https://registry.agentrust.io/aibom/llama-3.3-70b-20260101"
   },
   "runtime": {
     "platform": "intel-tdx",
-    "measurement": "sha384:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5...",
+    "measurement": "sha384:a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8",
     "rim_uri": "https://api.trustedservices.intel.com/sgx/certification/v4/rootcacrl",
     "firmware_version": "2.0.3",
     "nonce": "dGRYLXdvcmtsb2FkLW5vbmNl"
   },
   "policy": {
-    "bundle_hash": "sha256:c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3...",
+    "bundle_hash": "sha256:c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4",
     "enforcement_mode": "enforce",
     "version": "2.0.1",
     "policy_uri": "https://registry.agentrust.io/policy/document-v2.0.1"
   },
   "data_class": "internal",
   "tool_transcript": {
-    "hash": "sha256:f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6...",
+    "hash": "sha256:f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7",
     "call_count": 7,
     "transcript_uri": "https://registry.agentrust.io/transcript/tdx-2026-06-23T09:16:40Z"
   },
   "build_provenance": {
     "slsa_level": 3,
     "builder": "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml",
-    "digest": "sha256:b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8...",
-    "provenance_uri": "https://rekor.sigstore.dev/api/v1/log/entries/..."
+    "digest": "sha256:b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9",
+    "provenance_uri": "https://rekor.sigstore.dev/api/v1/log/entries/abc123"
   },
   "appraisal": {
     "status": "affirming",
@@ -46,8 +45,8 @@
     "jwk": {
       "kty": "EC",
       "crv": "P-384",
-      "x": "TDXd2VyaWZpY2F0aW9uS2V5...",
-      "y": "UmVmZXJlbmNlTWVhc3VyZW1l...",
+      "x": "TDXd2VyaWZpY2F0aW9uS2V5",
+      "y": "UmVmZXJlbmNlTWVhc3VyZW1l",
       "kid": "tdx-workload-key-2026-06-23"
     }
   }

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/examples/nvidia-h100.json

@@ -1,5 +1,4 @@
 {
-  "_comment": "TRACE v0.1 Trust Record — NVIDIA H100 Confidential Computing example. Truncated digests shown with '...' suffix.",
   "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
   "iat": 1750676300,
   "subject": "spiffe://trust.example.org/agent/image-analysis/prod",
@@ -7,33 +6,33 @@
     "provider": "anthropic",
     "model_id": "claude-opus-4-8",
     "version": "20260601",
-    "weights_digest": "sha256:d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4...",
+    "weights_digest": "sha256:d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5",
     "aibom_uri": "https://registry.agentrust.io/aibom/claude-opus-4-8-20260601"
   },
   "runtime": {
     "platform": "nvidia-h100",
-    "measurement": "sha384:b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6...",
-    "rim_uri": "https://nras.nvidia.com/v1/attestation/rim/...",
+    "measurement": "sha384:b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9",
+    "rim_uri": "https://nras.nvidia.com/v1/attestation/rim/h100",
     "firmware_version": "535.183.06",
     "nonce": "bnZpZGlhLWgxMDAtbm9uY2U"
   },
   "policy": {
-    "bundle_hash": "sha256:e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5...",
+    "bundle_hash": "sha256:e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6",
     "enforcement_mode": "enforce",
     "version": "1.0.0",
     "policy_uri": "https://registry.agentrust.io/policy/image-analysis-v1.0.0"
   },
   "data_class": "restricted",
   "tool_transcript": {
-    "hash": "sha256:a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7...",
+    "hash": "sha256:a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8",
     "call_count": 1,
     "transcript_uri": "https://registry.agentrust.io/transcript/h100-2026-06-23T09:18:20Z"
   },
   "build_provenance": {
     "slsa_level": 2,
     "builder": "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml",
-    "digest": "sha256:c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9...",
-    "provenance_uri": "https://rekor.sigstore.dev/api/v1/log/entries/..."
+    "digest": "sha256:c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0",
+    "provenance_uri": "https://rekor.sigstore.dev/api/v1/log/entries/ghi789"
   },
   "appraisal": {
     "status": "affirming",
@@ -46,8 +45,8 @@
     "jwk": {
       "kty": "EC",
       "crv": "P-256",
-      "x": "SDEwMENvbmZpZGVudGlhbA...",
-      "y": "Q29tcHV0aW5nS2V5Rm9yVA...",
+      "x": "SDEwMENvbmZpZGVudGlhbA",
+      "y": "Q29tcHV0aW5nS2V5Rm9yVA",
       "kid": "h100-cc-workload-key-2026-06-23"
     }
   }

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentrust-trace"
-version = "0.1.0"
+version = "0.1.1"
 description = "TRACE v0.1 — hardware-attested governance records for AI agents"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/schema/trace-claim.json

@@ -53,7 +53,7 @@
         "weights_digest": {
           "type": "string",
           "description": "SHA-256 or SHA-384 digest of the model weights. Required for local/confidential-inference deployments.",
-          "pattern": "^sha(256|384):[0-9a-f]+"
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
         },
         "aibom_uri": {
           "type": "string",
@@ -78,14 +78,15 @@
             "aws-nitro",
             "arm-cca",
             "google-confidential-space",
-            "tpm2"
+            "tpm2",
+            "software-only"
           ],
-          "description": "Hardware platform providing the root of trust."
+          "description": "Hardware platform providing the root of trust. software-only marks development-mode records with no hardware backing; they must never be treated as attested evidence."
         },
         "measurement": {
           "type": "string",
           "description": "Hardware measurement of the workload (e.g. TDX MRTD, SEV measurement, TPM PCR composite).",
-          "pattern": "^sha(256|384):[0-9a-f]+"
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
         },
         "rim_uri": {
           "type": "string",
@@ -111,7 +112,7 @@
         "bundle_hash": {
           "type": "string",
           "description": "SHA-256 or SHA-384 digest of the policy bundle in force at execution time.",
-          "pattern": "^sha(256|384):[0-9a-f]+"
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
         },
         "enforcement_mode": {
           "type": "string",
@@ -143,7 +144,7 @@
         "hash": {
           "type": "string",
           "description": "SHA-256 or SHA-384 digest of the full tool-call transcript, bound into the EAT envelope.",
-          "pattern": "^sha(256|384):[0-9a-f]+"
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
         },
         "call_count": {
           "type": "integer",
@@ -176,7 +177,7 @@
         "digest": {
           "type": "string",
           "description": "SHA-256 or SHA-384 digest of the container image or workload binary.",
-          "pattern": "^sha(256|384):[0-9a-f]+"
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
         },
         "provenance_uri": {
           "type": "string",
@@ -225,7 +226,7 @@
       "properties": {
         "jwk": {
           "type": "object",
-          "description": "JWK (RFC 7517) representing the TEE-sealed public key.",
+          "description": "JWK (RFC 7517) representing the TEE-sealed public key. Keys must carry actual key material: OKP keys require crv and x; EC keys require crv, x, and y.",
           "required": ["kty"],
           "properties": {
             "kty": {"type": "string"},
@@ -233,10 +234,31 @@
             "x":   {"type": "string"},
             "y":   {"type": "string"},
             "kid": {"type": "string"}
-          }
+          },
+          "allOf": [
+            {
+              "if": {
+                "required": ["kty"],
+                "properties": {"kty": {"const": "OKP"}}
+              },
+              "then": {"required": ["crv", "x"]}
+            },
+            {
+              "if": {
+                "required": ["kty"],
+                "properties": {"kty": {"const": "EC"}}
+              },
+              "then": {"required": ["crv", "x", "y"]}
+            }
+          ]
         }
       },
       "additionalProperties": false
+    },
+    "signature": {
+      "type": "string",
+      "description": "OPTIONAL embedded signature: base64url (no padding) signature by the cnf key over the canonical JSON form of the record with this field absent. Every Trust Record MUST be signature-bound per spec section 3.2.2, but enveloped profiles (e.g. JWS, cMCP RuntimeClaim) carry the signature outside the record, so this field is not required by the schema.",
+      "pattern": "^[A-Za-z0-9_-]+$"
     }
   },
   "additionalProperties": false

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/spec/trace-v0.1.md

@@ -9,7 +9,7 @@
 | Reference implementation | [agentrust-io/cmcp](https://github.com/agentrust-io/cmcp) — Confidential MCP |
 | License | CC BY 4.0 |
 
-> **Note:** This is a pre-ratification draft. Fields, wire formats, and conformance requirements are subject to change before v1.0. Send feedback to: aaron@opaque.co or open an issue on this repository.
+> **Note:** This is a pre-ratification draft. Fields, wire formats, and conformance requirements are subject to change before v1.0. Send feedback to: open an issue on this repository.
 
 ---
 
@@ -44,7 +44,7 @@ The wall is not technical capability — it is evidence. AI builders today produ
 
 The result: every regulated AI deployment re-litigates trust at every host boundary. Each cloud, each model provider, each agent framework ships its own evidence shape. Auditors cannot compare. Verifiers cannot federate. Workloads cannot move.
 
-The EU AI Act enforces tamper-evident logging for high-risk AI in August 2026. Autonomous agents inside critical infrastructure are landing before the standard exists to govern them.
+The EU AI Act mandates tamper-evident logging for high-risk AI (Article 12); under the current provisional timeline those obligations apply from around December 2027. Frameworks already in force — DORA for financial entities, HIPAA for healthcare — carry equivalent audit-trail requirements today. Autonomous agents inside critical infrastructure are landing before the standard exists to govern them.
 
 ---
 
@@ -115,6 +115,7 @@ The Trust Record is the unit of evidence. All fields are required unless marked
 | `cnf` | Confirmation key — binds record to TEE-held signing key | EAT `cnf` claim (RFC 8747) |
 | `eat_profile` | Profile URI identifying this as a TRACE v0.1 record | EAT profile claim |
 | `iat` | Issued-at timestamp (Unix epoch) | EAT standard claim |
+| `signature` | OPTIONAL as a record field: embedded signature by the `cnf` key over the canonical record (section 3.2.2). Profiles using an enveloping signature (JWS, COSE, cMCP RuntimeClaim) omit this field and carry the signature in the envelope. The signature binding itself is mandatory either way. | JWS / COSE signature over canonical JSON |
 
 Each field is independently verifiable. Sub-records (e.g., per-tool-call transcripts) compose under one root envelope.
 
@@ -183,15 +184,30 @@ Each field is independently verifiable. Sub-records (e.g., per-tool-call transcr
 - **Revocation:** silicon-root revocation is consumed from existing vendor channels. Workload-level keys SHOULD rotate at TEE-image boundaries. Verifiers MUST consult current revocation status at verification time.
 - **Hash agility:** SHA-256 minimum; SHA-384 required for FIPS-aligned profiles. Algorithm signaled in the EAT envelope per RFC 9711 §6.
 
+#### 3.2.2 Mandatory signature and freshness binding
+
+**Signature binding.** Every TRACE Trust Record MUST be cryptographically bound by a signature over its canonical JSON form, made by the key in `cnf`. Canonicalization is RFC 8785 (JCS) unless the profile declares a different canonicalization. The signature MAY be either:
+
+- **Embedded:** carried in the record's top-level `signature` field (base64url, no padding), computed over the canonical form of the record with the `signature` field absent; or
+- **Enveloping:** carried by a signed wrapper structure, e.g. a JWS (RFC 7515) whose payload is the record, a COSE_Sign1 envelope, or cMCP's RuntimeClaim (signature over the canonical record, key in `trace.cnf.jwk`).
+
+Each profile MUST declare which binding form it uses. A record with no verifiable signature binding is not a Trust Record: verifiers MUST reject it. Schema validity alone confers no trust.
+
+**Freshness.** Records MUST carry `iat`. Verifiers MUST enforce a maximum record age: a record whose `iat` is older than the maximum age MUST be rejected. The default maximum age is 24 hours; a deployment profile MAY specify a different value. Verifiers SHOULD additionally support challenge-nonce binding for online verification: the verifier supplies a nonce, the issuer echoes it in `runtime.nonce`, and the verifier checks the echo. When a challenge nonce was issued, a record that omits or mismatches it MUST be rejected.
+
+**Conformance alignment.** The TRACE conformance suite (trace-tests) already enforces both rules: records without a verifiable signature fail at conformance level 1 and above, and the default 24-hour max-age is enforced.
+
 ### 3.3 Verification
 
 Any party — browser, CLI, in-cluster verifier, third-party auditor — verifies:
 
-1. Signature chain resolves to a known silicon root (NVIDIA, Intel, AMD, or equivalent).
-2. Runtime measurements match published Reference Integrity Manifests (RIMs).
-3. Policy hash matches the policy bundle the verifier expects.
-4. SCITT receipt resolves on the named transparency log.
-5. SLSA provenance resolves to a trusted builder.
+1. The record's signature binding (section 3.2.2) verifies against the key in `cnf`, BEFORE any other field is trusted. A record with no verifiable binding MUST be rejected.
+2. The record is fresh: `iat` is within the maximum age (default 24 hours unless the deployment profile specifies otherwise). If the verifier issued a challenge nonce, `runtime.nonce` echoes it.
+3. Signature chain resolves to a known silicon root (NVIDIA, Intel, AMD, or equivalent).
+4. Runtime measurements match published Reference Integrity Manifests (RIMs).
+5. Policy hash matches the policy bundle the verifier expects.
+6. SCITT receipt resolves on the named transparency log.
+7. SLSA provenance resolves to a trusted builder.
 
 No callback to the issuer. No vendor in the trust path beyond silicon root and transparency log operators.
 
@@ -270,7 +286,7 @@ TRACE will publish vendor-co-authored claim-mapping annexes — one per silicon-
 
 ## 5. Reference Implementation: Confidential MCP (cMCP)
 
-OPAQUE's reference build at the MCP tool-call boundary.
+the reference implementation at the MCP tool-call boundary.
 
 | Phase | What ships | TRACE fields | Timeline |
 |---|---|---|---|

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/src/agentrust_trace/models.py

@@ -2,9 +2,9 @@ from __future__ import annotations
 
 from typing import Annotated, Literal
 
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, Field, model_validator
 
-_DIGEST_RE = r"^sha(256|384):[0-9a-f]+"
+_DIGEST_RE = r"^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
 
 DigestStr = Annotated[str, Field(pattern=_DIGEST_RE)]
 
@@ -31,6 +31,10 @@ class RuntimeInfo(BaseModel):
         "arm-cca",
         "google-confidential-space",
         "tpm2",
+        # Development / non-attested mode. Distinct from tpm2 so a dev-mode
+        # record can never be mistaken for hardware-backed evidence by a
+        # consumer that only inspects runtime.platform.
+        "software-only",
     ]
     measurement: DigestStr
     rim_uri: str | None = None
@@ -83,6 +87,18 @@ class JWK(BaseModel):
     y: str | None = None
     kid: str | None = None
 
+    @model_validator(mode="after")
+    def _require_key_material(self) -> JWK:
+        """A confirmation key without key material binds nothing (RFC 7518 §6)."""
+        required_by_kty = {"OKP": ("crv", "x"), "EC": ("crv", "x", "y")}
+        required = required_by_kty.get(self.kty, ())
+        missing = [name for name in required if getattr(self, name) is None]
+        if missing:
+            raise ValueError(
+                f"jwk with kty={self.kty!r} must carry key material: missing {', '.join(missing)}"
+            )
+        return self
+
 
 class ConfirmationKey(BaseModel):
     model_config = ConfigDict(extra="forbid")
@@ -107,3 +123,8 @@ class TrustRecord(BaseModel):
     appraisal: Appraisal
     transparency: str
     cnf: ConfirmationKey
+    signature: Annotated[str, Field(pattern=r"^[A-Za-z0-9_-]+$")] | None = None
+    """Optional embedded signature (base64url, no padding) by the cnf key over the
+    canonical JSON form of the record with this field absent. Every Trust Record must
+    be signature-bound per spec section 3.2.2; enveloped profiles carry the signature
+    outside the record instead of in this field."""

{agentrust_trace-0.1.0 → agentrust_trace-0.1.1}/src/agentrust_trace/schema/trace-v0.1.json

@@ -53,7 +53,7 @@
         "weights_digest": {
           "type": "string",
           "description": "SHA-256 or SHA-384 digest of the model weights. Required for local/confidential-inference deployments.",
-          "pattern": "^sha(256|384):[0-9a-f]+"
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
         },
         "aibom_uri": {
           "type": "string",
@@ -78,14 +78,15 @@
             "aws-nitro",
             "arm-cca",
             "google-confidential-space",
-            "tpm2"
+            "tpm2",
+            "software-only"
           ],
-          "description": "Hardware platform providing the root of trust."
+          "description": "Hardware platform providing the root of trust. software-only marks development-mode records with no hardware backing; they must never be treated as attested evidence."
         },
         "measurement": {
           "type": "string",
           "description": "Hardware measurement of the workload (e.g. TDX MRTD, SEV measurement, TPM PCR composite).",
-          "pattern": "^sha(256|384):[0-9a-f]+"
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
         },
         "rim_uri": {
           "type": "string",
@@ -111,7 +112,7 @@
         "bundle_hash": {
           "type": "string",
           "description": "SHA-256 or SHA-384 digest of the policy bundle in force at execution time.",
-          "pattern": "^sha(256|384):[0-9a-f]+"
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
         },
         "enforcement_mode": {
           "type": "string",
@@ -143,7 +144,7 @@
         "hash": {
           "type": "string",
           "description": "SHA-256 or SHA-384 digest of the full tool-call transcript, bound into the EAT envelope.",
-          "pattern": "^sha(256|384):[0-9a-f]+"
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
         },
         "call_count": {
           "type": "integer",
@@ -176,7 +177,7 @@
         "digest": {
           "type": "string",
           "description": "SHA-256 or SHA-384 digest of the container image or workload binary.",
-          "pattern": "^sha(256|384):[0-9a-f]+"
+          "pattern": "^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$"
         },
         "provenance_uri": {
           "type": "string",
@@ -225,7 +226,7 @@
       "properties": {
         "jwk": {
           "type": "object",
-          "description": "JWK (RFC 7517) representing the TEE-sealed public key.",
+          "description": "JWK (RFC 7517) representing the TEE-sealed public key. Keys must carry actual key material: OKP keys require crv and x; EC keys require crv, x, and y.",
           "required": ["kty"],
           "properties": {
             "kty": {"type": "string"},
@@ -233,10 +234,31 @@
             "x":   {"type": "string"},
             "y":   {"type": "string"},
             "kid": {"type": "string"}
-          }
+          },
+          "allOf": [
+            {
+              "if": {
+                "required": ["kty"],
+                "properties": {"kty": {"const": "OKP"}}
+              },
+              "then": {"required": ["crv", "x"]}
+            },
+            {
+              "if": {
+                "required": ["kty"],
+                "properties": {"kty": {"const": "EC"}}
+              },
+              "then": {"required": ["crv", "x", "y"]}
+            }
+          ]
         }
       },
       "additionalProperties": false
+    },
+    "signature": {
+      "type": "string",
+      "description": "OPTIONAL embedded signature: base64url (no padding) signature by the cnf key over the canonical JSON form of the record with this field absent. Every Trust Record MUST be signature-bound per spec section 3.2.2, but enveloped profiles (e.g. JWS, cMCP RuntimeClaim) carry the signature outside the record, so this field is not required by the schema.",
+      "pattern": "^[A-Za-z0-9_-]+$"
     }
   },
   "additionalProperties": false

agentrust_trace-0.1.1/tests/test_models.py

@@ -0,0 +1,131 @@
+"""Parse all three canonical examples through TrustRecord."""
+
+import json
+from pathlib import Path
+
+import pytest
+from pydantic import ValidationError
+
+from agentrust_trace import TrustRecord
+
+EXAMPLES_DIR = Path(__file__).parent.parent / "examples"
+
+
+def _load(name: str) -> dict:
+    # Examples must validate exactly as published: no preprocessing.
+    return json.loads((EXAMPLES_DIR / name).read_text())
+
+
+@pytest.mark.parametrize("filename", ["intel-tdx.json", "amd-sev-snp.json", "nvidia-h100.json"])
+def test_example_parses(filename: str) -> None:
+    record = TrustRecord.model_validate(_load(filename))
+    assert record.eat_profile == "tag:agentrust.io,2026:trace-v0.1"
+    assert record.subject.startswith("spiffe://")
+
+
+def test_intel_tdx_fields() -> None:
+    record = TrustRecord.model_validate(_load("intel-tdx.json"))
+    assert record.runtime.platform == "intel-tdx"
+    assert record.policy.enforcement_mode == "enforce"
+    assert record.appraisal.status == "affirming"
+    assert record.tool_transcript is not None
+    assert record.tool_transcript.call_count == 7
+
+
+def test_extra_fields_rejected() -> None:
+    data = _load("intel-tdx.json")
+    data["unknown_field"] = "should fail"
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
+
+
+def test_missing_required_field_rejected() -> None:
+    data = _load("intel-tdx.json")
+    del data["cnf"]
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
+
+
+def test_bad_digest_rejected() -> None:
+    data = _load("intel-tdx.json")
+    data["runtime"]["measurement"] = "not-a-digest"
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
+
+
+def test_bad_platform_rejected() -> None:
+    data = _load("intel-tdx.json")
+    data["runtime"]["platform"] = "unknown-cloud"
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
+
+
+# CRYPTO-008 / CRYPTO-009: DigestStr regex enforcement
+
+def test_digest_uppercase_rejected() -> None:
+    """CRYPTO-008: uppercase hex must be rejected (sha256: is lowercase-only)."""
+    data = _load("intel-tdx.json")
+    data["runtime"]["measurement"] = "sha256:" + "A" * 64
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
+
+
+def test_digest_sha256_too_short_rejected() -> None:
+    """CRYPTO-008/009: sha256 digest shorter than 64 chars must be rejected."""
+    data = _load("intel-tdx.json")
+    data["runtime"]["measurement"] = "sha256:" + "a" * 63
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
+
+
+def test_digest_sha256_exact_length_accepted() -> None:
+    """sha256 digest with exactly 64 lowercase hex chars must be accepted."""
+    data = _load("intel-tdx.json")
+    data["runtime"]["measurement"] = "sha256:" + "a" * 64
+    record = TrustRecord.model_validate(data)
+    assert record.runtime.measurement == "sha256:" + "a" * 64
+
+
+def test_digest_sha384_exact_length_accepted() -> None:
+    """sha384 digest with exactly 96 lowercase hex chars must be accepted."""
+    data = _load("intel-tdx.json")
+    data["runtime"]["measurement"] = "sha384:" + "b" * 96
+    record = TrustRecord.model_validate(data)
+    assert record.runtime.measurement == "sha384:" + "b" * 96
+
+
+def test_digest_sha512_rejected() -> None:
+    """CRYPTO-009: unsupported algorithm sha512 must be rejected."""
+    data = _load("intel-tdx.json")
+    data["runtime"]["measurement"] = "sha512:" + "a" * 128
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
+
+
+# cnf.jwk key material enforcement
+
+
+def test_okp_jwk_without_key_material_rejected() -> None:
+    """An OKP confirmation key with no crv/x carries no key material and binds nothing."""
+    data = _load("intel-tdx.json")
+    data["cnf"]["jwk"] = {"kty": "OKP"}
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
+
+
+def test_ec_jwk_without_y_rejected() -> None:
+    data = _load("intel-tdx.json")
+    data["cnf"]["jwk"] = {"kty": "EC", "crv": "P-256", "x": "dGVzdA"}
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
+
+
+def test_okp_jwk_with_key_material_accepted() -> None:
+    data = _load("intel-tdx.json")
+    data["cnf"]["jwk"] = {
+        "kty": "OKP",
+        "crv": "Ed25519",
+        "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
+    }
+    record = TrustRecord.model_validate(data)
+    assert record.cnf.jwk.x is not None

agentrust_trace-0.1.1/tests/test_validate.py

@@ -0,0 +1,77 @@
+"""validate_json and iter_errors against canonical examples."""
+
+import json
+from pathlib import Path
+
+import pytest
+
+from agentrust_trace import SCHEMA, iter_errors, validate_json
+
+EXAMPLES_DIR = Path(__file__).parent.parent / "examples"
+
+
+def _load(name: str) -> dict:
+    # Examples must validate exactly as published: no preprocessing.
+    return json.loads((EXAMPLES_DIR / name).read_text())
+
+
+@pytest.mark.parametrize("filename", ["intel-tdx.json", "amd-sev-snp.json", "nvidia-h100.json"])
+def test_examples_pass_json_schema(filename: str) -> None:
+    validate_json(_load(filename))
+
+
+def test_iter_errors_empty_on_valid() -> None:
+    assert iter_errors(_load("intel-tdx.json")) == []
+
+
+def test_invalid_eat_profile_fails() -> None:
+    data = _load("intel-tdx.json")
+    data["eat_profile"] = "wrong-profile"
+    errors = iter_errors(data)
+    assert errors, "expected at least one schema error"
+
+
+def test_missing_required_field_fails() -> None:
+    data = _load("intel-tdx.json")
+    del data["subject"]
+    errors = iter_errors(data)
+    assert errors
+
+
+def test_schema_is_dict() -> None:
+    assert isinstance(SCHEMA, dict)
+    assert SCHEMA.get("title") == "TRACE Trust Record"
+
+
+def test_comment_key_fails() -> None:
+    """additionalProperties is false: a _comment key must be rejected, including in examples."""
+    data = _load("intel-tdx.json")
+    data["_comment"] = "human note"
+    errors = iter_errors(data)
+    assert errors
+
+
+def test_okp_jwk_without_key_material_fails() -> None:
+    """cnf.jwk must carry key material: OKP requires crv and x."""
+    data = _load("intel-tdx.json")
+    data["cnf"]["jwk"] = {"kty": "OKP"}
+    errors = iter_errors(data)
+    assert errors
+
+
+def test_ec_jwk_without_y_fails() -> None:
+    """cnf.jwk must carry key material: EC requires crv, x, and y."""
+    data = _load("intel-tdx.json")
+    data["cnf"]["jwk"] = {"kty": "EC", "crv": "P-256", "x": "dGVzdA"}
+    errors = iter_errors(data)
+    assert errors
+
+
+def test_okp_jwk_with_key_material_passes() -> None:
+    data = _load("intel-tdx.json")
+    data["cnf"]["jwk"] = {
+        "kty": "OKP",
+        "crv": "Ed25519",
+        "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo",
+    }
+    assert iter_errors(data) == []

agentrust_trace-0.1.0/tests/test_models.py

@@ -1,61 +0,0 @@
-"""Parse all three canonical examples through TrustRecord."""
-
-import json
-from pathlib import Path
-
-import pytest
-from pydantic import ValidationError
-
-from agentrust_trace import TrustRecord
-
-EXAMPLES_DIR = Path(__file__).parent.parent / "examples"
-
-
-def _load(name: str) -> dict:
-    data = json.loads((EXAMPLES_DIR / name).read_text())
-    data.pop("_comment", None)  # examples carry a human note; not part of the schema
-    return data
-
-
-@pytest.mark.parametrize("filename", ["intel-tdx.json", "amd-sev-snp.json", "nvidia-h100.json"])
-def test_example_parses(filename: str) -> None:
-    record = TrustRecord.model_validate(_load(filename))
-    assert record.eat_profile == "tag:agentrust.io,2026:trace-v0.1"
-    assert record.subject.startswith("spiffe://")
-
-
-def test_intel_tdx_fields() -> None:
-    record = TrustRecord.model_validate(_load("intel-tdx.json"))
-    assert record.runtime.platform == "intel-tdx"
-    assert record.policy.enforcement_mode == "enforce"
-    assert record.appraisal.status == "affirming"
-    assert record.tool_transcript is not None
-    assert record.tool_transcript.call_count == 7
-
-
-def test_extra_fields_rejected() -> None:
-    data = _load("intel-tdx.json")
-    data["unknown_field"] = "should fail"
-    with pytest.raises(ValidationError):
-        TrustRecord.model_validate(data)
-
-
-def test_missing_required_field_rejected() -> None:
-    data = _load("intel-tdx.json")
-    del data["cnf"]
-    with pytest.raises(ValidationError):
-        TrustRecord.model_validate(data)
-
-
-def test_bad_digest_rejected() -> None:
-    data = _load("intel-tdx.json")
-    data["runtime"]["measurement"] = "not-a-digest"
-    with pytest.raises(ValidationError):
-        TrustRecord.model_validate(data)
-
-
-def test_bad_platform_rejected() -> None:
-    data = _load("intel-tdx.json")
-    data["runtime"]["platform"] = "unknown-cloud"
-    with pytest.raises(ValidationError):
-        TrustRecord.model_validate(data)

agentrust_trace-0.1.0/tests/test_validate.py

@@ -1,44 +0,0 @@
-"""validate_json and iter_errors against canonical examples."""
-
-import json
-from pathlib import Path
-
-import pytest
-
-from agentrust_trace import SCHEMA, iter_errors, validate_json
-
-EXAMPLES_DIR = Path(__file__).parent.parent / "examples"
-
-
-def _load(name: str) -> dict:
-    data = json.loads((EXAMPLES_DIR / name).read_text())
-    data.pop("_comment", None)
-    return data
-
-
-@pytest.mark.parametrize("filename", ["intel-tdx.json", "amd-sev-snp.json", "nvidia-h100.json"])
-def test_examples_pass_json_schema(filename: str) -> None:
-    validate_json(_load(filename))
-
-
-def test_iter_errors_empty_on_valid() -> None:
-    assert iter_errors(_load("intel-tdx.json")) == []
-
-
-def test_invalid_eat_profile_fails() -> None:
-    data = _load("intel-tdx.json")
-    data["eat_profile"] = "wrong-profile"
-    errors = iter_errors(data)
-    assert errors, "expected at least one schema error"
-
-
-def test_missing_required_field_fails() -> None:
-    data = _load("intel-tdx.json")
-    del data["subject"]
-    errors = iter_errors(data)
-    assert errors
-
-
-def test_schema_is_dict() -> None:
-    assert isinstance(SCHEMA, dict)
-    assert SCHEMA.get("title") == "TRACE Trust Record"