agentrust-trace 0.1.0__tar.gz → 0.2.0__tar.gz

{agentrust_trace-0.1.0 → agentrust_trace-0.2.0}/.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
     branches: ["main", "feat/**", "fix/**"]
   pull_request:
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -15,7 +18,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v4
         with:
           python-version: ${{ matrix.python-version }}
 

agentrust_trace-0.2.0/.github/workflows/contributor-check.yml

@@ -0,0 +1,42 @@
+name: Contributor reputation check
+
+on:
+  pull_request_target:
+    types: [opened]
+  issues:
+    types: [opened]
+  workflow_dispatch:
+    inputs:
+      username:
+        description: GitHub username to check
+        required: true
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    if: |
+      github.actor != 'dependabot[bot]' &&
+      github.actor != 'github-actions[bot]' &&
+      github.actor != 'copilot-swe-agent[bot]' &&
+      github.actor != 'claude-code[bot]' &&
+      github.actor != 'imran-siddique'
+    steps:
+      - name: Checkout org action
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          repository: agentrust-io/.github
+          ref: main
+          persist-credentials: false
+          sparse-checkout: |
+            scripts
+            .github/actions/contributor-check
+
+      - name: Run contributor check
+        uses: ./.github/actions/contributor-check
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}

agentrust_trace-0.2.0/.github/workflows/docs.yml

@@ -0,0 +1,43 @@
+name: Docs
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - "spec/**"
+      - "mkdocs.yml"
+      - "requirements-docs.txt"
+      - "README.md"
+      - "CHANGELOG.md"
+      - "CONTRIBUTING.md"
+      - "GOVERNANCE.md"
+      - "ROADMAP.md"
+      - "LIMITATIONS.md"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  deploy:
+    name: Build and deploy docs
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Install docs dependencies
+        run: |
+          pip install -r requirements-docs.txt
+          pip install -e ".[dev]"
+
+      - name: Build and deploy to GitHub Pages
+        run: mkdocs gh-deploy --force --clean

{agentrust_trace-0.1.0 → agentrust_trace-0.2.0}/.github/workflows/publish.yml

@@ -9,13 +9,16 @@ permissions:
   contents: read
   id-token: write  # OIDC trusted publishing — no stored API token needed
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v4
         with:
           python-version: "3.11"
 

agentrust_trace-0.2.0/.github/workflows/require-maintainer-approval.yml

@@ -0,0 +1,84 @@
+name: Require maintainer approval
+
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+    branches: [main]
+  # Re-evaluate the gate when a review is submitted or dismissed so an
+  # approval clears the failing status without waiting for a new push.
+  # Note: pull_request_review does not support a branches filter, so the
+  # base-branch check lives in the job-level `if` below.
+  pull_request_review:
+    types: [submitted, dismissed]
+
+permissions:
+  contents: read
+  pull-requests: read
+  statuses: write
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    if: github.event.pull_request.base.ref == 'main'
+    steps:
+      - name: Check for maintainer approval
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const MAINTAINERS = ['imran-siddique'];
+
+            const author = context.payload.pull_request.user.login;
+            if (MAINTAINERS.includes(author)) {
+              core.info(`Author ${author} is a maintainer, skipping gate`);
+              return;
+            }
+
+            const association = context.payload.pull_request.author_association;
+            if (association === 'MEMBER' || association === 'OWNER') {
+              core.info(`Author is ${association}, skipping gate`);
+              return;
+            }
+
+            // Both pull_request_target and pull_request_review payloads
+            // carry the PR at context.payload.pull_request.
+            const prNumber = context.payload.pull_request.number;
+
+            // Re-fetch the PR so we compare against the head SHA at
+            // evaluation time, not a possibly stale SHA from the payload.
+            const { data: pr } = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+            const headSha = pr.head.sha;
+
+            // Paginate: listReviews otherwise returns only the first 30.
+            const reviews = await github.paginate(github.rest.pulls.listReviews, {
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+
+            // Only a maintainer's most recent non-comment review counts,
+            // and it must approve the current head commit. An approval of
+            // an older commit does not clear the gate after a later push
+            // (prevents approve-then-swap).
+            const latestByMaintainer = new Map();
+            for (const review of reviews) {
+              if (
+                review.user &&
+                review.user.type === 'User' &&
+                MAINTAINERS.includes(review.user.login) &&
+                review.state !== 'COMMENTED'
+              ) {
+                latestByMaintainer.set(review.user.login, review);
+              }
+            }
+
+            const approved = [...latestByMaintainer.values()].some(
+              (r) => r.state === 'APPROVED' && r.commit_id === headSha
+            );
+
+            if (!approved) {
+              core.setFailed('Waiting for maintainer approval of the current head commit before merging.');
+            }

agentrust_trace-0.2.0/.github/workflows/sbom.yml

@@ -0,0 +1,30 @@
+name: SBOM
+
+on:
+  push:
+    branches: [main]
+  release:
+    types: [published]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  sbom:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Generate SBOM
+        uses: anchore/sbom-action@v0
+        with:
+          format: spdx-json
+          output-file: sbom.spdx.json
+      - name: Upload SBOM artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom
+          path: sbom.spdx.json

agentrust_trace-0.2.0/ADOPTERS.md

@@ -0,0 +1,11 @@
+# ADOPTERS
+
+Organizations using or evaluating the TRACE specification.
+
+To add your organization, open a pull request editing this file.
+
+---
+
+| Organization | Usage |
+|---|---|
+| Opaque Systems | Founding contributor — developed the initial specification, reference implementation, and TRACE registry infrastructure |

agentrust_trace-0.2.0/ANTITRUST.md

@@ -0,0 +1,26 @@
+# Antitrust Policy
+
+TRACE is an open specification project hosted under the agentrust-io organization and targeting donation to the Agentic AI Foundation (AAIF) under the Linux Foundation. Participation in this project is subject to antitrust and competition laws.
+
+## Prohibited topics
+
+The following topics must not be discussed in any project forum, issue, PR, mailing list, meeting, or chat channel:
+
+- Prices, pricing strategies, or cost structures of any product or service
+- Market allocation, geographic territories, or customer segmentation
+- Bids, contracts, or terms with any customer or competitor
+- Whether to deal with, or boycott, any company or individual
+- Production volumes, capacity plans, or sales forecasts
+- Any other competitively sensitive business information
+
+## What is appropriate
+
+Project discussions must be limited to technical matters: specification design, cryptographic protocols, SDK implementation, conformance test coverage, and interoperability. Commercial decisions are for each organization to make independently.
+
+## Reporting
+
+If you observe discussion that appears to violate this policy, stop the discussion immediately and report it to the Project Lead via private GitHub message or email. Do not continue the discussion or document it further in project channels.
+
+## Questions
+
+If you are uncertain whether a topic is appropriate for project discussion, consult your organization's legal counsel before participating.

{agentrust_trace-0.1.0 → agentrust_trace-0.2.0}/CHANGELOG.md

@@ -39,6 +39,25 @@ Seven open questions requiring founding-member input before v0.2 are documented
 
 ---
 
+## [0.2.0] — TBD
+
+### Specification
+
+- Extend `subject` field to accept DID URIs (any `did:` method) in addition to SPIFFE SVIDs.
+  Previously `^spiffe://` only; now `^(spiffe://|did:)`. Additive, backward-compatible.
+  DID-native runtimes (e.g. AGT `did:mesh:` identities) no longer require a parallel SPIFFE identity.
+  Closes: microsoft/agent-governance-toolkit ADR-0032, agentrust-io/trace-spec#35.
+
+### Schema
+
+- `schema/trace-claim.json`: `subject` pattern updated to `^(spiffe://|did:)`, description updated.
+
+### Reference Implementation
+
+- `TrustRecord.subject` pattern updated to `r"^(spiffe://|did:)"`.
+
+---
+
 ## Upcoming
 
 See [ROADMAP.md](ROADMAP.md) for planned changes in v0.2 and v1.0.

{agentrust_trace-0.1.0 → agentrust_trace-0.2.0}/CHARTER.md

@@ -1,7 +1,9 @@
 # Technical Charter — TRACE
 
 **Proposed hosting**: CoSAI (Coalition for Secure AI) for the technical workstream; Linux Foundation entity hosting the Model Context Protocol for specification, IP, trademark, and conformance mark.  
-**Status**: Pre-acceptance draft — effective upon host organization acceptance.  
+**Status**: Pre-acceptance draft — effective upon host organization acceptance.
+
+> **Note for external contributors:** This charter is a working draft and has not yet been accepted by a host organization. Governance terms, IP policy, and conformance mark ownership described here are proposed, not final. Do not implement production systems based on governance commitments in this document until v1.0 ratification.  
 **Version**: 0.1 (aligned with spec v0.1)
 
 ---

agentrust_trace-0.2.0/LIMITATIONS.md

@@ -0,0 +1,55 @@
+# Known Limitations
+
+This document describes what TRACE does not do, and where layered defenses are needed. Honest scope boundaries prevent misplaced trust.
+
+## What a TRACE claim does not prevent
+
+**Operator-forged software-only records**
+A TRACE claim at Level 0 (software-only signing) is signed by a key held in software. A privileged operator with root access can produce a valid-looking Level 0 record for a run that never happened, or that violated policy. Level 0 is suitable for development and audit-trail tooling only — not for third-party verification.
+
+**Replay of a valid past record**
+A TRACE claim proves a specific run happened; it does not prevent a verifier from being shown a valid record from an earlier run. Verifiers that rely on recency must check the `iat` and `exp` claims, require nonce binding to a challenge, or anchor records to a public transparency log and check for freshness.
+
+**Policy correctness**
+The `policy.bundle_hash` field attests that a specific policy was in force at runtime. It does not attest that the policy achieves the intended security outcome. Policy review is a separate control.
+
+**What happened inside the model**
+The call transcript records tool invocations, arguments, and responses that are observable at the gateway boundary. It does not record the model's internal chain-of-thought, intermediate reasoning, or context window contents. Reasoning that influences behavior without producing a tool call is not captured.
+
+**Cross-boundary data propagation**
+The call graph summary uses temporal adjacency to approximate data flow between tool calls. It cannot definitively prove which specific data from one tool response influenced which subsequent call. The `provenance_disclaimer` field in every call graph summary is required for this reason.
+
+**TEE side-channel attacks**
+Hardware attestation proves the TRACE signing key and policy engine were measured in silicon before execution. It does not protect against side-channel attacks (cache timing, power analysis) targeting the TEE itself. TEE-level side-channel defense is the responsibility of the TEE platform vendor.
+
+**Revocation of the signing key after issuance**
+If the TRACE signing key is compromised after records are issued, existing records remain cryptographically valid. Key monitoring, rapid revocation, and transparency log integration are the required controls — TRACE provides the anchoring mechanism but cannot detect compromise itself.
+
+## What Level 0 does not provide
+
+Level 0 (software-only signing) is suitable for development, internal audit trails, and staging environments. It does not satisfy:
+
+- EU AI Act Art. 12 (tamper-evident logging) — requires Level 1+
+- DORA Art. 9 (ICT risk management) — requires Level 1+ with transparency log anchoring
+- Any claim of hardware-rooted trust — the signing key is held in software and can be extracted by a privileged operator
+
+## What the SDK does not do
+
+- **Evaluate Cedar policy** — the SDK includes the Cedar policy field in the claim; evaluation requires the Cedar engine (included in AGT or cMCP)
+- **Store or index records** — the SDK produces and verifies TRACE claim documents; storage, rotation, and retrieval are the caller's responsibility
+- **Anchor to a transparency log** — the SDK generates records suitable for SCITT anchoring; submission to a transparency log requires a separate SCITT client
+- **Replace a secrets manager** — signing private keys must be stored in a secrets manager (Azure Key Vault, AWS Secrets Manager, HSM); do not store them on disk without protection
+- **Provide an authoritative verification service** — the self-hosted verifier confirms cryptographic validity against the issuer's key; authoritative third-party verification with SLA is a separate commercial service
+
+## Performance
+
+Hardware attestation adds latency at the point of claim generation (not per-tool-call):
+
+| Provider | Typical claim signing latency |
+|---|---|
+| Software (Level 0) | < 1 ms |
+| TPM | 50–200 ms |
+| SEV-SNP | 10–50 ms |
+| TDX | 10–50 ms |
+
+Claim verification (signature check + schema validation) is < 5 ms in all cases.

agentrust_trace-0.2.0/NOTICE

@@ -0,0 +1,21 @@
+TRACE
+Copyright 2026 AgentTrust Authors
+
+This product includes software developed by the AgentTrust project
+(https://github.com/agentrust-io/trace-spec).
+
+---
+
+Third-party components used by the Python SDK:
+
+pydantic
+  License: MIT
+  https://github.com/pydantic/pydantic
+
+jsonschema
+  License: MIT
+  https://github.com/python-jsonschema/jsonschema
+
+jcs (dev dependency — RFC 8785 canonical JSON)
+  License: MIT
+  https://github.com/nicowillis/jcs

{agentrust_trace-0.1.0 → agentrust_trace-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentrust-trace
-Version: 0.1.0
+Version: 0.2.0
 Summary: TRACE v0.1 — hardware-attested governance records for AI agents
 Project-URL: Homepage, https://github.com/agentrust-io/trace-spec
 Project-URL: Repository, https://github.com/agentrust-io/trace-spec
@@ -8,6 +8,7 @@ Project-URL: Issues, https://github.com/agentrust-io/trace-spec/issues
 Project-URL: Changelog, https://github.com/agentrust-io/trace-spec/blob/main/CHANGELOG.md
 License: Apache-2.0
 License-File: LICENSE
+License-File: NOTICE
 Keywords: ai-governance,attestation,confidential-computing,eat,rats,tee,trace
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
@@ -19,6 +20,7 @@ Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Classifier: Topic :: Security
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
+Requires-Dist: cryptography>=42.0
 Requires-Dist: jsonschema>=4.20
 Requires-Dist: pydantic>=2.0
 Provides-Extra: dev
@@ -29,13 +31,29 @@ Requires-Dist: ruff>=0.4; extra == 'dev'
 Requires-Dist: types-jsonschema; extra == 'dev'
 Description-Content-Type: text/markdown
 
-<p align="center">
+<p align="center">
   <img src="docs/assets/icon.svg" width="96" height="96" alt="TRACE"/>
 </p>
 
-# TRACE — Trust Runtime Attestation and Compliance Evidence
+# TRACE: Trust Runtime Attestation and Compliance Evidence
+
+[![License: CC BY 4.0](https://img.shields.io/badge/License-CC_BY_4.0-lightgrey.svg)](LICENSE)
+[![AAIF](https://img.shields.io/badge/Targeting-AAIF_%2F_Linux_Foundation-6366f1)](https://agenticai.foundation)
+[![Spec](https://img.shields.io/badge/Spec-v0.2-0ea5e9)](spec/trace-v0.1.md)
+[![PyPI](https://img.shields.io/pypi/v/agentrust-trace)](https://pypi.org/project/agentrust-trace/)
+[![Discord](https://dcbadge.limes.pink/api/server/9JWNpH7E?style=flat)](https://discord.gg/9JWNpH7E)
+
+> **Developer Preview.** Launching at Confidential Computing Summit, June 23 2026. May have breaking changes before v1.0.
+
+<p align="center">
+  <a href="spec/trace-v0.1.md">Specification</a> &nbsp;|&nbsp;
+  <a href="schema/trace-claim.json">Schema</a> &nbsp;|&nbsp;
+  <a href="examples/">Examples</a> &nbsp;|&nbsp;
+  <a href="https://github.com/agentrust-io/trace-registry">Registry</a> &nbsp;|&nbsp;
+  <a href="https://github.com/agentrust-io/cmcp">Reference Impl</a>
+</p>
 
-An open specification for hardware-attested AI agent governance records. TRACE defines the format, anchoring protocol, and verification rules for cryptographically provable evidence that an AI agent ran under a specific policy, in a verified hardware environment, on classified data, invoking identified tools — bound into a single signed artifact rooted in silicon attestation.
+An open specification for hardware-attested AI agent governance records. TRACE defines the format, anchoring protocol, and verification rules for cryptographically provable evidence that an AI agent ran under a specific policy, in a verified hardware environment, on classified data, invoking identified tools, bound into a single signed artifact rooted in silicon attestation.
 
 ## What a TRACE Trust Record Is
 
@@ -43,7 +61,7 @@ An open specification for hardware-attested AI agent governance records. TRACE d
 {
   "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
   "iat": 1750676142,
-  "subject": "spiffe://trust.example.org/agent/payments-processor/prod",
+  "subject": "spiffe://trust.example.org/agent/payments-processor/prod",  // or "did:mesh:spiffe://..."
   "model": {
     "provider": "anthropic",
     "model_id": "claude-sonnet-4-6",
@@ -84,11 +102,21 @@ An open specification for hardware-attested AI agent governance records. TRACE d
 
 The record is a single EAT envelope (RFC 9711). Each field is independently verifiable. No callback to the issuer is required.
 
+### Supported platforms
+
+| Platform | v0.1 | v0.2 (planned) | Notes |
+|---|---|---|---|
+| `intel-tdx` | Yes | Yes | |
+| `amd-sev-snp` | Yes | Yes | |
+| `nvidia-h100` | Yes | Yes | |
+| `gpu-cc` | No | Planned | Generic GPU confidential compute |
+| `opaque` | Yes | Yes | Explicit opt-in; contact maintainers |
+
 ## Specification
 
-- [`spec/trace-v0.1.md`](spec/trace-v0.1.md) — full specification
-- [`schema/trace-claim.json`](schema/trace-claim.json) — JSON Schema
-- [`examples/`](examples/) — example Trust Records for Intel TDX, AMD SEV-SNP, and NVIDIA H100
+- [`spec/trace-v0.1.md`](spec/trace-v0.1.md) -- full specification
+- [`schema/trace-claim.json`](schema/trace-claim.json) -- JSON Schema
+- [`examples/`](examples/) -- example Trust Records for Intel TDX, AMD SEV-SNP, and NVIDIA H100
 
 ## Standards composition
 
@@ -98,7 +126,7 @@ TRACE profiles existing standards rather than replacing them:
 |---|---|
 | RATS / EAT (RFC 9711) | Wire envelope and claim model |
 | SLSA Provenance v1.0 | Build-time provenance (`build_provenance`) |
-| SPIFFE SVID | Workload identity (`subject`) |
+| SPIFFE SVID / DID URI | Workload identity (`subject`) |
 | SCITT | Append-only transparency anchoring (`transparency`) |
 | EAR (draft-ietf-rats-ar4si) | Verifier appraisal output (`appraisal`) |
 | MCP / A2A | Agent tool-call transcript surface (`tool_transcript`) |
@@ -106,15 +134,33 @@ TRACE profiles existing standards rather than replacing them:
 
 ## Reference implementation
 
-[agentrust-io/cmcp](https://github.com/agentrust-io/cmcp) — Confidential MCP Gateway. Hardware-attested policy enforcement at the MCP tool-call boundary on Intel TDX, AMD SEV-SNP, and NVIDIA H100/Blackwell.
+[agentrust-io/cmcp](https://github.com/agentrust-io/cmcp) -- Confidential MCP Runtime. Hardware-attested policy enforcement at the MCP tool-call boundary on Intel TDX, AMD SEV-SNP, and NVIDIA H100/Blackwell.
 
 ## Registry
 
 A public append-only Merkle registry of TRACE Trust Record anchors: [agentrust-io/trace-registry](https://github.com/agentrust-io/trace-registry).
 
+## Install
+
+```bash
+pip install agentrust-trace
+```
+
+```python
+from agentrust_trace import TrustRecord, sign_record, load_signing_key
+
+key = load_signing_key()  # reads TRACE_PRIVATE_KEY_PEM or generates ephemeral
+record = sign_record(payload, key)
+TrustRecord.model_validate(record)  # validate before writing
+```
+
 ## Status
 
-Draft v0.1 — publishing at Confidential Computing Summit, San Francisco, June 23 2026. Targeting submission to the [Agentic AI Foundation (AAIF)](https://agenticai.foundation) under the Linux Foundation.
+v0.2. `subject` now accepts DID URIs (`did:`) in addition to SPIFFE SVIDs. `slsa_level: 0` supported for software-only deployments. Published at Confidential Computing Summit, San Francisco, June 23 2026. Targeting submission to the [Agentic AI Foundation (AAIF)](https://agenticai.foundation) under the Linux Foundation.
+
+## Community
+
+Questions, feedback, integration help: [Discord](https://discord.gg/9JWNpH7E).
 
 ## License
 

agentrust_trace-0.2.0/README.md

@@ -0,0 +1,134 @@
+<p align="center">
+  <img src="docs/assets/icon.svg" width="96" height="96" alt="TRACE"/>
+</p>
+
+# TRACE: Trust Runtime Attestation and Compliance Evidence
+
+[![License: CC BY 4.0](https://img.shields.io/badge/License-CC_BY_4.0-lightgrey.svg)](LICENSE)
+[![AAIF](https://img.shields.io/badge/Targeting-AAIF_%2F_Linux_Foundation-6366f1)](https://agenticai.foundation)
+[![Spec](https://img.shields.io/badge/Spec-v0.2-0ea5e9)](spec/trace-v0.1.md)
+[![PyPI](https://img.shields.io/pypi/v/agentrust-trace)](https://pypi.org/project/agentrust-trace/)
+[![Discord](https://dcbadge.limes.pink/api/server/9JWNpH7E?style=flat)](https://discord.gg/9JWNpH7E)
+
+> **Developer Preview.** Launching at Confidential Computing Summit, June 23 2026. May have breaking changes before v1.0.
+
+<p align="center">
+  <a href="spec/trace-v0.1.md">Specification</a> &nbsp;|&nbsp;
+  <a href="schema/trace-claim.json">Schema</a> &nbsp;|&nbsp;
+  <a href="examples/">Examples</a> &nbsp;|&nbsp;
+  <a href="https://github.com/agentrust-io/trace-registry">Registry</a> &nbsp;|&nbsp;
+  <a href="https://github.com/agentrust-io/cmcp">Reference Impl</a>
+</p>
+
+An open specification for hardware-attested AI agent governance records. TRACE defines the format, anchoring protocol, and verification rules for cryptographically provable evidence that an AI agent ran under a specific policy, in a verified hardware environment, on classified data, invoking identified tools, bound into a single signed artifact rooted in silicon attestation.
+
+## What a TRACE Trust Record Is
+
+```json
+{
+  "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+  "iat": 1750676142,
+  "subject": "spiffe://trust.example.org/agent/payments-processor/prod",  // or "did:mesh:spiffe://..."
+  "model": {
+    "provider": "anthropic",
+    "model_id": "claude-sonnet-4-6",
+    "version": "20251001",
+    "weights_digest": "sha256:a3f8d2c1..."
+  },
+  "runtime": {
+    "platform": "amd-sev-snp",
+    "measurement": "sha384:c9e4b1d2e3f4...",
+    "rim_uri": "https://kdsintf.amd.com/vcek/v1/..."
+  },
+  "policy": {
+    "bundle_hash": "sha256:b2c3d4e5...",
+    "enforcement_mode": "enforce",
+    "version": "1.2.0"
+  },
+  "data_class": "confidential",
+  "tool_transcript": {
+    "hash": "sha256:d4e5f6a7...",
+    "call_count": 3
+  },
+  "build_provenance": {
+    "slsa_level": 2,
+    "builder": "https://github.com/slsa-framework/slsa-github-generator",
+    "digest": "sha256:e5f6a7b8..."
+  },
+  "appraisal": {
+    "status": "affirming",
+    "verifier": "https://trust-authority.example.org",
+    "policy_ref": "https://trust-authority.example.org/policy/agent-v1"
+  },
+  "transparency": "https://registry.agentrust.io/claim/trace-2026-06-23T09:15:42Z-f2a8d1",
+  "cnf": {
+    "jwk": {"kty": "EC", "crv": "P-256", "x": "MEkwEw...", "y": "..."}
+  }
+}
+```
+
+The record is a single EAT envelope (RFC 9711). Each field is independently verifiable. No callback to the issuer is required.
+
+### Supported platforms
+
+| Platform | v0.1 | v0.2 (planned) | Notes |
+|---|---|---|---|
+| `intel-tdx` | Yes | Yes | |
+| `amd-sev-snp` | Yes | Yes | |
+| `nvidia-h100` | Yes | Yes | |
+| `gpu-cc` | No | Planned | Generic GPU confidential compute |
+| `opaque` | Yes | Yes | Explicit opt-in; contact maintainers |
+
+## Specification
+
+- [`spec/trace-v0.1.md`](spec/trace-v0.1.md) -- full specification
+- [`schema/trace-claim.json`](schema/trace-claim.json) -- JSON Schema
+- [`examples/`](examples/) -- example Trust Records for Intel TDX, AMD SEV-SNP, and NVIDIA H100
+
+## Standards composition
+
+TRACE profiles existing standards rather than replacing them:
+
+| Primitive | Role in TRACE |
+|---|---|
+| RATS / EAT (RFC 9711) | Wire envelope and claim model |
+| SLSA Provenance v1.0 | Build-time provenance (`build_provenance`) |
+| SPIFFE SVID / DID URI | Workload identity (`subject`) |
+| SCITT | Append-only transparency anchoring (`transparency`) |
+| EAR (draft-ietf-rats-ar4si) | Verifier appraisal output (`appraisal`) |
+| MCP / A2A | Agent tool-call transcript surface (`tool_transcript`) |
+| AIBOM (SPDX 3.0 / CycloneDX 1.7) | Model component inventory (`model`) |
+
+## Reference implementation
+
+[agentrust-io/cmcp](https://github.com/agentrust-io/cmcp) -- Confidential MCP Runtime. Hardware-attested policy enforcement at the MCP tool-call boundary on Intel TDX, AMD SEV-SNP, and NVIDIA H100/Blackwell.
+
+## Registry
+
+A public append-only Merkle registry of TRACE Trust Record anchors: [agentrust-io/trace-registry](https://github.com/agentrust-io/trace-registry).
+
+## Install
+
+```bash
+pip install agentrust-trace
+```
+
+```python
+from agentrust_trace import TrustRecord, sign_record, load_signing_key
+
+key = load_signing_key()  # reads TRACE_PRIVATE_KEY_PEM or generates ephemeral
+record = sign_record(payload, key)
+TrustRecord.model_validate(record)  # validate before writing
+```
+
+## Status
+
+v0.2. `subject` now accepts DID URIs (`did:`) in addition to SPIFFE SVIDs. `slsa_level: 0` supported for software-only deployments. Published at Confidential Computing Summit, San Francisco, June 23 2026. Targeting submission to the [Agentic AI Foundation (AAIF)](https://agenticai.foundation) under the Linux Foundation.
+
+## Community
+
+Questions, feedback, integration help: [Discord](https://discord.gg/9JWNpH7E).
+
+## License
+
+Creative Commons Attribution 4.0 International (CC BY 4.0)