agentrust-trace 0.1.1__tar.gz → 0.2.0__tar.gz

agentrust_trace-0.2.0/.github/workflows/docs.yml

@@ -0,0 +1,43 @@
+name: Docs
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - "spec/**"
+      - "mkdocs.yml"
+      - "requirements-docs.txt"
+      - "README.md"
+      - "CHANGELOG.md"
+      - "CONTRIBUTING.md"
+      - "GOVERNANCE.md"
+      - "ROADMAP.md"
+      - "LIMITATIONS.md"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  deploy:
+    name: Build and deploy docs
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+          cache: pip
+
+      - name: Install docs dependencies
+        run: |
+          pip install -r requirements-docs.txt
+          pip install -e ".[dev]"
+
+      - name: Build and deploy to GitHub Pages
+        run: mkdocs gh-deploy --force --clean

agentrust_trace-0.2.0/ANTITRUST.md

@@ -0,0 +1,26 @@
+# Antitrust Policy
+
+TRACE is an open specification project hosted under the agentrust-io organization and targeting donation to the Agentic AI Foundation (AAIF) under the Linux Foundation. Participation in this project is subject to antitrust and competition laws.
+
+## Prohibited topics
+
+The following topics must not be discussed in any project forum, issue, PR, mailing list, meeting, or chat channel:
+
+- Prices, pricing strategies, or cost structures of any product or service
+- Market allocation, geographic territories, or customer segmentation
+- Bids, contracts, or terms with any customer or competitor
+- Whether to deal with, or boycott, any company or individual
+- Production volumes, capacity plans, or sales forecasts
+- Any other competitively sensitive business information
+
+## What is appropriate
+
+Project discussions must be limited to technical matters: specification design, cryptographic protocols, SDK implementation, conformance test coverage, and interoperability. Commercial decisions are for each organization to make independently.
+
+## Reporting
+
+If you observe discussion that appears to violate this policy, stop the discussion immediately and report it to the Project Lead via private GitHub message or email. Do not continue the discussion or document it further in project channels.
+
+## Questions
+
+If you are uncertain whether a topic is appropriate for project discussion, consult your organization's legal counsel before participating.

{agentrust_trace-0.1.1 → agentrust_trace-0.2.0}/CHANGELOG.md

@@ -39,6 +39,25 @@ Seven open questions requiring founding-member input before v0.2 are documented
 
 ---
 
+## [0.2.0] — TBD
+
+### Specification
+
+- Extend `subject` field to accept DID URIs (any `did:` method) in addition to SPIFFE SVIDs.
+  Previously `^spiffe://` only; now `^(spiffe://|did:)`. Additive, backward-compatible.
+  DID-native runtimes (e.g. AGT `did:mesh:` identities) no longer require a parallel SPIFFE identity.
+  Closes: microsoft/agent-governance-toolkit ADR-0032, agentrust-io/trace-spec#35.
+
+### Schema
+
+- `schema/trace-claim.json`: `subject` pattern updated to `^(spiffe://|did:)`, description updated.
+
+### Reference Implementation
+
+- `TrustRecord.subject` pattern updated to `r"^(spiffe://|did:)"`.
+
+---
+
 ## Upcoming
 
 See [ROADMAP.md](ROADMAP.md) for planned changes in v0.2 and v1.0.

agentrust_trace-0.2.0/LIMITATIONS.md

@@ -0,0 +1,55 @@
+# Known Limitations
+
+This document describes what TRACE does not do, and where layered defenses are needed. Honest scope boundaries prevent misplaced trust.
+
+## What a TRACE claim does not prevent
+
+**Operator-forged software-only records**
+A TRACE claim at Level 0 (software-only signing) is signed by a key held in software. A privileged operator with root access can produce a valid-looking Level 0 record for a run that never happened, or that violated policy. Level 0 is suitable for development and audit-trail tooling only — not for third-party verification.
+
+**Replay of a valid past record**
+A TRACE claim proves a specific run happened; it does not prevent a verifier from being shown a valid record from an earlier run. Verifiers that rely on recency must check the `iat` and `exp` claims, require nonce binding to a challenge, or anchor records to a public transparency log and check for freshness.
+
+**Policy correctness**
+The `policy.bundle_hash` field attests that a specific policy was in force at runtime. It does not attest that the policy achieves the intended security outcome. Policy review is a separate control.
+
+**What happened inside the model**
+The call transcript records tool invocations, arguments, and responses that are observable at the gateway boundary. It does not record the model's internal chain-of-thought, intermediate reasoning, or context window contents. Reasoning that influences behavior without producing a tool call is not captured.
+
+**Cross-boundary data propagation**
+The call graph summary uses temporal adjacency to approximate data flow between tool calls. It cannot definitively prove which specific data from one tool response influenced which subsequent call. The `provenance_disclaimer` field in every call graph summary is required for this reason.
+
+**TEE side-channel attacks**
+Hardware attestation proves the TRACE signing key and policy engine were measured in silicon before execution. It does not protect against side-channel attacks (cache timing, power analysis) targeting the TEE itself. TEE-level side-channel defense is the responsibility of the TEE platform vendor.
+
+**Revocation of the signing key after issuance**
+If the TRACE signing key is compromised after records are issued, existing records remain cryptographically valid. Key monitoring, rapid revocation, and transparency log integration are the required controls — TRACE provides the anchoring mechanism but cannot detect compromise itself.
+
+## What Level 0 does not provide
+
+Level 0 (software-only signing) is suitable for development, internal audit trails, and staging environments. It does not satisfy:
+
+- EU AI Act Art. 12 (tamper-evident logging) — requires Level 1+
+- DORA Art. 9 (ICT risk management) — requires Level 1+ with transparency log anchoring
+- Any claim of hardware-rooted trust — the signing key is held in software and can be extracted by a privileged operator
+
+## What the SDK does not do
+
+- **Evaluate Cedar policy** — the SDK includes the Cedar policy field in the claim; evaluation requires the Cedar engine (included in AGT or cMCP)
+- **Store or index records** — the SDK produces and verifies TRACE claim documents; storage, rotation, and retrieval are the caller's responsibility
+- **Anchor to a transparency log** — the SDK generates records suitable for SCITT anchoring; submission to a transparency log requires a separate SCITT client
+- **Replace a secrets manager** — signing private keys must be stored in a secrets manager (Azure Key Vault, AWS Secrets Manager, HSM); do not store them on disk without protection
+- **Provide an authoritative verification service** — the self-hosted verifier confirms cryptographic validity against the issuer's key; authoritative third-party verification with SLA is a separate commercial service
+
+## Performance
+
+Hardware attestation adds latency at the point of claim generation (not per-tool-call):
+
+| Provider | Typical claim signing latency |
+|---|---|
+| Software (Level 0) | < 1 ms |
+| TPM | 50–200 ms |
+| SEV-SNP | 10–50 ms |
+| TDX | 10–50 ms |
+
+Claim verification (signature check + schema validation) is < 5 ms in all cases.

agentrust_trace-0.2.0/NOTICE

@@ -0,0 +1,21 @@
+TRACE
+Copyright 2026 AgentTrust Authors
+
+This product includes software developed by the AgentTrust project
+(https://github.com/agentrust-io/trace-spec).
+
+---
+
+Third-party components used by the Python SDK:
+
+pydantic
+  License: MIT
+  https://github.com/pydantic/pydantic
+
+jsonschema
+  License: MIT
+  https://github.com/python-jsonschema/jsonschema
+
+jcs (dev dependency — RFC 8785 canonical JSON)
+  License: MIT
+  https://github.com/nicowillis/jcs

{agentrust_trace-0.1.1 → agentrust_trace-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentrust-trace
-Version: 0.1.1
+Version: 0.2.0
 Summary: TRACE v0.1 — hardware-attested governance records for AI agents
 Project-URL: Homepage, https://github.com/agentrust-io/trace-spec
 Project-URL: Repository, https://github.com/agentrust-io/trace-spec
@@ -8,6 +8,7 @@ Project-URL: Issues, https://github.com/agentrust-io/trace-spec/issues
 Project-URL: Changelog, https://github.com/agentrust-io/trace-spec/blob/main/CHANGELOG.md
 License: Apache-2.0
 License-File: LICENSE
+License-File: NOTICE
 Keywords: ai-governance,attestation,confidential-computing,eat,rats,tee,trace
 Classifier: Development Status :: 3 - Alpha
 Classifier: Intended Audience :: Developers
@@ -19,6 +20,7 @@ Classifier: Topic :: Scientific/Engineering :: Artificial Intelligence
 Classifier: Topic :: Security
 Classifier: Typing :: Typed
 Requires-Python: >=3.11
+Requires-Dist: cryptography>=42.0
 Requires-Dist: jsonschema>=4.20
 Requires-Dist: pydantic>=2.0
 Provides-Extra: dev
@@ -37,7 +39,9 @@ Description-Content-Type: text/markdown
 
 [![License: CC BY 4.0](https://img.shields.io/badge/License-CC_BY_4.0-lightgrey.svg)](LICENSE)
 [![AAIF](https://img.shields.io/badge/Targeting-AAIF_%2F_Linux_Foundation-6366f1)](https://agenticai.foundation)
-[![Spec](https://img.shields.io/badge/Spec-v0.1-0ea5e9)](spec/trace-v0.1.md)
+[![Spec](https://img.shields.io/badge/Spec-v0.2-0ea5e9)](spec/trace-v0.1.md)
+[![PyPI](https://img.shields.io/pypi/v/agentrust-trace)](https://pypi.org/project/agentrust-trace/)
+[![Discord](https://dcbadge.limes.pink/api/server/9JWNpH7E?style=flat)](https://discord.gg/9JWNpH7E)
 
 > **Developer Preview.** Launching at Confidential Computing Summit, June 23 2026. May have breaking changes before v1.0.
 
@@ -57,7 +61,7 @@ An open specification for hardware-attested AI agent governance records. TRACE d
 {
   "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
   "iat": 1750676142,
-  "subject": "spiffe://trust.example.org/agent/payments-processor/prod",
+  "subject": "spiffe://trust.example.org/agent/payments-processor/prod",  // or "did:mesh:spiffe://..."
   "model": {
     "provider": "anthropic",
     "model_id": "claude-sonnet-4-6",
@@ -122,7 +126,7 @@ TRACE profiles existing standards rather than replacing them:
 |---|---|
 | RATS / EAT (RFC 9711) | Wire envelope and claim model |
 | SLSA Provenance v1.0 | Build-time provenance (`build_provenance`) |
-| SPIFFE SVID | Workload identity (`subject`) |
+| SPIFFE SVID / DID URI | Workload identity (`subject`) |
 | SCITT | Append-only transparency anchoring (`transparency`) |
 | EAR (draft-ietf-rats-ar4si) | Verifier appraisal output (`appraisal`) |
 | MCP / A2A | Agent tool-call transcript surface (`tool_transcript`) |
@@ -136,9 +140,27 @@ TRACE profiles existing standards rather than replacing them:
 
 A public append-only Merkle registry of TRACE Trust Record anchors: [agentrust-io/trace-registry](https://github.com/agentrust-io/trace-registry).
 
+## Install
+
+```bash
+pip install agentrust-trace
+```
+
+```python
+from agentrust_trace import TrustRecord, sign_record, load_signing_key
+
+key = load_signing_key()  # reads TRACE_PRIVATE_KEY_PEM or generates ephemeral
+record = sign_record(payload, key)
+TrustRecord.model_validate(record)  # validate before writing
+```
+
 ## Status
 
-Draft v0.1. Publishing at Confidential Computing Summit, San Francisco, June 23 2026. Targeting submission to the [Agentic AI Foundation (AAIF)](https://agenticai.foundation) under the Linux Foundation.
+v0.2. `subject` now accepts DID URIs (`did:`) in addition to SPIFFE SVIDs. `slsa_level: 0` supported for software-only deployments. Published at Confidential Computing Summit, San Francisco, June 23 2026. Targeting submission to the [Agentic AI Foundation (AAIF)](https://agenticai.foundation) under the Linux Foundation.
+
+## Community
+
+Questions, feedback, integration help: [Discord](https://discord.gg/9JWNpH7E).
 
 ## License
 

{agentrust_trace-0.1.1 → agentrust_trace-0.2.0}/README.md

@@ -6,7 +6,9 @@
 
 [![License: CC BY 4.0](https://img.shields.io/badge/License-CC_BY_4.0-lightgrey.svg)](LICENSE)
 [![AAIF](https://img.shields.io/badge/Targeting-AAIF_%2F_Linux_Foundation-6366f1)](https://agenticai.foundation)
-[![Spec](https://img.shields.io/badge/Spec-v0.1-0ea5e9)](spec/trace-v0.1.md)
+[![Spec](https://img.shields.io/badge/Spec-v0.2-0ea5e9)](spec/trace-v0.1.md)
+[![PyPI](https://img.shields.io/pypi/v/agentrust-trace)](https://pypi.org/project/agentrust-trace/)
+[![Discord](https://dcbadge.limes.pink/api/server/9JWNpH7E?style=flat)](https://discord.gg/9JWNpH7E)
 
 > **Developer Preview.** Launching at Confidential Computing Summit, June 23 2026. May have breaking changes before v1.0.
 
@@ -26,7 +28,7 @@ An open specification for hardware-attested AI agent governance records. TRACE d
 {
   "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
   "iat": 1750676142,
-  "subject": "spiffe://trust.example.org/agent/payments-processor/prod",
+  "subject": "spiffe://trust.example.org/agent/payments-processor/prod",  // or "did:mesh:spiffe://..."
   "model": {
     "provider": "anthropic",
     "model_id": "claude-sonnet-4-6",
@@ -91,7 +93,7 @@ TRACE profiles existing standards rather than replacing them:
 |---|---|
 | RATS / EAT (RFC 9711) | Wire envelope and claim model |
 | SLSA Provenance v1.0 | Build-time provenance (`build_provenance`) |
-| SPIFFE SVID | Workload identity (`subject`) |
+| SPIFFE SVID / DID URI | Workload identity (`subject`) |
 | SCITT | Append-only transparency anchoring (`transparency`) |
 | EAR (draft-ietf-rats-ar4si) | Verifier appraisal output (`appraisal`) |
 | MCP / A2A | Agent tool-call transcript surface (`tool_transcript`) |
@@ -105,9 +107,27 @@ TRACE profiles existing standards rather than replacing them:
 
 A public append-only Merkle registry of TRACE Trust Record anchors: [agentrust-io/trace-registry](https://github.com/agentrust-io/trace-registry).
 
+## Install
+
+```bash
+pip install agentrust-trace
+```
+
+```python
+from agentrust_trace import TrustRecord, sign_record, load_signing_key
+
+key = load_signing_key()  # reads TRACE_PRIVATE_KEY_PEM or generates ephemeral
+record = sign_record(payload, key)
+TrustRecord.model_validate(record)  # validate before writing
+```
+
 ## Status
 
-Draft v0.1. Publishing at Confidential Computing Summit, San Francisco, June 23 2026. Targeting submission to the [Agentic AI Foundation (AAIF)](https://agenticai.foundation) under the Linux Foundation.
+v0.2. `subject` now accepts DID URIs (`did:`) in addition to SPIFFE SVIDs. `slsa_level: 0` supported for software-only deployments. Published at Confidential Computing Summit, San Francisco, June 23 2026. Targeting submission to the [Agentic AI Foundation (AAIF)](https://agenticai.foundation) under the Linux Foundation.
+
+## Community
+
+Questions, feedback, integration help: [Discord](https://discord.gg/9JWNpH7E).
 
 ## License
 

agentrust_trace-0.2.0/docs/crosswalks/owasp-agentic-top-10.md

@@ -0,0 +1,65 @@
+# OWASP Agentic AI Top 10 Evidence Cross-walk
+
+> **Non-normative.** This document is informative only. Nothing here changes TRACE v0.1 schema fields, wire formats, required claims, or conformance requirements. References to "TRACE" mean the TRACE v0.1 Trust Record as defined in [`spec/trace-v0.1.md`](../../spec/trace-v0.1.md).
+
+---
+
+## Purpose
+
+OWASP's Agentic AI Top 10 (ASI01–ASI10) names the principal risk categories for autonomous AI agents. TRACE is an evidence and attestation layer: it does not prevent these risks, but it produces verifiable, hardware-rooted records that support audit, incident review, and governance verification after or during execution.
+
+This page answers a concrete question for each OWASP risk: which TRACE Trust Record claims carry relevant evidence, what that evidence actually proves, and where TRACE v0.1 leaves a gap that a future profile would need to close.
+
+Field names are exact TRACE v0.1 claim names as specified in §3.1 of the spec. Sub-field references such as `policy.bundle_hash`, `runtime.platform`, and `appraisal.status` refer to the nested fields shown in the §3.2 wire-format example.
+
+---
+
+## Mapping table
+
+| OWASP risk | Relevant TRACE claims | Evidence TRACE can provide | Limitations / out of scope | Future TRACE profile need |
+|---|---|---|---|---|
+| **ASI01: Agent Goal Hijack** | `policy`, `tool_transcript`, `data_class`, `runtime`, `transparency` | `policy.bundle_hash` shows which policy was bound at execution time; `policy.enforcement_mode` shows whether it ran in `enforce` or `silent`; `tool_transcript.hash` and `tool_transcript.call_count` show the scope of tool activity; `data_class` shows the sensitivity of data processed; `transparency` anchors the record to an append-only log for independent audit. | Does not capture the agent's internal goal representation or reasoning chain. Does not itself detect or block prompt injection. A hijacked goal that stays within recorded tool boundaries leaves no additional fingerprint in v0.1 claims. | MCP/A2A profile fields for intent binding, goal hash, prompt-to-plan linkage, and per-decision policy outcome records. |
+| **ASI02: Tool Misuse and Exploitation** | `tool_transcript`, `policy`, `data_class`, `runtime`, `transparency` | `tool_transcript.hash` binds the transcript of tool invocations crossing a protocol boundary (MCP, A2A) into the signed record; `tool_transcript.call_count` bounds the observed call volume; `policy.bundle_hash` and `policy.enforcement_mode` show what rules were in force; `data_class` shows the sensitivity classification applied at the call layer; `runtime.platform` and `runtime.measurement` bind the execution environment. | `tool_transcript` covers calls crossing an instrumented protocol boundary. Functions embedded inside the deployed binary are bound only by `build_provenance` and `model`, not by per-invocation transcript records. Does not prove each call was semantically appropriate without per-call policy decision records. | MCP profile for per-call tool identity, parameters, egress data class, and allow/deny decision outcome per invocation. |
+| **ASI03: Identity and Privilege Abuse** | `subject`, `cnf`, `signature`, `runtime`, `policy`, `appraisal` | `subject` carries the SPIFFE SVID binding workload identity to a TEE-held key; `cnf` binds the signing key to the TEE via the hardware measurement in `runtime`; `appraisal.status` records the verifier's judgment of the evidence against policy; `policy.bundle_hash` shows what authorization rules were bound. Together these allow a verifier to confirm that the claimed identity corresponded to a genuine, measured workload at record issuance time. | Does not replace IAM or RBAC systems. Does not prove that external permissions granted to the workload were correctly scoped. Does not cover lateral movement or privilege escalation that occurred at infrastructure layers outside the TEE boundary. | Delegation profile fields for scoped credentials, audience restriction, purpose binding, and per-action authorization evidence. |
+| **ASI04: Agentic Supply Chain Vulnerabilities** | `build_provenance`, `model`, `runtime`, `transparency`, `appraisal` | `build_provenance.slsa_level`, `build_provenance.builder`, and `build_provenance.digest` bind build-time provenance to the running workload; `model.weights_digest` and `model.model_id` bind the model artifact; `runtime.measurement` and `runtime.rim_uri` bind the runtime image to vendor-published Reference Integrity Manifests; `transparency` provides an append-only anchor for the full record. | Does not enumerate every transitive dependency. Does not detect malicious code that was present at build time but is not reflected in measurement divergence. Does not prove model behavior is safe -- only that the identified artifact was the one that executed. | Richer AIBOM/SBOM linkage in the `model` sub-claim; vendor platform annexes specifying per-silicon supply-chain appraisal criteria. |
+| **ASI05: Unexpected Code Execution** | `runtime`, `build_provenance`, `tool_transcript`, `policy`, `appraisal` | `runtime.measurement` shows what workload and container digest were loaded; `build_provenance.digest` and `build_provenance.slsa_level` bind the build artifact; `tool_transcript.hash` captures tool invocations at protocol boundaries; `appraisal.status` records whether the verifier accepted the runtime evidence against current RIMs. | Does not prevent code execution. Does not prove no code ran outside the recorded `tool_transcript` scope: inline code execution embedded in the workload binary is not captured at invocation granularity by v0.1 claims. | Tool and code-execution profile: sandbox identity, command execution transcript hash, filesystem and network boundary evidence per invocation. |
+| **ASI06: Memory and Context Poisoning** | `model`, `data_class`, `tool_transcript`, `build_provenance`, `transparency` | `model.model_id` and `model.weights_digest` identify the model artifact; `data_class` records the sensitivity classification applied to inputs and outputs; `tool_transcript.hash` captures context-retrieval calls that crossed an instrumented boundary; `build_provenance.digest` binds the build artifact that includes any vector-store or RAG client code. | TRACE v0.1 does not bind memory snapshots, RAG corpus roots, embedding-store contents, or poisoning scan results. Context provenance -- where retrieved chunks originated and whether they were validated -- is not a v0.1 claim. | Memory and RAG profile: context source hashes, corpus Merkle roots, poisoning scan status, namespace and tenant boundary evidence. |
+| **ASI07: Insecure Inter-Agent Communication** | `subject`, `cnf`, `signature`, `runtime`, `tool_transcript`, `transparency` | `subject` and `cnf` establish and bind workload identity for each participating agent; `signature` (or the enveloping-signature equivalent) proves record integrity; `runtime.measurement` binds the TEE that produced the record; `tool_transcript.hash` anchors the inter-agent call transcript; `transparency` anchors the record in an append-only log accessible to any verifier. | TRACE v0.1 does not define a normative A2A profile. Message-level semantic validation, nonce binding per message, and delegation chain records across multiple hops are not v0.1 claims. | A2A profile: peer agent identity, per-message hash, audience restriction, nonce, delegation chain, and protocol version binding. |
+| **ASI08: Cascading Failures** | `tool_transcript`, `transparency`, `subject`, `appraisal`, `policy` | `tool_transcript.hash` and `tool_transcript.call_count` provide a bounded activity record for post-incident traceability; `subject` identifies the workload at each hop where a Trust Record was issued; `appraisal.status` and `appraisal.verifier` record the verification outcome; `policy.bundle_hash` shows what controls were bound; `transparency` provides an auditable anchor for reconstructing the sequence of records. | Does not itself detect cascade conditions, stop propagation, or reconstruct full multi-agent lineage unless every participating agent issued Trust Records and those records are correlated at analysis time. Lineage reconstruction requires out-of-band tooling. | Workflow provenance profile: parent/child record references, propagation lineage identifiers, blast-radius counters, and circuit-breaker event records. |
+| **ASI09: Human-Agent Trust Exploitation** | `tool_transcript`, `policy`, `data_class`, `transparency`, `appraisal` | `tool_transcript.hash` records the set of actions the agent took at protocol boundaries; `policy.bundle_hash` and `policy.enforcement_mode` show what rules were in force; `data_class` records the sensitivity class of data involved; `appraisal.status` provides the verifier's assessment; `transparency` anchors the record for independent audit. Collectively these support a post-incident review of what the agent was authorized to do and what it did. | Does not prove what a human was shown in the UI, whether the explanation was accurate, or whether informed consent was obtained. Does not detect social engineering at the human layer. | HITL (human-in-the-loop) evidence profile: approval record, reviewer identity, hash of displayed risk summary, and human decision evidence bound into the Trust Record. |
+| **ASI10: Rogue Agents** | `subject`, `runtime`, `cnf`, `signature`, `policy`, `tool_transcript`, `appraisal`, `transparency` | The full v0.1 claim set combines hardware-bound identity (`subject`, `cnf`), measured execution environment (`runtime`), policy binding (`policy.bundle_hash`, `policy.enforcement_mode`), tool activity (`tool_transcript`), verifier judgment (`appraisal.status`), and transparency anchoring (`transparency`) into one signed, independently verifiable record. A verifier can confirm that the agent presenting this record ran as a measured, policy-bound workload with a TEE-rooted identity at the stated time. | Does not determine behavioral intent. Does not detect rogue behavior that remained within the boundary of recorded claims. A workload can issue a valid Trust Record and still behave in ways the record does not constrain at inference time. | Behavioral integrity profile: declared capability manifest hash, expected tool set, execution baseline hash, and anomaly or quarantine event records. |
+
+---
+
+## What TRACE does not do
+
+The table above surfaces per-risk scope boundaries. These apply across all ten risks:
+
+**TRACE does not prevent OWASP Agentic AI risks.** TRACE is an evidence and attestation layer. It records what happened -- what executed, under what policy, in what environment, on what data class, invoking what tools -- and binds that record cryptographically to a hardware root of trust. Controls that act before, during, or around execution (firewalls, guardrails, RBAC, prompt filters, sandboxing) are out of scope.
+
+**TRACE does not adjudicate model behavior.** As stated in §2.4 of the spec, prompt injection, jailbreaks, hallucination, and alignment drift are permanent scope boundaries. TRACE proves what model artifact executed and what countermeasures were bound; it does not evaluate whether the model's output was correct or intended.
+
+**TRACE v0.1 does not cover intra-binary execution.** `tool_transcript` captures invocations crossing an instrumented protocol boundary (MCP, A2A, or equivalent). Code paths executed inside the deployed binary -- including embedded tool dispatch, in-process memory reads, or direct API calls -- are bound only by `build_provenance` and `model`, not at invocation granularity.
+
+**TRACE does not replace IAM, RBAC, or network controls.** `subject` and `cnf` establish and bind workload identity, but the permissions granted to that identity by external systems are outside the Trust Record. A correctly identified workload can still hold excessive privileges.
+
+**TRACE does not capture UI or human-layer interactions.** What a human sees, approves, or consents to is not a v0.1 claim. This affects ASI09 directly and is a gap for any risk that involves human oversight.
+
+**TRACE does not reconstruct multi-agent lineage automatically.** Records from multiple agents can be correlated by a verifier using `subject`, `transparency`, and `tool_transcript` identifiers, but the v0.1 schema has no normative parent/child record pointer. Lineage reconstruction requires out-of-band analysis tooling and is addressed in the v0.2 workflow provenance profile item.
+
+---
+
+## Relationship to the TRACE roadmap
+
+This cross-walk is a v0.2 roadmap item listed in [`ROADMAP.md`](../../ROADMAP.md). The "Future TRACE profile need" column in the table above describes the additional claim structures that would close each gap; those profiles are separate roadmap items and will be specified in later releases.
+
+The MITRE ATLAS cross-walk (a separate v0.2 item) will address tactics and techniques at a finer granularity than the OWASP risk categories here.
+
+---
+
+## References
+
+- OWASP Agentic AI Top 10: <https://genai.owasp.org/>
+- TRACE v0.1 specification: [`spec/trace-v0.1.md`](../../spec/trace-v0.1.md)
+- TRACE roadmap: [`ROADMAP.md`](../../ROADMAP.md)
+- MITRE ATLAS: <https://atlas.mitre.org/>

agentrust_trace-0.2.0/docs/stylesheets/extra.css

@@ -0,0 +1,24 @@
+:root {
+  --md-primary-fg-color: #7c3aed;
+  --md-primary-fg-color--light: #a78bfa;
+  --md-primary-fg-color--dark: #5b21b6;
+  --md-accent-fg-color: #0ea5e9;
+}
+
+[data-md-color-scheme="slate"] {
+  --md-primary-fg-color: #818cf8;
+  --md-primary-fg-color--light: #a5b4fc;
+  --md-primary-fg-color--dark: #6366f1;
+  --md-accent-fg-color: #38bdf8;
+  --md-default-bg-color: #0f0a1e;
+  --md-default-bg-color--light: #1a1033;
+  --md-code-bg-color: #1e1533;
+}
+
+.md-header {
+  background: linear-gradient(135deg, #0d0a1f 0%, #071828 100%);
+}
+
+.md-hero__inner {
+  padding-top: 2rem;
+}

agentrust_trace-0.2.0/mkdocs.yml

@@ -0,0 +1,125 @@
+site_name: TRACE
+site_description: Trust Runtime Attestation and Compliance Evidence — open attestation standard for agentic AI governance
+site_url: https://agentrust-io.github.io/trace-spec
+repo_url: https://github.com/agentrust-io/trace-spec
+repo_name: agentrust-io/trace-spec
+edit_uri: edit/main/
+docs_dir: .
+exclude_docs: |
+  .github/
+  node_modules/
+  src/
+  tests/
+  schema/
+  examples/
+  LICENSE
+  NOTICE
+  ANTITRUST.md
+  ADOPTERS.md
+  MAINTAINERS.md
+  SECURITY.md
+  CHARTER.md
+  CODE_OF_CONDUCT.md
+  pyproject.toml
+
+theme:
+  name: material
+  logo: docs/assets/icon.svg
+  favicon: docs/assets/icon.svg
+  palette:
+    - scheme: slate
+      primary: custom
+      accent: custom
+      toggle:
+        icon: material/brightness-7
+        name: Switch to light mode
+    - scheme: default
+      primary: custom
+      accent: custom
+      toggle:
+        icon: material/brightness-4
+        name: Switch to dark mode
+  features:
+    - navigation.instant
+    - navigation.tracking
+    - navigation.tabs
+    - navigation.tabs.sticky
+    - navigation.sections
+    - navigation.top
+    - navigation.path
+    - search.suggest
+    - search.highlight
+    - content.code.copy
+    - content.tabs.link
+    - toc.follow
+    - header.autohide
+  icon:
+    repo: fontawesome/brands/github
+  font:
+    text: Inter, system-ui, -apple-system, sans-serif
+    code: JetBrains Mono, Cascadia Code, monospace
+
+plugins:
+  - search
+  - minify:
+      minify_html: true
+  - mkdocstrings:
+      default_handler: python
+      handlers:
+        python:
+          paths: [src]
+          options:
+            docstring_style: google
+            show_source: false
+            show_root_heading: true
+            show_root_full_path: false
+            show_symbol_type_heading: true
+            show_symbol_type_toc: true
+            members_order: source
+            separate_signature: true
+            show_signature_annotations: true
+            unwrap_annotated: true
+
+markdown_extensions:
+  - admonition
+  - pymdownx.details
+  - pymdownx.superfences:
+      custom_fences:
+        - name: mermaid
+          class: mermaid
+          format: !!python/name:pymdownx.superfences.fence_code_format
+  - pymdownx.tabbed:
+      alternate_style: true
+  - pymdownx.highlight:
+      anchor_linenums: true
+  - pymdownx.inlinehilite
+  - pymdownx.snippets
+  - pymdownx.emoji:
+      emoji_index: !!python/name:material.extensions.emoji.twemoji
+      emoji_generator: !!python/name:material.extensions.emoji.to_svg
+  - attr_list
+  - md_in_html
+  - tables
+  - toc:
+      permalink: true
+
+extra:
+  social:
+    - icon: fontawesome/brands/github
+      link: https://github.com/agentrust-io/trace-spec
+  generator: false
+
+extra_css:
+  - docs/stylesheets/extra.css
+
+nav:
+  - Home: README.md
+  - Specification: spec/trace-v0.1.md
+  - Crosswalks:
+      - OWASP Agentic Top 10: docs/crosswalks/owasp-agentic-top-10.md
+  - Project:
+      - Limitations: LIMITATIONS.md
+      - Changelog: CHANGELOG.md
+      - Contributing: CONTRIBUTING.md
+      - Governance: GOVERNANCE.md
+      - Roadmap: ROADMAP.md

{agentrust_trace-0.1.1 → agentrust_trace-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentrust-trace"
-version = "0.1.1"
+version = "0.2.0"
 description = "TRACE v0.1 — hardware-attested governance records for AI agents"
 readme = "README.md"
 license = { text = "Apache-2.0" }
@@ -24,6 +24,7 @@ classifiers = [
 dependencies = [
     "pydantic>=2.0",
     "jsonschema>=4.20",
+    "cryptography>=42.0",
 ]
 
 [project.optional-dependencies]

agentrust_trace-0.2.0/requirements-docs.txt

@@ -0,0 +1,6 @@
+mkdocs>=1.6
+mkdocs-material>=9.5
+mkdocs-minify-plugin>=0.8
+pymdown-extensions>=10.7
+mkdocstrings[python]>=0.25
+griffe>=0.47

{agentrust_trace-0.1.1 → agentrust_trace-0.2.0}/schema/trace-claim.json

@@ -30,8 +30,8 @@
     },
     "subject": {
       "type": "string",
-      "description": "Workload identity as a SPIFFE SVID URI.",
-      "pattern": "^spiffe://"
+      "description": "Workload identity as a SPIFFE SVID URI or DID URI.",
+      "pattern": "^(spiffe://|did:)"
     },
     "model": {
       "type": "object",
@@ -117,7 +117,8 @@
         "enforcement_mode": {
           "type": "string",
           "enum": ["enforce", "advisory", "silent"],
-          "description": "How policy decisions were applied: enforce (block on deny), advisory (log only), silent (no logging)."
+          "default": "enforce",
+          "description": "How policy decisions were applied: enforce (block on deny), advisory (log and allow), silent (allow and suppress operational logs; the audit chain still records every would-have-denied decision). Gateways MUST default to enforce. A deployment MUST explicitly configure silent mode; it MUST NOT be the default."
         },
         "version": {
           "type": "string",
@@ -166,9 +167,9 @@
       "properties": {
         "slsa_level": {
           "type": "integer",
-          "minimum": 1,
+          "minimum": 0,
           "maximum": 3,
-          "description": "SLSA Build Level achieved. Level 2 minimum for TRACE conformance; Level 3 for production mark."
+          "description": "SLSA Build Level achieved. Level 0 = software-only (development/staging); Level 2 minimum for TRACE conformance; Level 3 for production mark."
         },
         "builder": {
           "type": "string",

{agentrust_trace-0.1.1 → agentrust_trace-0.2.0}/spec/trace-v0.1.md

@@ -2,7 +2,7 @@
 
 | Field | Value |
 |---|---|
-| Version | 0.1 — Draft |
+| Version | 0.2 — Draft |
 | Status | RFC — Request for Comments |
 | Authors | Rishabh Poddar, Aaron Fulkerson (OPAQUE Systems) |
 | Target announcement | Confidential Computing Summit, San Francisco — 23 June 2026 |
@@ -103,10 +103,10 @@ The Trust Record is the unit of evidence. All fields are required unless marked
 
 | Field | Description | Source primitive |
 |---|---|---|
-| `subject` | Workload identity (agent, tool, model invocation) | SPIFFE SVID |
+| `subject` | Workload identity (agent, tool, model invocation) | SPIFFE SVID or DID URI |
 | `model` | Model identity, weights digest, version | EAT claim + AIBOM reference |
 | `runtime` | TEE measurement chain (firmware → kernel → image → workload) | RATS Evidence + vendor RIM |
-| `policy` | Bound policy set hash + enforcement mode | Policy artifact hash sealed to TEE measurement |
+| `policy` | Bound policy set hash + enforcement mode. `enforcement_mode` MUST default to `enforce`; a deployment MUST explicitly configure `silent` mode. | Policy artifact hash sealed to TEE measurement |
 | `data_class` | Classification of inputs and outputs | Classification label bound to per-call execution |
 | `tool_transcript` | MCP / A2A tool calls invoked, parameters classified, responses filtered | MCP / A2A protocol transcripts bound to TEE measurement |
 | `build_provenance` | How the running code and model were built | SLSA Provenance v1.0 |
@@ -265,7 +265,7 @@ TRACE is a **profile**, not a parallel stack. It binds existing primitives into
 
 These components exist in their respective ecosystems. TRACE adds the binding rule that places each into a hardware-attested envelope:
 
-- **`policy` claim.** Policy artifacts (OPA bundles, Cedar policies, custom DSLs) and policy hashing are established. TRACE adds the binding: the policy bundle hash is sealed to the TEE measurement, the enforcement mode is recorded, and substituting the policy invalidates the runtime claim.
+- **`policy` claim.** Policy artifacts (OPA bundles, Cedar policies, custom DSLs) and policy hashing are established. TRACE adds the binding: the policy bundle hash is sealed to the TEE measurement, the enforcement mode is recorded, and substituting the policy invalidates the runtime claim. Gateways MUST default `enforcement_mode` to `enforce`. A deployment MUST explicitly configure `silent` mode; `silent` MUST NOT be the default. In `silent` mode, the audit chain still records every would-have-denied decision; only operational log lines are suppressed.
 - **`data_class` claim.** Data classification schemes are established (DLP labels, NIST SP 800-60, sensitivity tags). TRACE adds: a classification label is attached to inputs and outputs at the per-call layer and recorded in the Trust Record alongside the runtime evidence.
 - **`tool_transcript` claim.** MCP and A2A transcripts exist at the protocol layer. TRACE adds cryptographic binding of the transcript hash into the EAT envelope and per-call parameter classification.
 - **AI-agent execution profile.** A profile registry that pins the claim set, evidence requirements, and verification rules for AI-agent workloads specifically.

{agentrust_trace-0.1.1 → agentrust_trace-0.2.0}/src/agentrust_trace/__init__.py

@@ -1,4 +1,4 @@
-"""agentrust-trace — TRACE v0.1 Trust Record models and validation."""
+"""agentrust-trace — TRACE Trust Record models, validation, and signing."""
 
 from agentrust_trace.models import (
     Appraisal,
@@ -11,13 +11,20 @@ from agentrust_trace.models import (
     ToolTranscript,
     TrustRecord,
 )
+from agentrust_trace.sign import (
+    generate_key,
+    key_to_jwk,
+    load_key,
+    load_signing_key,
+    sign_record,
+)
 from agentrust_trace.validate import (
     iter_errors,
     SCHEMA,
     validate_json,
 )
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 
 __all__ = [
     "__version__",
@@ -33,4 +40,9 @@ __all__ = [
     "SCHEMA",
     "iter_errors",
     "validate_json",
+    "generate_key",
+    "key_to_jwk",
+    "load_key",
+    "load_signing_key",
+    "sign_record",
 ]

{agentrust_trace-0.1.1 → agentrust_trace-0.2.0}/src/agentrust_trace/models.py

@@ -62,7 +62,7 @@ class ToolTranscript(BaseModel):
 class BuildProvenance(BaseModel):
     model_config = ConfigDict(extra="forbid")
 
-    slsa_level: Annotated[int, Field(ge=1, le=3)]
+    slsa_level: Annotated[int, Field(ge=0, le=3)]
     builder: str | None = None
     digest: DigestStr
     provenance_uri: str | None = None
@@ -113,7 +113,7 @@ class TrustRecord(BaseModel):
 
     eat_profile: Literal["tag:agentrust.io,2026:trace-v0.1"]
     iat: Annotated[int, Field(ge=1700000000)]
-    subject: Annotated[str, Field(pattern=r"^spiffe://")]
+    subject: Annotated[str, Field(pattern=r"^(spiffe://|did:)")]
     model: ModelInfo
     runtime: RuntimeInfo
     policy: PolicyInfo

{agentrust_trace-0.1.1 → agentrust_trace-0.2.0}/src/agentrust_trace/schema/trace-v0.1.json

@@ -117,7 +117,8 @@
         "enforcement_mode": {
           "type": "string",
           "enum": ["enforce", "advisory", "silent"],
-          "description": "How policy decisions were applied: enforce (block on deny), advisory (log only), silent (no logging)."
+          "default": "enforce",
+          "description": "How policy decisions were applied: enforce (block on deny), advisory (log and allow), silent (allow and suppress operational logs; the audit chain still records every would-have-denied decision). Gateways MUST default to enforce. A deployment MUST explicitly configure silent mode; it MUST NOT be the default."
         },
         "version": {
           "type": "string",

agentrust_trace-0.2.0/src/agentrust_trace/sign.py

@@ -0,0 +1,80 @@
+"""Signing utilities for TRACE Trust Records.
+
+Produces a signed record dict with an embedded ``signature`` field --
+Ed25519 over the canonical JSON of the record with the signature field absent.
+This is the same convention used by cMCP RuntimeClaim and verified by
+trace-tests TR-SIG at all conformance levels.
+"""
+
+from __future__ import annotations
+
+import base64
+import json
+import os
+import warnings
+from typing import Any
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+
+def generate_key() -> Ed25519PrivateKey:
+    """Generate a new Ed25519 signing key."""
+    return Ed25519PrivateKey.generate()
+
+
+def load_key(pem: str) -> Ed25519PrivateKey:
+    """Load an Ed25519 private key from a PEM string."""
+    return serialization.load_pem_private_key(pem.encode(), password=None)  # type: ignore[return-value]
+
+
+def load_signing_key() -> Ed25519PrivateKey:
+    """Load key from ``TRACE_PRIVATE_KEY_PEM`` env var, or generate an ephemeral one.
+
+    Emits a warning when falling back to an ephemeral key so callers notice
+    that the resulting records cannot be re-verified after the process exits.
+    """
+    pem = os.environ.get("TRACE_PRIVATE_KEY_PEM")
+    if pem:
+        return load_key(pem)
+    warnings.warn(
+        "TRACE_PRIVATE_KEY_PEM not set -- generating ephemeral Ed25519 key. "
+        "The signed record cannot be re-verified after this process exits. "
+        "Set TRACE_PRIVATE_KEY_PEM to a persistent PEM for production use.",
+        stacklevel=2,
+    )
+    return generate_key()
+
+
+def key_to_jwk(key: Ed25519PrivateKey) -> dict[str, str]:
+    """Return the public JWK dict for *key* (OKP / Ed25519)."""
+    pub = key.public_key()
+    raw = pub.public_bytes(
+        encoding=serialization.Encoding.Raw,
+        format=serialization.PublicFormat.Raw,
+    )
+    x = base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+    return {"kty": "OKP", "crv": "Ed25519", "x": x}
+
+
+def _canonical_bytes(d: dict[str, Any]) -> bytes:
+    return json.dumps(d, sort_keys=True, separators=(",", ":"), ensure_ascii=True).encode()
+
+
+def sign_record(record: dict[str, Any], key: Ed25519PrivateKey) -> dict[str, Any]:
+    """Return a copy of *record* with ``cnf.jwk`` populated and a ``signature`` field added.
+
+    The signature is Ed25519 over the canonical JSON (sorted keys, no whitespace)
+    of the record with the ``signature`` field absent. ``cnf.jwk`` is set to the
+    public key derived from *key*.
+
+    The returned dict is a plain JSON-serialisable object. Pass it to
+    ``json.dumps()`` to get the wire form, or to ``TrustRecord.model_validate()``
+    to confirm structural validity before writing.
+    """
+    jwk = key_to_jwk(key)
+    payload: dict[str, Any] = {**record, "cnf": {"jwk": jwk}}
+    body = _canonical_bytes({k: v for k, v in payload.items() if k != "signature"})
+    sig_bytes = key.sign(body)
+    sig_b64 = base64.urlsafe_b64encode(sig_bytes).rstrip(b"=").decode()
+    return {**payload, "signature": sig_b64}

{agentrust_trace-0.1.1 → agentrust_trace-0.2.0}/tests/test_models.py

@@ -20,7 +20,7 @@ def _load(name: str) -> dict:
 def test_example_parses(filename: str) -> None:
     record = TrustRecord.model_validate(_load(filename))
     assert record.eat_profile == "tag:agentrust.io,2026:trace-v0.1"
-    assert record.subject.startswith("spiffe://")
+    assert record.subject.startswith(("spiffe://", "did:"))
 
 
 def test_intel_tdx_fields() -> None:
@@ -105,6 +105,27 @@ def test_digest_sha512_rejected() -> None:
 # cnf.jwk key material enforcement
 
 
+def test_subject_accepts_did_uri() -> None:
+    data = _load("intel-tdx.json")
+    data["subject"] = "did:key:z6MkhaXgBZDvotzL8oCYaXeFuJArwvX6mDMsKTJVjtN7R"
+    record = TrustRecord.model_validate(data)
+    assert record.subject.startswith("did:")
+
+
+def test_subject_accepts_did_web() -> None:
+    data = _load("intel-tdx.json")
+    data["subject"] = "did:web:example.org:agents:payments-processor"
+    record = TrustRecord.model_validate(data)
+    assert record.subject.startswith("did:")
+
+
+def test_subject_rejects_http_scheme() -> None:
+    data = _load("intel-tdx.json")
+    data["subject"] = "https://example.org/agent"
+    with pytest.raises(ValidationError):
+        TrustRecord.model_validate(data)
+
+
 def test_okp_jwk_without_key_material_rejected() -> None:
     """An OKP confirmation key with no crv/x carries no key material and binds nothing."""
     data = _load("intel-tdx.json")

agentrust_trace-0.2.0/tests/test_sign.py

@@ -0,0 +1,121 @@
+"""Tests for agentrust_trace.sign."""
+
+import base64
+import json
+
+import pytest
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+from agentrust_trace import TrustRecord, generate_key, key_to_jwk, sign_record
+from agentrust_trace.sign import _canonical_bytes
+
+
+def _b64url_decode(s: str) -> bytes:
+    pad = 4 - len(s) % 4
+    if pad != 4:
+        s += "=" * pad
+    return base64.urlsafe_b64decode(s)
+
+
+def _minimal_record() -> dict:
+    return {
+        "eat_profile": "tag:agentrust.io,2026:trace-v0.1",
+        "iat": 1750000000,
+        "subject": "did:mesh:spiffe://factory.example/agent/payments/prod",
+        "model": {"provider": "anthropic", "model_id": "claude-sonnet-4-6"},
+        "runtime": {
+            "platform": "software-only",
+            "measurement": "sha256:" + "0" * 64,
+        },
+        "policy": {
+            "bundle_hash": "sha256:" + "a" * 64,
+            "enforcement_mode": "enforce",
+        },
+        "data_class": "confidential",
+        "build_provenance": {
+            "slsa_level": 0,
+            "digest": "sha256:" + "b" * 64,
+        },
+        "appraisal": {
+            "status": "affirming",
+            "verifier": "https://agt.example.org/verifier",
+        },
+        "transparency": "",
+        "tool_transcript": {
+            "hash": "sha256:" + "c" * 64,
+            "call_count": 3,
+        },
+    }
+
+
+def test_sign_record_adds_signature_and_cnf():
+    key = generate_key()
+    record = sign_record(_minimal_record(), key)
+    assert "signature" in record
+    assert "cnf" in record
+    assert record["cnf"]["jwk"]["kty"] == "OKP"
+    assert record["cnf"]["jwk"]["crv"] == "Ed25519"
+    assert "x" in record["cnf"]["jwk"]
+
+
+def test_sign_record_signature_verifies():
+    key = generate_key()
+    record = sign_record(_minimal_record(), key)
+
+    jwk = record["cnf"]["jwk"]
+    pub_bytes = _b64url_decode(jwk["x"])
+    pub_key = Ed25519PublicKey.from_public_bytes(pub_bytes)
+
+    body = _canonical_bytes({k: v for k, v in record.items() if k != "signature"})
+    sig_bytes = _b64url_decode(record["signature"])
+    pub_key.verify(sig_bytes, body)  # raises InvalidSignature if wrong
+
+
+def test_tampered_record_fails_verification():
+    key = generate_key()
+    record = sign_record(_minimal_record(), key)
+
+    jwk = record["cnf"]["jwk"]
+    pub_bytes = _b64url_decode(jwk["x"])
+    pub_key = Ed25519PublicKey.from_public_bytes(pub_bytes)
+
+    tampered = {**record, "data_class": "public"}
+    body = _canonical_bytes({k: v for k, v in tampered.items() if k != "signature"})
+    sig_bytes = _b64url_decode(record["signature"])
+    with pytest.raises(InvalidSignature):
+        pub_key.verify(sig_bytes, body)
+
+
+def test_signed_record_passes_trust_record_validation():
+    key = generate_key()
+    record = sign_record(_minimal_record(), key)
+    validated = TrustRecord.model_validate(record)
+    assert validated.appraisal.status == "affirming"
+    assert validated.subject.startswith("did:")
+
+
+def test_key_to_jwk_shape():
+    key = generate_key()
+    jwk = key_to_jwk(key)
+    assert jwk["kty"] == "OKP"
+    assert jwk["crv"] == "Ed25519"
+    assert len(jwk["x"]) > 0
+
+
+def test_sign_record_did_subject():
+    key = generate_key()
+    record = _minimal_record()
+    record["subject"] = "did:key:z6MkhaXgBZDvotzL8oCYaXeFuJArwvX6mDMsKTJVjtN7R"
+    signed = sign_record(record, key)
+    validated = TrustRecord.model_validate(signed)
+    assert validated.subject.startswith("did:key:")
+
+
+def test_sign_record_spiffe_subject():
+    key = generate_key()
+    record = _minimal_record()
+    record["subject"] = "spiffe://trust.example.org/agent/payments/prod"
+    signed = sign_record(record, key)
+    validated = TrustRecord.model_validate(signed)
+    assert validated.subject.startswith("spiffe://")