litzki-sovp-agentrust-bridge 0.1.0__tar.gz

litzki_sovp_agentrust_bridge-0.1.0/.gitignore

@@ -0,0 +1,11 @@
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.venv/
+dist/
+build/
+*.egg-info/
+
+# Private signing keys — never commit (demo keys are generated locally, see README)
+*-private.pem
+*.key

litzki_sovp_agentrust_bridge-0.1.0/PKG-INFO

@@ -0,0 +1,77 @@
+Metadata-Version: 2.5
+Name: litzki-sovp-agentrust-bridge
+Version: 0.1.0
+Summary: SOVP to AgenTrust TRACE bridge
+License: Apache-2.0
+Requires-Python: >=3.11
+Requires-Dist: agent-manifest>=0.11.1
+Requires-Dist: agentrust-trace-tests>=0.5.1
+Requires-Dist: agentrust-trace>=0.9.0
+Requires-Dist: cmcp-runtime>=0.4.0
+Requires-Dist: cryptography<51,>=42
+Description-Content-Type: text/markdown
+
+# Litzki SOVP AgenTrust Integration
+
+Exports SOVP attestation results as signed AgenTrust TRACE records.
+
+## What it does
+
+This integration provides a Python adapter that:
+
+- loads a SOVP attestation result from JSON;
+- maps explicitly supplied SOVP and AgenTrust fields into a TRACE envelope;
+- signs the TRACE envelope with Ed25519 over a canonical JSON pre-image that excludes only the `signature` field;
+- writes the signed record as JSON for downstream validation with `agentrust-trace-tests`.
+
+## What it does not claim
+
+- It does not certify SOVP or any SOVP deployment.
+- It does not call non-attested data attested.
+- It does not mark the integration as Verified until the generated records pass `agentrust-trace-tests` in CI or a reviewer reproduction environment.
+
+## Installation
+
+```bash
+python -m pip install -e integrations/litzki-sovp
+```
+
+The package declares runtime dependencies on released PyPI packages: `cmcp-runtime`, `agentrust-trace`, `agentrust-trace-tests`, and `agent-manifest`.
+
+## Input contract
+
+The adapter expects a JSON object with an `agentrust` object containing the TRACE envelope fields and a `sovp` object containing the source attestation payload. The adapter only signs fields present in `agentrust`; it does not infer missing attestation claims.
+
+See `examples/sovp-attestation.json` for the minimal local fixture shape.
+
+## Usage
+
+First generate a local Ed25519 signing key. This is a throwaway demo key; it is
+git-ignored and must not be committed. Use a persistent, protected key for any
+record you intend to be re-verified later.
+
+```bash
+openssl genpkey -algorithm Ed25519 \
+  -out integrations/litzki-sovp/examples/ed25519-private.pem
+```
+
+Then produce a signed TRACE record:
+
+```bash
+litzki-sovp-trace \
+  --input integrations/litzki-sovp/examples/sovp-attestation.json \
+  --private-key integrations/litzki-sovp/examples/ed25519-private.pem \
+  --output /tmp/sovp.trace.json
+```
+
+## Reproduction target
+
+```bash
+python -m pytest integrations/litzki-sovp/tests
+trace-tests verify --record /tmp/sovp.trace.json --level 0
+```
+
+The generated record passes TRACE conformance at **Level 0** (`TR-ENV`, `TR-SIG`,
+`TR-POL`). Level 0 is the honest ceiling for this bridge: it transcribes a SOVP
+attestation rather than measuring a hardware TEE, so `runtime.platform` is
+`software-only`, which the suite accepts only at Level 0.

litzki_sovp_agentrust_bridge-0.1.0/README.md

@@ -0,0 +1,64 @@
+# Litzki SOVP AgenTrust Integration
+
+Exports SOVP attestation results as signed AgenTrust TRACE records.
+
+## What it does
+
+This integration provides a Python adapter that:
+
+- loads a SOVP attestation result from JSON;
+- maps explicitly supplied SOVP and AgenTrust fields into a TRACE envelope;
+- signs the TRACE envelope with Ed25519 over a canonical JSON pre-image that excludes only the `signature` field;
+- writes the signed record as JSON for downstream validation with `agentrust-trace-tests`.
+
+## What it does not claim
+
+- It does not certify SOVP or any SOVP deployment.
+- It does not call non-attested data attested.
+- It does not mark the integration as Verified until the generated records pass `agentrust-trace-tests` in CI or a reviewer reproduction environment.
+
+## Installation
+
+```bash
+python -m pip install -e integrations/litzki-sovp
+```
+
+The package declares runtime dependencies on released PyPI packages: `cmcp-runtime`, `agentrust-trace`, `agentrust-trace-tests`, and `agent-manifest`.
+
+## Input contract
+
+The adapter expects a JSON object with an `agentrust` object containing the TRACE envelope fields and a `sovp` object containing the source attestation payload. The adapter only signs fields present in `agentrust`; it does not infer missing attestation claims.
+
+See `examples/sovp-attestation.json` for the minimal local fixture shape.
+
+## Usage
+
+First generate a local Ed25519 signing key. This is a throwaway demo key; it is
+git-ignored and must not be committed. Use a persistent, protected key for any
+record you intend to be re-verified later.
+
+```bash
+openssl genpkey -algorithm Ed25519 \
+  -out integrations/litzki-sovp/examples/ed25519-private.pem
+```
+
+Then produce a signed TRACE record:
+
+```bash
+litzki-sovp-trace \
+  --input integrations/litzki-sovp/examples/sovp-attestation.json \
+  --private-key integrations/litzki-sovp/examples/ed25519-private.pem \
+  --output /tmp/sovp.trace.json
+```
+
+## Reproduction target
+
+```bash
+python -m pytest integrations/litzki-sovp/tests
+trace-tests verify --record /tmp/sovp.trace.json --level 0
+```
+
+The generated record passes TRACE conformance at **Level 0** (`TR-ENV`, `TR-SIG`,
+`TR-POL`). Level 0 is the honest ceiling for this bridge: it transcribes a SOVP
+attestation rather than measuring a hardware TEE, so `runtime.platform` is
+`software-only`, which the suite accepts only at Level 0.

litzki_sovp_agentrust_bridge-0.1.0/examples/sovp-attestation.json

@@ -0,0 +1,25 @@
+{
+  "agentrust": {
+    "trace_id": "0192f3a0-0000-7000-8000-0000000000aa",
+    "agent_id": "spiffe://litzki.systems/agent/sovp-demo",
+    "agent_manifest_id": "0192f3a0-0000-7000-8000-000000000001",
+    "manifest_verification_result": "VALID",
+    "tool_id": "systems.litzki.sovp.attestation",
+    "policy_hash": "sha256:a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1",
+    "catalog_hash": "sha256:b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2b2",
+    "decision": "allow",
+    "decision_reason": "SOVP attestation result accepted by caller policy.",
+    "payload_classification": "internal",
+    "egress_destination": "trace.local",
+    "hitl_required": false,
+    "hitl_approval_id": null,
+    "timestamp": "2026-08-22T00:00:00Z",
+    "tee_measurement": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd"
+  },
+  "sovp": {
+    "result": "passed",
+    "measurement": "sha256:cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
+    "nonce": "example-nonce",
+    "subject": "sovp-demo"
+  }
+}

litzki_sovp_agentrust_bridge-0.1.0/integration.yaml

@@ -0,0 +1,34 @@
+name: litzki-sovp
+vendor: Litzki Systems
+product: SOVP
+version: 0.1.0
+category: attestation
+summary: Emits signed AgenTrust TRACE records from SOVP attestation results.
+maintainer:
+  name: Litzki Systems
+  email: maintainers@litzki.systems
+links:
+  homepage: https://github.com/litzki-systems/sovp-agentrust-bridge
+  repository: https://github.com/litzki-systems/sovp-agentrust-bridge
+runtime:
+  language: python
+  package: litzki-sovp-agentrust-bridge
+  requires_python: '>=3.11'
+  dependencies:
+    - cmcp-runtime
+    - agentrust-trace
+    - agentrust-trace-tests
+    - agent-manifest
+capabilities:
+  emits:
+    - trace-record
+  consumes:
+    - sovp-attestation-result
+claims:
+  tier: community
+  trace_conformance: level-0
+  verified: false
+notes:
+  - Generated records pass agentrust-trace-tests at Level 0 (TR-ENV, TR-SIG, TR-POL). Reproduce with `trace-tests verify --record <record> --level 0`; this repository's CI runs that reproduction on every push and pull request (.github/workflows/ci.yml, Python 3.11 and 3.12).
+  - Level 0 is the honest ceiling for this bridge. It transcribes a SOVP attestation rather than measuring a hardware TEE, so runtime.platform is software-only, which the suite accepts only at Level 0.
+  - The Verified tier is granted by the AgenTrust maintainers during marketplace review, never self-declared. This field stays false until then.

litzki_sovp_agentrust_bridge-0.1.0/pyproject.toml

@@ -0,0 +1,28 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "litzki-sovp-agentrust-bridge"
+version = "0.1.0"
+description = "SOVP to AgenTrust TRACE bridge"
+readme = "README.md"
+requires-python = ">=3.11"
+license = {text = "Apache-2.0"}
+dependencies = [
+  "agent-manifest>=0.11.1",
+  "agentrust-trace>=0.9.0",
+  "agentrust-trace-tests>=0.5.1",
+  "cmcp-runtime>=0.4.0",
+  "cryptography>=42,<51",
+]
+
+[project.scripts]
+litzki-sovp-trace = "litzki_sovp.adapter:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/litzki_sovp"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]

litzki_sovp_agentrust_bridge-0.1.0/src/litzki_sovp/__init__.py

@@ -0,0 +1,5 @@
+"""Litzki SOVP to AgenTrust TRACE bridge."""
+
+from litzki_sovp.trace import build_trace_record, sign_trace_record, trace_signing_pre_image
+
+__all__ = ["build_trace_record", "sign_trace_record", "trace_signing_pre_image"]

litzki_sovp_agentrust_bridge-0.1.0/src/litzki_sovp/adapter.py

@@ -0,0 +1,40 @@
+"""Command line adapter for SOVP attestation JSON to signed TRACE JSON."""
+
+from __future__ import annotations
+
+import argparse
+import json
+from pathlib import Path
+
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from litzki_sovp.trace import build_trace_record, sign_trace_record
+
+
+def load_private_key(path: Path) -> Ed25519PrivateKey:
+    key = serialization.load_pem_private_key(path.read_bytes(), password=None)
+    if not isinstance(key, Ed25519PrivateKey):
+        raise ValueError("private key must be an Ed25519 PEM key")
+    return key
+
+
+def convert_file(input_path: Path, private_key_path: Path, output_path: Path) -> None:
+    sovp_result = json.loads(input_path.read_text(encoding="utf-8"))
+    private_key = load_private_key(private_key_path)
+    record = build_trace_record(sovp_result)
+    signed = sign_trace_record(record, private_key)
+    output_path.write_text(json.dumps(signed, indent=2, sort_keys=True) + "\n", encoding="utf-8")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="Convert SOVP attestation JSON to a signed AgenTrust TRACE record")
+    parser.add_argument("--input", required=True, type=Path, help="SOVP attestation result JSON")
+    parser.add_argument("--private-key", required=True, type=Path, help="Ed25519 private key in PEM format")
+    parser.add_argument("--output", required=True, type=Path, help="Output TRACE JSON path")
+    args = parser.parse_args()
+    convert_file(args.input, args.private_key, args.output)
+
+
+if __name__ == "__main__":
+    main()

litzki_sovp_agentrust_bridge-0.1.0/src/litzki_sovp/trace.py

@@ -0,0 +1,157 @@
+"""TRACE record construction for SOVP attestation results.
+
+Builds an AgenTrust TRACE v0.2 Trust Record from a SOVP attestation document and
+signs it with the released ``agentrust-trace`` signing implementation, so the
+output verifies under ``agentrust-trace-tests`` (TR-ENV / TR-SIG / TR-POL) at
+Level 0.
+
+Design stance: this bridge only *transcribes* a SOVP attestation into TRACE
+shape. It measures nothing itself, so every field that would otherwise assert a
+strong guarantee is set to its weakest honest value:
+
+- ``runtime.platform`` is ``software-only`` (no hardware TEE in the bridge);
+- ``origin.kind`` is ``third-party-control-plane`` (the evidence is asserted by
+  SOVP, not measured by this runtime);
+- ``appraisal.status`` is ``none`` (no verifier appraised the result);
+- ``build_provenance.slsa_level`` is ``0`` (no build-provenance guarantee claimed).
+
+This mirrors the project README's "What it does not claim" section: the record
+never dresses transcribed evidence up as hardware-attested.
+"""
+
+from __future__ import annotations
+
+import time
+from collections.abc import Mapping
+from typing import Any
+
+from agentrust_trace.sign import TRACE_PROFILE_V0_2, sign_record
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+# Fields the caller must supply explicitly in the ``agentrust`` object. The bridge
+# never infers an attestation claim it was not given.
+TRACE_REQUIRED_FIELDS = (
+    "agent_id",
+    "policy_hash",
+    "catalog_hash",
+    "payload_classification",
+    "tee_measurement",
+)
+
+# TR-POL-002 accepts only these; the model's fourth value ``declared`` passes the
+# schema but fails Level-0 conformance, so it is deliberately not offered here.
+_VALID_ENFORCEMENT_MODES = frozenset({"enforce", "advisory", "silent"})
+
+
+def _enforcement_mode(agentrust: Mapping[str, Any]) -> str:
+    """Return a conformance-valid ``policy.enforcement_mode`` for the record.
+
+    Honest mapping from the caller's own governance decision:
+
+    - an explicit ``policy_enforcement_mode`` wins, but must be one the TRACE
+      conformance suite accepts;
+    - otherwise, a caller ``decision`` that was acted on means the policy was
+      *enforced*; with no decision at all the honest value is ``advisory`` (a
+      policy is named but nothing is asserted to have acted on it).
+    """
+    mode = agentrust.get("policy_enforcement_mode")
+    if mode is not None:
+        if mode not in _VALID_ENFORCEMENT_MODES:
+            raise ValueError(
+                f"policy_enforcement_mode must be one of {sorted(_VALID_ENFORCEMENT_MODES)}, "
+                f"got {mode!r} (the schema also allows 'declared', but it fails TRACE "
+                "conformance TR-POL-002)"
+            )
+        return mode
+    return "enforce" if agentrust.get("decision") else "advisory"
+
+
+def build_trace_record(sovp_result: Mapping[str, Any]) -> dict[str, Any]:
+    """Build an unsigned AgenTrust TRACE v0.2 Trust Record from a SOVP result.
+
+    ``sovp_result`` must contain an ``agentrust`` object with the fields named in
+    :data:`TRACE_REQUIRED_FIELDS` and may contain a ``sovp`` object with the source
+    attestation payload. Missing required fields raise ``ValueError``; nothing is
+    inferred.
+    """
+    agentrust = sovp_result.get("agentrust")
+    if not isinstance(agentrust, Mapping):
+        raise ValueError("SOVP result must contain an 'agentrust' object")
+
+    missing = [field for field in TRACE_REQUIRED_FIELDS if field not in agentrust]
+    if missing:
+        raise ValueError(f"missing TRACE fields: {', '.join(missing)}")
+
+    sovp = sovp_result.get("sovp", {})
+    if not isinstance(sovp, Mapping):
+        raise ValueError("'sovp' must be an object when present")
+
+    now = int(time.time())
+
+    return {
+        "eat_profile": TRACE_PROFILE_V0_2,
+        "iat": now,
+        "subject": agentrust["agent_id"],
+        "model": {
+            "provider": str(agentrust.get("model_provider", "litzki-systems")),
+            "model_id": str(agentrust.get("model_id", "sovp")),
+            "version": str(agentrust.get("model_version", "0.1.0")),
+        },
+        "runtime": {
+            # No hardware TEE in the bridge; the measurement is transcribed from
+            # SOVP and the software-only platform says so.
+            "platform": "software-only",
+            "measurement": agentrust["tee_measurement"],
+            "nonce": sovp.get("nonce"),
+        },
+        "policy": {
+            "bundle_hash": agentrust["policy_hash"],
+            "enforcement_mode": _enforcement_mode(agentrust),
+        },
+        "data_class": agentrust["payload_classification"],
+        "origin": {
+            # The evidence is asserted by SOVP, not measured here.
+            "kind": "third-party-control-plane",
+            "producer": "SOVP",
+            "source_event_id": str(
+                sovp.get("subject", agentrust.get("trace_id", "sovp-attestation"))
+            ),
+            "ingested_at": now,
+        },
+        "build_provenance": {
+            # slsa_level 0 == no build-provenance guarantee claimed. The catalog
+            # hash is the one contextual digest the caller supplies.
+            "slsa_level": 0,
+            "digest": agentrust["catalog_hash"],
+        },
+        "appraisal": {
+            "status": "none",
+            "verifier": "litzki-sovp-agentrust-bridge",
+            "timestamp": now,
+        },
+    }
+
+
+def sign_trace_record(
+    record: Mapping[str, Any], private_key: Ed25519PrivateKey
+) -> dict[str, Any]:
+    """Return a signed TRACE record.
+
+    Delegates to ``agentrust_trace.sign.sign_record``, which populates ``cnf.jwk``
+    with the public key and adds an Ed25519 ``signature`` over the RFC 8785 (JCS)
+    canonical form of the record with only the ``signature`` field absent. This is
+    the exact convention ``agentrust-trace-tests`` TR-SIG verifies.
+    """
+    return sign_record(dict(record), private_key)
+
+
+def trace_signing_pre_image(record: Mapping[str, Any]) -> bytes:
+    """Return the canonical signing pre-image for a TRACE record.
+
+    Kept for API stability (re-exported from the package root). Signing itself is
+    owned by ``agentrust-trace``; this delegates to the same canonicalization so a
+    caller inspecting the pre-image sees exactly the bytes that get signed.
+    """
+    from agentrust_trace.sign import _canonical_bytes
+
+    return _canonical_bytes({k: v for k, v in record.items() if k != "signature"})

litzki_sovp_agentrust_bridge-0.1.0/tests/test_trace.py

@@ -0,0 +1,96 @@
+import copy
+
+import pytest
+from agentrust_trace import verify_record
+from agentrust_trace.models import TrustRecord
+from agentrust_trace.sign import TRACE_PROFILE_V0_2
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from trace_tests.result import Status
+from trace_tests.runner import run
+
+from litzki_sovp.trace import build_trace_record, sign_trace_record, trace_signing_pre_image
+
+
+def _sovp_result():
+    return {
+        "agentrust": {
+            "trace_id": "0192f3a0-0000-7000-8000-0000000000aa",
+            "agent_id": "spiffe://litzki.systems/agent/sovp-demo",
+            "policy_hash": "sha256:" + "a1" * 32,
+            "catalog_hash": "sha256:" + "b2" * 32,
+            "decision": "allow",
+            "decision_reason": "SOVP attestation result accepted by caller policy.",
+            "payload_classification": "internal",
+            "tee_measurement": "sha256:" + "cd" * 32,
+        },
+        "sovp": {"result": "passed", "measurement": "sha256:" + "cd" * 32, "nonce": "example-nonce", "subject": "sovp-demo"},
+    }
+
+
+def test_build_trace_record_requires_explicit_trace_fields():
+    source = _sovp_result()
+    del source["agentrust"]["policy_hash"]
+
+    with pytest.raises(ValueError, match="policy_hash"):
+        build_trace_record(source)
+
+
+def test_build_trace_record_is_a_structurally_valid_v0_2_record():
+    record = build_trace_record(_sovp_result())
+
+    assert record["eat_profile"] == TRACE_PROFILE_V0_2
+    # The unsigned record is a valid TrustRecord except for the cnf/signature that
+    # signing adds, so validate the signed form.
+    signed = sign_trace_record(record, Ed25519PrivateKey.generate())
+    TrustRecord.model_validate(signed)
+
+
+def test_enforcement_mode_rejects_non_conformant_override():
+    source = _sovp_result()
+    source["agentrust"]["policy_enforcement_mode"] = "declared"
+
+    with pytest.raises(ValueError, match="TR-POL-002"):
+        build_trace_record(source)
+
+
+def test_signed_record_verifies_with_agentrust_trace():
+    private_key = Ed25519PrivateKey.generate()
+    signed = sign_trace_record(build_trace_record(_sovp_result()), private_key)
+
+    # Real verifier: profile, freshness, and Ed25519 signature over the JCS pre-image.
+    verify_record(signed, private_key.public_key())
+
+
+def test_tampered_field_invalidates_signature():
+    private_key = Ed25519PrivateKey.generate()
+    signed = sign_trace_record(build_trace_record(_sovp_result()), private_key)
+
+    tampered = copy.deepcopy(signed)
+    tampered["data_class"] = "public"
+
+    with pytest.raises(InvalidSignature):
+        verify_record(tampered, private_key.public_key())
+
+
+def test_pre_image_excludes_only_signature():
+    record = sign_trace_record(build_trace_record(_sovp_result()), Ed25519PrivateKey.generate())
+    record["signature"] = "one"
+    first = trace_signing_pre_image(record)
+    record["signature"] = "two"
+
+    assert trace_signing_pre_image(record) == first
+
+
+def test_record_passes_trace_tests_level_0():
+    signed = sign_trace_record(build_trace_record(_sovp_result()), Ed25519PrivateKey.generate())
+
+    results = run(signed, "trace", level=0)
+    failures = [
+        finding
+        for findings in results.values()
+        for finding in findings
+        if finding.status is Status.FAIL
+    ]
+
+    assert not failures, [f.message for f in failures]