Technical report / Version 1
+OPAQUE Systems
+Agent Manifest proposes a signed record of the artifacts that define an AI agent, including its system prompt, model, policy, tools, retrieval corpus, memory, decision trace, delegation, supply chain, and human approvals. Artifact digests and canonical serialization make changes to the recorded baseline detectable when a verifier has the relevant artifacts and trusted keys. The design composes SPIFFE identities, RFC 8785 canonicalization, Ed25519 signatures, an optional ML-DSA-65 profile, and hardware-attestation bindings. This technical report describes the original model and preserves the recorded Ed25519 software benchmarks, delegation checks, and tamper probes. Signed metadata alone does not prove that the recorded configuration was used during execution. The evaluation does not measure post-quantum performance or establish live hardware provenance; continuous verification of mutable memory and retrieval state is outside its scope. Current SDK behavior and normative requirements are maintained separately.
A signed baseline for agent artifacts, with recorded Ed25519 benchmarks, delegation checks, and tamper probes.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. Agent Manifest: Portable, Hardware-Attestable Identity and Provenance for AI Agents. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026agentmanifest,
+ title = {Agent Manifest: Portable, Hardware-Attestable Identity and Provenance for AI Agents},
+ author = {Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/agent-manifest/v1/}
+}
+Version 1, September 27, 2026: Separates signed-baseline checks from proof of runtime use, states evaluation limits, and adds the publication scope and patent notice.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 1
+OPAQUE Systems
+Agent Manifest proposes a signed record of the artifacts that define an AI agent, including its system prompt, model, policy, tools, retrieval corpus, memory, decision trace, delegation, supply chain, and human approvals. Artifact digests and canonical serialization make changes to the recorded baseline detectable when a verifier has the relevant artifacts and trusted keys. The design composes SPIFFE identities, RFC 8785 canonicalization, Ed25519 signatures, an optional ML-DSA-65 profile, and hardware-attestation bindings. This technical report describes the original model and preserves the recorded Ed25519 software benchmarks, delegation checks, and tamper probes. Signed metadata alone does not prove that the recorded configuration was used during execution. The evaluation does not measure post-quantum performance or establish live hardware provenance; continuous verification of mutable memory and retrieval state is outside its scope. Current SDK behavior and normative requirements are maintained separately.
A signed baseline for agent artifacts, with recorded Ed25519 benchmarks, delegation checks, and tamper probes.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Imran Siddique. Agent Manifest: Portable, Hardware-Attestable Identity and Provenance for AI Agents. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026agentmanifest,
+ title = {Agent Manifest: Portable, Hardware-Attestable Identity and Provenance for AI Agents},
+ author = {Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/agent-manifest/v1/}
+}
+Version 1, September 27, 2026: Separates signed-baseline checks from proof of runtime use, states evaluation limits, and adds the publication scope and patent notice.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 1
+OPAQUE Systems
+cMCP (Confidential MCP) proposes a gateway for policy evaluation at the Model Context Protocol tool-call boundary. The gateway evaluates Cedar policies before dispatch and emits signed records binding policy measurements, session identifiers, and tool-call evidence. Its design combines policy hashing, monotonic session sensitivity, tool-catalog pinning, and audit-chain checks. This technical report preserves software-only experiments for those mechanisms, including synthetic healthcare call traces and simulated attestation paths. The measurements illustrate behavior under the stated inputs and assumptions; they do not validate a hardware TEE, establish complete information-flow tracking, or show that every tool invocation was captured. Hardware provenance requires independent attestation appraisal and signing-key binding. Replay and omission detection additionally depend on freshness checks and an expected session or log boundary. The report distinguishes these deployment requirements from the software behavior measured here.
A gateway design combining policy evaluation, session sensitivity, tool-catalog pinning, and signed tool-call records.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Rishabh Poddar; Aaron Fulkerson; Imran Siddique. cMCP: Verifiable Policy Enforcement for AI Agent Tool Calls. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026cmcp,
+ title = {cMCP: Verifiable Policy Enforcement for AI Agent Tool Calls},
+ author = {Rishabh Poddar and Aaron Fulkerson and Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/cmcp/v1/}
+}
+Version 1, September 27, 2026: Narrows the abstract to the measured software behavior, corrects the false-discovery terminology, and adds the publication scope and patent notice.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 1
+OPAQUE Systems
+cMCP (Confidential MCP) proposes a gateway for policy evaluation at the Model Context Protocol tool-call boundary. The gateway evaluates Cedar policies before dispatch and emits signed records binding policy measurements, session identifiers, and tool-call evidence. Its design combines policy hashing, monotonic session sensitivity, tool-catalog pinning, and audit-chain checks. This technical report preserves software-only experiments for those mechanisms, including synthetic healthcare call traces and simulated attestation paths. The measurements illustrate behavior under the stated inputs and assumptions; they do not validate a hardware TEE, establish complete information-flow tracking, or show that every tool invocation was captured. Hardware provenance requires independent attestation appraisal and signing-key binding. Replay and omission detection additionally depend on freshness checks and an expected session or log boundary. The report distinguishes these deployment requirements from the software behavior measured here.
A gateway design combining policy evaluation, session sensitivity, tool-catalog pinning, and signed tool-call records.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Rishabh Poddar; Aaron Fulkerson; Imran Siddique. cMCP: Verifiable Policy Enforcement for AI Agent Tool Calls. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026cmcp,
+ title = {cMCP: Verifiable Policy Enforcement for AI Agent Tool Calls},
+ author = {Rishabh Poddar and Aaron Fulkerson and Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/cmcp/v1/}
+}
+Version 1, September 27, 2026: Narrows the abstract to the measured software behavior, corrects the false-discovery terminology, and adds the publication scope and patent notice.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
AgenTrust Research
Technical reports with open source, recorded experiments, and explicit limits. Read the work, inspect the evidence, and cite a specific version.
Runtime evidence
A portable format for runtime claims, with recorded measurements of signing, verification, record size, and conformance fixtures.
Read the reportTool-call enforcement
A gateway design combining policy evaluation, session sensitivity, tool-catalog pinning, and signed tool-call records.
Read the reportAgent identity
A signed baseline for agent artifacts, with recorded Ed25519 benchmarks, delegation checks, and tamper probes.
Read the reportThese reports preserve historical designs and software evaluations. A signature, an attestation result, and an execution-completeness claim establish different properties. Each paper page identifies the evidence evaluated and the limits that remain.
For implementation, follow the current project specifications linked from each report. Paper text is available under CC BY 4.0; code retains its project license.
Technical report / Version 1
+OPAQUE Systems
+TRACE (Trust, Runtime Attestation, and Compliance Evidence) proposes a portable record for claims about AI agent runtimes: workload identity, model, policy, data class, tool transcript, build provenance, and appraisal. It composes RATS/EAT, signatures, and transparency evidence into a format that a relying party can evaluate against its own trust policy. A valid signature establishes integrity and possession of the signing key; hardware origin additionally requires verified attestation and a binding from that evidence to the key. This technical report describes the original design and preserves the recorded software evaluation of agentrust-trace 0.2.0 and trace-tests 0.2.0. The evaluation measures canonicalization, Ed25519 signing and verification, record size, and fixture outcomes. It does not measure silicon certificate-chain appraisal or establish that the recorded runtime claims are true. The current normative specification and its implementation limits are maintained separately.
A portable format for runtime claims, with recorded measurements of signing, verification, record size, and conformance fixtures.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Rishabh Poddar; Aaron Fulkerson; Imran Siddique. TRACE: Trust, Runtime Attestation, and Compliance Evidence (A Portable Attestation Format for AI Agent Runtime Governance). AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026trace,
+ title = {TRACE: Trust, Runtime Attestation, and Compliance Evidence (A Portable Attestation Format for AI Agent Runtime Governance)},
+ author = {Rishabh Poddar and Aaron Fulkerson and Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/trace/v1/}
+}
+Version 1, September 27, 2026: Clarifies the signature and hardware-evidence boundary, corrects the description of saved conformance outcomes, and preserves the historical measurements.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 1
+OPAQUE Systems
+TRACE (Trust, Runtime Attestation, and Compliance Evidence) proposes a portable record for claims about AI agent runtimes: workload identity, model, policy, data class, tool transcript, build provenance, and appraisal. It composes RATS/EAT, signatures, and transparency evidence into a format that a relying party can evaluate against its own trust policy. A valid signature establishes integrity and possession of the signing key; hardware origin additionally requires verified attestation and a binding from that evidence to the key. This technical report describes the original design and preserves the recorded software evaluation of agentrust-trace 0.2.0 and trace-tests 0.2.0. The evaluation measures canonicalization, Ed25519 signing and verification, record size, and fixture outcomes. It does not measure silicon certificate-chain appraisal or establish that the recorded runtime claims are true. The current normative specification and its implementation limits are maintained separately.
A portable format for runtime claims, with recorded measurements of signing, verification, record size, and conformance fixtures.
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
Rishabh Poddar; Aaron Fulkerson; Imran Siddique. TRACE: Trust, Runtime Attestation, and Compliance Evidence (A Portable Attestation Format for AI Agent Runtime Governance). AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
@techreport{agentrust2026trace,
+ title = {TRACE: Trust, Runtime Attestation, and Compliance Evidence (A Portable Attestation Format for AI Agent Runtime Governance)},
+ author = {Rishabh Poddar and Aaron Fulkerson and Imran Siddique},
+ institution = {AgenTrust},
+ year = {2026},
+ type = {Technical report},
+ note = {Version 1; not peer reviewed},
+ url = {https://agentrust-io.com/research/trace/v1/}
+}
+Version 1, September 27, 2026: Clarifies the signature and hardware-evidence boundary, corrects the description of saved conformance outcomes, and preserves the historical measurements.
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
Technical report / Version 1
+OPAQUE Systems
+{esc(p['abstract'])}
{esc(p['contribution'])}
The source package preserves the recorded inputs and results. No new experiment run or independent replication is claimed for this edition.
+Read the current specification and implementation guidance. This report describes an earlier design and evaluation; the current specification governs implementation.
{esc('; '.join(p['authors']))}. {esc(p['title'])}. AgenTrust technical report, version 1, 2026.
+Download BibTeX / Download CITATION.cff
{esc(citation(p))}Version 1, September 27, 2026: {esc(p['changes'])}
+Based on a manuscript originally dated June 23, 2026, with later recorded experiments. That manuscript date is not presented as a verified publication date.
+File checksums. Published version files are retained; substantive revisions receive a new version.
Open an issue in the project repository and identify the report version and section.
{esc(p['topic'])}
{esc(p['contribution'])}
Read the reportAgenTrust Research
Technical reports with open source, recorded experiments, and explicit limits. Read the work, inspect the evidence, and cite a specific version.
These reports preserve historical designs and software evaluations. A signature, an attestation result, and an execution-completeness claim establish different properties. Each paper page identifies the evidence evaluated and the limits that remain.
For implementation, follow the current project specifications linked from each report. Paper text is available under CC BY 4.0; code retains its project license.