feat: optional independent signed catalog authority receipt

[altrudev]

Summary

Adds an opt-in, independently signed Ed25519 correspondence receipt binding the Agent Manifest signing digest, agent identity, policy bundle hash, complete sealed cMCP catalog hash, and Agent Manifest Merkle root. Preserves upstream #713 native tool projection and verification; no replacement or bypass of SDK validation.

Assurance

• Domain-separated signed receipt, strict canonical fields and validity interval
• Fail-closed startup when configured receipt, measurements or signer are invalid
• Native upstream catalog verification remains mandatory
• Operator deployment/rotation and limitation documentation
• Local VPS: pytest -q tests/unit tests/integration: 2382 passed, 6 skipped, 4 deprecation warnings; git diff --check clean
• Six skips: real Azure SEV-SNP fixture (2), real TDX quote (2), optional Agent Governance Toolkit package (2)

Review requests

Please review whether an independent issuer receipt is useful alongside native Merkle binding; specifically JSON/COSE signing preimages, trust anchor management, optional deployment semantics, and cryptographic canonicalization. This is a draft for independent maintainer review, not a claim of hardware attestation or release approval.

No private keys or proprietary runtime implementation are included.

[github-actions]

🔴 Contributor Check: HIGH

Check	Result
Profile	HIGH
Credential	LOW
Overall	HIGH

Automated check by AgenTrust Contributor Check.

[imran-siddique]

@altrudev on your review question: not in core. The gap the bridge covers, server identity and output schemas that the tool Merkle root leaves out, is already bound by the manifest itself. Under evidence-requirements-experimental-v1, _require_sealed_catalog_requirement refuses startup unless a signed tool-catalog component carries the sealed catalog digest as expected_observed_digest, and the SDK checks policy_bundle_hash (L395). A second issuer key signing values the gateway already recomputes adds a trust root without adding a measurement. If the experimental label is what blocks you, a proposal to promote that profile is the change I would review.

Separately, Lint fails on 6 ruff errors (ruff check src/ tests/), which cancelled the test matrix.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 92.47312% with 7 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/cmcp_runtime/catalog/authority_bridge.py	95.38%	3 Missing ⚠️
src/cmcp_runtime/config.py	76.92%	3 Missing ⚠️
src/cmcp_runtime/startup.py	93.33%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

[altrudev]

@imran-siddique The latest EDRG verification is complete for commit "fecb430".

The full local suite passed 2,384 tests, with 6 documented skips. Ruff, mypy, startup binding, signature validation, and adversarial regression checks also passed.

The PR remains in draft pending independent maintainer review. Could you review the implementation and advise whether any further changes are required before approval?

The software-only assurance boundaries remain unchanged. No hardware attestation or production certification is claimed.

Val Rukhaylo / Altru.dev