Repository navigation
v0.3: let a record name the agent manifest it ran under #483
Description
A TRACE v0.2 record cannot say which approved agent deployment produced it. schema/trace-claim.json has no manifest field and the top level is additionalProperties: false, so a producer cannot add one. Agent Manifest spec §6.3.2 says TRACE envelopes MUST carry agent_manifest_id and manifest_verification_result, which a v0.2 record cannot satisfy, so the two specs disagree today.
This matters for external receipts too. A PACT receipt or any other authorization receipt can only reach a record through references[], and §3.1.2 says a verifier MUST NOT treat a resolved reference as attested evidence.
Proposal for v0.3: an optional top-level manifest object with id, digest and media_type, covered by the record signature. Two drafts already point this way: ManifestRef in schema/trace-token-experimental-v1.json and runtime.evidence.binds: "manifest-digest" in schema/trace-claim-v0.3-draft.json. One shape should serve both.
Open questions:
- Does the record carry the verification result, or only the reference, leaving appraisal to the verifier?
- Should the Agent Manifest §6.3.2 MUST be relaxed to match whatever v0.3 adopts?
Activity
trace-manifest-ref-v0: vectors for the reference-only manifest digest (…
babyblueviper1 commentedon Oct 9, 2026
@imran-siddique on the first question, I'd carry only the reference and leave appraisal to the verifier, for the reason §3.1.2 already gives. A result the producer writes is an assertion about bytes the verifier can fetch and hash itself. If the record carries
manifest_verification_result, a verifier that copies it forward reportsverifiedon a manifest it never checked.Vectors for the shape you proposed,
manifest {id, digest, media_type}inside the signed record:trace-manifest-ref-v0, 6 cases, offline checker (Python + cryptography), v0.2 embedded signatures over JCS.manifest_verification_result: verified.not-establishedwith a named reason, not a pass, and the record itself still verifies (rule 3 of §3.1.2).manifestadded after signing: the signature check fails before the manifest is looked at.manifest: v0.2 behaviour unchanged.check.py --mutantsalso runs four wrong checkers (trusts the asserted result, treats unresolvable as a pass, skips the signature-first step, rejects the record when the manifest is unresolvable); each is caught by at least one case. It runs in CI on every push.It's the same pattern as
poisoning_scan.subject_digestin agent-manifest #486: bind the subject by digest, and check the binding before the result.On the second question: with reference-only, §6.3.2 could keep its MUST for
agent_manifest_idplus the digest, and makemanifest_verification_resultinformative. If you want the vectors as v0.3 fixtures, I'll open the PR againstconformance/.imran-siddique commentedon Oct 12, 2026
@babyblueviper1 reference-only, on both questions. Your six cases reproduce at
2cd4ae7, all four wrong checkers die, and m3 settles it:verifiedasserted over a digest that no longer matches.On the Agent Manifest side, agentrust-io/agent-manifest#498 adds
agent_manifest_digestto section 6.3.2 and says a verifier MUST NOT report the producer's result as its own.Yes to the PR against
conformance/as v0.3 draft fixtures. Use the repo'srfc8785dependency in place of the vendored_rfc8785, and leaveCHANGELOG.mdout; the entry gets written at merge.babyblueviper1 commentedon Oct 12, 2026
@imran-siddique the fixtures PR is #487: six fixtures under
conformance/tests/vectors/manifest-ref-v0.3-draft/, signed through the repo'srfc8785, withCHANGELOG.mdleft out. The test states the draft rule as a small reference checker, and each of the four wrong checkers is caught. The records are byte-identical to the six cases above. The full conformance suite passes locally (718).conformance: v0.3 draft fixtures for the manifest reference (#483) (#487
docs(spec): 6.3.2 requires the digest for a binding and reports UNVER…
docs(spec): section 6.3.2 binds the manifest by digest and leaves app…
imran-siddique commentedon Oct 15, 2026
Status at main
9392ec7. The six fixtures from #487 merged on 12 October (97852f0). On the other side, agentrust-io/agent-manifest#498 merged on 14 October (3c02529), so §6.3.2 now requiresagent_manifest_digestand says a verifier MUST NOT report the producer's result as its own.The field itself has not landed.
schema/trace-claim-v0.3-draft.jsonstill has no top-levelmanifest, its only manifest hook isruntime.evidence.binds: "manifest-digest", and no conformance module reads the reference yet. The fixtures are ready for whichever PR adds the property.dinakarjs commentedon Oct 16, 2026
Completed an independent interoperability audit of #538 at 75b5fbb: #538 (review).
The remaining work is concrete, beyond adding the schema member:
All observations were executed against the two actual subschemas and the fixture checker; #538's complete root and conformance suites pass. This supports its existing Refs wording and keeping this issue open. No profile choice or production implementation was made on behalf of maintainers.