From 7bdb7ca4f47194af88f4c6ae49d2d2a2c8fabfe1 Mon Sep 17 00:00:00 2001 From: Imran Siddique <45405841+imran-siddique@users.noreply.github.com> Date: Fri, 2 Oct 2026 16:44:02 -0700 Subject: [PATCH 1/2] Prepare conformance 0.6.2 and deploy docs alongside the specification --- .github/workflows/conformance-docs.yml | 3 +- .github/workflows/docs.yml | 42 ++++++++++++++++++++++++-- conformance/CHANGELOG.md | 30 +++++++++++++----- conformance/README.md | 4 +-- conformance/mkdocs.yml | 2 +- conformance/pyproject.toml | 4 +-- 6 files changed, 68 insertions(+), 17 deletions(-) diff --git a/.github/workflows/conformance-docs.yml b/.github/workflows/conformance-docs.yml index 1a25542c..016fbc63 100644 --- a/.github/workflows/conformance-docs.yml +++ b/.github/workflows/conformance-docs.yml @@ -1,6 +1,7 @@ name: Conformance docs on: + workflow_call: push: branches: [main] paths: @@ -16,7 +17,7 @@ permissions: contents: read concurrency: - group: conformance-docs-${{ github.ref }} + group: conformance-docs-${{ github.workflow }}-${{ github.ref }} cancel-in-progress: false jobs: diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index c046b52a..d3abdf91 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -23,6 +23,16 @@ on: - "ROADMAP.md" - "LIMITATIONS.md" - "CNAME" + - "conformance/**" + - ".github/workflows/docs.yml" + - ".github/workflows/conformance-docs.yml" + pull_request: + paths: + - 'conformance/**' + - '.github/workflows/docs.yml' + - '.github/workflows/conformance-docs.yml' + - 'mkdocs.yml' + - 'docs/**' workflow_dispatch: permissions: @@ -33,8 +43,13 @@ concurrency: cancel-in-progress: false jobs: + conformance: + permissions: + contents: read + uses: ./.github/workflows/conformance-docs.yml deploy: - name: Build and deploy docs + name: Build combined specification and conformance docs + needs: conformance runs-on: ubuntu-latest steps: @@ -81,5 +96,26 @@ jobs: run: | sed 's|^docs_dir: \.$|docs_dir: .docs_build|' mkdocs.yml > .mkdocs_build.yml - - name: Build and deploy to GitHub Pages - run: mkdocs gh-deploy --force --clean --config-file .mkdocs_build.yml + - name: Build specification documentation + run: mkdocs build --clean --config-file .mkdocs_build.yml + + - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 + with: + name: conformance-docs + path: site/conformance/ + + - name: Verify combined site + run: | + rm -f site/conformance/CNAME + test -s site/index.html + test -s site/conformance/index.html + test "$(cat site/CNAME)" = "trace.agentrust-io.com" + + - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 + with: + name: trace-combined-docs + path: site/ + + - name: Deploy combined site to GitHub Pages + if: github.event_name != 'pull_request' + run: ghp-import -n -p -f site diff --git a/conformance/CHANGELOG.md b/conformance/CHANGELOG.md index 6b6a1206..725f7ceb 100644 --- a/conformance/CHANGELOG.md +++ b/conformance/CHANGELOG.md @@ -2,6 +2,20 @@ ## Unreleased +## v0.6.2 - 2026-10-02 + +### Added + +- Portable anchor inclusion vectors contributed by dinakarjs: nine valid and + eighteen invalid cases, with a Python harness and independent JavaScript + cross-check (trace-spec #463; original trace-tests #137). + +### Changed + +- Maintain the conformance suite in trace-spec/conformance and publish through + its separate conformance publisher. Package name, import and CLI are unchanged. +- Serve conformance documentation under trace.agentrust-io.com/conformance/. + ## v0.6.1 - 2026-09-26 ### Changed @@ -98,7 +112,7 @@ Each change here refuses input that 0.6.0 accepted, so a record that passed on CI installs from hash-pinned locks (#101); actionlint and a test-environment guard added (#100). -## v0.5.1 — 2026-08-22 +## v0.5.1 - 2026-08-22 - Level 1 and Level 2 verification now requires a verifier-issued challenge via `--expected-nonce` and checks it against the signed `runtime.nonce` using @@ -107,7 +121,7 @@ Each change here refuses input that 0.6.0 accepted, so a record that passed on CLI could report conformance for a fresh signed record containing an attacker-chosen or replayed nonce. -## v0.5.0 — 2026-08-09 +## v0.5.0 - 2026-08-09 ### Added @@ -115,13 +129,13 @@ Each change here refuses input that 0.6.0 accepted, so a record that passed on It runs every level up to `--max-level` instead of one, because the answer a reader needs is the highest level the record reaches, not whether it cleared the level the person running the tool happened to choose. `--fail-under N` gates CI on a level; without it the command exits `0`, since producing an artifact and enforcing a threshold are different jobs. - **The report states that it is not evidence.** It is unsigned HTML describing one run of one suite version, and anyone can edit it, so every report carries the record's digest, the suite and authoring-library versions, and the command to reproduce the result — and tells a reader who does not trust the sender to go check the record instead. A conformance report that looks authoritative and cannot be checked is the same shape of thing as a control plane writing its own log, which is the problem this project exists to fix. + **The report states that it is not evidence.** It is unsigned HTML describing one run of one suite version, and anyone can edit it, so every report carries the record's digest, the suite and authoring-library versions, and the command to reproduce the result - and tells a reader who does not trust the sender to go check the record instead. A conformance report that looks authoritative and cannot be checked is the same shape of thing as a control plane writing its own log, which is the problem this project exists to fix. Self-contained by construction: no scripts, no external CSS, no fonts, no badge service. A badge served from someone else's infrastructure would add a dependency to an artifact whose whole point is needing none. A test asserts the HTML fetches nothing. The HTML and the JSON are rendered from one assembled structure so they cannot disagree about the verdict, and unverified findings count as failures from Level 1 up exactly as they do in `verify`. -## v0.4.1 — 2026-08-03 +## v0.4.1 - 2026-08-03 ### Fixed @@ -129,7 +143,7 @@ Each change here refuses input that 0.6.0 accepted, so a record that passed on This mattered more than a wrong string usually would. The v0.2 profile cutover shipped in 0.4.0, and a 0.2.x suite rejects every v0.2 record, so `--version` is exactly the command someone runs to work out whether their suite matches their producer. It was the one command that could not answer. -## v0.4.0 — 2026-07-28 +## v0.4.0 - 2026-07-28 ### Changed @@ -139,11 +153,11 @@ Each change here refuses input that 0.6.0 accepted, so a record that passed on - Registry, verifier, and documentation hosts moved from `agentrust.io` to `agentrust-io.com`. -## v0.3.0 — 2026-07-21 +## v0.3.0 - 2026-07-21 - `azure-cvm-sev-snp` platform accepted (`runtime.platform`): Azure confidential VMs run SEV-SNP behind a Hyper-V paravisor (vTPM-rooted). Added to the bundled schema enum and the TR-RTE valid-platform set so Azure TRACE records pass conformance. Matches `agentrust-trace>=0.4`. -## v0.2.0 — 2026-06-19 +## v0.2.0 - 2026-06-19 - DID subject support: `subject` now accepts `did:` URIs in addition to `spiffe://`. - Embedded signature verification: plain TRACE records signed with `agentrust-trace sign_record()` are now cryptographically verified at all levels. @@ -151,7 +165,7 @@ Each change here refuses input that 0.6.0 accepted, so a record that passed on - Software-only platform: `runtime.platform: "software-only"` accepted at Level 0. - Private key leak detection: TR-SIG now fails records that embed a private key (`d` member) in `cnf.jwk`. -## v0.1.0 — 2026-05-01 +## v0.1.0 - 2026-05-01 - Initial release with 7 test modules: TR-ENV, TR-SIG, TR-RTE, TR-POL, TR-TXN, TR-ANC, TR-SCA. - Conformance levels 0, 1, 2. diff --git a/conformance/README.md b/conformance/README.md index 91782dc7..1b14613c 100644 --- a/conformance/README.md +++ b/conformance/README.md @@ -9,7 +9,7 @@ Community updates and contributor highlights: [AgenTrust on LinkedIn](https://ww ### Check a TRACE record and see which conformance level it reaches

- + Full Documentation

@@ -102,7 +102,7 @@ remains an unsigned self-report; see [Known Limitations](LIMITATIONS.md). | | | |---|---| -| 📖 Full documentation | [tests.agentrust-io.com](https://tests.agentrust-io.com) | +| 📖 Full documentation | [tests.agentrust-io.com](https://trace.agentrust-io.com/conformance/) | | 📄 TRACE Specification | [trace-spec](https://github.com/agentrust-io/trace-spec) | | 🗂 Test schemas | [schemas/](schemas/) | | 💬 Discussions | [GitHub Discussions](https://github.com/orgs/agentrust-io/discussions) | diff --git a/conformance/mkdocs.yml b/conformance/mkdocs.yml index 110abbe9..7bf625f6 100644 --- a/conformance/mkdocs.yml +++ b/conformance/mkdocs.yml @@ -1,6 +1,6 @@ site_name: TRACE Tests site_description: "Conformance test suite for TRACE: Trust Runtime Attestation and Compliance Evidence" -site_url: https://tests.agentrust-io.com +site_url: https://trace.agentrust-io.com/conformance/ repo_url: https://github.com/agentrust-io/trace-spec repo_name: agentrust-io/trace-spec edit_uri: edit/main/conformance/ diff --git a/conformance/pyproject.toml b/conformance/pyproject.toml index b0f217ef..610b420f 100644 --- a/conformance/pyproject.toml +++ b/conformance/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "hatchling.build" [project] name = "agentrust-trace-tests" -version = "0.6.1" +version = "0.6.2" description = "TRACE conformance test suite" readme = "README.md" license = { text = "Apache-2.0" } @@ -36,7 +36,7 @@ dependencies = [ [project.urls] Homepage = "https://github.com/agentrust-io/trace-spec" Repository = "https://github.com/agentrust-io/trace-spec" -Documentation = "https://github.com/agentrust-io/trace-spec/tree/main/conformance#readme" +Documentation = "https://trace.agentrust-io.com/conformance/" "Bug Tracker" = "https://github.com/agentrust-io/trace-spec/issues" [project.scripts] From 402b20406f92e23715bad1ecab791f7752fe7e2c Mon Sep 17 00:00:00 2001 From: Imran Siddique <45405841+imran-siddique@users.noreply.github.com> Date: Fri, 2 Oct 2026 21:21:29 -0700 Subject: [PATCH 2/2] Isolate pull request docs builds and refresh conformance release labels --- .github/workflows/docs.yml | 4 ++-- conformance/README.md | 4 ++-- conformance/index.md | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index d3abdf91..ca9e17ed 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -39,8 +39,8 @@ permissions: contents: write concurrency: - group: docs-deploy - cancel-in-progress: false + group: ${{ github.event_name == 'pull_request' && format('docs-pr-{0}', github.ref) || 'docs-deploy' }} + cancel-in-progress: ${{ github.event_name == 'pull_request' }} jobs: conformance: diff --git a/conformance/README.md b/conformance/README.md index 1b14613c..579e82c4 100644 --- a/conformance/README.md +++ b/conformance/README.md @@ -10,7 +10,7 @@ Community updates and contributor highlights: [AgenTrust on LinkedIn](https://ww

- Full Documentation + Full Documentation

@@ -102,7 +102,7 @@ remains an unsigned self-report; see [Known Limitations](LIMITATIONS.md). | | | |---|---| -| 📖 Full documentation | [tests.agentrust-io.com](https://trace.agentrust-io.com/conformance/) | +| 📖 Full documentation | [trace.agentrust-io.com/conformance/](https://trace.agentrust-io.com/conformance/) | | 📄 TRACE Specification | [trace-spec](https://github.com/agentrust-io/trace-spec) | | 🗂 Test schemas | [schemas/](schemas/) | | 💬 Discussions | [GitHub Discussions](https://github.com/orgs/agentrust-io/discussions) | diff --git a/conformance/index.md b/conformance/index.md index 6e0326f5..29957292 100644 --- a/conformance/index.md +++ b/conformance/index.md @@ -16,7 +16,7 @@ The suite checks one record and the evidence supplied with it, reports the highe [What this proves, and what it does not](LIMITATIONS.md){ .md-button } !!! tip "TL;DR" - [agentrust-trace-tests](https://pypi.org/project/agentrust-trace-tests/) 0.6.1 (Apache-2.0) runs eight modules against a record on your machine and writes a report carrying the record digest, the suite version and the command to reproduce it. A pass describes the record and says nothing about the agent, and TR-RTE checks the shape of attestation fields without verifying a quote against AMD or Intel roots. + [agentrust-trace-tests](https://pypi.org/project/agentrust-trace-tests/) 0.6.2 (Apache-2.0) runs eight modules against a record on your machine and writes a report carrying the record digest, the suite version and the command to reproduce it. A pass describes the record and says nothing about the agent, and TR-RTE checks the shape of attestation fields without verifying a quote against AMD or Intel roots.
@@ -104,4 +104,4 @@ A conformance report that looks authoritative and cannot be checked is the same The suite tracks [TRACE Spec v0.2](https://trace.agentrust-io.com). See [Changelog](CHANGELOG.md) for what moved between suite versions. -**Status:** agentrust-trace-tests 0.6.1 · Apache-2.0 · tracks TRACE Spec v0.2 · Sponsored by OPAQUE, which funds the engineering, infrastructure and confidential-computing work behind these projects. +**Status:** agentrust-trace-tests 0.6.2 · Apache-2.0 · tracks TRACE Spec v0.2 · Sponsored by OPAQUE, which funds the engineering, infrastructure and confidential-computing work behind these projects.